Edit tour

Windows Analysis Report
BundleSweetIMSetup.exe

Overview

General Information

Sample name:	BundleSweetIMSetup.exe
Analysis ID:	1431987
MD5:	bcc96659d6a46536dbde959fb9d60f67
SHA1:	eb2352a46bf4d0112346814b406f2af3484cb93f
SHA256:	beb0423b1afe047964ad168060a8fd92c550814f6797b937ee0092004640aa18
Infos:

Detection

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Compliance

Score:	50
Range:	0 - 100

Signatures

Antivirus detection for URL or domain

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Creates an undocumented autostart registry key

Found suspicious ZIP file

Overwrites Mozilla Firefox settings

Tries to harvest and steal browser information (history, passwords, etc)

Changes the start page of internet explorer

Checks for available system drives (often done to infect USB drives)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a connection to the internet is available

Contains functionality to dynamically determine API calls

Contains functionality to launch a process as a different user

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to shutdown / reboot the system

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Deletes files inside the Windows folder

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found evaded block containing many API calls

Found evasive API chain (may stop execution after checking a module file name)

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Internet Explorer Autorun Keys Modification

Sigma detected: Suspicious Execution From GUID Like Folder Names

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

BundleSweetIMSetup.exe (PID: 6936 cmdline: "C:\Users\user\Desktop\BundleSweetIMSetup.exe" MD5: BCC96659D6A46536DBDE959FB9D60F67)

SweetIMSetup.exe (PID: 7004 cmdline: /s /w /v" /qn SIMHP=0 SIMSP=0 " MD5: CED6A16415E6AE2243ACC2B776B9D965)

msiexec.exe (PID: 6608 cmdline: MSIEXEC.EXE /i "C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B}\SweetIMSetup.msi" /qn SIMHP=0 SIMSP=0 SETUPEXEDIR="C:\Users\user\AppData\Local\Temp" MD5: 9D09DC1EDA745A5F87553048E57620CF)

SweetIESetup.exe (PID: 7592 cmdline: /s /w /v" /qn SIMOB=0 SIMADDREGIE={UserSelectedHP=1,UserSelectedDS=1} " MD5: 4E3FCE1D8BE37088E4E40B829DA24091)

msiexec.exe (PID: 7628 cmdline: MSIEXEC.EXE /i "C:\Users\user\AppData\Local\Temp\{B3CA5B4C-F637-458C-81D6-CD8DADBE9841}\SweetIESetup.msi" /qn SIMOB=0 SIMADDREGIE={UserSelectedHP=1,UserSelectedDS=1} SETUPEXEDIR="C:\Users\user\AppData\Local\Temp" MD5: 9D09DC1EDA745A5F87553048E57620CF)

chrome.exe (PID: 7992 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://www.sweetim.com/installbar.asp?barid={C598706C-038F-11EF-8C2C-ECF4BBEA1588} MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 4020 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1960,i,7459701528248846225,13626864308159879949,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

msiexec.exe (PID: 6888 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 7204 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding A265C8E8A3BB4B1A10A4D9F720E583B6 MD5: 9D09DC1EDA745A5F87553048E57620CF)

VistaCookiesCollector.exe (PID: 7288 cmdline: C:\Users\user\AppData\Local\Temp\{A81A974F-8A22-43E6-9243-5198FF758DA1}\VistaCookiesCollector.exe http://sweetim.com,C:\Users\user\AppData\LocalLow\simcookies.dat MD5: 8E11C6FCF30B1DC4C7069144B80C2709)

SweetIM.exe (PID: 7388 cmdline: "C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe" -AutoStartIM MD5: 15A4D1A8C15CB3C0C13C3F36899475E6)

msiexec.exe (PID: 7684 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding F0CC6D3E1A3C8837D5C7D007B45C879F MD5: 9D09DC1EDA745A5F87553048E57620CF)

cleanup

Sigma Signatures

System Summary

Sigma detected: Internet Explorer Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 1, EventID: 13, EventType: SetValue, Image: C:\Windows\SysWOW64\msiexec.exe, ProcessId: 7684, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-2246122658-3693405117-2476756634-1002\Software\SweetIM\Toolbars\Internet Explorer\Data\UserSelectedHP

Sigma detected: Suspicious Execution From GUID Like Folder Names

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: MSIEXEC.EXE /i "C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B}\SweetIMSetup.msi" /qn SIMHP=0 SIMSP=0 SETUPEXEDIR="C:\Users\user\AppData\Local\Temp", CommandLine: MSIEXEC.EXE /i "C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B}\SweetIMSetup.msi" /qn SIMHP=0 SIMSP=0 SETUPEXEDIR="C:\Users\user\AppData\Local\Temp", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\msiexec.exe, NewProcessName: C:\Windows\SysWOW64\msiexec.exe, OriginalFileName: C:\Windows\SysWOW64\msiexec.exe, ParentCommandLine: /s /w /v" /qn SIMHP=0 SIMSP=0 ", ParentImage: C:\Users\user\AppData\Local\Temp\SweetIMSetup.exe, ParentProcessId: 7004, ParentProcessName: SweetIMSetup.exe, ProcessCommandLine: MSIEXEC.EXE /i "C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B}\SweetIMSetup.msi" /qn SIMHP=0 SIMSP=0 SETUPEXEDIR="C:\Users\user\AppData\Local\Temp", ProcessId: 6608, ProcessName: msiexec.exe

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: SWEETIE, EventID: 13, EventType: SetValue, Image: C:\Windows\SysWOW64\msiexec.exe, ProcessId: 7684, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847}\(Default)

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://storage2.stgbssint.com/Search/SearchApplication/Resources/Images/Search/closeSprite.png

Avira URL Cloud: Label: malware

Multi AV Scanner detection for dropped file

Source: C:\Program Files (x86)\SweetIM\Messenger\ContentPackagesActivationHandler.exe	ReversingLabs: Detection: 34%
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	ReversingLabs: Detection: 30%
Source: C:\Program Files (x86)\SweetIM\Messenger\mgAdaptersProxy.dll	ReversingLabs: Detection: 26%
Source: C:\Program Files (x86)\SweetIM\Messenger\mgArchive.dll	ReversingLabs: Detection: 21%
Source: C:\Program Files (x86)\SweetIM\Messenger\mgFlashPlayer.dll	ReversingLabs: Detection: 26%
Source: C:\Program Files (x86)\SweetIM\Messenger\mgICQAuto.dll	ReversingLabs: Detection: 30%
Source: C:\Program Files (x86)\SweetIM\Messenger\mgICQMessengerAdapter.dll	ReversingLabs: Detection: 24%
Source: C:\Program Files (x86)\SweetIM\Messenger\mgMediaPlayer.dll	ReversingLabs: Detection: 26%
Source: C:\Program Files (x86)\SweetIM\Messenger\mgMsnAuto.dll	ReversingLabs: Detection: 30%
Source: C:\Program Files (x86)\SweetIM\Messenger\mgMsnMessengerAdapter.dll	ReversingLabs: Detection: 21%
Source: C:\Program Files (x86)\SweetIM\Messenger\mgSweetIM.dll	ReversingLabs: Detection: 22%
Source: C:\Program Files (x86)\SweetIM\Messenger\mgUpdateSupport.dll	ReversingLabs: Detection: 30%
Source: C:\Program Files (x86)\SweetIM\Messenger\mgYahooAuto.dll	ReversingLabs: Detection: 29%
Source: C:\Program Files (x86)\SweetIM\Messenger\mgYahooMessengerAdapter.dll	ReversingLabs: Detection: 25%
Source: C:\Program Files (x86)\SweetIM\Messenger\mgcommon.dll	ReversingLabs: Detection: 30%
Source: C:\Program Files (x86)\SweetIM\Messenger\mgcommunication.dll	ReversingLabs: Detection: 30%
Source: C:\Program Files (x86)\SweetIM\Messenger\mgconfig.dll	ReversingLabs: Detection: 27%
Source: C:\Program Files (x86)\SweetIM\Messenger\mghooking.dll	ReversingLabs: Detection: 33%
Source: C:\Program Files (x86)\SweetIM\Messenger\mglogger.dll	ReversingLabs: Detection: 29%
Source: C:\Program Files (x86)\SweetIM\Messenger\mgsimcommon.dll	ReversingLabs: Detection: 26%
Source: C:\Program Files (x86)\SweetIM\Messenger\mgxml_wrapper.dll	ReversingLabs: Detection: 26%
Source: C:\Program Files (x86)\SweetIM\Messenger\resources\sqlite\mgSqlite3.dll	ReversingLabs: Detection: 20%
Source: C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\ClearHist.exe	ReversingLabs: Detection: 30%
Source: C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgHelper.dll	ReversingLabs: Detection: 28%
Source: C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgHelperApp.exe	ReversingLabs: Detection: 31%
Source: C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll	ReversingLabs: Detection: 26%
Source: C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarProxy.dll	ReversingLabs: Detection: 27%
Source: C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgcommon.dll	ReversingLabs: Detection: 24%
Source: C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgconfig.dll	ReversingLabs: Detection: 27%
Source: C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mghooking.dll	ReversingLabs: Detection: 24%
Source: C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mglogger.dll	ReversingLabs: Detection: 25%
Source: C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgsimcommon.dll	ReversingLabs: Detection: 21%
Source: C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgxml_wrapper.dll	ReversingLabs: Detection: 24%
Source: C:\Users\user\AppData\Local\Temp\1714110143_4764500_750.tmp	ReversingLabs: Detection: 16%
Source: C:\Users\user\AppData\Local\Temp\1714110143_4764625_750.tmp	ReversingLabs: Detection: 16%
Source: C:\Users\user\AppData\Local\Temp\SweetIESetup.exe (copy)	ReversingLabs: Detection: 16%
Source: C:\Users\user\AppData\Local\Temp\SweetIMSetup.exe (copy)	ReversingLabs: Detection: 16%
Source: C:\Users\user\AppData\Local\Temp\{A7BC02AF-1128-4A31-BCF8-1A3EE803D3B3}\mgSqlite3.dll	ReversingLabs: Detection: 20%
Source: C:\Users\user\AppData\Local\Temp\{A81A974F-8A22-43E6-9243-5198FF758DA1}\mgSqlite3.dll	ReversingLabs: Detection: 20%
Source: C:\Windows\Installer\MSIC547.tmp	ReversingLabs: Detection: 28%
Source: C:\Windows\Installer\MSID16F.tmp	ReversingLabs: Detection: 28%
Source: C:\Windows\Installer\MSID25A.tmp	ReversingLabs: Detection: 28%
Source: C:\Windows\Installer\MSID2C8.tmp	ReversingLabs: Detection: 28%
Source: C:\Windows\Installer\MSIEB08.tmp	ReversingLabs: Detection: 21%
Source: C:\Windows\Installer\MSIEF30.tmp	ReversingLabs: Detection: 24%
Source: C:\Windows\Installer\MSIF7EB.tmp	ReversingLabs: Detection: 21%
Source: C:\Windows\Installer\MSIF889.tmp	ReversingLabs: Detection: 21%

Multi AV Scanner detection for submitted file

Source: BundleSweetIMSetup.exe	ReversingLabs: Detection: 50%
Source: BundleSweetIMSetup.exe	Virustotal: Detection: 37%			Perma Link

Phishing

Source: https://www.sweetim.com/installbar.asp?barid={C598706C-038F-11EF-8C2C-ECF4BBEA1588}

HTTP Parser: No favicon

Compliance

Uses 32bit PE files

Source: BundleSweetIMSetup.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Found installer window with terms and condition text

Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe

Window detected: Agree && Continue >DisagreeTo continue the installation you must agree to the following terms of service agreementSweetIM provides aid when misspelling or incorrectly formatting browser address request.SWEETIM Technologies LTD.Thank you for installing SweetIM for Messenger and SweetIM Toolbar for browserSweetIM is certified as Trusted Download Program by TRUSTeEND USER LICENSE AGREEMENT / TERMS OF SERVICE / AND PRIVACY POLICY IMPORTANT - PLEASE READ THE FOLLOWING AGREEMENT CAREFULLY.THIS AGREEMENT SHALL GOVERN YOUR USE OF SWEETIM SOFTWARE SERVICE AND SITE. IF AFTER READING THIS AGREEMNET YOU WISH TO USE THE SWEETIM SOFTWARE WEBSITE AND ITS FEATURES PLEASE INDICATE YOUR ACCEPTANCE HEREOF BY CLICKING "I AGREE" AT THE END.Please note: (1) you MUST be 13 years or older to install or to use the SweetIM Software. If you are not yet 13 do not download SweetIM Software; (2) the SweetIM Software is not intended for use by or be available to persons under the age limit of any jurisdiction which restricts the use of Internet-based applications and services according to age. IF YOU RESIDE IN SUCH A JURISDICTION AND ARE UNDER THAT JURISDICTION'S AGE LIMIT FOR USING INTERNET-BASED APPLICATIONS OR SERVICES YOU MAY NOT DOWNLOAD INSTALL OR USE THE SWEETIM SOFTWARE AND YOU MAY NOT ACCESS THE SERVICESThis combined End User License Agreement / Terms / and Privacy policy (The "Agreement") constitutes a valid and binding agreement between SweetIM Technologies LTD. (formerly known as Imvent Ltd) which governs the use of the SweetIM Website Software and its features (together with its affiliates successors and assigns "SweetIM") and you ("you" or "your") for the use of the SweetIM Software Network Content and Services as defined below. You must enter into this agreement in order to install and use such SweetIM Software. When you download the SweetIM Software you will receive the following software features: 1.SweetIM for Messenger: An add-on toolbar that allows you to easily add fun content to your instant messenger conversations. This content is updated constantly and offers fun Emoticons Audibles Winks SoundFX Nudges Games special effects and more.2.SweetIM Toolbar for IE and for Firefox: A toolbar that is located on your internet browser and allows you to:oAdd SweetIM fun content such as emoticons texticons and other animations to web mail chat forums and social networksoSearch the web through SweetIM Search powered by Google (described below).oSweetIM Search: allows you to search the web through:1.A search box in the toolbar.2.Default Search (for IE 7 and up and Firefox): Using the search box next to the address bar. Upon installation we offer you to use SweetIM search as your default search provider in IE 7 and up and Firefox. You can manually choose other search providers by clicking on the drop down button next to the search box. 3. Search Assistance: if you place a search query in the address bar or misspell an address this feature provides you with

PE / OLE file has a valid certificate

Source: BundleSweetIMSetup.exe

Static PE information: certificate valid

Uses new MSVCR Dlls

Source: C:\Users\user\AppData\Local\Temp\SweetIMSetup.exe

File opened: C:\Program Files (x86)\SweetIM\Messenger\MSVCR71.dll

Jump to behavior

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 13.249.98.125:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.249.98.125:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.193.120.112:443 -> 192.168.2.4:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.193.120.112:443 -> 192.168.2.4:49768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.4:49771 version: TLS 1.2

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: BundleSweetIMSetup.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Binary contains paths to debug symbols

Source:	Binary string: c:\Imvent\Develop\Client\vc\output\release\mgconfig.pdb source: mgconfig.dll0.3.dr
Source:	Binary string: C:\Imvent\Develop\Client\vc\SweetSDM\Release\SweetSDM.pdb source: BundleSweetIMSetup.exe, 00000000.00000002.2071455802.0000000000401000.00000040.00000001.01000000.00000003.sdmp
Source:	Binary string: c:\Imvent\Develop\Client\vc\Toolbar\Release_bin\mgHelper.pdbh source: mgHelper.dll.3.dr
Source:	Binary string: c:\SimOlderVersions\SIM 3.6\Client\vc\output\Release\mgICQMessengerAdapter.pdb source: mgICQMessengerAdapter.dll.3.dr
Source:	Binary string: c:\Imvent\Develop\Client\vc\output\release\mghooking.pdb source: mghooking.dll0.3.dr
Source:	Binary string: c:\Imvent\Develop\Client\vc\output\release\mghooking.pdb source: mghooking.dll0.3.dr
Source:	Binary string: c:\Imvent\Develop\Client\vc\Toolbar\Release_bin\mgHelper.pdb source: mgHelper.dll.3.dr
Source:	Binary string: msvcp71.pdb source: SweetIM.exe, SweetIM.exe, 00000007.00000002.1895639481.000000007C3C1000.00000020.00000001.01000000.00000010.sdmp, msvcp71.dll.3.dr
Source:	Binary string: c:\Imvent\Develop\Client\vc\Toolbar\output\release\mgToolbarProxy.pdb source: mgToolbarProxy.dll.3.dr
Source:	Binary string: c:\SimOlderVersions\SIM 3.6\Client\vc\output\release\mgICQAuto.pdb source: mgICQAuto.dll.3.dr
Source:	Binary string: C:\Imvent\Develop\Client\vc\SweetSDM\Release\SweetSDM.pdb@ source: BundleSweetIMSetup.exe, 00000000.00000002.2071455802.0000000000401000.00000040.00000001.01000000.00000003.sdmp
Source:	Binary string: msvcr71.pdb source: SweetIMSetup.exe, 00000001.00000002.1844516312.000000007C361000.00000020.00000001.01000000.00000011.sdmp, SweetIM.exe, SweetIM.exe, 00000007.00000002.1895440500.000000007C361000.00000020.00000001.01000000.00000011.sdmp

Spreading

Checks for available system drives (often done to infect USB drives)

Source: C:\Windows\System32\msiexec.exe	File opened: z:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: x:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: v:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: t:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: r:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: p:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: n:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: l:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: j:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: h:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: f:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: b:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: y:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: w:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: u:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: s:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: q:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: o:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: m:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: k:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: i:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: g:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: e:	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File opened: c:
Source: C:\Windows\System32\msiexec.exe	File opened: a:	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\SweetIMSetup.exe	Code function: 1_2_00413D18 __EH_prolog,GetTempPathA,FindFirstFileA,CompareFileTime,DeleteFileA,FindNextFileA,FindClose,	1_2_00413D18
Source: C:\Users\user\AppData\Local\Temp\SweetIMSetup.exe	Code function: 1_2_00422D97 CreateEventA,GetProcAddress,SearchPathA,GetModuleFileNameA,FindFirstFileA,VirtualProtect,VirtualQuery,VirtualProtect,VirtualProtect,FindClose,FindClose,	1_2_00422D97
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Code function: 7_2_007B36A0 _IsDirectoryEmpty@4,wcslen,??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z,??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z,??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z,FindFirstFileW,wcscmp,wcscmp,wcscmp,FindNextFileW,FindClose,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,	7_2_007B36A0
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Code function: 7_2_007B3800 DeleteFolder,wcslen,IsDirectoryFile,wcscpy,PathAddBackslashW,PathAddExtensionW,FindFirstFileW,FindNextFileW,wcscpy,PathAddBackslashW,wcscat,DeleteFileW,DeleteFolder,FindClose,RemoveDirectoryW,	7_2_007B3800
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Code function: 7_2_10007070 ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,RegQueryValueExW,wcslen,wcscat,_IsFileExist@4,??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z,RegCloseKey,?GetShellFolderPath@@YG?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@PBG@Z,??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z,?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ,_IsFileExist@4,??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,RegQueryValueExW,??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z,wcslen,??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z,?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ,wcscpy,PathStripPathW,wcslen,wcslen,wcslen,?erase@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@II@Z,?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBG@Z,?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ,FindFirstFileW,??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z,FindClose,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,?find@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGI@Z,?npos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@2IB,wcslen,?erase@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@II@Z,??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z,?SplitString@@YAHABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@0AAV?$vector@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@V?$allocator@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@2@@2@H@Z,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ,_wtoi,_wtoi,?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ,_wtoi,?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ,_wtoi,?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ,_wtoi,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,	7_2_10007070
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Code function: 7_2_7C378DFA _wstat,wcspbrk,_errno,__doserrno,towlower,_getdrive,FindFirstFileW,wcspbrk,_wfullpath,wcslen,GetDriveTypeW,_errno,__doserrno,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FindClose,GetLastError,FindClose,	7_2_7C378DFA
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Code function: 7_2_7C376DCB _findfirst64,FindFirstFileA,GetLastError,_errno,_errno,_errno,strcpy,	7_2_7C376DCB
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Code function: 7_2_7C377ED3 _stat,_mbspbrk,_errno,__doserrno,_mbctolower,_getdrive,FindFirstFileA,_mbspbrk,_fullpath,strlen,GetDriveTypeA,_errno,__doserrno,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FindClose,GetLastError,FindClose,	7_2_7C377ED3
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Code function: 7_2_7C376FD6 _findfirsti64,FindFirstFileA,GetLastError,_errno,_errno,_errno,strcpy,	7_2_7C376FD6

Networking

Contains functionality to check if a connection to the internet is available

Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe

Code function: 7_2_10016120 ?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ,InternetCheckConnectionW,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,

7_2_10016120

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 239.255.255.250 239.255.255.250

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 152.195.50.149
Source: unknown	TCP traffic detected without corresponding DNS query: 152.195.50.149
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86

Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe

Code function: 7_2_004C3CC0 ?URLDownload@CDownloadManager@@QAEHPBGPAGPAVCBSCallbackImpl@@H@Z,GetFileAttributesW,SetFileAttributesW,RegOpenKeyExW,RegEnumKeyExW,RegCloseKey,URLDownloadToFileW,DeleteUrlCacheEntryW,DeleteFileW,InternetOpenW,InternetSetOptionW,InternetOpenUrlW,InternetCloseHandle,HttpQueryInfoW,HttpQueryInfoW,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,HttpQueryInfoW,_wtol,CreateFileW,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,InternetReadFile,WriteFile,FlushFileBuffers,Sleep,CloseHandle,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,DeleteUrlCacheEntryW,

7_2_004C3CC0

Source: global traffic	HTTP traffic detected: GET /bi/track.gif?prodid=1&compid=35&actid=100&cargo=WV:6.2;SC:0;SSN:145695948050;C_FILEVER:1.3.0.3;C_BUILDTIME:1302091979;C_REPORT:;B_IMVER:3.6.0002;B_IEVER:4.2.0004;B_BUILDTIME:1318168523;B_INFO:;; HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: content.sweetim.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=6NvAnKL1OPtr5PT&MD=RuvlYw+b HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /bi/track.gif?prodid=1&compid=35&actid=102&cargo=WV:6.2;SC:0;SSN:145695948050;C_FILEVER:1.3.0.3;C_BUILDTIME:1302091979;C_REPORT:;B_IMVER:3.6.0002;B_IEVER:4.2.0004;B_BUILDTIME:1318168523;B_INFO:;; HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: content.sweetim.comConnection: Keep-AliveCookie: UserId=C0736790-038F-11EF-AAC5-BF869E32CC1E; UserData=2024-04-26T05%3A42%3A21.577Z
Source: global traffic	HTTP traffic detected: GET /installbar.asp?barid={C598706C-038F-11EF-8C2C-ECF4BBEA1588} HTTP/1.1Host: www.sweetim.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AfQPRnlSkk0SHkG5PXvb3F_Q7hH-5ddsxHHT56Cx-_JWux0fg0SnDHAT6sRgPwMxLj9QK3jdbgroAjU8smhTZreN3EjllobyDxCd6anURJdX2LwhsxiO4Wd9jGJUvOZjNG0AxlKa5b7kLavSfewVpsPdhgIchnuqABvb/EFAIDNBMNNNIBPCAJPCGLCLEFINDMKAJ_24_4_1_2.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /search/images/homepage/button_bg.png HTTP/1.1Host: se-p-static-content.seccint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.sweetim.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /Search/SearchApplication/Resources/SpyGlass130x40.png HTTP/1.1Host: storage2.stgbssint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.sweetim.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /Search/SearchApplication/Resources/Images/Search/closeSprite.png HTTP/1.1Host: storage2.stgbssint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.sweetim.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.sweetim.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-arch: "x86"sec-ch-ua-platform-version: "10.0.0"dpr: 1downlink: 1.3sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-platform: "Windows"device-memory: 8rtt: 350sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36viewport-width: 1280sec-ch-ua-full-version: "117.0.5938.132"ect: 3gAccept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.sweetim.com/installbar.asp?barid={C598706C-038F-11EF-8C2C-ECF4BBEA1588}Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: UserId=D725A570-038F-11EF-AAC5-BF869E32CC1E; UserData=2024-04-26T05%3A42%3A59.655Z; st=SearchWeb; _hse=true
Source: global traffic	HTTP traffic detected: GET /search/images/homepage/button_bg.png HTTP/1.1Host: se-p-static-content.seccint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /Search/SearchApplication/Resources/SpyGlass130x40.png HTTP/1.1Host: storage2.stgbssint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /Search/SearchApplication/Resources/Images/Search/closeSprite.png HTTP/1.1Host: storage2.stgbssint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.sweetim.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: UserId=D725A570-038F-11EF-AAC5-BF869E32CC1E; UserData=2024-04-26T05%3A42%3A59.655Z; st=SearchWeb; _hse=true
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /webstore/inlineinstall/detail/efaidnbmnnnibpcajpcglclefindmkaj HTTP/1.1Host: chrome.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=6NvAnKL1OPtr5PT&MD=RuvlYw+b HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /bi/track.gif?prodid=1&compid=35&actid=100&cargo=WV:6.2;SC:0;SSN:145695948050;C_FILEVER:1.3.0.3;C_BUILDTIME:1302091979;C_REPORT:;B_IMVER:3.6.0002;B_IEVER:4.2.0004;B_BUILDTIME:1318168523;B_INFO:;; HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: content.sweetim.com
Source: global traffic	HTTP traffic detected: GET /bi/track.gif?prodid=1&compid=35&actid=102&cargo=WV:6.2;SC:0;SSN:145695948050;C_FILEVER:1.3.0.3;C_BUILDTIME:1302091979;C_REPORT:;B_IMVER:3.6.0002;B_IEVER:4.2.0004;B_BUILDTIME:1318168523;B_INFO:;; HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: content.sweetim.comCookie: UserId=C0736790-038F-11EF-AAC5-BF869E32CC1E; UserData=2024-04-26T05%3A42%3A21.577Z
Source: global traffic	HTTP traffic detected: GET /installbar.asp?barid={C598706C-038F-11EF-8C2C-ECF4BBEA1588} HTTP/1.1Host: www.sweetim.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: toolbar.xml.3.dr	String found in binary or memory: <EXTERNAL_SEARCH target="sim_search_combo" engine="http://www.facebook.com/s.php" param="q=" encoding="65001"/> equals www.facebook.com (Facebook)
Source: toolbar.xml.3.dr	String found in binary or memory: <WEBJUMP name="doFacebookNewTab" href="http://www.facebook.com" targetwindow="newtab"/> equals www.facebook.com (Facebook)
Source: BundleSweetIMSetup.exe, 00000000.00000003.1920924192.0000000004271000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1920992518.00000000042B3000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1920858823.0000000002B1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "web_app":{"app_id":{"install_url":{"aghbiahbpaijignceidepookljebhfak":["https://drive.google.com/drive/installwebapp?usp=chrome_default"],"agimnkijcaahngcdmfeangaknmldooml":["https://www.youtube.com/s/notifications/manifest/cr_install.html"],"fhihpiojkbmbpdjeoajapmgkhlnakfjf":["https://docs.google.com/spreadsheets/installwebapp?usp=chrome_default"],"fmgjjmmmlfnkbppncabfkddbjimcfncm":["https://mail.google.com/mail/installwebapp?usp=chrome_default"],"kefjledonklijopmnomlcbpllchaibag":["https://docs.google.com/presentation/installwebapp?usp=chrome_default"],"mpnpojknpmmopombnjdcgaaiekajbnjb":["https://docs.google.com/document/installwebapp?usp=chrome_default"]}}}, equals www.youtube.com (Youtube)
Source: BundleSweetIMSetup.exe	String found in binary or memory: "],"agimnkijcaahngcdmfeangaknmldooml":["https://www.youtube.com/s/notifications/manifest/cr_install.html"],"fhihpiojkbmbpdjeoajapmgkhlnakfjf":["https://docs.google.com/spreadsheets/installwebapp?usp=chrome_default"],"fmgjjmmmlfnkbppncabfkddbjimcfncm":["https:/ equals www.youtube.com (Youtube)
Source: BundleSweetIMSetup.exe, 00000000.00000003.1920924192.0000000004274000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1920491757.0000000004271000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1920281542.0000000004274000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "web_app":{"app_id":{"install_url":{"aghbiahbpaijignceidepookljebhfak":["https://drive.google.com/drive/installwebapp?usp=chrome_default"],"agimnkijcaahngcdmfeangaknmldooml":["https://www.youtube.com/s/notifications/manifest/cr_install.html"],"fhihpiojkbmbpdjeoajapmgkhlnakfjf":["https://docs.google.com/spreadsheets/installwebapp?usp=chrome_default"],"fmgjjmmmlfnkbppncabfkddbjimcfncm":["https://mail.google.com/mail/installwebapp?usp=chrome_default"],"kefjledonklijopmnomlcbpllchaibag":["https://docs.google.com/presentation/installwebapp?usp=chrome_default"],"mpnpojknpmmopombnjdcgaaiekajbnjb":["https://docs.google.com/document/installwebapp?usp=chrome_default"]}}} equals www.youtube.com (Youtube)
Source: BundleSweetIMSetup.exe, 00000000.00000003.1918937740.000000000427A000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1918984515.000000000427A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "web_app":{"app_id":{"install_url":{"aghbiahbpaijignceidepookljebhfak":["https://drive.google.com/drive/installwebapp?usp=chrome_default"],"agimnkijcaahngcdmfeangaknmldooml":["https://www.youtube.com/s/notifications/manifest/cr_install.html"],"fhihpiojkbmbpdjeoajapmgkhlnakfjf":["https://docs.google.com/spreadsheets/installwebapp?usp=chrome_default"],"fmgjjmmmlfnkbppncabfkddbjimcfncm":["https://mail.google.com/mail/installwebapp?usp=chrome_default"],"kefjledonklijopmnomlcbpllchaibag":["https://docs.google.com/presentation/installwebapp?usp=chrome_default"],"mpnpojknpmmopombnjdcgaaiekajbnjb":["https://docs.google.com/document/installwebapp?usp=chrome_default"]}}}": equals www.youtube.com (Youtube)
Source: BundleSweetIMSetup.exe, 00000000.00000003.1919261004.0000000004274000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1919178794.0000000004274000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1919315905.000000000427A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "web_app":{"app_id":{"install_url":{"aghbiahbpaijignceidepookljebhfak":["https://drive.google.com/drive/installwebapp?usp=chrome_default"],"agimnkijcaahngcdmfeangaknmldooml":["https://www.youtube.com/s/notifications/manifest/cr_install.html"],"fhihpiojkbmbpdjeoajapmgkhlnakfjf":["https://docs.google.com/spreadsheets/installwebapp?usp=chrome_default"],"fmgjjmmmlfnkbppncabfkddbjimcfncm":["https://mail.google.com/mail/installwebapp?usp=chrome_default"],"kefjledonklijopmnomlcbpllchaibag":["https://docs.google.com/presentation/installwebapp?usp=chrome_default"],"mpnpojknpmmopombnjdcgaaiekajbnjb":["https://docs.google.com/document/installwebapp?usp=chrome_default"]}}}":i equals www.youtube.com (Youtube)
Source: BundleSweetIMSetup.exe, 00000000.00000003.1916601668.0000000002B1C000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1919721396.000000000427A000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1921062510.000000000427A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "web_app":{"app_id":{"install_url":{"aghbiahbpaijignceidepookljebhfak":["https://drive.google.com/drive/installwebapp?usp=chrome_default"],"agimnkijcaahngcdmfeangaknmldooml":["https://www.youtube.com/s/notifications/manifest/cr_install.html"],"fhihpiojkbmbpdjeoajapmgkhlnakfjf":["https://docs.google.com/spreadsheets/installwebapp?usp=chrome_default"],"fmgjjmmmlfnkbppncabfkddbjimcfncm":["https://mail.google.com/mail/installwebapp?usp=chrome_default"],"kefjledonklijopmnomlcbpllchaibag":["https://docs.google.com/presentation/installwebapp?usp=chrome_default"],"mpnpojknpmmopombnjdcgaaiekajbnjb":["https://docs.google.com/document/installwebapp?usp=chrome_default"]}}}i equals www.youtube.com (Youtube)
Source: BundleSweetIMSetup.exe, 00000000.00000003.1916881361.000000000429A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "web_app":{"app_id":{"install_url":{"aghbiahbpaijignceidepookljebhfak":["https://drive.google.com/drive/installwebapp?usp=chrome_default"],"agimnkijcaahngcdmfeangaknmldooml":["https://www.youtube.com/s/notifications/manifest/cr_install.html"],"fhihpiojkbmbpdjeoajapmgkhlnakfjf":["https://docs.google.com/spreadsheets/installwebapp?usp=chrome_default"],"fmgjjmmmlfnkbppncabfkddbjimcfncm":["https://mail.google.com/mail/installwebapp?usp=chrome_default"],"kefjledonklijopmnomlcbpllchaibag":["https://docs.google.com/presentation/installwebapp?usp=chrome_default"],"mpnpojknpmmopombnjdcgaaiekajbnjb":["https://docs.google.com/document/installwebapp?usp=chrome_default"]}}}ru equals www.youtube.com (Youtube)
Source: BundleSweetIMSetup.exe, 00000000.00000003.1931108151.00000000042C1000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1931357660.00000000042C2000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1932783884.00000000042BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ://www.youtube.com/s/notifications/manifest/cr_install.html"],"fhihpiojkbmbpdjeoajap equals www.youtube.com (Youtube)
Source: BundleSweetIMSetup.exe	String found in binary or memory: fault"],"agimnkijcaahngcdmfeangaknmldooml":["https://www.youtube.com/s/notifications/manifest/cr_install.html"],"fhihpiojkbmbpdjeo equals www.youtube.com (Youtube)
Source: BundleSweetIMSetup.exe	String found in binary or memory: ml":["https://www.youtube.com/s/notifications/manifest/cr_install.html"],"fhihpiojkbmbpdjeoajapmgkhlnakfjf":["https://docs.google. equals www.youtube.com (Youtube)
Source: BundleSweetIMSetup.exe, 00000000.00000003.1920760714.00000000042C2000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1920726981.00000000042C1000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1922449222.00000000042C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: web_app":{"app_id":{"install_url":{"aghbiahbpaijignceidepookljebhfak":["https://drive.google.com/drive/installwebapp?usp=chrome_default"],"agimnkijcaahngcdmfeangaknmldooml":["https://www.youtube.com/s/notifications/manifest/cr_install.html"],"fhihpiojkbmbpdjeoajapmgkhlnakfjf":["https://docs.google.com/spreadsheets/installwebapp?usp=chrome_default"],"fmgjjmmmlfnkbppncabfkddbjimcfncm":["https://mail.google.com/mail/installwebapp?usp=chrome_default"],"kefjledonklijopmnomlcbpllchaibag":["https://docs.google.com/presentation/installwebapp?usp=chrome_default"],"mpnpojknpmmopombnjdcgaaiekajbnjb":["https://docs.google.com/document/installwebapp?usp=chrome_default"]}}}, equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: content.sweetim.com
Source: global traffic	DNS traffic detected: DNS query: www.sweetim.com
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: storage2.stgbssint.com
Source: global traffic	DNS traffic detected: DNS query: se-p-static-content.seccint.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: chrome.google.com

Source: toolbar.xml.3.dr	String found in binary or memory: http://127.0.0.1/test/content-notifier.js
Source: toolbar.xml.3.dr	String found in binary or memory: http://127.0.0.1/test/locales34.xml
Source: sweetim-toolbar.xul.10.dr, sweetim-toolbar.xul1.10.dr	String found in binary or memory: http://127.0.0.1/test/rc_tb.html
Source: addonlistener.js.10.dr, addonlistener.js0.10.dr	String found in binary or memory: http://adblockplus.org/blog/how-many-hacks-does-it-take-to-make-your-extension-install-without-a-res
Source: chromecache_795.15.dr	String found in binary or memory: http://api.autocompleteplus.com/?q=
Source: stringbundles.js1.10.dr, stringbundles.js0.10.dr	String found in binary or memory: http://books.mozdev.org/html/mozilla-chp-11-sect-3.html)
Source: toolbar.xml.3.dr	String found in binary or memory: http://cdn.content.sweetim.com/toolbar/emoticons/mietb202p.html
Source: toolbar.xml.3.dr	String found in binary or memory: http://cdn.content.sweetim.com/toolbar/fb/images/facebook.png
Source: toolbar.xml.3.dr	String found in binary or memory: http://cdn.content.sweetim.com/toolbar/fb/m0100.html
Source: toolbar.xml.3.dr	String found in binary or memory: http://cdn.content.sweetim.com/toolbar/icons/webmail/animals.png
Source: toolbar.xml.3.dr	String found in binary or memory: http://cdn.content.sweetim.com/toolbar/icons/webmail/emoticons.png
Source: toolbar.xml.3.dr	String found in binary or memory: http://cdn.content.sweetim.com/toolbar/icons/webmail/gestures.png
Source: toolbar.xml.3.dr	String found in binary or memory: http://cdn.content.sweetim.com/toolbar/icons/webmail/glitters.png
Source: toolbar.xml.3.dr	String found in binary or memory: http://cdn.content.sweetim.com/toolbar/icons/webmail/love.png
Source: toolbar.xml.3.dr	String found in binary or memory: http://cdn.content.sweetim.com/toolbar/icons/webmail/texticons.png
Source: toolbar.xml.3.dr	String found in binary or memory: http://cdn.content.sweetim.com/toolbar/resources/fb/ieinfb.js
Source: toolbar.xml.3.dr	String found in binary or memory: http://cdn.content.sweetim.com/toolbar/resources/fb/ieinfb_https.js
Source: toolbar.xml.3.dr	String found in binary or memory: http://cdn.content.sweetim.com/toolbar/webmail/mietb20i.html?menu=1
Source: toolbar.xml.3.dr	String found in binary or memory: http://cdn.content.sweetim.com/toolbar/webmail/mietb20i.html?menu=2
Source: toolbar.xml.3.dr	String found in binary or memory: http://cdn.content.sweetim.com/toolbar/webmail/mietb20i.html?menu=3
Source: toolbar.xml.3.dr	String found in binary or memory: http://cdn.content.sweetim.com/toolbar/webmail/mietb20i.html?menu=4
Source: toolbar.xml.3.dr	String found in binary or memory: http://cdn.content.sweetim.com/toolbar/webmail/mietb20i.html?menu=5
Source: toolbar.xml.3.dr	String found in binary or memory: http://cdn.content.sweetim.com/toolbar/webmail/mietb20i.html?menu=7
Source: toolbar.xml.3.dr	String found in binary or memory: http://cdn.content.sweetim.com/toolbar/winks/mietb202p.html
Source: toolbar.xml.3.dr	String found in binary or memory: http://cdn.triplegames.com/shared/apps/gamearcade/arcade.htm?publisherId=3205&sectionId=767997
Source: BundleSweetIMSetup.exe, 00000000.00000003.1674858263.0000000000EAC000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1969481685.0000000000ED0000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.2062389261.0000000000EEF000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.2068998373.0000000000EE9000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.2061074019.0000000000EEF000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.2063830032.0000000000EEF000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.2068383399.0000000000EE6000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.2065296062.0000000000EE2000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.2065627810.0000000000EEB000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.2069638260.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1712185619.0000000000EB8000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000002.2073522009.0000000000EEF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://content.sweetim.com/bi/track.gif?prodid=1&compid=35&actid=100&8
Source: BundleSweetIMSetup.exe, 00000000.00000003.1712185619.0000000000EAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://content.sweetim.com/bi/track.gif?prodid=1&compid=35&actid=100&cargo=WV:6.2;SC:0;SSN:145695948
Source: BundleSweetIMSetup.exe, 00000000.00000002.2076285085.0000000004281000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.2069638260.0000000000F68000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000002.2073522009.0000000000F68000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.2068998373.0000000000F68000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000002.2073166287.0000000000E7E000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.2065627810.0000000000F68000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.2061543965.0000000002A54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://content.sweetim.com/bi/track.gif?prodid=1&compid=35&actid=102&cargo=WV:6.2;SC:0;SSN:145695948
Source: BundleSweetIMSetup.exe, 00000000.00000002.2071455802.0000000000401000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://content.sweetim.com/bi/track.gif?prodid=1&compid=actid=%d;;cargo=&irmaReportDownloadRemoteFil
Source: sweetim-contentmenu.xul0.10.dr, sweetim-contentmenu.xul.10.dr	String found in binary or memory: http://content.sweetim.com/sim/mfftb20.html
Source: MSIC4F8.tmp.3.dr, MSIDA99.tmp.3.dr, 48c209.msi.3.dr, SweetIESetup.msi.8.dr, 48c20d.msi.3.dr, MSIE99E.tmp.3.dr, MSIF8B9.tmp.3.dr, MSIEAC8.tmp.3.dr	String found in binary or memory: http://crl.thawte.com/ThawteCodeSigningCA.crl0
Source: MSIC4F8.tmp.3.dr, MSIDA99.tmp.3.dr, 48c209.msi.3.dr, SweetIESetup.msi.8.dr, 48c20d.msi.3.dr, MSIE99E.tmp.3.dr, MSIF8B9.tmp.3.dr, MSIEAC8.tmp.3.dr	String found in binary or memory: http://crl.thawte.com/ThawtePremiumServerCA.crl0
Source: cookies.js0.10.dr, cookies.js1.10.dr, cookies.js.10.dr	String found in binary or memory: http://developer.mozilla.org/En/NsICookieService
Source: commands.js0.10.dr	String found in binary or memory: http://developer.mozilla.org/en/docs/Code_snippets:Cookies
Source: SIMAutoCompleteSearch.js1.10.dr, SIMAutoCompleteSearch.js.10.dr	String found in binary or memory: http://developer.mozilla.org/en/docs/How_to_implement_custom_autocomplete_search_component
Source: splitter.js0.10.dr	String found in binary or memory: http://developer.mozilla.org/en/docs/XUL_Tutorial:More_Event_Handlers
Source: install.js.10.dr	String found in binary or memory: http://developer.mozilla.org/en/docs/nsIFile:remove
Source: config.js0.10.dr	String found in binary or memory: http://developer.mozilla.org/en/docs/nsIPrefBranch
Source: bar.js1.3.dr	String found in binary or memory: http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=8
Source: SIMAutoCompleteSearch.js1.10.dr, SIMAutoCompleteSearch.js.10.dr	String found in binary or memory: http://forums.mozillazine.org/viewtopic.php?f=19&t=2070317)
Source: cookies.js0.10.dr, cookies.js1.10.dr, cookies.js.10.dr	String found in binary or memory: http://forums.mozillazine.org/viewtopic.php?f=27&t=656397
Source: BundleSweetIMSetup.exe, BundleSweetIMSetup.exe, 00000000.00000003.1944544419.0000000004296000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1941745817.00000000042A1000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1931426271.0000000004295000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1931108151.0000000004295000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1942049041.00000000042A2000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1931392225.0000000004295000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1931985408.000000000429C000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1931954475.000000000429A000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1945571211.0000000004296000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1947052473.0000000004296000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1940929338.0000000004295000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1931858184.0000000004296000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1943390567.0000000004296000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1947428250.00000000042A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://home.swee
Source: BundleSweetIMSetup.exe, 00000000.00000002.2076375666.00000000042A2000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1949290499.00000000042A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://home.sweeA
Source: prefs.js.0.dr, globals.js0.10.dr	String found in binary or memory: http://home.sweetim.com
Source: BundleSweetIMSetup.exe, 00000000.00000003.1921147282.00000000042A1000.00000004.00000020.00020000.00000000.sdmp, Preferences.0.dr	String found in binary or memory: http://home.sweetim.com/?barid=
Source: toolbar.xml.3.dr	String found in binary or memory: http://home.sweetim.com/?st=1$amp_crg_equals_cargo;
Source: BundleSweetIMSetup.exe, 00000000.00000003.1969399479.0000000002A86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://home.sweetim.com/cal
Source: BundleSweetIMSetup.exe, 00000000.00000003.1935736279.00000000042BD000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1936066195.00000000042BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://home.sweetim.com;
Source: mgsimcommon.dll.3.dr	String found in binary or memory: http://home.sweetim.com?barid=/&barid=&barid=?http://search.sweetim.com/search.asp?src=6&q=
Source: SweetIESetup.msi.8.dr, 48c20d.msi.3.dr, MSIEB08.tmp.3.dr, MSIF7EB.tmp.3.dr	String found in binary or memory: http://home.sweetim.comPrevious.HKLM.Start
Source: 48c209.msi.3.dr, MSID16F.tmp.3.dr, MSID25A.tmp.3.dr, MSIC547.tmp.3.dr	String found in binary or memory: http://home.sweetim.comSIMHPURLhttp://search.sweetim.com/?src=6&q=
Source: BundleSweetIMSetup.exe, 00000000.00000002.2071455802.0000000000401000.00000040.00000001.01000000.00000003.sdmp, SweetIM.exe, 00000007.00000002.1893180868.00000000004A4000.00000002.00000001.01000000.00000013.sdmp	String found in binary or memory: http://home.sweetim.comhttp://search.sweetim.com/search.asp?src=6&q=
Source: chromecache_795.15.dr	String found in binary or memory: http://info.sweetim.com
Source: chromecache_795.15.dr	String found in binary or memory: http://info.sweetim.com/aboutus/
Source: chromecache_795.15.dr	String found in binary or memory: http://info.sweetim.com/privacy-policy/
Source: chromecache_795.15.dr	String found in binary or memory: http://info.sweetim.com/terms/
Source: install.js.10.dr	String found in binary or memory: http://kb.mozillazine.org/Keyword.URL)
Source: install.js.10.dr	String found in binary or memory: http://kb.mozillazine.org/Search_Provider)
Source: mglogger.dll0.3.dr	String found in binary or memory: http://mguglielmi.free.fr
Source: MSIC4F8.tmp.3.dr, MSIDA99.tmp.3.dr, 48c209.msi.3.dr, SweetIESetup.msi.8.dr, 48c20d.msi.3.dr, MSIE99E.tmp.3.dr, MSIF8B9.tmp.3.dr, MSIEAC8.tmp.3.dr	String found in binary or memory: http://ocsp.thawte.com0
Source: mglogger.dll0.3.dr	String found in binary or memory: http://resource.jsmadeeasy.com/viewscript.asp?scriptid=507
Source: inject.js.10.dr, inject.js1.10.dr	String found in binary or memory: http://sc.sweetim.com/apps/in/fb/infb.js
Source: install.js.10.dr	String found in binary or memory: http://search.sweetim.
Source: BundleSweetIMSetup.exe, 00000000.00000002.2071455802.0000000000401000.00000040.00000001.01000000.00000003.sdmp, SweetIM.exe, 00000007.00000002.1893761079.00000000007D7000.00000002.00000001.01000000.0000000E.sdmp, 48c209.msi.3.dr, install.js.10.dr, MSID16F.tmp.3.dr, SweetIESetup.msi.8.dr, MSID25A.tmp.3.dr, 48c20d.msi.3.dr, sweetim.xml.10.dr, MSIC547.tmp.3.dr	String found in binary or memory: http://search.sweetim.com
Source: BundleSweetIMSetup.exe, 00000000.00000003.1942817662.00000000042C2000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1942781086.00000000042BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://search.sweetim.com/?src=6$1q=
Source: BundleSweetIMSetup.exe, BundleSweetIMSetup.exe, 00000000.00000003.1945077551.00000000042BD000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1944736609.00000000042C1000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1945416513.00000000042C1000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1946637880.00000000042C1000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1942817662.00000000042C2000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1948776353.00000000042C0000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1941087262.00000000042AC000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1948421204.00000000042C2000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1941207681.00000000042B4000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1943216817.00000000042BD000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1947394238.00000000042C2000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1943178865.00000000042C2000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1944813184.00000000042C2000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1949217415.00000000042C1000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1945116548.00000000042C2000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1946152544.00000000042BD000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1946475050.00000000042BD000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1942957332.00000000042BD000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1944176269.00000000042C2000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1947806512.00000000042C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://search.sweetim.com/?src=6&q=
Source: globals.js1.10.dr, globals.js0.10.dr	String found in binary or memory: http://search.sweetim.com/?src=6&q=
Source: toolbar.xml.3.dr	String found in binary or memory: http://search.sweetim.com/redir.asp?pid=1&q=$sim_search_combo;
Source: sweetim-toolbar.xul.10.dr, sweetim-toolbar.xul1.10.dr	String found in binary or memory: http://search.sweetim.com/redir.asp?pid=1&q=%sim_search_combo
Source: sweetim-toolbar.xul.10.dr, sweetim-toolbar.xul1.10.dr	String found in binary or memory: http://search.sweetim.com/redir.asp?pid=10&q=%sim_search_combo
Source: sweetim-toolbar.xul.10.dr, sweetim-toolbar.xul1.10.dr	String found in binary or memory: http://search.sweetim.com/redir.asp?pid=11&q=%sim_search_combo
Source: sweetim-toolbar.xul.10.dr, sweetim-toolbar.xul1.10.dr	String found in binary or memory: http://search.sweetim.com/redir.asp?pid=12&q=%sim_search_combo
Source: sweetim-toolbar.xul.10.dr, sweetim-toolbar.xul1.10.dr	String found in binary or memory: http://search.sweetim.com/redir.asp?pid=13&q=%sim_search_combo
Source: sweetim-toolbar.xul.10.dr, sweetim-toolbar.xul1.10.dr	String found in binary or memory: http://search.sweetim.com/redir.asp?pid=14&q=%sim_search_combo
Source: toolbar.xml.3.dr	String found in binary or memory: http://search.sweetim.com/redir.asp?pid=15&q=$sim_search_combo;
Source: sweetim-toolbar.xul.10.dr, sweetim-toolbar.xul1.10.dr	String found in binary or memory: http://search.sweetim.com/redir.asp?pid=15&q=%sim_search_combo
Source: sweetim-toolbar.xul.10.dr, sweetim-toolbar.xul1.10.dr	String found in binary or memory: http://search.sweetim.com/redir.asp?pid=16&q=%sim_search_combo
Source: sweetim-toolbar.xul.10.dr, sweetim-toolbar.xul1.10.dr	String found in binary or memory: http://search.sweetim.com/redir.asp?pid=17&q=%sim_search_combo
Source: toolbar.xml.3.dr	String found in binary or memory: http://search.sweetim.com/redir.asp?pid=2&q=$sim_search_combo;
Source: sweetim-toolbar.xul.10.dr, sweetim-toolbar.xul1.10.dr	String found in binary or memory: http://search.sweetim.com/redir.asp?pid=2&q=%sim_search_combo
Source: toolbar.xml.3.dr	String found in binary or memory: http://search.sweetim.com/redir.asp?pid=3&q=$sim_search_combo;
Source: sweetim-toolbar.xul.10.dr, sweetim-toolbar.xul1.10.dr	String found in binary or memory: http://search.sweetim.com/redir.asp?pid=3&q=%sim_search_combo
Source: toolbar.xml.3.dr	String found in binary or memory: http://search.sweetim.com/redir.asp?pid=4&q=$sim_search_combo;
Source: sweetim-toolbar.xul.10.dr, sweetim-toolbar.xul1.10.dr	String found in binary or memory: http://search.sweetim.com/redir.asp?pid=4&q=%sim_search_combo
Source: toolbar.xml.3.dr	String found in binary or memory: http://search.sweetim.com/redir.asp?pid=5&q=$sim_search_combo;
Source: sweetim-toolbar.xul.10.dr, sweetim-toolbar.xul1.10.dr	String found in binary or memory: http://search.sweetim.com/redir.asp?pid=5&q=%sim_search_combo
Source: toolbar.xml.3.dr	String found in binary or memory: http://search.sweetim.com/redir.asp?pid=6&q=$sim_search_combo;
Source: sweetim-toolbar.xul.10.dr, sweetim-toolbar.xul1.10.dr	String found in binary or memory: http://search.sweetim.com/redir.asp?pid=6&q=%sim_search_combo
Source: sweetim-toolbar.xul.10.dr, sweetim-toolbar.xul1.10.dr	String found in binary or memory: http://search.sweetim.com/redir.asp?pid=7&q=%sim_search_combo
Source: sweetim-toolbar.xul.10.dr, sweetim-toolbar.xul1.10.dr	String found in binary or memory: http://search.sweetim.com/redir.asp?pid=8&q=%sim_search_combo
Source: sweetim-toolbar.xul.10.dr, sweetim-toolbar.xul1.10.dr	String found in binary or memory: http://search.sweetim.com/redir.asp?pid=9&q=%sim_search_combo
Source: globals.js1.10.dr, globals.js0.10.dr, toolbar.xml.3.dr	String found in binary or memory: http://search.sweetim.com/search.asp
Source: search.js0.10.dr	String found in binary or memory: http://search.sweetim.com/search.asp?src=1&q=%sim_search_combo
Source: mgHelper.dll.3.dr	String found in binary or memory: http://search.sweetim.com/search.asp?src=2&pdp=1000&q=%shttp://search.sweetim.com/search.asp?src=8&p
Source: MenuExt.html.3.dr	String found in binary or memory: http://search.sweetim.com/search.asp?src=4&q=
Source: BundleSweetIMSetup.exe, 00000000.00000003.1923091904.00000000042A2000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1969287489.0000000000F4E000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1922482118.00000000042A1000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1922236173.00000000042A1000.00000004.00000020.00020000.00000000.sdmp, SweetIM.exe, 48c209.msi.3.dr, MSID16F.tmp.3.dr, MSID25A.tmp.3.dr, MSIC547.tmp.3.dr	String found in binary or memory: http://search.sweetim.com/search.asp?src=6&q=
Source: install.js.10.dr	String found in binary or memory: http://search.yahoo.com/
Source: addonlistener.js.10.dr, addonlistener.js0.10.dr	String found in binary or memory: http://stackoverflow.com/questions/6284051/in-my-firefox-extension-onuninstalled-event-doesnt-seem-t
Source: VistaCookiesCollector.exe, 00000005.00000002.1791302329.00000000004D0000.00000004.00000020.00020000.00000000.sdmp, VistaCookiesCollector.exe, 00000005.00000002.1791260931.0000000000450000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sweetim.com
Source: VistaCookiesCollector.exe, 00000005.00000002.1791302329.00000000004DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sweetim.com/
Source: VistaCookiesCollector.exe, 00000005.00000002.1791302329.00000000004DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sweetim.com/c77b0923665da6f1
Source: VistaCookiesCollector.exe, 00000005.00000002.1791537351.0000000000AC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sweetim.com2;C:
Source: 48c20d.msi.3.dr, MSIEB08.tmp.3.dr, MSIF7EB.tmp.3.dr	String found in binary or memory: http://sweetim.comAnalyzeCookieslogDllVersion.
Source: 48c209.msi.3.dr, MSID16F.tmp.3.dr, MSID25A.tmp.3.dr, MSIC547.tmp.3.dr	String found in binary or memory: http://sweetim.comREFERRALID
Source: BundleSweetIMSetup.exe, 00000000.00000002.2071455802.0000000000401000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://sweetim.comREFERRALIDGetReferralCookieFound.
Source: toolbar.xml.3.dr	String found in binary or memory: http://tab.search.sweetim.com/tab.asp
Source: cookies.js0.10.dr, cookies.js1.10.dr, cookies.js.10.dr	String found in binary or memory: http://weblogs.mozillazine.org/doron/archives/2008/06/extensions_and_firefox_3_nsico.html
Source: 48c209.msi.3.dr, MSID16F.tmp.3.dr, MSID25A.tmp.3.dr, MSIC547.tmp.3.dr	String found in binary or memory: http://www.aim.comSweetIM
Source: toolbar.xml.3.dr	String found in binary or memory: http://www.hi5.com
Source: MSIC4F8.tmp.3.dr, MSIDA99.tmp.3.dr, 48c209.msi.3.dr, SweetIESetup.msi.8.dr, 48c20d.msi.3.dr, MSIE99E.tmp.3.dr, MSIF8B9.tmp.3.dr, MSIEAC8.tmp.3.dr	String found in binary or memory: http://www.macrovision.com0
Source: install.rdf1.10.dr	String found in binary or memory: http://www.mozilla.org/2004/em-rdf#
Source: SweetIM.exe, 00000007.00000002.1893761079.00000000007D7000.00000002.00000001.01000000.0000000E.sdmp, 48c209.msi.3.dr, MSID16F.tmp.3.dr, SweetIESetup.msi.8.dr, MSID25A.tmp.3.dr, 48c20d.msi.3.dr, sweetim.xml.10.dr, MSIC547.tmp.3.dr	String found in binary or memory: http://www.mozilla.org/2006/browser/search/
Source: sweetim-toolbar.xul.10.dr, sweetim-toolbar.css.10.dr, bindings.xml0.10.dr, bindings.xml1.10.dr, sweetim-contentmenu.xul0.10.dr, sweetim-toolbar.xul1.10.dr, sweetim-contentmenu.xul.10.dr	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul
Source: bindings.xml1.10.dr	String found in binary or memory: http://www.mozilla.org/xbl
Source: toolbar.xml.3.dr	String found in binary or memory: http://www.orkut.com
Source: 48c20b.rbs.3.dr, MSICDA5.tmp.3.dr, install.rdf1.10.dr, globals.js1.10.dr, globals.js0.10.dr	String found in binary or memory: http://www.sweetim.com
Source: toolbar.xml.3.dr	String found in binary or memory: http://www.sweetim.com/
Source: globals.js1.10.dr, globals.js0.10.dr	String found in binary or memory: http://www.sweetim.com/about_overview.asp
Source: SweetIM.exe, 00000007.00000002.1894174346.0000000002630000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sweetim.com/autoupdate/u.asp
Source: BundleSweetIMSetup.exe, 00000000.00000002.2073166287.0000000000E7E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sweetim.com/cbi.gif
Source: BundleSweetIMSetup.exe, 00000000.00000002.2071455802.0000000000401000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.sweetim.com/cbi.gifSubmitTrackingPixel.
Source: SweetIM.exe, 00000007.00000002.1894174346.0000000002630000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sweetim.com/download/install/SweetIMSetup.exeup.exe
Source: globals.js1.10.dr, globals.js0.10.dr, toolbar.xml.3.dr	String found in binary or memory: http://www.sweetim.com/eula.html#privacy
Source: globals.js1.10.dr, globals.js0.10.dr	String found in binary or memory: http://www.sweetim.com/forum/
Source: BundleSweetIMSetup.exe, 00000000.00000003.1674858263.0000000000EAC000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1675117885.0000000000F5F000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000002.2071455802.000000000045F000.00000040.00000001.01000000.00000003.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1674858263.0000000000F4E000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1712010420.0000000002A3C000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1674811988.0000000002A4D000.00000004.00000020.00020000.00000000.sdmp, 48c209.msi.3.dr, SweetIESetup.msi.8.dr, 48c20d.msi.3.dr	String found in binary or memory: http://www.sweetim.com/help
Source: globals.js1.10.dr, globals.js0.10.dr, toolbar.xml.3.dr	String found in binary or memory: http://www.sweetim.com/help_contact.asp
Source: globals.js1.10.dr, globals.js0.10.dr	String found in binary or memory: http://www.sweetim.com/help_simff.asp
Source: BundleSweetIMSetup.exe, 00000000.00000003.1674811988.0000000002A4D000.00000004.00000020.00020000.00000000.sdmp, toolbar.xml.3.dr	String found in binary or memory: http://www.sweetim.com/help_simie.asp
Source: BundleSweetIMSetup.exe, 00000000.00000003.1674858263.0000000000EAC000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1675117885.0000000000F5F000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000002.2071455802.000000000045F000.00000040.00000001.01000000.00000003.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1674858263.0000000000F4E000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1712010420.0000000002A3C000.00000004.00000020.00020000.00000000.sdmp, 48c209.msi.3.dr, SweetIESetup.msi.8.dr, 48c20d.msi.3.dr	String found in binary or memory: http://www.sweetim.com/help_simie.asp#inst
Source: BundleSweetIMSetup.exe, 00000000.00000003.2061543965.0000000002A54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sweetim.com/installbar.asp?barid=
Source: toolbar.xml.3.dr	String found in binary or memory: http://www.sweetim.com/installbar.asp?barid=$toolbar_id;
Source: globals.js1.10.dr, globals.js0.10.dr	String found in binary or memory: http://www.sweetim.com/installbar.asp?barid=%toolbar_id
Source: BundleSweetIMSetup.exe, 00000000.00000002.2071455802.0000000000401000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.sweetim.com/installbar.asp?barid=GetSIMAppID
Source: 48c20d.msi.3.dr, MSIEB08.tmp.3.dr, MSIF7EB.tmp.3.dr	String found in binary or memory: http://www.sweetim.com/installbar.asp?barid=http://www.sweetim.com/uninstallbar.asp?barid=http://www
Source: sweetim-toolbar.xul.10.dr, sweetim-toolbar.xul1.10.dr	String found in binary or memory: http://www.sweetim.com/simffbar/rc.html
Source: install.rdf1.10.dr	String found in binary or memory: http://www.sweetim.com/simffbar/update.rdf?ff_version=%APP_VERSION%&toolbar_status=%ITEM_STATUS%
Source: toolbar.xml.3.dr	String found in binary or memory: http://www.sweetim.com/simiebar/
Source: toolbar.xml.3.dr	String found in binary or memory: http://www.sweetim.com/simiebar/download/toolbar.cab
Source: toolbar.xml.3.dr	String found in binary or memory: http://www.sweetim.com/uninstallbar.asp?barid=$toolbar_id;
Source: globals.js1.10.dr, globals.js0.10.dr	String found in binary or memory: http://www.sweetim.com/uninstallbar.asp?barid=%toolbar_id
Source: BundleSweetIMSetup.exe, 00000000.00000002.2071455802.0000000000401000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.sweetim.com/uninstallbar.asp?barid=http://www.sweetim.com/updatebar.aspFinalizeSweetIESet
Source: toolbar.xml.3.dr	String found in binary or memory: http://www.sweetim.com/uninstallhelp.asp
Source: globals.js1.10.dr, globals.js0.10.dr	String found in binary or memory: http://www.sweetim.com/uninstallhelpff.asp
Source: 48c209.msi.3.dr, MSID16F.tmp.3.dr, MSID25A.tmp.3.dr, MSIC547.tmp.3.dr	String found in binary or memory: http://www.sweetim.com/uninstallim.asp?simappid=%sUPGRADINGPRODUCTCODEhttp://www.sweetim.com/downloa
Source: globals.js1.10.dr, globals.js0.10.dr, toolbar.xml.3.dr	String found in binary or memory: http://www.sweetim.com/updatebar.asp
Source: 48c209.msi.3.dr, SweetIESetup.msi.8.dr, 48c20d.msi.3.dr, mgSqlite3.dll.4.dr, mgSqlite3.dll.3.dr, mgSqlite3.dll.10.dr	String found in binary or memory: http://www.sweetim.com0
Source: uninstallobserver.js1.10.dr, uninstallobserver.js0.10.dr	String found in binary or memory: http://xulsolutions.blogspot.com/2006/07/creating-uninstall-script-for.html
Source: BundleSweetIMSetup.exe, 00000000.00000002.2075447475.000000000332C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: BundleSweetIMSetup.exe, BundleSweetIMSetup.exe, 00000000.00000003.1916707330.0000000004277000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1920924192.0000000004271000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1918984515.000000000427A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com
Source: BundleSweetIMSetup.exe, BundleSweetIMSetup.exe, 00000000.00000003.1916707330.0000000004277000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1920924192.0000000004271000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1918984515.000000000427A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com:443
Source: BundleSweetIMSetup.exe	String found in binary or memory: https://bridge.l
Source: BundleSweetIMSetup.exe	String found in binary or memory: https://bridge.lga1.a
Source: BundleSweetIMSetup.exe	String found in binary or memory: https://bridge.lga1.admark
Source: BundleSweetIMSetup.exe	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&c
Source: BundleSweetIMSetup.exe, 00000000.00000003.1948585972.00000000042B4000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1947911162.00000000042C7000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1935188702.00000000042AC000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1946152544.00000000042BD000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1946475050.00000000042BD000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1942957332.00000000042BD000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1947694690.00000000042C7000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1942852451.00000000042C7000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1935924437.00000000042AC000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1934723785.00000000042B3000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1935593919.00000000042A4000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1944176269.00000000042C2000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1947806512.00000000042C2000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1946074746.00000000042BD000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1934003704.00000000042A8000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1942781086.00000000042BD000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1946308990.00000000042BD000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1947731414.00000000042BD000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1947620062.00000000042BD000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1934221488.0000000002B1C000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1944457193.00000000042C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: BundleSweetIMSetup.exe, BundleSweetIMSetup.exe, 00000000.00000003.1944544419.0000000004296000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1943390567.0000000004296000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.ap01.n
Source: BundleSweetIMSetup.exe	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?
Source: BundleSweetIMSetup.exe	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?versio
Source: BundleSweetIMSetup.exe, 00000000.00000003.1947093299.0000000002B1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=169633223
Source: BundleSweetIMSetup.exe, 00000000.00000003.1944544419.0000000004296000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1945077551.00000000042BD000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1936131977.00000000042B4000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1942817662.00000000042C2000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1946115163.00000000042C7000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1935736279.00000000042BD000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1944882361.00000000042B1000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1932917107.0000000002B1A000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1948421204.00000000042C2000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1943216817.00000000042BD000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1947394238.00000000042C2000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1943178865.00000000042C2000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1935188702.00000000042A4000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1935096471.00000000042B6000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1945303103.00000000042B4000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1948205588.0000000004271000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1934686053.00000000042BD000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1935997640.0000000002B1A000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1947357892.00000000042AC000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1946975552.0000000004271000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1936337518.00000000042BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: SIMAutoCompleteSearch.js1.10.dr, SIMAutoCompleteSearch.js.10.dr	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=625319
Source: BundleSweetIMSetup.exe, 00000000.00000002.2075447475.000000000332C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/asse
Source: BundleSweetIMSetup.exe, 00000000.00000002.2075447475.000000000332C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icoht
Source: BundleSweetIMSetup.exe, 00000000.00000003.1931108151.0000000004295000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1931240313.00000000042A4000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1931426271.00000000042A8000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1932093565.00000000042B1000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1932017591.00000000042AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/search
Source: BundleSweetIMSetup.exe, 00000000.00000002.2075447475.000000000332C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appi0
Source: BundleSweetIMSetup.exe, 00000000.00000003.1969287489.0000000000F68000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.2069638260.0000000000F68000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000002.2073522009.0000000000F68000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1712185619.0000000000F68000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.2068998373.0000000000F68000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.2065627810.0000000000F68000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://content.sweetim.com/4
Source: BundleSweetIMSetup.exe, 00000000.00000003.1712185619.0000000000EAC000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.2061543965.0000000002A54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://content.sweetim.com/bi/track.gif?prodid=1&compid=35&actid=100&cargo=WV:6.2;SC:0;SSN:14569594
Source: BundleSweetIMSetup.exe, 00000000.00000003.2068998373.0000000000F01000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000002.2073522009.0000000000F01000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.2064156782.0000000002A54000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.2068807066.0000000002A46000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000002.2074530070.0000000002A48000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.2066491581.0000000002A46000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.2061074019.0000000000F01000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.2064156782.0000000002A46000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000002.2073166287.0000000000E7E000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.2061543965.0000000002A46000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.2069638260.0000000000F01000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.2065627810.0000000000F01000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.2061543965.0000000002A54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://content.sweetim.com/bi/track.gif?prodid=1&compid=35&actid=102&cargo=WV:6.2;SC:0;SSN:14569594
Source: BundleSweetIMSetup.exe, 00000000.00000003.1969287489.0000000000F68000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.2069638260.0000000000F68000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000002.2073522009.0000000000F68000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1712185619.0000000000F68000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.2068998373.0000000000F68000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.2065627810.0000000000F68000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://content.sweetim.com/c
Source: BundleSweetIMSetup.exe, 00000000.00000003.1948585972.00000000042B4000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1947911162.00000000042C7000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1935188702.00000000042AC000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1946152544.00000000042BD000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1946475050.00000000042BD000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1942957332.00000000042BD000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1947694690.00000000042C7000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1942852451.00000000042C7000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1935924437.00000000042AC000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1934723785.00000000042B3000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1935593919.00000000042A4000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1944176269.00000000042C2000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1947806512.00000000042C2000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1946074746.00000000042BD000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1934003704.00000000042A8000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1942781086.00000000042BD000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1946308990.00000000042BD000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1947731414.00000000042BD000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1947620062.00000000042BD000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1934221488.0000000002B1C000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1944457193.00000000042C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: BundleSweetIMSetup.exe	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_
Source: BundleSweetIMSetup.exe, 00000000.00000003.1944544419.0000000004296000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1945077551.00000000042BD000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1936131977.00000000042B4000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1942817662.00000000042C2000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1946115163.00000000042C7000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1935736279.00000000042BD000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1944882361.00000000042B1000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1932917107.0000000002B1A000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1948421204.00000000042C2000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1943216817.00000000042BD000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1947394238.00000000042C2000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1943178865.00000000042C2000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1935188702.00000000042A4000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1935096471.00000000042B6000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1945303103.00000000042B4000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1948205588.0000000004271000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1934686053.00000000042BD000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1935997640.0000000002B1A000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1947357892.00000000042AC000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1946975552.0000000004271000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1936337518.00000000042BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: tabinfo.js.10.dr	String found in binary or memory: https://developer.mozilla.org/en/Code_snippets/Tabbed_browser
Source: addonlistener.js.10.dr, addonlistener.js0.10.dr	String found in binary or memory: https://developer.mozilla.org/en/Extensions/Bootstrapped_extensions)
Source: BundleSweetIMSetup.exe, 00000000.00000003.1931108151.00000000042C1000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1931357660.00000000042C2000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1932783884.00000000042BD000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1932818795.00000000042C5000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1931614131.00000000042C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.googl
Source: BundleSweetIMSetup.exe	String found in binary or memory: https://docs.google.
Source: BundleSweetIMSetup.exe	String found in binary or memory: https://docs.google.com/document/installwebapp?usp=chro
Source: BundleSweetIMSetup.exe	String found in binary or memory: https://docs.google.com/document/installwebapp?usp=chrome_
Source: BundleSweetIMSetup.exe, 00000000.00000003.1918937740.000000000427A000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1918984515.000000000427A000.00000004.00000020.00020000.00000000.sdmp, Preferences.0.dr	String found in binary or memory: https://docs.google.com/document/installwebapp?usp=chrome_default
Source: BundleSweetIMSetup.exe	String found in binary or memory: https://docs.google.com/presentat
Source: BundleSweetIMSetup.exe, 00000000.00000003.1931108151.00000000042C1000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1931357660.00000000042C2000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1932783884.00000000042BD000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1932818795.00000000042C5000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1931614131.00000000042C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/in
Source: BundleSweetIMSetup.exe, 00000000.00000003.1918937740.000000000427A000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1918984515.000000000427A000.00000004.00000020.00020000.00000000.sdmp, Preferences.0.dr	String found in binary or memory: https://docs.google.com/presentation/installwebapp?usp=chrome_default
Source: BundleSweetIMSetup.exe, BundleSweetIMSetup.exe, 00000000.00000003.1919261004.0000000004274000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1920924192.0000000004274000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1916601668.0000000002B1C000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1931108151.00000000042C1000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1931357660.00000000042C2000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1920924192.0000000004271000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1916881361.000000000429A000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1919178794.0000000004274000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1919721396.000000000427A000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1920491757.0000000004271000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1921062510.000000000427A000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1932783884.00000000042BD000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1932818795.00000000042C5000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1920992518.00000000042B3000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1920281542.0000000004274000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1919748111.0000000004274000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1920858823.0000000002B1A000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1931614131.00000000042C5000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1920760714.00000000042C2000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1920726981.00000000042C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/installwebapp?usp=chrome_default
Source: BundleSweetIMSetup.exe, 00000000.00000003.1931108151.00000000042C1000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1931357660.00000000042C2000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1932783884.00000000042BD000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1932818795.00000000042C5000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1933055444.00000000042BD000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1933341291.00000000042C3000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1931614131.00000000042C5000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1933188058.00000000042C3000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1933228210.00000000042BD000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1932983840.00000000042B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.go
Source: BundleSweetIMSetup.exe	String found in binary or memory: https://drive.google.com/drive/installwebapp?usp=chrome_d
Source: BundleSweetIMSetup.exe	String found in binary or memory: https://drive.google.com/drive/installwebapp?usp=chrome_defaul
Source: BundleSweetIMSetup.exe, 00000000.00000003.1918937740.000000000427A000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1918984515.000000000427A000.00000004.00000020.00020000.00000000.sdmp, Preferences.0.dr	String found in binary or memory: https://drive.google.com/drive/installwebapp?usp=chrome_default
Source: BundleSweetIMSetup.exe, 00000000.00000003.1947357892.00000000042AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?
Source: BundleSweetIMSetup.exe, 00000000.00000003.1935924437.00000000042AC000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1935482180.00000000042AC000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1935593919.00000000042AC000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1935848149.00000000042AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7
Source: BundleSweetIMSetup.exe, 00000000.00000003.1947769791.00000000042B4000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1947178638.00000000042B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBU
Source: BundleSweetIMSetup.exe	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqmf
Source: BundleSweetIMSetup.exe	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR
Source: BundleSweetIMSetup.exe	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9
Source: prefs.js.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: BundleSweetIMSetup.exe	String found in binary or memory: https://mail.google.com/mail/installwebapp
Source: BundleSweetIMSetup.exe, 00000000.00000003.1931108151.00000000042C1000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1931357660.00000000042C2000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1932783884.00000000042BD000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1932818795.00000000042C5000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1931614131.00000000042C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/installwebapp?usp=chrom4
Source: BundleSweetIMSetup.exe, 00000000.00000003.1918937740.000000000427A000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1918984515.000000000427A000.00000004.00000020.00020000.00000000.sdmp, Preferences.0.dr	String found in binary or memory: https://mail.google.com/mail/installwebapp?usp=chrome_default
Source: BundleSweetIMSetup.exe	String found in binary or memory: https://support.micr
Source: BundleSweetIMSetup.exe	String found in binary or memory: https://www.amazon.
Source: BundleSweetIMSetup.exe, 00000000.00000002.2076466457.00000000042B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=G
Source: BundleSweetIMSetup.exe	String found in binary or memory: https://www.amazon.com/?tag=admarketus-2
Source: BundleSweetIMSetup.exe	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=
Source: BundleSweetIMSetup.exe, 00000000.00000003.1944544419.0000000004296000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1945077551.00000000042BD000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1936131977.00000000042B4000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1942817662.00000000042C2000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1946115163.00000000042C7000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1935736279.00000000042BD000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1944882361.00000000042B1000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1932917107.0000000002B1A000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1948421204.00000000042C2000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1943216817.00000000042BD000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1947394238.00000000042C2000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1943178865.00000000042C2000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1935188702.00000000042A4000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1935096471.00000000042B6000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1945303103.00000000042B4000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1948205588.0000000004271000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1934686053.00000000042BD000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1935997640.0000000002B1A000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1947357892.00000000042AC000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1946975552.0000000004271000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1936337518.00000000042BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: BundleSweetIMSetup.exe, 00000000.00000002.2075447475.000000000332C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: BundleSweetIMSetup.exe, 00000000.00000002.2075447475.000000000332C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=
Source: BundleSweetIMSetup.exe, 00000000.00000003.1945571211.0000000004296000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1943390567.0000000004296000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.expedia.com/?locale=en_U
Source: BundleSweetIMSetup.exe, 00000000.00000003.1947769791.00000000042B4000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1947178638.00000000042B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid
Source: BundleSweetIMSetup.exe	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid
Source: BundleSweetIMSetup.exe, 00000000.00000003.1934475528.0000000002B1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMA
Source: BundleSweetIMSetup.exe, 00000000.00000003.1944544419.0000000004296000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1945571211.0000000004296000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1943390567.0000000004296000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEM
Source: BundleSweetIMSetup.exe	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL
Source: BundleSweetIMSetup.exe, 00000000.00000003.1936337518.00000000042BF000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1948059516.00000000042C7000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1945116548.00000000042C2000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1946819961.0000000004271000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1948585972.00000000042B4000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1947911162.00000000042C7000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1935188702.00000000042AC000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1946152544.00000000042BD000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1946475050.00000000042BD000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1942957332.00000000042BD000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1947694690.00000000042C7000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1942852451.00000000042C7000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1935924437.00000000042AC000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1934723785.00000000042B3000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1935593919.00000000042A4000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1944176269.00000000042C2000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1947806512.00000000042C2000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1946074746.00000000042BD000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1934003704.00000000042A8000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1942781086.00000000042BD000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1946308990.00000000042BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: BundleSweetIMSetup.exe, 00000000.00000003.1918937740.000000000427A000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1918984515.000000000427A000.00000004.00000020.00020000.00000000.sdmp, Preferences.0.dr	String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 13.249.98.125:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.249.98.125:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.193.120.112:443 -> 192.168.2.4:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.193.120.112:443 -> 192.168.2.4:49768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.4:49771 version: TLS 1.2

Change of System Appearance

Changes the start page of internet explorer

Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe

Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main Start Page

Jump to behavior

System Summary

Found suspicious ZIP file

Source: SweetIMToolbar.xpi.10.dr	Zip Entry: chrome/sweetim-toolbar/content/main.js
Source: SweetIMToolbar.xpi.10.dr	Zip Entry: chrome/sweetim-toolbar/content/sweetim-toolbar.js
Source: SweetIMToolbar.xpi.10.dr	Zip Entry: chrome/sweetim-toolbar/content/chevron.js
Source: SweetIMToolbar.xpi.10.dr	Zip Entry: chrome/sweetim-toolbar/content/commands.js
Source: SweetIMToolbar.xpi.10.dr	Zip Entry: chrome/sweetim-toolbar/content/config.js
Source: SweetIMToolbar.xpi.10.dr	Zip Entry: chrome/sweetim-toolbar/content/contentmenu-handler.js
Source: SweetIMToolbar.xpi.10.dr	Zip Entry: chrome/sweetim-toolbar/content/contentmenu.js
Source: SweetIMToolbar.xpi.10.dr	Zip Entry: chrome/sweetim-toolbar/content/cookies.js
Source: SweetIMToolbar.xpi.10.dr	Zip Entry: chrome/sweetim-toolbar/content/file.js
Source: SweetIMToolbar.xpi.10.dr	Zip Entry: chrome/sweetim-toolbar/content/globals.js
Source: SweetIMToolbar.xpi.10.dr	Zip Entry: chrome/sweetim-toolbar/content/highlight.js
Source: SweetIMToolbar.xpi.10.dr	Zip Entry: chrome/sweetim-toolbar/content/history.js
Source: SweetIMToolbar.xpi.10.dr	Zip Entry: chrome/sweetim-toolbar/content/install.js
Source: SweetIMToolbar.xpi.10.dr	Zip Entry: chrome/sweetim-toolbar/content/logger.js
Source: SweetIMToolbar.xpi.10.dr	Zip Entry: chrome/sweetim-toolbar/content/registry.js
Source: SweetIMToolbar.xpi.10.dr	Zip Entry: chrome/sweetim-toolbar/content/release.js
Source: SweetIMToolbar.xpi.10.dr	Zip Entry: chrome/sweetim-toolbar/content/search.js
Source: SweetIMToolbar.xpi.10.dr	Zip Entry: chrome/sweetim-toolbar/content/searchguard.js
Source: SweetIMToolbar.xpi.10.dr	Zip Entry: chrome/sweetim-toolbar/content/searchservice.js
Source: SweetIMToolbar.xpi.10.dr	Zip Entry: chrome/sweetim-toolbar/content/splitter.js
Source: SweetIMToolbar.xpi.10.dr	Zip Entry: chrome/sweetim-toolbar/content/stringbundles.js
Source: SweetIMToolbar.xpi.10.dr	Zip Entry: chrome/sweetim-toolbar/content/tabinfo.js
Source: SweetIMToolbar.xpi.10.dr	Zip Entry: chrome/sweetim-toolbar/content/tabinfo-array.js
Source: SweetIMToolbar.xpi.10.dr	Zip Entry: chrome/sweetim-toolbar/content/tooltip.js
Source: SweetIMToolbar.xpi.10.dr	Zip Entry: chrome/sweetim-toolbar/content/uninstallobserver.js
Source: SweetIMToolbar.xpi.10.dr	Zip Entry: chrome/sweetim-toolbar/content/version.js
Source: SweetIMToolbar.xpi.10.dr	Zip Entry: chrome/sweetim-toolbar/content/webprogresslistener.js
Source: SweetIMToolbar.xpi.10.dr	Zip Entry: chrome/sweetim-toolbar/content/remote.js
Source: SweetIMToolbar.xpi.10.dr	Zip Entry: chrome/sweetim-toolbar/content/dynamic.js
Source: SweetIMToolbar.xpi.10.dr	Zip Entry: chrome/sweetim-toolbar/content/ppcbully.js
Source: SweetIMToolbar.xpi.10.dr	Zip Entry: chrome/sweetim-toolbar/content/gui.js
Source: SweetIMToolbar.xpi.10.dr	Zip Entry: chrome/sweetim-toolbar/content/inject.js
Source: SweetIMToolbar.xpi.10.dr	Zip Entry: chrome/sweetim-toolbar/content/version-ff.js
Source: SweetIMToolbar.xpi.10.dr	Zip Entry: chrome/sweetim-toolbar/content/findword.js
Source: SweetIMToolbar.xpi.10.dr	Zip Entry: chrome/sweetim-toolbar/content/wait.js
Source: SweetIMToolbar.xpi.10.dr	Zip Entry: chrome/sweetim-toolbar/content/addonlistener.js
Source: SweetIMToolbar.xpi.10.dr	Zip Entry: chrome/sweetim-toolbar/content/addonmanager.js
Source: SweetIMToolbar.xpi.10.dr	Zip Entry: chrome/sweetim-toolbar/content/global-namespace.js
Source: SweetIMToolbar.xpi.10.dr	Zip Entry: chrome/sweetim-toolbar/content/messagebox.js
Source: SweetIMToolbar.xpi.10.dr	Zip Entry: chrome/sweetim-toolbar/content/domainutils.js
Source: SweetIMToolbar.xpi.10.dr	Zip Entry: chrome/sweetim-toolbar/content/generalobserver.js
Source: SweetIMToolbar.xpi.10.dr	Zip Entry: components/SIMAutoCompleteSearch.js

Contains functionality to call native functions

Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Code function: 7_2_0081D66C GetLastError,GetCurrentProcessId,CreateFileMappingA,MapViewOfFile,UnmapViewOfFile,NtConnectPort,CloseHandle,FindCloseChangeNotification,CloseHandle,OpenProcess,OpenProcess,GetCurrentProcess,DuplicateHandle,WriteFile,WriteFile,WriteFile,WriteFile,WriteFile,CloseHandle,ReleaseMutex,CloseHandle,CloseHandle,SetLastError,	7_2_0081D66C
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Code function: 7_2_0081C98C LocalAlloc,NtReplyWaitReceivePort,NtAcceptConnectPort,LocalFree,GetCurrentProcessId,LocalAlloc,NtAcceptConnectPort,LocalAlloc,LocalFree,NtCompleteConnectPort,CloseHandle,SetEvent,EnterCriticalSection,LeaveCriticalSection,LocalFree,NtAcceptConnectPort,LocalFree,LocalFree,LocalFree,	7_2_0081C98C
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Code function: 7_2_0081CCDC InitializeSecurityDescriptor,SetSecurityDescriptorDacl,LocalAlloc,NtCreatePort,LocalFree,EnterCriticalSection,LocalAlloc,CreateSemaphoreA,CreateThread,CreateThread,SetThreadPriority,SetThreadPriority,InitializeCriticalSection,LeaveCriticalSection,	7_2_0081CCDC
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Code function: 7_2_0081DC3A ReleaseSemaphore,NtConnectPort,WaitForSingleObject,TerminateThread,CloseHandle,WaitForSingleObject,TerminateThread,CloseHandle,SetEvent,WaitForSingleObject,TerminateThread,CloseHandle,CloseHandle,LocalFree,LocalFree,CloseHandle,CloseHandle,DeleteCriticalSection,LocalFree,	7_2_0081DC3A
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Code function: 7_2_0081D664 GetLastError,GetCurrentProcessId,CreateFileMappingA,MapViewOfFile,UnmapViewOfFile,NtConnectPort,CloseHandle,FindCloseChangeNotification,CloseHandle,OpenProcess,CloseHandle,SetLastError,	7_2_0081D664
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Code function: 7_2_0081CB86 LocalAlloc,NtReplyWaitReceivePort,NtAcceptConnectPort,LocalFree,ReleaseSemaphore,LocalFree,	7_2_0081CB86

Contains functionality to launch a process as a different user

Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe

Code function: 7_2_007CCA30 ?CreateLowProcess@CVistaSupport@OSVista@@QAEHPBG0K@Z,wcslen,wcscpy,GetCurrentProcess,OpenProcessToken,DuplicateTokenEx,CloseHandle,ConvertStringSidToSidW,GetLengthSid,SetTokenInformation,CreateProcessAsUserW,WaitForSingleObject,CloseHandle,CloseHandle,LocalFree,CloseHandle,CloseHandle,

7_2_007CCA30

Contains functionality to shutdown / reboot the system

Source: C:\Users\user\AppData\Local\Temp\SweetIMSetup.exe	Code function: 1_2_00421166 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,		1_2_00421166
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Code function: 7_2_007CC6F0 ?Restart@CShutDownManager@@QAE_N_N@Z,ExitWindowsEx,		7_2_007CC6F0

Creates files inside the system directory

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\48c209.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIC380.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIC4F8.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIC547.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\SourceHash{A81A974F-8A22-43E6-9243-5198FF758DA1}	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSICDA5.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{A81A974F-8A22-43E6-9243-5198FF758DA1}	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{A81A974F-8A22-43E6-9243-5198FF758DA1}\ARPPRODUCTICON.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\48c20c.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\48c20c.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID16F.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID25A.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID2C8.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIDA99.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\48c20d.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIE99E.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIEAC8.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIEB08.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\SourceHash{A7BC02AF-1128-4A31-BCF8-1A3EE803D3B3}	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIEB47.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{A7BC02AF-1128-4A31-BCF8-1A3EE803D3B3}	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{A7BC02AF-1128-4A31-BCF8-1A3EE803D3B3}\ARPPRODUCTICON.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\48c210.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\48c210.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIEF30.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIF7EB.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIF889.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIF8B9.tmp	Jump to behavior

Deletes files inside the Windows folder

Source: C:\Windows\System32\msiexec.exe

File deleted: C:\Windows\Installer\MSIC380.tmp

Jump to behavior

Detected potential crypto function

Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	Code function: 0_3_0429ED80	0_3_0429ED80
Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	Code function: 0_3_0429ED80	0_3_0429ED80
Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	Code function: 0_3_0429ED80	0_3_0429ED80
Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	Code function: 0_3_0429ED80	0_3_0429ED80
Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	Code function: 0_3_0429ED80	0_3_0429ED80
Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	Code function: 0_3_0429ED80	0_3_0429ED80
Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	Code function: 0_3_0429ED80	0_3_0429ED80
Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	Code function: 0_3_0429ED80	0_3_0429ED80
Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	Code function: 0_3_0429ED80	0_3_0429ED80
Source: C:\Users\user\AppData\Local\Temp\SweetIMSetup.exe	Code function: 1_2_00432106	1_2_00432106
Source: C:\Users\user\AppData\Local\Temp\SweetIMSetup.exe	Code function: 1_2_0042C18D	1_2_0042C18D
Source: C:\Users\user\AppData\Local\Temp\SweetIMSetup.exe	Code function: 1_2_00428BF0	1_2_00428BF0
Source: C:\Users\user\AppData\Local\Temp\{A81A974F-8A22-43E6-9243-5198FF758DA1}\VistaCookiesCollector.exe	Code function: 5_2_00409C88	5_2_00409C88
Source: C:\Users\user\AppData\Local\Temp\{A81A974F-8A22-43E6-9243-5198FF758DA1}\VistaCookiesCollector.exe	Code function: 5_2_00406966	5_2_00406966
Source: C:\Users\user\AppData\Local\Temp\{A81A974F-8A22-43E6-9243-5198FF758DA1}\VistaCookiesCollector.exe	Code function: 5_2_00402580	5_2_00402580
Source: C:\Users\user\AppData\Local\Temp\{A81A974F-8A22-43E6-9243-5198FF758DA1}\VistaCookiesCollector.exe	Code function: 5_2_00404B7C	5_2_00404B7C
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Code function: 7_2_00492180	7_2_00492180
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Code function: 7_2_007B1360	7_2_007B1360
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Code function: 7_2_007CE660	7_2_007CE660
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Code function: 7_2_007CE7A0	7_2_007CE7A0
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Code function: 7_2_007CD950	7_2_007CD950
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Code function: 7_2_008110B8	7_2_008110B8
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Code function: 7_2_0080C3F4	7_2_0080C3F4
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Code function: 7_2_008098CC	7_2_008098CC
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Code function: 7_2_0080E9E8	7_2_0080E9E8
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Code function: 7_2_0080BB10	7_2_0080BB10
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Code function: 7_2_00812D90	7_2_00812D90
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Code function: 7_2_00808EBC	7_2_00808EBC
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Code function: 7_2_10012050	7_2_10012050
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Code function: 7_2_7C37DC27	7_2_7C37DC27
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Code function: 7_2_7C396FA7	7_2_7C396FA7

Found potential string decryption / allocating functions

Source: C:\Users\user\AppData\Local\Temp\{A81A974F-8A22-43E6-9243-5198FF758DA1}\VistaCookiesCollector.exe	Code function: String function: 00404B30 appears 35 times
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Code function: String function: 7C3630A4 appears 50 times
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Code function: String function: 0080451C appears 65 times
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Code function: String function: 008044F8 appears 34 times
Source: C:\Users\user\AppData\Local\Temp\SweetIMSetup.exe	Code function: String function: 00427498 appears 243 times

Sample file is different than original file name gathered from version info

Source: BundleSweetIMSetup.exe, 00000000.00000002.2071455802.0000000000401000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: P@...*OLESelfRegisterSpecialBuildProductVersionProductNamePrivateBuildOriginalFilenameLegalTrademarksLegalCopyrightInternalNameFileVersionFileDescriptionCompanyNameComments\VarFileInfo\TranslationUnknown@ vs BundleSweetIMSetup.exe
Source: BundleSweetIMSetup.exe, 00000000.00000002.2076548180.00000000042B6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemgToolbarIE.dll$ vs BundleSweetIMSetup.exe

Uses 32bit PE files

Source: BundleSweetIMSetup.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 1714110143_4764703_750.tmp.0.dr

Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: classification engine

Classification label: mal60.phis.spyw.winEXE@39/504@21/9

Source: C:\Users\user\AppData\Local\Temp\SweetIMSetup.exe	Code function: 1_2_00421166 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,	1_2_00421166
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Code function: 7_2_007CC720 ?AdjustToken@CShutDownManager@@AAE_N_N@Z,GetCurrentProcess,OpenProcessToken,GetLastError,_CxxThrowException,LookupPrivilegeValueW,GetLastError,_CxxThrowException,AdjustTokenPrivileges,GetLastError,_CxxThrowException,wsprintfW,MessageBoxW,CloseHandle,	7_2_007CC720
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Code function: 7_2_0081E15C GetCurrentProcess,OpenProcessToken,GetTokenInformation,LocalAlloc,GetTokenInformation,LookupPrivilegeValueA,LookupPrivilegeValueA,LookupPrivilegeValueA,AdjustTokenPrivileges,LocalFree,CloseHandle,FindCloseChangeNotification,	7_2_0081E15C
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Code function: 7_2_0081E143 GetCurrentProcess,OpenProcessToken,GetTokenInformation,LocalAlloc,GetTokenInformation,LookupPrivilegeValueA,LookupPrivilegeValueA,LookupPrivilegeValueA,AdjustTokenPrivileges,LocalFree,CloseHandle,FindCloseChangeNotification,	7_2_0081E143

Source: C:\Users\user\AppData\Local\Temp\SweetIMSetup.exe

Code function: 1_2_004207E4 LoadLibraryA,GetProcAddress,lstrcpyA,GetDiskFreeSpaceExA,GetDiskFreeSpaceA,FreeLibrary,

1_2_004207E4

Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe

Code function: 7_2_007BE200 ?URLEncode2@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@V12@K@Z,??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z,CoCreateInstance,??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,??_U@YAPAXI@Z,??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z,??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@G@Z,??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@G@Z,??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@G@Z,??_V@YAXPAX@Z,??_V@YAXPAX@Z,??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z,??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,

7_2_007BE200

Source: C:\Users\user\AppData\Local\Temp\SweetIMSetup.exe

Code function: 1_2_0040A454 FindResourceA,SizeofResource,LoadResource,LockResource,

1_2_0040A454

Source: C:\Windows\System32\msiexec.exe

File created: C:\Program Files (x86)\SweetIM

Jump to behavior

Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\track[1].htm

Jump to behavior

Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\{D564BB4E-74F6-4fd5-900A-313328F6DF9F}
Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\{EEE6C370-6118-11DC-9C72-001320C79847}

Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe

File created: C:\Users\user\AppData\Local\Temp\1714110139_4760671_41.tmp

Jump to behavior

Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe

File read: C:\Windows\win.ini

Jump to behavior

Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 48c209.msi.3.dr, 1714110143_4764703_750.tmp.0.dr, SweetIESetup.msi.8.dr, 48c20d.msi.3.dr, mgSqlite3.dll.4.dr, mgSqlite3.dll.3.dr, mgSqlite3.dll.10.dr	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
Source: 48c209.msi.3.dr, 1714110143_4764703_750.tmp.0.dr, SweetIESetup.msi.8.dr, 48c20d.msi.3.dr, mgSqlite3.dll.4.dr, mgSqlite3.dll.3.dr, mgSqlite3.dll.10.dr	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: 48c209.msi.3.dr, 1714110143_4764703_750.tmp.0.dr, SweetIESetup.msi.8.dr, 48c20d.msi.3.dr, mgSqlite3.dll.4.dr, mgSqlite3.dll.3.dr, mgSqlite3.dll.10.dr	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
Source: 48c209.msi.3.dr, 1714110143_4764703_750.tmp.0.dr, SweetIESetup.msi.8.dr, 48c20d.msi.3.dr, mgSqlite3.dll.4.dr, mgSqlite3.dll.3.dr, mgSqlite3.dll.10.dr	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
Source: 48c209.msi.3.dr, 1714110143_4764703_750.tmp.0.dr, SweetIESetup.msi.8.dr, 48c20d.msi.3.dr, mgSqlite3.dll.4.dr, mgSqlite3.dll.3.dr, mgSqlite3.dll.10.dr	Binary or memory string: CREATE TABLE "%w"."%w_node"(nodeno INTEGER PRIMARY KEY, data BLOB);CREATE TABLE "%w"."%w_rowid"(rowid INTEGER PRIMARY KEY, nodeno INTEGER);CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY, parentnode INTEGER);INSERT INTO '%q'.'%q_node' VALUES(1, zeroblob(%d))
Source: 1714110143_4764703_750.tmp.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: 1714110143_4764703_750.tmp.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: 1714110143_4764703_750.tmp.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: 1714110143_4764703_750.tmp.0.dr	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);name='%q'
Source: 48c209.msi.3.dr, 1714110143_4764703_750.tmp.0.dr, SweetIESetup.msi.8.dr, 48c20d.msi.3.dr, mgSqlite3.dll.4.dr, mgSqlite3.dll.3.dr, mgSqlite3.dll.10.dr	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: 1714110143_4764703_750.tmp.0.dr	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');sqlite_sequence
Source: 48c209.msi.3.dr, 1714110143_4764703_750.tmp.0.dr, SweetIESetup.msi.8.dr, 48c20d.msi.3.dr, mgSqlite3.dll.4.dr, mgSqlite3.dll.3.dr, mgSqlite3.dll.10.dr	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: 1714110143_4764703_750.tmp.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: 48c209.msi.3.dr, 1714110143_4764703_750.tmp.0.dr, SweetIESetup.msi.8.dr, 48c20d.msi.3.dr, mgSqlite3.dll.4.dr, mgSqlite3.dll.3.dr, mgSqlite3.dll.10.dr	Binary or memory string: SELECT 'DELETE FROM vacuum_db.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'
Source: 1714110143_4764703_750.tmp.0.dr	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;U

Source: BundleSweetIMSetup.exe	ReversingLabs: Detection: 50%
Source: BundleSweetIMSetup.exe	Virustotal: Detection: 37%

Source: BundleSweetIMSetup.exe	String found in binary or memory: user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);
Source: BundleSweetIMSetup.exe	String found in binary or memory: "web_app":{"app_id":{"install_url":{"aghbiahbpaijignceidepookljebhfak":["https://drive.google.com/drive/installwebapp?usp=chrome_d
Source: BundleSweetIMSetup.exe	String found in binary or memory: edpiccmgmieda":{"cohort":"1::","cohortname":"","dlrc":6120,"installdate":6120,"pf":"dcb37f49-aa68-4ebc-a8d4-14eaa556e331"}}},"web_app":{"app_id":{"install_url":{"aghbiahbpaijignceidepookljebhfak":["https://drive.google.com/drive/installwebapp?usp=chrome_defaul
Source: BundleSweetIMSetup.exe	String found in binary or memory: 8f88011f783"); user_pref("app.update.auto.migrated", true); user_pref("app.update.background.rolledout", true); user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0); user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830)
Source: BundleSweetIMSetup.exe	String found in binary or memory: "],"agimnkijcaahngcdmfeangaknmldooml":["https://www.youtube.com/s/notifications/manifest/cr_install.html"],"fhihpiojkbmbpdjeoajapmgkhlnakfjf":["https://docs.google.com/spreadsheets/installwebapp?usp=chrome_default"],"fmgjjmmmlfnkbppncabfkddbjimcfncm":["https:/
Source: BundleSweetIMSetup.exe	String found in binary or memory: mail.google.com/mail/installwebapp?usp=chrome_default"],"kefjledonklijopmnomlcbpllchaibag":["https://docs.google.com/presentation/installwebapp?usp=chrome_default"],"mpnpojknpmmopombnjdcgaaiekajbnjb":["https://docs.google.com/document/installwebapp?usp=chrome_
Source: BundleSweetIMSetup.exe	String found in binary or memory: japmgkhlnakfjf":["https://docs.google.com/spreadsheets/installwebapp?usp=chrome_default"],"fmgjjmmmlfnkbppncabfkddbjimcfncm":["htt
Source: BundleSweetIMSetup.exe	String found in binary or memory: s://mail.google.com/mail/installwebapp?usp=chrome_default"],"kefjledonklijopmnomlcbpllchaibag":["https://docs.google.com/presentat
Source: BundleSweetIMSetup.exe	String found in binary or memory: on/installwebapp?usp=chrome_default"],"mpnpojknpmmopombnjdcgaaiekajbnjb":["https://docs.google.com/document/installwebapp?usp=chro
Source: BundleSweetIMSetup.exe	String found in binary or memory: om/spreadsheets/installwebapp?usp=chrome_default"],"fmgjjmmmlfnkbppncabfkddbjimcfncm":["https://mail.google.com/mail/installwebapp
Source: BundleSweetIMSetup.exe	String found in binary or memory: 3-bf01-28f88011f783"); user_pref("app.update.auto.migrated", true); user_pref("app.update.background.rolledout", true); user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0); user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 169
Source: BundleSweetIMSetup.exe	String found in binary or memory: usp=chrome_default"],"kefjledonklijopmnomlcbpllchaibag":["https://docs.google.com/presentation/installwebapp?usp=chrome_default"],
Source: BundleSweetIMSetup.exe	String found in binary or memory: hbiahbpaijignceidepookljebhfak":["https://drive.google.com/drive/installwebapp?usp=chrome_default"],"agimnkijcaahngcdmfeangaknmldo
Source: BundleSweetIMSetup.exe	String found in binary or memory: mpnpojknpmmopombnjdcgaaiekajbnjb":["https://docs.google.com/document/installwebapp?usp=chrome_default"]}}},"web_apps":{"did_migrat
Source: BundleSweetIMSetup.exe	String found in binary or memory: eanup-thumbnails", 0); user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830); user_pr
Source: BundleSweetIMSetup.exe	String found in binary or memory: pdateTime.browser-cleanup-thumbnails", 0); user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1

Source: unknown	Process created: C:\Users\user\Desktop\BundleSweetIMSetup.exe "C:\Users\user\Desktop\BundleSweetIMSetup.exe"
Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	Process created: C:\Users\user\AppData\Local\Temp\SweetIMSetup.exe /s /w /v" /qn SIMHP=0 SIMSP=0 "
Source: C:\Users\user\AppData\Local\Temp\SweetIMSetup.exe	Process created: C:\Windows\SysWOW64\msiexec.exe MSIEXEC.EXE /i "C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B}\SweetIMSetup.msi" /qn SIMHP=0 SIMSP=0 SETUPEXEDIR="C:\Users\user\AppData\Local\Temp"
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding A265C8E8A3BB4B1A10A4D9F720E583B6
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Users\user\AppData\Local\Temp\{A81A974F-8A22-43E6-9243-5198FF758DA1}\VistaCookiesCollector.exe C:\Users\user\AppData\Local\Temp\{A81A974F-8A22-43E6-9243-5198FF758DA1}\VistaCookiesCollector.exe http://sweetim.com,C:\Users\user\AppData\LocalLow\simcookies.dat
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe "C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe" -AutoStartIM
Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	Process created: C:\Users\user\AppData\Local\Temp\SweetIESetup.exe /s /w /v" /qn SIMOB=0 SIMADDREGIE={UserSelectedHP=1,UserSelectedDS=1} "
Source: C:\Users\user\AppData\Local\Temp\SweetIESetup.exe	Process created: C:\Windows\SysWOW64\msiexec.exe MSIEXEC.EXE /i "C:\Users\user\AppData\Local\Temp\{B3CA5B4C-F637-458C-81D6-CD8DADBE9841}\SweetIESetup.msi" /qn SIMOB=0 SIMADDREGIE={UserSelectedHP=1,UserSelectedDS=1} SETUPEXEDIR="C:\Users\user\AppData\Local\Temp"
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding F0CC6D3E1A3C8837D5C7D007B45C879F
Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://www.sweetim.com/installbar.asp?barid={C598706C-038F-11EF-8C2C-ECF4BBEA1588}
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1960,i,7459701528248846225,13626864308159879949,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	Process created: C:\Users\user\AppData\Local\Temp\SweetIMSetup.exe /s /w /v" /qn SIMHP=0 SIMSP=0 "	Jump to behavior
Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	Process created: C:\Users\user\AppData\Local\Temp\SweetIESetup.exe /s /w /v" /qn SIMOB=0 SIMADDREGIE={UserSelectedHP=1,UserSelectedDS=1} "	Jump to behavior
Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://www.sweetim.com/installbar.asp?barid={C598706C-038F-11EF-8C2C-ECF4BBEA1588}	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SweetIMSetup.exe	Process created: C:\Windows\SysWOW64\msiexec.exe MSIEXEC.EXE /i "C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B}\SweetIMSetup.msi" /qn SIMHP=0 SIMSP=0 SETUPEXEDIR="C:\Users\user\AppData\Local\Temp"	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding A265C8E8A3BB4B1A10A4D9F720E583B6	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding F0CC6D3E1A3C8837D5C7D007B45C879F	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Users\user\AppData\Local\Temp\{A81A974F-8A22-43E6-9243-5198FF758DA1}\VistaCookiesCollector.exe C:\Users\user\AppData\Local\Temp\{A81A974F-8A22-43E6-9243-5198FF758DA1}\VistaCookiesCollector.exe http://sweetim.com,C:\Users\user\AppData\LocalLow\simcookies.dat	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe "C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe" -AutoStartIM	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SweetIESetup.exe	Process created: C:\Windows\SysWOW64\msiexec.exe MSIEXEC.EXE /i "C:\Users\user\AppData\Local\Temp\{B3CA5B4C-F637-458C-81D6-CD8DADBE9841}\SweetIESetup.msi" /qn SIMOB=0 SIMADDREGIE={UserSelectedHP=1,UserSelectedDS=1} SETUPEXEDIR="C:\Users\user\AppData\Local\Temp"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1960,i,7459701528248846225,13626864308159879949,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	Section loaded: windows.shell.servicehostbuilder.dll	Jump to behavior
Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SweetIMSetup.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SweetIMSetup.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SweetIMSetup.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SweetIMSetup.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SweetIMSetup.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SweetIMSetup.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SweetIMSetup.exe	Section loaded: msvcr71.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msvcr71.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{A81A974F-8A22-43E6-9243-5198FF758DA1}\VistaCookiesCollector.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{A81A974F-8A22-43E6-9243-5198FF758DA1}\VistaCookiesCollector.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{A81A974F-8A22-43E6-9243-5198FF758DA1}\VistaCookiesCollector.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{A81A974F-8A22-43E6-9243-5198FF758DA1}\VistaCookiesCollector.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{A81A974F-8A22-43E6-9243-5198FF758DA1}\VistaCookiesCollector.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{A81A974F-8A22-43E6-9243-5198FF758DA1}\VistaCookiesCollector.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{A81A974F-8A22-43E6-9243-5198FF758DA1}\VistaCookiesCollector.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{A81A974F-8A22-43E6-9243-5198FF758DA1}\VistaCookiesCollector.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{A81A974F-8A22-43E6-9243-5198FF758DA1}\VistaCookiesCollector.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{A81A974F-8A22-43E6-9243-5198FF758DA1}\VistaCookiesCollector.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{A81A974F-8A22-43E6-9243-5198FF758DA1}\VistaCookiesCollector.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{A81A974F-8A22-43E6-9243-5198FF758DA1}\VistaCookiesCollector.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{A81A974F-8A22-43E6-9243-5198FF758DA1}\VistaCookiesCollector.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{A81A974F-8A22-43E6-9243-5198FF758DA1}\VistaCookiesCollector.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{A81A974F-8A22-43E6-9243-5198FF758DA1}\VistaCookiesCollector.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{A81A974F-8A22-43E6-9243-5198FF758DA1}\VistaCookiesCollector.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Section loaded: mgupdatesupport.dll	Jump to behavior
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Section loaded: mgcommon.dll	Jump to behavior
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Section loaded: mgconfig.dll	Jump to behavior
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Section loaded: mgadaptersproxy.dll	Jump to behavior
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Section loaded: msvcp71.dll	Jump to behavior
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Section loaded: msvcr71.dll	Jump to behavior
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Section loaded: mgsimcommon.dll	Jump to behavior
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Section loaded: mgcommunication.dll	Jump to behavior
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Section loaded: mgcommon.dll	Jump to behavior
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Section loaded: mghooking.dll	Jump to behavior
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Section loaded: mgxml_wrapper.dll	Jump to behavior
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Section loaded: mgconfig.dll	Jump to behavior
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Section loaded: msvcp71.dll	Jump to behavior
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Section loaded: msvcr71.dll	Jump to behavior
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Section loaded: msvcr71.dll	Jump to behavior
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Section loaded: mgxml_wrapper.dll	Jump to behavior
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SweetIESetup.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SweetIESetup.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SweetIESetup.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SweetIESetup.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SweetIESetup.exe	Section loaded: msvcr71.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SweetIESetup.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SweetIESetup.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msvcr71.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msvcr71.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mgsimcommon.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mgcommon.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mgconfig.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mghooking.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mghelper.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mgcommon.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mgxml_wrapper.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msxml3.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mlang.dll

Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{304CE942-6E39-40D8-943A-B913C40C9CD4}\InprocServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\SweetIMSetup.exe

File written: C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B}\Setup.INI

Jump to behavior

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Found installer window with terms and condition text

Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe

PE / OLE file has a valid certificate

Source: BundleSweetIMSetup.exe

Static PE information: certificate valid

Submission file is bigger than most known malware samples

Source: BundleSweetIMSetup.exe

Static file information: File size 4666160 > 1048576

Uses new MSVCR Dlls

Source: C:\Users\user\AppData\Local\Temp\SweetIMSetup.exe

File opened: C:\Program Files (x86)\SweetIM\Messenger\MSVCR71.dll

Jump to behavior

PE file has a big raw section

Source: BundleSweetIMSetup.exe

Static PE information: Raw size of UPX1 is bigger than: 0x100000 < 0x465200

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: BundleSweetIMSetup.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Binary contains paths to debug symbols

Source:	Binary string: c:\Imvent\Develop\Client\vc\output\release\mgconfig.pdb source: mgconfig.dll0.3.dr
Source:	Binary string: C:\Imvent\Develop\Client\vc\SweetSDM\Release\SweetSDM.pdb source: BundleSweetIMSetup.exe, 00000000.00000002.2071455802.0000000000401000.00000040.00000001.01000000.00000003.sdmp
Source:	Binary string: c:\Imvent\Develop\Client\vc\Toolbar\Release_bin\mgHelper.pdbh source: mgHelper.dll.3.dr
Source:	Binary string: c:\SimOlderVersions\SIM 3.6\Client\vc\output\Release\mgICQMessengerAdapter.pdb source: mgICQMessengerAdapter.dll.3.dr
Source:	Binary string: c:\Imvent\Develop\Client\vc\output\release\mghooking.pdb source: mghooking.dll0.3.dr
Source:	Binary string: c:\Imvent\Develop\Client\vc\output\release\mghooking.pdb source: mghooking.dll0.3.dr
Source:	Binary string: c:\Imvent\Develop\Client\vc\Toolbar\Release_bin\mgHelper.pdb source: mgHelper.dll.3.dr
Source:	Binary string: msvcp71.pdb source: SweetIM.exe, SweetIM.exe, 00000007.00000002.1895639481.000000007C3C1000.00000020.00000001.01000000.00000010.sdmp, msvcp71.dll.3.dr
Source:	Binary string: c:\Imvent\Develop\Client\vc\Toolbar\output\release\mgToolbarProxy.pdb source: mgToolbarProxy.dll.3.dr
Source:	Binary string: c:\SimOlderVersions\SIM 3.6\Client\vc\output\release\mgICQAuto.pdb source: mgICQAuto.dll.3.dr
Source:	Binary string: C:\Imvent\Develop\Client\vc\SweetSDM\Release\SweetSDM.pdb@ source: BundleSweetIMSetup.exe, 00000000.00000002.2071455802.0000000000401000.00000040.00000001.01000000.00000003.sdmp
Source:	Binary string: msvcr71.pdb source: SweetIMSetup.exe, 00000001.00000002.1844516312.000000007C361000.00000020.00000001.01000000.00000011.sdmp, SweetIM.exe, SweetIM.exe, 00000007.00000002.1895440500.000000007C361000.00000020.00000001.01000000.00000011.sdmp

Data Obfuscation

Contains functionality to dynamically determine API calls

Source: C:\Users\user\AppData\Local\Temp\SweetIMSetup.exe

Code function: 1_2_004101BC __EH_prolog,lstrcpyA,lstrcpyA,lstrcpyA,LoadLibraryA,GetProcAddress,FreeLibrary,

1_2_004101BC

PE file contains sections with non-standard names

Source: 1714110143_4764703_750.tmp.0.dr	Static PE information: section name: .stab
Source: 1714110143_4764703_750.tmp.0.dr	Static PE information: section name: .stabstr
Source: mgAdaptersProxy.dll.3.dr	Static PE information: section name: .SHARDAT
Source: mgAdaptersProxy.dll.3.dr	Static PE information: section name: .SHARDAT
Source: mgHelper.dll.3.dr	Static PE information: section name: .SHARED
Source: mgToolbarIE.dll.3.dr	Static PE information: section name: .SHARED

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\AppData\Local\Temp\SweetIMSetup.exe	Code function: 1_2_00427498 push eax; ret	1_2_004274B6
Source: C:\Users\user\AppData\Local\Temp\SweetIMSetup.exe	Code function: 1_2_00427BC0 push eax; ret	1_2_00427BEE
Source: C:\Users\user\AppData\Local\Temp\{A81A974F-8A22-43E6-9243-5198FF758DA1}\VistaCookiesCollector.exe	Code function: 5_2_00405940 push eax; ret	5_2_00405954
Source: C:\Users\user\AppData\Local\Temp\{A81A974F-8A22-43E6-9243-5198FF758DA1}\VistaCookiesCollector.exe	Code function: 5_2_00405940 push eax; ret	5_2_0040597C
Source: C:\Users\user\AppData\Local\Temp\{A81A974F-8A22-43E6-9243-5198FF758DA1}\VistaCookiesCollector.exe	Code function: 5_2_00404B6B push ecx; ret	5_2_00404B7B
Source: C:\Users\user\AppData\Local\Temp\{A81A974F-8A22-43E6-9243-5198FF758DA1}\VistaCookiesCollector.exe	Code function: 5_2_0040AF14 push eax; ret	5_2_0040AF32
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Code function: 7_2_004080D7 push ecx; ret	7_2_004080E7
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Code function: 7_2_00485987 push ecx; ret	7_2_00485997
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Code function: 7_2_0049306F push ecx; ret	7_2_0049307F
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Code function: 7_2_00492CF0 push eax; ret	7_2_00492D04
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Code function: 7_2_00492CF0 push eax; ret	7_2_00492D2C
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Code function: 7_2_004A35E7 push ecx; ret	7_2_004A35F7
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Code function: 7_2_004C4610 push eax; ret	7_2_004C4624
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Code function: 7_2_004C4610 push eax; ret	7_2_004C464C
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Code function: 7_2_004C48EF push ecx; ret	7_2_004C48FF
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Code function: 7_2_004D7763 push ecx; ret	7_2_004D7773
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Code function: 7_2_007D407B push ecx; ret	7_2_007D408B
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Code function: 7_2_007D3C70 push eax; ret	7_2_007D3C84
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Code function: 7_2_007D3C70 push eax; ret	7_2_007D3CAC
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Code function: 7_2_007BCF50 push ecx; mov dword ptr [esp], 00000000h	7_2_007BCF66
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Code function: 7_2_0080D0D8 push 0080D104h; ret	7_2_0080D0FC
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Code function: 7_2_008080E0 push 00808133h; ret	7_2_0080812B
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Code function: 7_2_00807060 push 0080708Ch; ret	7_2_00807084
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Code function: 7_2_00808138 push 00808165h; ret	7_2_0080815D
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Code function: 7_2_0081E4A0 push 0081E533h; ret	7_2_0081E52B
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Code function: 7_2_008055E4 push 00805635h; ret	7_2_0080562D
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Code function: 7_2_0081E538 push 0081E56Ch; ret	7_2_0081E564
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Code function: 7_2_0081E63C push 0081E662h; ret	7_2_0081E65A
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Code function: 7_2_0080589E push 008058CCh; ret	7_2_008058C4
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Code function: 7_2_008058A0 push 008058CCh; ret	7_2_008058C4
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Code function: 7_2_008058D8 push 00805904h; ret	7_2_008058FC

Source: msvcr90.dll.3.dr

Static PE information: section name: .text entropy: 6.922045894978299

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Persistence and Installation Behavior

Drops PE files

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID16F.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\SweetIM\Messenger\mgAdaptersProxy.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\Microsoft.VC90.CRT\msvcm90.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\Microsoft.VC90.CRT\msvcp90.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgcommon.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\SweetIM\Messenger\ContentPackagesActivationHandler.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\SweetIM\Messenger\mgcommunication.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarProxy.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgxml_wrapper.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIF889.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\SweetIM\Messenger\mgICQAuto.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\SweetIM\Messenger\mgYahooAuto.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgconfig.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\SweetIM\Messenger\mgUpdateSupport.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\SweetIM\Messenger\msvcr71.dll	Jump to dropped file
Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	File created: C:\Users\user\AppData\Local\Temp\1714110143_4764703_750.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgsimcommon.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIDA99.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIC4F8.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	File created: C:\Users\user\AppData\Local\Temp\sqlite3.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIF7EB.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mglogger.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID2C8.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\SweetIM\Messenger\mgArchive.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\SweetIM\Messenger\mgsimcommon.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\SweetIM\Messenger\mgMsnAuto.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgHelperApp.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIEB08.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\{A7BC02AF-1128-4A31-BCF8-1A3EE803D3B3}\mgSqlite3.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\Microsoft.VC90.CRT\msvcr90.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\SweetIM\Messenger\mgMediaPlayer.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIEAC8.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID25A.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\ClearHist.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIC380.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\SweetIM\Messenger\mgcommon.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\SweetIM\Messenger\mgconfig.dll	Jump to dropped file
Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	File created: C:\Users\user\AppData\Local\Temp\SweetIESetup.exe (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	File created: C:\Users\user\AppData\Local\Temp\1714110143_4764500_750.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIEF30.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\SweetIM\Messenger\mgICQMessengerAdapter.dll	Jump to dropped file
Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	File created: C:\Users\user\AppData\Local\Temp\1714110143_4764625_750.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\SweetIM\Messenger\mgSweetIM.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\{A81A974F-8A22-43E6-9243-5198FF758DA1}\VistaCookiesCollector.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIC547.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIF8B9.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\SweetIM\Messenger\mgYahooMessengerAdapter.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\SweetIM\Messenger\mglogger.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIE99E.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\SweetIM\Messenger\mgFlashPlayer.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mghooking.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\SweetIM\Messenger\mgxml_wrapper.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\{A81A974F-8A22-43E6-9243-5198FF758DA1}\mgSqlite3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	File created: C:\Users\user\AppData\Local\Temp\SweetIMSetup.exe (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\SweetIM\Messenger\mghooking.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\SweetIM\Messenger\msvcp71.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgHelper.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\SweetIM\Messenger\resources\sqlite\mgSqlite3.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\SweetIM\Messenger\mgMsnMessengerAdapter.dll	Jump to dropped file

Drops PE files to the windows directory (C:\Windows)

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIC547.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIEB08.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID16F.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIF8B9.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIEAC8.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIDA99.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID25A.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIE99E.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIC380.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIC4F8.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIF7EB.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIF889.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIEF30.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID2C8.tmp	Jump to dropped file

Boot Survival

Creates an undocumented autostart registry key

Source: C:\Windows\SysWOW64\msiexec.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Toolbar {EEE6C35B-6118-11DC-9C72-001320C79847}
Source: C:\Windows\SysWOW64\msiexec.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Toolbar {EEE6C35B-6118-11DC-9C72-001320C79847}
Source: C:\Windows\SysWOW64\msiexec.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847} NULL
Source: C:\Windows\SysWOW64\msiexec.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847} NULL
Source: C:\Windows\SysWOW64\msiexec.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847} NoExplorer
Source: C:\Windows\SysWOW64\msiexec.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847} NoExplorer

Source: C:\Windows\System32\msiexec.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run SweetIM			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run SweetIM			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Extensive use of GetProcAddress (often used to hide API calls)

Source: C:\Users\user\AppData\Local\Temp\SweetIMSetup.exe

Code function: 1_2_00422B9D LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

1_2_00422B9D

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SweetIMSetup.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SweetIMSetup.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SweetIMSetup.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SweetIMSetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SweetIMSetup.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SweetIMSetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SweetIMSetup.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SweetIMSetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SweetIMSetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SweetIMSetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SweetIESetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SweetIESetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SweetIESetup.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SweetIESetup.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SweetIESetup.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SweetIESetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SweetIESetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SweetIESetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found dropped PE file which has not been started or loaded

Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\SweetIM\Messenger\mgArchive.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgHelperApp.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\SweetIM\Messenger\mgMsnAuto.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIEB08.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSID16F.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{A7BC02AF-1128-4A31-BCF8-1A3EE803D3B3}\mgSqlite3.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\Microsoft.VC90.CRT\msvcr90.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\SweetIM\Messenger\mgMediaPlayer.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\Microsoft.VC90.CRT\msvcp90.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\Microsoft.VC90.CRT\msvcm90.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIEAC8.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSID25A.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\ClearHist.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\SweetIM\Messenger\ContentPackagesActivationHandler.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIC380.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarProxy.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIF889.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\SweetIM\Messenger\mgYahooAuto.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\SweetIM\Messenger\mgICQAuto.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIEF30.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\SweetIM\Messenger\mgICQMessengerAdapter.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\SweetIM\Messenger\mgSweetIM.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIC547.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIF8B9.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1714110143_4764703_750.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\SweetIM\Messenger\mglogger.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\SweetIM\Messenger\mgYahooMessengerAdapter.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIDA99.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIE99E.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\SweetIM\Messenger\mgFlashPlayer.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{A81A974F-8A22-43E6-9243-5198FF758DA1}\mgSqlite3.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIC4F8.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\sqlite3.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIF7EB.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mglogger.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\SweetIM\Messenger\resources\sqlite\mgSqlite3.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSID2C8.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\SweetIM\Messenger\mgMsnMessengerAdapter.dll	Jump to dropped file

Found evaded block containing many API calls

Source: C:\Users\user\AppData\Local\Temp\SweetIMSetup.exe	Evaded block: after key decision			graph_1-26880
Source: C:\Users\user\AppData\Local\Temp\SweetIMSetup.exe	Evaded block: after key decision			graph_1-27128

Found evasive API chain (may stop execution after checking a module file name)

Source: C:\Users\user\AppData\Local\Temp\{A81A974F-8A22-43E6-9243-5198FF758DA1}\VistaCookiesCollector.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess

graph_5-5967

Found evasive API chain checking for process token information

Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_7-50729

Found large amount of non-executed APIs

Source: C:\Users\user\AppData\Local\Temp\{A81A974F-8A22-43E6-9243-5198FF758DA1}\VistaCookiesCollector.exe	API coverage: 6.0 %
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	API coverage: 3.7 %

Source: C:\Users\user\AppData\Local\Temp\SweetIMSetup.exe	File Volume queried: C:\Users\user\AppData\Local\Temp FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SweetIESetup.exe	File Volume queried: C:\Users\user\AppData\Local\Temp FullSizeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\SweetIMSetup.exe	Code function: 1_2_00413D18 __EH_prolog,GetTempPathA,FindFirstFileA,CompareFileTime,DeleteFileA,FindNextFileA,FindClose,	1_2_00413D18
Source: C:\Users\user\AppData\Local\Temp\SweetIMSetup.exe	Code function: 1_2_00422D97 CreateEventA,GetProcAddress,SearchPathA,GetModuleFileNameA,FindFirstFileA,VirtualProtect,VirtualQuery,VirtualProtect,VirtualProtect,FindClose,FindClose,	1_2_00422D97
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Code function: 7_2_007B36A0 _IsDirectoryEmpty@4,wcslen,??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z,??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z,??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z,FindFirstFileW,wcscmp,wcscmp,wcscmp,FindNextFileW,FindClose,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,	7_2_007B36A0
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Code function: 7_2_007B3800 DeleteFolder,wcslen,IsDirectoryFile,wcscpy,PathAddBackslashW,PathAddExtensionW,FindFirstFileW,FindNextFileW,wcscpy,PathAddBackslashW,wcscat,DeleteFileW,DeleteFolder,FindClose,RemoveDirectoryW,	7_2_007B3800
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Code function: 7_2_10007070 ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,RegQueryValueExW,wcslen,wcscat,_IsFileExist@4,??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z,RegCloseKey,?GetShellFolderPath@@YG?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@PBG@Z,??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z,?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ,_IsFileExist@4,??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,RegQueryValueExW,??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z,wcslen,??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z,?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ,wcscpy,PathStripPathW,wcslen,wcslen,wcslen,?erase@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@II@Z,?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBG@Z,?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ,FindFirstFileW,??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z,FindClose,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,?find@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGI@Z,?npos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@2IB,wcslen,?erase@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@II@Z,??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z,?SplitString@@YAHABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@0AAV?$vector@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@V?$allocator@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@2@@2@H@Z,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ,_wtoi,_wtoi,?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ,_wtoi,?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ,_wtoi,?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ,_wtoi,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,	7_2_10007070
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Code function: 7_2_7C378DFA _wstat,wcspbrk,_errno,__doserrno,towlower,_getdrive,FindFirstFileW,wcspbrk,_wfullpath,wcslen,GetDriveTypeW,_errno,__doserrno,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FindClose,GetLastError,FindClose,	7_2_7C378DFA
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Code function: 7_2_7C376DCB _findfirst64,FindFirstFileA,GetLastError,_errno,_errno,_errno,strcpy,	7_2_7C376DCB
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Code function: 7_2_7C377ED3 _stat,_mbspbrk,_errno,__doserrno,_mbctolower,_getdrive,FindFirstFileA,_mbspbrk,_fullpath,strlen,GetDriveTypeA,_errno,__doserrno,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FindClose,GetLastError,FindClose,	7_2_7C377ED3
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Code function: 7_2_7C376FD6 _findfirsti64,FindFirstFileA,GetLastError,_errno,_errno,_errno,strcpy,	7_2_7C376FD6

Source: C:\Users\user\AppData\Local\Temp\SweetIMSetup.exe

Code function: 1_2_0041AD16 GetVersionExA,GetSystemInfo,

1_2_0041AD16

Source: VistaCookiesCollector.exe, 00000005.00000002.1791302329.00000000004DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll7
Source: BundleSweetIMSetup.exe, 00000000.00000003.1726120393.0000000002A54000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1736669295.0000000002A54000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.2068998373.0000000000F01000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000002.2073522009.0000000000F01000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.2064156782.0000000002A54000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.2066491581.0000000002A54000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1731561853.0000000002A54000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1712185619.0000000000F4E000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1969287489.0000000000F4E000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.2068807066.0000000002A54000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: BundleSweetIMSetup.exe, 00000000.00000003.1726120393.0000000002A54000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1736669295.0000000002A54000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.2064156782.0000000002A54000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.2066491581.0000000002A54000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1731561853.0000000002A54000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.2068807066.0000000002A54000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000002.2074530070.0000000002A54000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1712010420.0000000002A54000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1720707154.0000000002A54000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.2061543965.0000000002A54000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW&
Source: SweetIM.exe, 00000007.00000002.1893598487.0000000000516000.00000004.00000020.00020000.00000000.sdmp, SweetIM.exe, 00000007.00000003.1892322214.0000000000516000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\AppData\Local\Temp\{A81A974F-8A22-43E6-9243-5198FF758DA1}\VistaCookiesCollector.exe	API call chain: ExitProcess graph end node	graph_5-5969
Source: C:\Users\user\AppData\Local\Temp\{A81A974F-8A22-43E6-9243-5198FF758DA1}\VistaCookiesCollector.exe	API call chain: ExitProcess graph end node	graph_5-5952
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	API call chain: ExitProcess graph end node	graph_7-50628
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	API call chain: ExitProcess graph end node	graph_7-50709
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	API call chain: ExitProcess graph end node	graph_7-50294

Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Source: C:\Users\user\AppData\Local\Temp\SweetIMSetup.exe

Code function: 1_2_00404DE4 GetProcessHeap,LdrInitializeThunk,

1_2_00404DE4

Contains functionality to dynamically determine API calls

Source: C:\Users\user\AppData\Local\Temp\SweetIMSetup.exe

Code function: 1_2_004101BC __EH_prolog,lstrcpyA,lstrcpyA,lstrcpyA,LoadLibraryA,GetProcAddress,FreeLibrary,

1_2_004101BC

Contains functionality to read the PEB

Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Code function: 7_2_00817534 mov eax, dword ptr fs:[00000030h]	7_2_00817534
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Code function: 7_2_008179F5 mov eax, dword ptr fs:[00000030h]	7_2_008179F5
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Code function: 7_2_00817A00 mov eax, dword ptr fs:[00000030h]	7_2_00817A00
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Code function: 7_2_0080BDBC mov eax, dword ptr fs:[00000030h]	7_2_0080BDBC

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Source: C:\Users\user\AppData\Local\Temp\SweetIMSetup.exe

Code function: 1_2_00404008 GetFileSize,GetProcessHeap,GetProcessHeap,RtlAllocateHeap,ReadFile,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

1_2_00404008

Source: C:\Users\user\AppData\Local\Temp\SweetIMSetup.exe	Code function: 1_2_0042E90F SetUnhandledExceptionFilter,	1_2_0042E90F
Source: C:\Users\user\AppData\Local\Temp\SweetIMSetup.exe	Code function: 1_2_0042E921 SetUnhandledExceptionFilter,	1_2_0042E921
Source: C:\Users\user\AppData\Local\Temp\{A81A974F-8A22-43E6-9243-5198FF758DA1}\VistaCookiesCollector.exe	Code function: 5_2_0040480E SetUnhandledExceptionFilter,	5_2_0040480E
Source: C:\Users\user\AppData\Local\Temp\{A81A974F-8A22-43E6-9243-5198FF758DA1}\VistaCookiesCollector.exe	Code function: 5_2_004047FA SetUnhandledExceptionFilter,	5_2_004047FA

HIPS / PFW / Operating System Protection Evasion

Creates a process in suspended mode (likely to inject code)

Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://www.sweetim.com/installbar.asp?barid={C598706C-038F-11EF-8C2C-ECF4BBEA1588}			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe "C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe" -AutoStartIM			Jump to behavior

Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe

Code function: 7_2_007B66A0 ?init@CMutex@@QAEXPAG@Z,??0CWinOsInfo@@QAE@XZ,?IsVistaOrLater@CWinOsInfo@@QBE_NXZ,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,ConvertStringSecurityDescriptorToSecurityDescriptorW,GetSecurityDescriptorSacl,SetSecurityDescriptorSacl,CreateMutexW,CreateMutexW,CreateMutexW,GetLastError,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateMutexW,GetLastError,GetLastError,wsprintfW,??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z,??0CErrException@@QAE@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z,??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z,??_7CErrException@@6B@,_CxxThrowException,??1CWinOsInfo@@UAE@XZ,

7_2_007B66A0

Source: C:\Users\user\AppData\Local\Temp\SweetIMSetup.exe

Code function: 1_2_0042123B GetCurrentThread,OpenThreadToken,GetLastError,GetLastError,GetCurrentProcess,OpenProcessToken,GetLastError,GetTokenInformation,GetTokenInformation,GetLastError,GetTokenInformation,AllocateAndInitializeSid,EqualSid,FreeSid,

1_2_0042123B

Source: BundleSweetIMSetup.exe, BundleSweetIMSetup.exe, 00000000.00000003.1731380441.00000000042BB000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1731472873.00000000042C0000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1941087262.00000000042AC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: SweetIMSetup.exe, SweetIMSetup.exe, 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmp, SweetIMSetup.exe, 00000001.00000000.1745279311.000000000043D000.00000008.00000001.01000000.0000000A.sdmp, SweetIESetup.exe, 00000008.00000002.1913355012.000000000043D000.00000008.00000001.01000000.00000017.sdmp	Binary or memory string: Shell_TrayWnd
Source: BundleSweetIMSetup.exe, 00000000.00000003.1918020280.000000000429D000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1917921416.0000000004296000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager!V
Source: BundleSweetIMSetup.exe, 00000000.00000002.2071455802.000000000045F000.00000040.00000001.01000000.00000003.sdmp, SweetIMSetup.exe, 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmp, SweetIMSetup.exe, 00000001.00000000.1745279311.000000000043D000.00000008.00000001.01000000.0000000A.sdmp	Binary or memory string: %sSetupLogFileNameSoftware\InstallShield\ISWI\7.0\SetupExeLogShell_TrayWndSplashTimeTahomaCancelMsi.dll%x,ALLCANCELDescriptionTitleMSlovenianBasquedefault%#04x0x0409.iniNoSuppressRebootKeyDotNetOptionalInstallIfSilentDotNetOptionalSETUPEXEDIRCertKeyCacheFolderCacheRootLocationTypeSuppressWrongOSSuppressReboot%.2lx" 00000000000000000000000000000000AM_OTP#xAM_CONTENTID="This program cannot be run in DOS mode.toys::file

Language, Device and Operating System Detection

Contains functionality to query CPU information (cpuid)

Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe

Code function: 7_2_0080D74C cpuid

7_2_0080D74C

Contains functionality to query locales information (e.g. system language)

Source: C:\Users\user\AppData\Local\Temp\SweetIMSetup.exe	Code function: GetLocaleInfoA,	1_2_004213BE
Source: C:\Users\user\AppData\Local\Temp\SweetIMSetup.exe	Code function: GetLocaleInfoA,TranslateCharsetInfo,	1_2_00421361
Source: C:\Users\user\AppData\Local\Temp\{A81A974F-8A22-43E6-9243-5198FF758DA1}\VistaCookiesCollector.exe	Code function: GetLocaleInfoA,	5_2_00408CF8
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Code function: GetLocaleInfoA,	7_2_00805570
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Code function: ??0CWinOsInfo@@QAE@XZ,?GetPlatformId@CWinOsInfo@@QBEKXZ,?GetMajor@CWinOsInfo@@QBEKXZ,?GetMinor@CWinOsInfo@@QBEKXZ,?GetCSDString@CWinOsInfo@@QBEPBGXZ,??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z,wsprintfW,wsprintfW,??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z,wsprintfW,??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z,wsprintfW,??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z,??1CWinOsInfo@@UAE@XZ,GetLocaleInfoW,GetLocaleInfoW,??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z,??_V@YAXPAX@Z,	7_2_10005490
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Code function: GetLocaleInfoA,_TranslateName,_TranslateName,IsValidCodePage,IsValidLocale,strcpy,_itoa,	7_2_7C370C1A
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Code function: GetLocaleInfoA,atol,	7_2_7C370DCF
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Code function: GetLastError,malloc,malloc,free,_strncpy,free,__crtGetLocaleInfoW,isdigit,	7_2_7C370FF0

Queries the volume information (name, serial number etc) of a device

Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\SweetIMSetup.exe

Code function: 1_2_00413EA3 __EH_prolog,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,lstrlenA,lstrlenA,lstrcatA,lstrcatA,wsprintfA,wsprintfA,lstrcatA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,GetSystemTimeAsFileTime,

1_2_00413EA3

Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe

Code function: 7_2_7C372E79 _lock,strcmp,free,strlen,malloc,strcpy,_strncpy,atol,free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,_local_unwind2,atol,atol,_strncpy,

7_2_7C372E79

Source: C:\Users\user\AppData\Local\Temp\SweetIMSetup.exe

Code function: 1_2_00415269 GetVersionExA,GetTempPathA,GetWindowsDirectoryA,wsprintfA,

1_2_00415269

Lowering of HIPS / PFW / Operating System Security Settings

Overwrites Mozilla Firefox settings

Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\searchplugins\sweetim.xml
Source: C:\Windows\SysWOW64\msiexec.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\searchplugins\sweetim.xml

Stealing of Sensitive Information

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\user.js	Jump to behavior
Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Preferences	Jump to behavior
Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\searchplugins\sweetim.xml
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies-wal	Jump to behavior
Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\BundleSweetIMSetup.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\user.js	Jump to behavior

Remote Access Functionality

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Code function: 7_2_004C3B60 ?OnStopBinding@CBSCallbackImpl@@UAGJJPBG@Z,		7_2_004C3B60
Source: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	Code function: 7_2_004C3BA0 ?GetBindInfo@CBSCallbackImpl@@UAGJPAKPAU_tagBINDINFO@@@Z,		7_2_004C3BA0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Valid Accounts	4 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	1 Replication Through Removable Media	2 Command and Scripting Interpreter	1 Valid Accounts	1 Valid Accounts	31 Obfuscated Files or Information	LSASS Memory	11 Peripheral Device Discovery	Remote Desktop Protocol	11 Browser Session Hijacking	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	11 Registry Run Keys / Startup Folder	11 Access Token Manipulation	11 Software Packing	Security Account Manager	1 System Network Connections Discovery	SMB/Windows Admin Shares	1 Data from Local System	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	12 Process Injection	1 DLL Side-Loading	NTDS	3 File and Directory Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	11 Registry Run Keys / Startup Folder	1 File Deletion	LSA Secrets	46 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	22 Masquerading	Cached Domain Credentials	1 Query Registry	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Valid Accounts	DCSync	111 Security Software Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Access Token Manipulation	Proc Filesystem	2 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
BundleSweetIMSetup.exe	50%	ReversingLabs	Win32.PUA.SweetIM
BundleSweetIMSetup.exe	38%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label
C:\Program Files (x86)\SweetIM\Messenger\ContentPackagesActivationHandler.exe	35%	ReversingLabs	Win32.PUA.SweetIM
C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe	30%	ReversingLabs	Win32.PUA.SweetIM
C:\Program Files (x86)\SweetIM\Messenger\mgAdaptersProxy.dll	26%	ReversingLabs	Win32.PUA.SweetIM
C:\Program Files (x86)\SweetIM\Messenger\mgArchive.dll	22%	ReversingLabs	Win32.PUA.SweetIM
C:\Program Files (x86)\SweetIM\Messenger\mgFlashPlayer.dll	26%	ReversingLabs	Win32.PUA.SweetIM
C:\Program Files (x86)\SweetIM\Messenger\mgICQAuto.dll	30%	ReversingLabs	Win32.PUA.SweetIM
C:\Program Files (x86)\SweetIM\Messenger\mgICQMessengerAdapter.dll	24%	ReversingLabs	Win32.PUA.SweetIM
C:\Program Files (x86)\SweetIM\Messenger\mgMediaPlayer.dll	26%	ReversingLabs	Win32.PUA.SweetIM
C:\Program Files (x86)\SweetIM\Messenger\mgMsnAuto.dll	30%	ReversingLabs	Win32.PUA.SweetIM
C:\Program Files (x86)\SweetIM\Messenger\mgMsnMessengerAdapter.dll	22%	ReversingLabs	Win32.PUA.SweetIM
C:\Program Files (x86)\SweetIM\Messenger\mgSweetIM.dll	23%	ReversingLabs	Win32.PUA.SweetIM
C:\Program Files (x86)\SweetIM\Messenger\mgUpdateSupport.dll	30%	ReversingLabs	Win32.PUA.SweetIM
C:\Program Files (x86)\SweetIM\Messenger\mgYahooAuto.dll	29%	ReversingLabs	Win32.PUA.SweetIM
C:\Program Files (x86)\SweetIM\Messenger\mgYahooMessengerAdapter.dll	25%	ReversingLabs	Win32.PUA.SweetIM
C:\Program Files (x86)\SweetIM\Messenger\mgcommon.dll	30%	ReversingLabs	Win32.PUA.SweetIM
C:\Program Files (x86)\SweetIM\Messenger\mgcommunication.dll	30%	ReversingLabs	Win32.PUA.SweetIM
C:\Program Files (x86)\SweetIM\Messenger\mgconfig.dll	27%	ReversingLabs	Win32.PUA.SweetIM
C:\Program Files (x86)\SweetIM\Messenger\mghooking.dll	33%	ReversingLabs	Win32.PUA.SweetIM
C:\Program Files (x86)\SweetIM\Messenger\mglogger.dll	29%	ReversingLabs	Win32.PUA.SweetIM
C:\Program Files (x86)\SweetIM\Messenger\mgsimcommon.dll	26%	ReversingLabs	Win32.PUA.SweetIM
C:\Program Files (x86)\SweetIM\Messenger\mgxml_wrapper.dll	26%	ReversingLabs	Win32.PUA.SweetIM
C:\Program Files (x86)\SweetIM\Messenger\msvcp71.dll	0%	ReversingLabs
C:\Program Files (x86)\SweetIM\Messenger\msvcr71.dll	0%	ReversingLabs
C:\Program Files (x86)\SweetIM\Messenger\resources\sqlite\mgSqlite3.dll	21%	ReversingLabs
C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\ClearHist.exe	30%	ReversingLabs	Win32.PUA.SweetIM
C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\Microsoft.VC90.CRT\msvcm90.dll	0%	ReversingLabs
C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\Microsoft.VC90.CRT\msvcp90.dll	0%	ReversingLabs
C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\Microsoft.VC90.CRT\msvcr90.dll	0%	ReversingLabs
C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgHelper.dll	29%	ReversingLabs	Win32.PUA.SweetIM
C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgHelperApp.exe	32%	ReversingLabs	Win32.PUA.SweetIM
C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll	26%	ReversingLabs	Win32.PUA.SweetIM
C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarProxy.dll	27%	ReversingLabs	Win32.PUA.SweetIM
C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgcommon.dll	24%	ReversingLabs	Win32.PUA.SweetIM
C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgconfig.dll	27%	ReversingLabs	Win32.PUA.SweetIM
C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mghooking.dll	24%	ReversingLabs	Win32.PUA.SweetIM
C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mglogger.dll	25%	ReversingLabs	Win32.PUA.SweetIM
C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgsimcommon.dll	22%	ReversingLabs	Win32.PUA.SweetIM
C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgxml_wrapper.dll	24%	ReversingLabs	Win32.PUA.SweetIM
C:\Users\user\AppData\Local\Temp\1714110143_4764500_750.tmp	17%	ReversingLabs	Win32.PUA.SweetIM
C:\Users\user\AppData\Local\Temp\1714110143_4764625_750.tmp	16%	ReversingLabs	Win32.PUA.SweetIM
C:\Users\user\AppData\Local\Temp\1714110143_4764703_750.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\SweetIESetup.exe (copy)	16%	ReversingLabs	Win32.PUA.SweetIM
C:\Users\user\AppData\Local\Temp\SweetIMSetup.exe (copy)	17%	ReversingLabs	Win32.PUA.SweetIM
C:\Users\user\AppData\Local\Temp\sqlite3.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\{A7BC02AF-1128-4A31-BCF8-1A3EE803D3B3}\mgSqlite3.dll	21%	ReversingLabs
C:\Users\user\AppData\Local\Temp\{A81A974F-8A22-43E6-9243-5198FF758DA1}\VistaCookiesCollector.exe	18%	ReversingLabs	Win32.PUA.SweetIM
C:\Users\user\AppData\Local\Temp\{A81A974F-8A22-43E6-9243-5198FF758DA1}\mgSqlite3.dll	21%	ReversingLabs
C:\Windows\Installer\MSIC380.tmp	0%	ReversingLabs
C:\Windows\Installer\MSIC4F8.tmp	0%	ReversingLabs
C:\Windows\Installer\MSIC547.tmp	29%	ReversingLabs	Win32.PUA.SweetIM
C:\Windows\Installer\MSID16F.tmp	29%	ReversingLabs	Win32.PUA.SweetIM
C:\Windows\Installer\MSID25A.tmp	29%	ReversingLabs	Win32.PUA.SweetIM
C:\Windows\Installer\MSID2C8.tmp	29%	ReversingLabs	Win32.PUA.SweetIM
C:\Windows\Installer\MSIDA99.tmp	0%	ReversingLabs
C:\Windows\Installer\MSIE99E.tmp	0%	ReversingLabs
C:\Windows\Installer\MSIEAC8.tmp	0%	ReversingLabs
C:\Windows\Installer\MSIEB08.tmp	21%	ReversingLabs	Win32.PUA.SweetIM
C:\Windows\Installer\MSIEF30.tmp	24%	ReversingLabs	Win32.PUA.SweetIM
C:\Windows\Installer\MSIF7EB.tmp	21%	ReversingLabs	Win32.PUA.SweetIM
C:\Windows\Installer\MSIF889.tmp	21%	ReversingLabs	Win32.PUA.SweetIM
C:\Windows\Installer\MSIF8B9.tmp	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	0%	URL Reputation	safe
http://api.autocompleteplus.com/?q=	0%	Avira URL Cloud	safe
https://drive.go	0%	Avira URL Cloud	safe
https://docs.googl	0%	Avira URL Cloud	safe
http://home.swee	0%	Avira URL Cloud	safe
https://bridge.lga1.a	0%	Avira URL Cloud	safe
https://imp.mt48.net/static?id=7	0%	Avira URL Cloud	safe
http://api.autocompleteplus.com/?q=	0%	Virustotal		Browse
https://www.amazon.	0%	Avira URL Cloud	safe
https://storage2.stgbssint.com/Search/SearchApplication/Resources/Images/Search/closeSprite.png	100%	Avira URL Cloud	malware
http://home.sweetim.comhttp://search.sweetim.com/search.asp?src=6&q=	0%	Avira URL Cloud	safe
http://www.sweetim.com0	0%	Avira URL Cloud	safe
https://www.amazon.	0%	Virustotal		Browse
https://bridge.lga1.ap01.n	0%	Avira URL Cloud	safe
http://127.0.0.1/test/rc_tb.html	0%	Avira URL Cloud	safe
https://support.micr	0%	Avira URL Cloud	safe
http://www.aim.comSweetIM	0%	Avira URL Cloud	safe
http://sweetim.comAnalyzeCookieslogDllVersion.	0%	Avira URL Cloud	safe
http://www.macrovision.com0	0%	Avira URL Cloud	safe
https://se-p-static-content.seccint.com/search/images/homepage/button_bg.png	0%	Avira URL Cloud	safe
http://sweetim.comREFERRALID	0%	Avira URL Cloud	safe
http://sweetim.com2;C:	0%	Avira URL Cloud	safe
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
d1p1fga02t8l00.cloudfront.net	108.157.173.24	true	false	high
www3.l.google.com	192.178.50.46	true	false	high
d1a7vclbryqy69.cloudfront.net	13.249.98.125	true	false	high
www.google.com	142.250.217.228	true	false	high
googlehosted.l.googleusercontent.com	192.178.50.65	true	false	high
dw0k3g0iqpx8s.cloudfront.net	13.249.98.78	true	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
se-p-static-content.seccint.com	unknown	unknown	false	unknown
storage2.stgbssint.com	unknown	unknown	false	unknown
www.sweetim.com	unknown	unknown	false	high
chrome.google.com	unknown	unknown	false	high
content.sweetim.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://content.sweetim.com/bi/track.gif?prodid=1&compid=35&actid=102&cargo=WV:6.2;SC:0;SSN:145695948050;C_FILEVER:1.3.0.3;C_BUILDTIME:1302091979;C_REPORT:;B_IMVER:3.6.0002;B_IEVER:4.2.0004;B_BUILDTIME:1318168523;B_INFO:;;	false		high
https://www.sweetim.com/installbar.asp?barid={C598706C-038F-11EF-8C2C-ECF4BBEA1588}	false		high
https://www.sweetim.com/favicon.ico	false		high
https://storage2.stgbssint.com/Search/SearchApplication/Resources/Images/Search/closeSprite.png	false	Avira URL Cloud: malware	unknown
http://content.sweetim.com/bi/track.gif?prodid=1&compid=35&actid=100&cargo=WV:6.2;SC:0;SSN:145695948050;C_FILEVER:1.3.0.3;C_BUILDTIME:1302091979;C_REPORT:;B_IMVER:3.6.0002;B_IEVER:4.2.0004;B_BUILDTIME:1318168523;B_INFO:;;	false		high
https://content.sweetim.com/bi/track.gif?prodid=1&compid=35&actid=100&cargo=WV:6.2;SC:0;SSN:145695948050;C_FILEVER:1.3.0.3;C_BUILDTIME:1302091979;C_REPORT:;B_IMVER:3.6.0002;B_IEVER:4.2.0004;B_BUILDTIME:1318168523;B_INFO:;;	false		high
http://www.sweetim.com/installbar.asp?barid={C598706C-038F-11EF-8C2C-ECF4BBEA1588}	false		high
https://se-p-static-content.seccint.com/search/images/homepage/button_bg.png	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://developer.mozilla.org/en/Extensions/Bootstrapped_extensions)	addonlistener.js.10.dr, addonlistener.js0.10.dr	false		high
http://search.sweetim.com/redir.asp?pid=7&q=%sim_search_combo	sweetim-toolbar.xul.10.dr, sweetim-toolbar.xul1.10.dr	false		high
https://bridge.lga1.a	BundleSweetIMSetup.exe	false	Avira URL Cloud: safe	unknown
http://www.sweetim.com/installbar.asp?barid=$toolbar_id;	toolbar.xml.3.dr	false		high
http://www.sweetim.com/uninstallhelpff.asp	globals.js1.10.dr, globals.js0.10.dr	false		high
http://info.sweetim.com/privacy-policy/	chromecache_795.15.dr	false		high
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	BundleSweetIMSetup.exe, 00000000.00000003.1948585972.00000000042B4000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1947911162.00000000042C7000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1935188702.00000000042AC000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1946152544.00000000042BD000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1946475050.00000000042BD000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1942957332.00000000042BD000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1947694690.00000000042C7000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1942852451.00000000042C7000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1935924437.00000000042AC000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1934723785.00000000042B3000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1935593919.00000000042A4000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1944176269.00000000042C2000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1947806512.00000000042C2000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1946074746.00000000042BD000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1934003704.00000000042A8000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1942781086.00000000042BD000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1946308990.00000000042BD000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1947731414.00000000042BD000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1947620062.00000000042BD000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1934221488.0000000002B1C000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1944457193.00000000042C7000.00000004.00000020.00020000.00000000.sdmp	false		high
http://api.autocompleteplus.com/?q=	chromecache_795.15.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://developer.mozilla.org/en/docs/How_to_implement_custom_autocomplete_search_component	SIMAutoCompleteSearch.js1.10.dr, SIMAutoCompleteSearch.js.10.dr	false		high
http://search.sweetim.com/redir.asp?pid=14&q=%sim_search_combo	sweetim-toolbar.xul.10.dr, sweetim-toolbar.xul1.10.dr	false		high
http://content.sweetim.com/bi/track.gif?prodid=1&compid=35&actid=102&cargo=WV:6.2;SC:0;SSN:145695948	BundleSweetIMSetup.exe, 00000000.00000002.2076285085.0000000004281000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.2069638260.0000000000F68000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000002.2073522009.0000000000F68000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.2068998373.0000000000F68000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000002.2073166287.0000000000E7E000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.2065627810.0000000000F68000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.2061543965.0000000002A54000.00000004.00000020.00020000.00000000.sdmp	false		high
https://drive.go	BundleSweetIMSetup.exe, 00000000.00000003.1931108151.00000000042C1000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1931357660.00000000042C2000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1932783884.00000000042BD000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1932818795.00000000042C5000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1933055444.00000000042BD000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1933341291.00000000042C3000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1931614131.00000000042C5000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1933188058.00000000042C3000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1933228210.00000000042BD000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1932983840.00000000042B3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://search.sweetim.com/redir.asp?pid=2&q=%sim_search_combo	sweetim-toolbar.xul.10.dr, sweetim-toolbar.xul1.10.dr	false		high
http://stackoverflow.com/questions/6284051/in-my-firefox-extension-onuninstalled-event-doesnt-seem-t	addonlistener.js.10.dr, addonlistener.js0.10.dr	false		high
http://home.swee	BundleSweetIMSetup.exe, BundleSweetIMSetup.exe, 00000000.00000003.1944544419.0000000004296000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1941745817.00000000042A1000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1931426271.0000000004295000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1931108151.0000000004295000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1942049041.00000000042A2000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1931392225.0000000004295000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1931985408.000000000429C000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1931954475.000000000429A000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1945571211.0000000004296000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1947052473.0000000004296000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1940929338.0000000004295000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1931858184.0000000004296000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1943390567.0000000004296000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1947428250.00000000042A1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://info.sweetim.com/terms/	chromecache_795.15.dr	false		high
http://search.sweetim.com/?src=6&q=	globals.js1.10.dr, globals.js0.10.dr	false		high
http://www.sweetim.com/simiebar/download/toolbar.cab	toolbar.xml.3.dr	false		high
https://docs.googl	BundleSweetIMSetup.exe, 00000000.00000003.1931108151.00000000042C1000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1931357660.00000000042C2000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1932783884.00000000042BD000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1932818795.00000000042C5000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1931614131.00000000042C5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://imp.mt48.net/static?id=7	BundleSweetIMSetup.exe, 00000000.00000003.1935924437.00000000042AC000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1935482180.00000000042AC000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1935593919.00000000042AC000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1935848149.00000000042AC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.amazon.	BundleSweetIMSetup.exe	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	BundleSweetIMSetup.exe, 00000000.00000003.1944544419.0000000004296000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1945077551.00000000042BD000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1936131977.00000000042B4000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1942817662.00000000042C2000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1946115163.00000000042C7000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1935736279.00000000042BD000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1944882361.00000000042B1000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1932917107.0000000002B1A000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1948421204.00000000042C2000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1943216817.00000000042BD000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1947394238.00000000042C2000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1943178865.00000000042C2000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1935188702.00000000042A4000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1935096471.00000000042B6000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1945303103.00000000042B4000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1948205588.0000000004271000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1934686053.00000000042BD000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1935997640.0000000002B1A000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1947357892.00000000042AC000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1946975552.0000000004271000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1936337518.00000000042BF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://drive.google.com/drive/installwebapp?usp=chrome_d	BundleSweetIMSetup.exe	false		high
http://www.sweetim.com/forum/	globals.js1.10.dr, globals.js0.10.dr	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appi0	BundleSweetIMSetup.exe, 00000000.00000002.2075447475.000000000332C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://home.sweetim.comhttp://search.sweetim.com/search.asp?src=6&q=	BundleSweetIMSetup.exe, 00000000.00000002.2071455802.0000000000401000.00000040.00000001.01000000.00000003.sdmp, SweetIM.exe, 00000007.00000002.1893180868.00000000004A4000.00000002.00000001.01000000.00000013.sdmp	false	Avira URL Cloud: safe	unknown
http://search.sweetim.com	BundleSweetIMSetup.exe, 00000000.00000002.2071455802.0000000000401000.00000040.00000001.01000000.00000003.sdmp, SweetIM.exe, 00000007.00000002.1893761079.00000000007D7000.00000002.00000001.01000000.0000000E.sdmp, 48c209.msi.3.dr, install.js.10.dr, MSID16F.tmp.3.dr, SweetIESetup.msi.8.dr, MSID25A.tmp.3.dr, 48c20d.msi.3.dr, sweetim.xml.10.dr, MSIC547.tmp.3.dr	false		high
http://content.sweetim.com/bi/track.gif?prodid=1&compid=35&actid=100&cargo=WV:6.2;SC:0;SSN:145695948	BundleSweetIMSetup.exe, 00000000.00000003.1712185619.0000000000EAC000.00000004.00000020.00020000.00000000.sdmp	false		high
http://search.sweetim.com/search.asp?src=2&pdp=1000&q=%shttp://search.sweetim.com/search.asp?src=8&p	mgHelper.dll.3.dr	false		high
http://adblockplus.org/blog/how-many-hacks-does-it-take-to-make-your-extension-install-without-a-res	addonlistener.js.10.dr, addonlistener.js0.10.dr	false		high
http://cdn.content.sweetim.com/toolbar/icons/webmail/emoticons.png	toolbar.xml.3.dr	false		high
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&c	BundleSweetIMSetup.exe	false		high
http://home.sweetim.com/cal	BundleSweetIMSetup.exe, 00000000.00000003.1969399479.0000000002A86000.00000004.00000020.00020000.00000000.sdmp	false		high
http://search.sweetim.com/?src=6$1q=	BundleSweetIMSetup.exe, 00000000.00000003.1942817662.00000000042C2000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1942781086.00000000042BD000.00000004.00000020.00020000.00000000.sdmp	false		high
http://search.sweetim.com/redir.asp?pid=1&q=$sim_search_combo;	toolbar.xml.3.dr	false		high
http://www.sweetim.com0	48c209.msi.3.dr, SweetIESetup.msi.8.dr, 48c20d.msi.3.dr, mgSqlite3.dll.4.dr, mgSqlite3.dll.3.dr, mgSqlite3.dll.10.dr	false	Avira URL Cloud: safe	unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	BundleSweetIMSetup.exe, 00000000.00000003.1944544419.0000000004296000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1945077551.00000000042BD000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1936131977.00000000042B4000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1942817662.00000000042C2000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1946115163.00000000042C7000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1935736279.00000000042BD000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1944882361.00000000042B1000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1932917107.0000000002B1A000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1948421204.00000000042C2000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1943216817.00000000042BD000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1947394238.00000000042C2000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1943178865.00000000042C2000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1935188702.00000000042A4000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1935096471.00000000042B6000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1945303103.00000000042B4000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1948205588.0000000004271000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1934686053.00000000042BD000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1935997640.0000000002B1A000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1947357892.00000000042AC000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1946975552.0000000004271000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1936337518.00000000042BF000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sweetim.com/	toolbar.xml.3.dr	false		high
http://mguglielmi.free.fr	mglogger.dll0.3.dr	false		high
https://www.ecosia.org/newtab/	BundleSweetIMSetup.exe, 00000000.00000002.2075447475.000000000332C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bridge.lga1.ap01.n	BundleSweetIMSetup.exe, BundleSweetIMSetup.exe, 00000000.00000003.1944544419.0000000004296000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1943390567.0000000004296000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sweetim.com/uninstallbar.asp?barid=$toolbar_id;	toolbar.xml.3.dr	false		high
http://search.sweetim.com/redir.asp?pid=3&q=$sim_search_combo;	toolbar.xml.3.dr	false		high
http://www.sweetim.com/uninstallim.asp?simappid=%sUPGRADINGPRODUCTCODEhttp://www.sweetim.com/downloa	48c209.msi.3.dr, MSID16F.tmp.3.dr, MSID25A.tmp.3.dr, MSIC547.tmp.3.dr	false		high
https://www.amazon.com/?tag=admarketus-2	BundleSweetIMSetup.exe	false		high
http://www.sweetim.com/help_simie.asp	BundleSweetIMSetup.exe, 00000000.00000003.1674811988.0000000002A4D000.00000004.00000020.00020000.00000000.sdmp, toolbar.xml.3.dr	false		high
http://search.sweetim.com/redir.asp?pid=6&q=$sim_search_combo;	toolbar.xml.3.dr	false		high
http://127.0.0.1/test/rc_tb.html	sweetim-toolbar.xul.10.dr, sweetim-toolbar.xul1.10.dr	false	Avira URL Cloud: safe	unknown
http://cdn.content.sweetim.com/toolbar/fb/m0100.html	toolbar.xml.3.dr	false		high
http://search.sweetim.com/redir.asp?pid=9&q=%sim_search_combo	sweetim-toolbar.xul.10.dr, sweetim-toolbar.xul1.10.dr	false		high
http://search.sweetim.com/redir.asp?pid=4&q=%sim_search_combo	sweetim-toolbar.xul.10.dr, sweetim-toolbar.xul1.10.dr	false		high
http://search.sweetim.com/redir.asp?pid=4&q=$sim_search_combo;	toolbar.xml.3.dr	false		high
https://support.micr	BundleSweetIMSetup.exe	false	Avira URL Cloud: safe	unknown
http://www.aim.comSweetIM	48c209.msi.3.dr, MSID16F.tmp.3.dr, MSID25A.tmp.3.dr, MSIC547.tmp.3.dr	false	Avira URL Cloud: safe	unknown
https://drive.google.com/drive/installwebapp?usp=chrome_default	BundleSweetIMSetup.exe, 00000000.00000003.1918937740.000000000427A000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1918984515.000000000427A000.00000004.00000020.00020000.00000000.sdmp, Preferences.0.dr	false		high
http://sweetim.comAnalyzeCookieslogDllVersion.	48c20d.msi.3.dr, MSIEB08.tmp.3.dr, MSIF7EB.tmp.3.dr	false	Avira URL Cloud: safe	unknown
http://www.sweetim.com/installbar.asp?barid=	BundleSweetIMSetup.exe, 00000000.00000003.2061543965.0000000002A54000.00000004.00000020.00020000.00000000.sdmp	false		high
http://search.sweetim.com/search.asp?src=1&q=%sim_search_combo	search.js0.10.dr	false		high
http://www.sweetim.com/updatebar.asp	globals.js1.10.dr, globals.js0.10.dr, toolbar.xml.3.dr	false		high
http://kb.mozillazine.org/Keyword.URL)	install.js.10.dr	false		high
https://www.amazon.com/?tag=admarketus-20&ref=	BundleSweetIMSetup.exe	false		high
https://docs.google.com/document/installwebapp?usp=chrome_	BundleSweetIMSetup.exe	false		high
https://mail.google.com/mail/installwebapp?usp=chrom4	BundleSweetIMSetup.exe, 00000000.00000003.1931108151.00000000042C1000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1931357660.00000000042C2000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1932783884.00000000042BD000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1932818795.00000000042C5000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1931614131.00000000042C5000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.sweetim.com/help_simie.asp#inst	BundleSweetIMSetup.exe, 00000000.00000003.1674858263.0000000000EAC000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1675117885.0000000000F5F000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000002.2071455802.000000000045F000.00000040.00000001.01000000.00000003.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1674858263.0000000000F4E000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1712010420.0000000002A3C000.00000004.00000020.00020000.00000000.sdmp, 48c209.msi.3.dr, SweetIESetup.msi.8.dr, 48c20d.msi.3.dr	false		high
http://sweetim.com/	VistaCookiesCollector.exe, 00000005.00000002.1791302329.00000000004DE000.00000004.00000020.00020000.00000000.sdmp	false		high
http://content.sweetim.com/sim/mfftb20.html	sweetim-contentmenu.xul0.10.dr, sweetim-contentmenu.xul.10.dr	false		high
http://search.sweetim.com/redir.asp?pid=15&q=$sim_search_combo;	toolbar.xml.3.dr	false		high
http://www.macrovision.com0	MSIC4F8.tmp.3.dr, MSIDA99.tmp.3.dr, 48c209.msi.3.dr, SweetIESetup.msi.8.dr, 48c20d.msi.3.dr, MSIE99E.tmp.3.dr, MSIF8B9.tmp.3.dr, MSIEAC8.tmp.3.dr	false	Avira URL Cloud: safe	unknown
http://content.sweetim.com/bi/track.gif?prodid=1&compid=35&actid=100&8	BundleSweetIMSetup.exe, 00000000.00000003.1674858263.0000000000EAC000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1969481685.0000000000ED0000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.2062389261.0000000000EEF000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.2068998373.0000000000EE9000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.2061074019.0000000000EEF000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.2063830032.0000000000EEF000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.2068383399.0000000000EE6000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.2065296062.0000000000EE2000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.2065627810.0000000000EEB000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.2069638260.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1712185619.0000000000EB8000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000002.2073522009.0000000000EEF000.00000004.00000020.00020000.00000000.sdmp	false		high
http://cdn.content.sweetim.com/toolbar/resources/fb/ieinfb.js	toolbar.xml.3.dr	false		high
http://search.sweetim.com/redir.asp?pid=16&q=%sim_search_combo	sweetim-toolbar.xul.10.dr, sweetim-toolbar.xul1.10.dr	false		high
http://www.sweetim.com/installbar.asp?barid=GetSIMAppID	BundleSweetIMSetup.exe, 00000000.00000002.2071455802.0000000000401000.00000040.00000001.01000000.00000003.sdmp	false		high
http://search.sweetim.com/redir.asp?pid=11&q=%sim_search_combo	sweetim-toolbar.xul.10.dr, sweetim-toolbar.xul1.10.dr	false		high
http://xulsolutions.blogspot.com/2006/07/creating-uninstall-script-for.html	uninstallobserver.js1.10.dr, uninstallobserver.js0.10.dr	false		high
http://www.sweetim.com	48c20b.rbs.3.dr, MSICDA5.tmp.3.dr, install.rdf1.10.dr, globals.js1.10.dr, globals.js0.10.dr	false		high
http://sweetim.comREFERRALID	48c209.msi.3.dr, MSID16F.tmp.3.dr, MSID25A.tmp.3.dr, MSIC547.tmp.3.dr	false	Avira URL Cloud: safe	unknown
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	BundleSweetIMSetup.exe, 00000000.00000003.1948585972.00000000042B4000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1947911162.00000000042C7000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1935188702.00000000042AC000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1946152544.00000000042BD000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1946475050.00000000042BD000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1942957332.00000000042BD000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1947694690.00000000042C7000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1942852451.00000000042C7000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1935924437.00000000042AC000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1934723785.00000000042B3000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1935593919.00000000042A4000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1944176269.00000000042C2000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1947806512.00000000042C2000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1946074746.00000000042BD000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1934003704.00000000042A8000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1942781086.00000000042BD000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1946308990.00000000042BD000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1947731414.00000000042BD000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1947620062.00000000042BD000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1934221488.0000000002B1C000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1944457193.00000000042C7000.00000004.00000020.00020000.00000000.sdmp	false		high
http://cdn.content.sweetim.com/toolbar/icons/webmail/animals.png	toolbar.xml.3.dr	false		high
http://www.sweetim.com/eula.html#privacy	globals.js1.10.dr, globals.js0.10.dr, toolbar.xml.3.dr	false		high
http://www.sweetim.com/simiebar/	toolbar.xml.3.dr	false		high
https://cdn.ecosia.org/asse	BundleSweetIMSetup.exe, 00000000.00000002.2075447475.000000000332C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://forums.mozillazine.org/viewtopic.php?f=27&t=656397	cookies.js0.10.dr, cookies.js1.10.dr, cookies.js.10.dr	false		high
http://www.sweetim.com/help	BundleSweetIMSetup.exe, 00000000.00000003.1674858263.0000000000EAC000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1675117885.0000000000F5F000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000002.2071455802.000000000045F000.00000040.00000001.01000000.00000003.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1674858263.0000000000F4E000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1712010420.0000000002A3C000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1674811988.0000000002A4D000.00000004.00000020.00020000.00000000.sdmp, 48c209.msi.3.dr, SweetIESetup.msi.8.dr, 48c20d.msi.3.dr	false		high
http://search.sweetim.com/redir.asp?pid=6&q=%sim_search_combo	sweetim-toolbar.xul.10.dr, sweetim-toolbar.xul1.10.dr	false		high
http://www.sweetim.com/help_contact.asp	globals.js1.10.dr, globals.js0.10.dr, toolbar.xml.3.dr	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9	BundleSweetIMSetup.exe	false	Avira URL Cloud: safe	unknown
http://www.sweetim.com/uninstallbar.asp?barid=%toolbar_id	globals.js1.10.dr, globals.js0.10.dr	false		high
https://bugzilla.mozilla.org/show_bug.cgi?id=625319	SIMAutoCompleteSearch.js1.10.dr, SIMAutoCompleteSearch.js.10.dr	false		high
http://sweetim.com	VistaCookiesCollector.exe, 00000005.00000002.1791302329.00000000004D0000.00000004.00000020.00020000.00000000.sdmp, VistaCookiesCollector.exe, 00000005.00000002.1791260931.0000000000450000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icoht	BundleSweetIMSetup.exe, 00000000.00000002.2075447475.000000000332C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://search.sweetim.com/?src=6&q=	BundleSweetIMSetup.exe, BundleSweetIMSetup.exe, 00000000.00000003.1945077551.00000000042BD000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1944736609.00000000042C1000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1945416513.00000000042C1000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1946637880.00000000042C1000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1942817662.00000000042C2000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1948776353.00000000042C0000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1941087262.00000000042AC000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1948421204.00000000042C2000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1941207681.00000000042B4000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1943216817.00000000042BD000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1947394238.00000000042C2000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1943178865.00000000042C2000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1944813184.00000000042C2000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1949217415.00000000042C1000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1945116548.00000000042C2000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1946152544.00000000042BD000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1946475050.00000000042BD000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1942957332.00000000042BD000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1944176269.00000000042C2000.00000004.00000020.00020000.00000000.sdmp, BundleSweetIMSetup.exe, 00000000.00000003.1947806512.00000000042C2000.00000004.00000020.00020000.00000000.sdmp	false		high
http://sweetim.com2;C:	VistaCookiesCollector.exe, 00000005.00000002.1791537351.0000000000AC0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
192.178.50.46	www3.l.google.com	United States	15169	GOOGLEUS	false
192.178.50.65	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
142.250.217.228	www.google.com	United States	15169	GOOGLEUS	false
13.249.98.78	dw0k3g0iqpx8s.cloudfront.net	United States	16509	AMAZON-02US	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
13.249.98.125	d1a7vclbryqy69.cloudfront.net	United States	16509	AMAZON-02US	false
13.249.98.124	unknown	United States	16509	AMAZON-02US	false
108.157.173.24	d1p1fga02t8l00.cloudfront.net	United States	16509	AMAZON-02US	false

Private

IP
192.168.2.4

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1431987
Start date and time:	2024-04-26 07:41:28 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 55s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	BundleSweetIMSetup.exe
Detection:	MAL
Classification:	mal60.phis.spyw.winEXE@39/504@21/9
EGA Information:	Successful, ratio: 75%
HCA Information:	Successful, ratio: 99% Number of executed functions: 176 Number of non-executed functions: 259
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 72.21.81.240, 192.229.211.108, 192.178.50.35, 142.250.217.206, 172.253.123.84, 142.250.217.202, 142.250.64.170, 172.217.165.202, 172.217.3.74, 142.250.217.170, 192.178.50.42, 142.250.64.138, 192.178.50.74, 142.250.217.234, 142.250.189.138, 34.104.35.123, 172.217.15.202, 172.217.2.202, 142.250.64.202, 142.250.64.234, 142.250.189.131
Excluded domains from analysis (whitelisted): fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, clientservices.googleapis.com, www.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, update.googleapis.com, clients.l.google.com
Execution Graph export aborted for target BundleSweetIMSetup.exe, PID 6936 because there are no executed function
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtEnumerateValueKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
06:42:32	Autostart	Run: HKLM\Software\Microsoft\Windows\CurrentVersion\Run SweetIM C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe
07:42:36	API Interceptor	4x Sleep call for process: BundleSweetIMSetup.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
239.255.255.250	https://4yu76uyd4.best/ccon/	Get hash	malicious	Unknown	Browse
	http://callumsyed.net/	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse
	DOC-Zcns1G_.html	Get hash	malicious	HTMLPhisher	Browse
	DOC-Zcns1G_.html	Get hash	malicious	HTMLPhisher	Browse
	DOC-Zcns1G_.html	Get hash	malicious	HTMLPhisher	Browse
	https://therufus.org/download.php	Get hash	malicious	Unknown	Browse
	https://shorturl.at/lMOT7	Get hash	malicious	Unknown	Browse
	https://mcas-proxyweb.mcas.ms/certificate-checker?login=false&originalUrl=https%3A%2F%2Fapc01.safelinks.protection.outlook.com.mcas.ms%2F%3Furl%3Dhttps%253A%252F%252Fmyapps.microsoft.com%252Fsignin%252F08558f59-9161-41fc-88b3-f0434087a79c%253FtenantId%253D258ac4e4-146a-411e-9dc8-79a9e12fd6da%26data%3D05%257C01%257Cgary.fabrizio1%2540Service.wipro.com%257C8a0e1c61209e469846ba08dbe05e2370%257C258ac4e4146a411e9dc879a9e12fd6da%257C0%257C0%257C638350467206547446%257CUnknown%257CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%253D%257C3000%257C%257C%257C%26sdata%3Dp0jrjFUb%252Fusi2RID%252FGIlCE82AM9dEDuVAB4PHdDC1%252F4%253D%26reserved%3D0%26McasTsid%3D20893&McasCSRF=a0328b22f805eebb5f9c68ee3df482ea7a84065b3bbced70493927bf9ce1f085	Get hash	malicious	Unknown	Browse
	https://mcas-proxyweb.mcas.ms/certificate-checker?login=false&originalUrl=https%3A%2F%2Fapc01.safelinks.protection.outlook.com.mcas.ms%2F%3Furl%3Dhttps%253A%252F%252Fwittywebevents.wipro.com%252Femail-analytics%252Fapi%252Ft%252Fl%253FobjId%253D637c92a3e4b00b92caee94cc%26data%3D05%257C02%257Cgary.fabrizio1%2540wipro.com%257Cb8fe953db5914d2bac8108dc65645f6b%257C258ac4e4146a411e9dc879a9e12fd6da%257C0%257C0%257C638496729264132835%257CUnknown%257CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%253D%257C0%257C%257C%257C%26sdata%3DX8fjcrb6FJIv3A6MeNVFttkEvMY37x2gBwDUYM2DULg%253D%26reserved%3D0%26McasTsid%3D20893&McasCSRF=a0328b22f805eebb5f9c68ee3df482ea7a84065b3bbced70493927bf9ce1f085	Get hash	malicious	Unknown	Browse
	https://mcas-proxyweb.mcas.ms/certificate-checker?login=false&originalUrl=https%3A%2F%2Fapc01.safelinks.protection.outlook.com.mcas.ms%2F%3Furl%3Dhttps%253A%252F%252Fwittywebevents.wipro.com%252Femail-analytics%252Fapi%252Ft%252Fl%253FobjId%253D637c92a3e4b00b92caee94cc%26data%3D05%257C02%257Cgary.fabrizio1%2540wipro.com%257Cb8fe953db5914d2bac8108dc65645f6b%257C258ac4e4146a411e9dc879a9e12fd6da%257C0%257C0%257C638496729264132835%257CUnknown%257CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%253D%257C0%257C%257C%257C%26sdata%3DX8fjcrb6FJIv3A6MeNVFttkEvMY37x2gBwDUYM2DULg%253D%26reserved%3D0%26McasTsid%3D20893&McasCSRF=a0328b22f805eebb5f9c68ee3df482ea7a84065b3bbced70493927bf9ce1f085	Get hash	malicious	Unknown	Browse
13.249.98.124	ACTCsxhga8.exe	Get hash	malicious	Glupteba, SmokeLoader, Stealc	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
dw0k3g0iqpx8s.cloudfront.net	http://search.pdf2docs.com	Get hash	malicious	Unknown	Browse	13.226.34.4
	http://find.zsrc-now.com	Get hash	malicious	Unknown	Browse	13.226.175.38
	http://find.zsrc-now.com	Get hash	malicious	Unknown	Browse	13.224.103.16

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-02US	https://shorturl.at/lMOT7	Get hash	malicious	Unknown	Browse	65.8.178.46
	https://uporniacomnuvidx.z13.web.core.windows.net/index.html	Get hash	malicious	TechSupportScam	Browse	65.8.184.5
	https://purexxfilmsjoybear.z13.web.core.windows.net/index.html	Get hash	malicious	TechSupportScam	Browse	65.8.184.63
	https://jpmanysexcomvistsxx.z13.web.core.windows.net/index.html	Get hash	malicious	TechSupportScam	Browse	65.8.184.63
	RemotePCHost.exe	Get hash	malicious	Unknown	Browse	54.193.137.147
	https://autode.sk/4bb5BeV	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	18.154.227.62
	https://www.bing.com/ck/a?!&&p=8c604c2d3901cb1eJmltdHM9MTcxMjc5MzYwMCZpZ3VpZD0wODdjNjgyYy00N2ZlLTYyOGQtMzA1ZC03YmVmNDY5NTYzNjUmaW5zaWQ9NTE2MQ&ptn=3&ver=2&hsh=3&fclid=087c682c-47fe-628d-305d-7bef46956365&u=a1aHR0cHM6Ly9rZWljb3NlY3VyaXR5LmNvbS5teC8&ntb=1	Get hash	malicious	Unknown	Browse	34.213.75.202
	https://url.us.m.mimecastprotect.com/s/qkT5Cv2pWyUOjZODty9fnF?domain=google.com	Get hash	malicious	Unknown	Browse	3.161.136.95
	http://neoparts.com.br./driz/oybe/am9sZW5lLmJ1cm5zQHNlY3VydXN0ZWNobm9sb2dpZXMuY29t$?utp=consumer&	Get hash	malicious	HTMLPhisher	Browse	108.156.152.27
	SecuriteInfo.com.MSExcel.CVE_2017_0199.DDOC.exploit.32374.20351.xlsx	Get hash	malicious	Unknown	Browse	76.76.21.21
AMAZON-02US	https://shorturl.at/lMOT7	Get hash	malicious	Unknown	Browse	65.8.178.46
	https://uporniacomnuvidx.z13.web.core.windows.net/index.html	Get hash	malicious	TechSupportScam	Browse	65.8.184.5
	https://purexxfilmsjoybear.z13.web.core.windows.net/index.html	Get hash	malicious	TechSupportScam	Browse	65.8.184.63
	https://jpmanysexcomvistsxx.z13.web.core.windows.net/index.html	Get hash	malicious	TechSupportScam	Browse	65.8.184.63
	RemotePCHost.exe	Get hash	malicious	Unknown	Browse	54.193.137.147
	https://autode.sk/4bb5BeV	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	18.154.227.62
	https://www.bing.com/ck/a?!&&p=8c604c2d3901cb1eJmltdHM9MTcxMjc5MzYwMCZpZ3VpZD0wODdjNjgyYy00N2ZlLTYyOGQtMzA1ZC03YmVmNDY5NTYzNjUmaW5zaWQ9NTE2MQ&ptn=3&ver=2&hsh=3&fclid=087c682c-47fe-628d-305d-7bef46956365&u=a1aHR0cHM6Ly9rZWljb3NlY3VyaXR5LmNvbS5teC8&ntb=1	Get hash	malicious	Unknown	Browse	34.213.75.202
	https://url.us.m.mimecastprotect.com/s/qkT5Cv2pWyUOjZODty9fnF?domain=google.com	Get hash	malicious	Unknown	Browse	3.161.136.95
	http://neoparts.com.br./driz/oybe/am9sZW5lLmJ1cm5zQHNlY3VydXN0ZWNobm9sb2dpZXMuY29t$?utp=consumer&	Get hash	malicious	HTMLPhisher	Browse	108.156.152.27
	SecuriteInfo.com.MSExcel.CVE_2017_0199.DDOC.exploit.32374.20351.xlsx	Get hash	malicious	Unknown	Browse	76.76.21.21
AMAZON-02US	https://shorturl.at/lMOT7	Get hash	malicious	Unknown	Browse	65.8.178.46
	https://uporniacomnuvidx.z13.web.core.windows.net/index.html	Get hash	malicious	TechSupportScam	Browse	65.8.184.5
	https://purexxfilmsjoybear.z13.web.core.windows.net/index.html	Get hash	malicious	TechSupportScam	Browse	65.8.184.63
	https://jpmanysexcomvistsxx.z13.web.core.windows.net/index.html	Get hash	malicious	TechSupportScam	Browse	65.8.184.63
	RemotePCHost.exe	Get hash	malicious	Unknown	Browse	54.193.137.147
	https://autode.sk/4bb5BeV	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	18.154.227.62
	https://www.bing.com/ck/a?!&&p=8c604c2d3901cb1eJmltdHM9MTcxMjc5MzYwMCZpZ3VpZD0wODdjNjgyYy00N2ZlLTYyOGQtMzA1ZC03YmVmNDY5NTYzNjUmaW5zaWQ9NTE2MQ&ptn=3&ver=2&hsh=3&fclid=087c682c-47fe-628d-305d-7bef46956365&u=a1aHR0cHM6Ly9rZWljb3NlY3VyaXR5LmNvbS5teC8&ntb=1	Get hash	malicious	Unknown	Browse	34.213.75.202
	https://url.us.m.mimecastprotect.com/s/qkT5Cv2pWyUOjZODty9fnF?domain=google.com	Get hash	malicious	Unknown	Browse	3.161.136.95
	http://neoparts.com.br./driz/oybe/am9sZW5lLmJ1cm5zQHNlY3VydXN0ZWNobm9sb2dpZXMuY29t$?utp=consumer&	Get hash	malicious	HTMLPhisher	Browse	108.156.152.27
	SecuriteInfo.com.MSExcel.CVE_2017_0199.DDOC.exploit.32374.20351.xlsx	Get hash	malicious	Unknown	Browse	76.76.21.21
AMAZON-02US	https://shorturl.at/lMOT7	Get hash	malicious	Unknown	Browse	65.8.178.46
	https://uporniacomnuvidx.z13.web.core.windows.net/index.html	Get hash	malicious	TechSupportScam	Browse	65.8.184.5
	https://purexxfilmsjoybear.z13.web.core.windows.net/index.html	Get hash	malicious	TechSupportScam	Browse	65.8.184.63
	https://jpmanysexcomvistsxx.z13.web.core.windows.net/index.html	Get hash	malicious	TechSupportScam	Browse	65.8.184.63
	RemotePCHost.exe	Get hash	malicious	Unknown	Browse	54.193.137.147
	https://autode.sk/4bb5BeV	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	18.154.227.62
	https://www.bing.com/ck/a?!&&p=8c604c2d3901cb1eJmltdHM9MTcxMjc5MzYwMCZpZ3VpZD0wODdjNjgyYy00N2ZlLTYyOGQtMzA1ZC03YmVmNDY5NTYzNjUmaW5zaWQ9NTE2MQ&ptn=3&ver=2&hsh=3&fclid=087c682c-47fe-628d-305d-7bef46956365&u=a1aHR0cHM6Ly9rZWljb3NlY3VyaXR5LmNvbS5teC8&ntb=1	Get hash	malicious	Unknown	Browse	34.213.75.202
	https://url.us.m.mimecastprotect.com/s/qkT5Cv2pWyUOjZODty9fnF?domain=google.com	Get hash	malicious	Unknown	Browse	3.161.136.95
	http://neoparts.com.br./driz/oybe/am9sZW5lLmJ1cm5zQHNlY3VydXN0ZWNobm9sb2dpZXMuY29t$?utp=consumer&	Get hash	malicious	HTMLPhisher	Browse	108.156.152.27
	SecuriteInfo.com.MSExcel.CVE_2017_0199.DDOC.exploit.32374.20351.xlsx	Get hash	malicious	Unknown	Browse	76.76.21.21

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://4yu76uyd4.best/ccon/	Get hash	malicious	Unknown	Browse	13.85.23.86 23.193.120.112
	http://callumsyed.net/	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	13.85.23.86 23.193.120.112
	DOC-Zcns1G_.html	Get hash	malicious	HTMLPhisher	Browse	13.85.23.86 23.193.120.112
	DOC-Zcns1G_.html	Get hash	malicious	HTMLPhisher	Browse	13.85.23.86 23.193.120.112
	https://shorturl.at/lMOT7	Get hash	malicious	Unknown	Browse	13.85.23.86 23.193.120.112
	https://mcas-proxyweb.mcas.ms/certificate-checker?login=false&originalUrl=https%3A%2F%2Fapc01.safelinks.protection.outlook.com.mcas.ms%2F%3Furl%3Dhttps%253A%252F%252Fmyapps.microsoft.com%252Fsignin%252F08558f59-9161-41fc-88b3-f0434087a79c%253FtenantId%253D258ac4e4-146a-411e-9dc8-79a9e12fd6da%26data%3D05%257C01%257Cgary.fabrizio1%2540Service.wipro.com%257C8a0e1c61209e469846ba08dbe05e2370%257C258ac4e4146a411e9dc879a9e12fd6da%257C0%257C0%257C638350467206547446%257CUnknown%257CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%253D%257C3000%257C%257C%257C%26sdata%3Dp0jrjFUb%252Fusi2RID%252FGIlCE82AM9dEDuVAB4PHdDC1%252F4%253D%26reserved%3D0%26McasTsid%3D20893&McasCSRF=a0328b22f805eebb5f9c68ee3df482ea7a84065b3bbced70493927bf9ce1f085	Get hash	malicious	Unknown	Browse	13.85.23.86 23.193.120.112
	https://mcas-proxyweb.mcas.ms/certificate-checker?login=false&originalUrl=https%3A%2F%2Fapc01.safelinks.protection.outlook.com.mcas.ms%2F%3Furl%3Dhttps%253A%252F%252Fwittywebevents.wipro.com%252Femail-analytics%252Fapi%252Ft%252Fl%253FobjId%253D637c92a3e4b00b92caee94cc%26data%3D05%257C02%257Cgary.fabrizio1%2540wipro.com%257Cb8fe953db5914d2bac8108dc65645f6b%257C258ac4e4146a411e9dc879a9e12fd6da%257C0%257C0%257C638496729264132835%257CUnknown%257CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%253D%257C0%257C%257C%257C%26sdata%3DX8fjcrb6FJIv3A6MeNVFttkEvMY37x2gBwDUYM2DULg%253D%26reserved%3D0%26McasTsid%3D20893&McasCSRF=a0328b22f805eebb5f9c68ee3df482ea7a84065b3bbced70493927bf9ce1f085	Get hash	malicious	Unknown	Browse	13.85.23.86 23.193.120.112
	https://mcas-proxyweb.mcas.ms/certificate-checker?login=false&originalUrl=https%3A%2F%2Fapc01.safelinks.protection.outlook.com.mcas.ms%2F%3Furl%3Dhttps%253A%252F%252Fwittywebevents.wipro.com%252Femail-analytics%252Fapi%252Ft%252Fl%253FobjId%253D637c92a3e4b00b92caee94cc%26data%3D05%257C02%257Cgary.fabrizio1%2540wipro.com%257Cb8fe953db5914d2bac8108dc65645f6b%257C258ac4e4146a411e9dc879a9e12fd6da%257C0%257C0%257C638496729264132835%257CUnknown%257CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%253D%257C0%257C%257C%257C%26sdata%3DX8fjcrb6FJIv3A6MeNVFttkEvMY37x2gBwDUYM2DULg%253D%26reserved%3D0%26McasTsid%3D20893&McasCSRF=a0328b22f805eebb5f9c68ee3df482ea7a84065b3bbced70493927bf9ce1f085	Get hash	malicious	Unknown	Browse	13.85.23.86 23.193.120.112
	https://site-stlp3.powerappsportals.com/	Get hash	malicious	Unknown	Browse	13.85.23.86 23.193.120.112
	https://ndw5xvotehflt.pages.dev/smart89/	Get hash	malicious	Unknown	Browse	13.85.23.86 23.193.120.112
37f463bf4616ecd445d4a1937da06e19	Commande No 00007 de M.N.S. S.A. 24000127 MNS Distribution.exe	Get hash	malicious	GuLoader, Remcos	Browse	13.249.98.125
	ad.msi	Get hash	malicious	Latrodectus	Browse	13.249.98.125
	Document_a19_79b555791-28h97348k5477-3219g9.js	Get hash	malicious	Latrodectus	Browse	13.249.98.125
	360total.dll.dll	Get hash	malicious	Latrodectus	Browse	13.249.98.125
	ad.msi	Get hash	malicious	Latrodectus	Browse	13.249.98.125
	SecuriteInfo.com.MSExcel.CVE_2017_0199.DDOC.exploit.32374.20351.xlsx	Get hash	malicious	Unknown	Browse	13.249.98.125
	SecuriteInfo.com.Win32.Malware-gen.9746.16728.exe	Get hash	malicious	FormBook, GuLoader	Browse	13.249.98.125
	ProconGO1121082800.LnK.lnk	Get hash	malicious	Unknown	Browse	13.249.98.125
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	13.249.98.125
	Version.125.7599.75.js	Get hash	malicious	SocGholish	Browse	13.249.98.125

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	34112
Entropy (8bit):	5.796495360213887
Encrypted:	false
SSDEEP:	384:Nw9baw/tqqw31HFcnvfBuzyaD7Jn52zXYFu5J5N01kJRC:NQaw/tVw3jooTIbHe
MD5:	AAE3B52E5DAA9A65BC625EADE50A44B4
SHA1:	AF595106221F69142406D996686115EB92DD8944
SHA-256:	BCD020DE3BEED025DCB8EF31579371D6121E64D5A9D0BDEE315808FDFC6CD554
SHA-512:	D7F34877E3C70001E80FAA17783BAE07A3BBF601026662993793240183E86C1A65A9FCC9F826ACEF297B5709786502A56D40C0D4391F8C84F6E8CC7DE35FFE7F
Malicious:	false
Reputation:	low
Preview:	...@IXOS.@.....@P=.X.@.....@.....@.....@.....@.....@......&.{A81A974F-8A22-43E6-9243-5198FF758DA1}..SweetIM for Messenger 3.6..SweetIMSetup.msi.@.....@.....@.....@......ARPPRODUCTICON.exe..&.{88655337-61D8-45FF-9B01-BB29C2AAFDE6}.....@.....@.....@.....@.......@.....@.....@.......@......SweetIM for Messenger 3.6......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{7D8D174B-3913-4B63-AC98-73E40D7D8B60}&.{A81A974F-8A22-43E6-9243-5198FF758DA1}.@......&.{3FE7B4A9-F987-4178-919D-0352382BC051}&.{A81A974F-8A22-43E6-9243-5198FF758DA1}.@......&.{2C982089-08F2-4C7A-BB39-32CD1652E5E4}&.{A81A974F-8A22-43E6-9243-5198FF758DA1}.@......&.{C50A8E86-DD06-4529-95D1-DB619CE4DDFB}&.{A81A974F-8A22-43E6-9243-5198FF758DA1}.@......&.{305C457F-A573-4331-B422-83E881FD8EE7}&.{A81A974F-8A22-43E6-9243-5198FF758DA1}.@......&.{E0B676BA-E9B1-40AF-B9F9-D7DD9A467543}&.{A81A974F-8A22-43E6-9243-5198FF758DA1}.@......&.{58338CDF-

C:\Config.Msi\48c20f.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	19798
Entropy (8bit):	5.711677637475957
Encrypted:	false
SSDEEP:	192:i1g+RuNxbAU+CWpZovNPMbbHHaN1JW8z/xZ7y8i+DZ45C9xNF26KIDZWtCnxhvu2:0mmCaSlHb/3BuwkuwKmeF
MD5:	66FCED6EE0370751F23ECCF7F92F810A
SHA1:	E7514410463528B8D0E6CE16E6AA6558AE64F931
SHA-256:	CBCADA4F1DBE05A7706F0580103CBDEB1C94434AB9F540FC85018A3222809932
SHA-512:	119115FF3908D8BB83528A69FB27978731CA4883C4D4F68D31605245A41A7815DCBCA44C61528B25105D4F9A1E2B9F0560EC603C20ACBCD29B1B65C06D1F789F
Malicious:	false
Reputation:	low
Preview:	...@IXOS.@.....@S=.X.@.....@.....@.....@.....@.....@......&.{A7BC02AF-1128-4A31-BCF8-1A3EE803D3B3}).SweetIM Toolbar for Internet Explorer 4.2..SweetIESetup.msi.@.....@.....@.....@......ARPPRODUCTICON.exe..&.{F44840C4-6708-42BA-807E-138D61C83EB9}.....@.....@.....@.....@.......@.....@.....@.......@....).SweetIM Toolbar for Internet Explorer 4.2......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{B655F7E9-422F-408D-9DA6-690F6F437498}&.{A7BC02AF-1128-4A31-BCF8-1A3EE803D3B3}.@......&.{097CDE68-E405-4381-BD2C-C0A94023F82D}&.{A7BC02AF-1128-4A31-BCF8-1A3EE803D3B3}.@......&.{DF3F12EC-2B75-4144-8208-FE511A561A65}&.{A7BC02AF-1128-4A31-BCF8-1A3EE803D3B3}.@......&.{6B8676E2-D239-4211-830F-745CD4816053}&.{A7BC02AF-1128-4A31-BCF8-1A3EE803D3B3}.@......&.{33FAD51D-022C-419F-861A-7D5DC713CA7D}&.{A7BC02AF-1128-4A31-BCF8-1A3EE803D3B3}.@......&.{E588F4FB-4EED-4465-BEE1-C0990E613299}&.{A7BC02AF-1128-4A31-BCF8-1

C:\Program Files (x86)\SweetIM\Messenger\ContentPackagesActivationHandler.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	123184
Entropy (8bit):	5.6531883654688135
Encrypted:	false
SSDEEP:	1536:TnwPks2TwO+Iydk233dHeeeR/IZvN5I5KplH1KvuRVo4v:TnwPkzlv233d+RwZLHlH1Kc
MD5:	2522191078E80AE1BBBC7EF51D54D4D9
SHA1:	E43E49734BD1129A597A1F852E2A68AE97B825A6
SHA-256:	835DACFCB1E13DA99672C6C46035587CB7A183014D1F218F8DCEB7B725BA5384
SHA-512:	2C0819EDB39F63142D3CD7EA486B356E0A727D5C841F4F4C0FE786CD1984B40893A6F704602E9AAD16F8653BE1FAD8BF6BBA2FE00395000B75E3B4F0771DEC71
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 35%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........@.g...g...g...k...g...k...g...k...g...k...g...o...g..[o...g..Vp...g...g..&g..Vp...g..4l...g..Vp...g..Rich.g..........................PE..L.....6N..........................................@.................................%.......................................h........@...{..............0!.......... ...................................@............................................text............................... ..`.rdata...d.......p..................@..@.data...X....0.......0..............@....rsrc....{...@.......@..............@..@........................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	114992
Entropy (8bit):	5.109750616038281
Encrypted:	false
SSDEEP:	1536:nfRXjWg1g9crILp1sM5Y+eFuyfP+7zASkWTtNRnhYJ+uUJppUaWo42:Bzm1sV+etPUASkW5NgJ+FUC
MD5:	15A4D1A8C15CB3C0C13C3F36899475E6
SHA1:	C7C8F02263509248FE139E07C4B7A1A281ECA1C7
SHA-256:	1EF7B897D41608A79ADF62A4252E8376A1EFC9E5A1CA9055AC577E36664D0919
SHA-512:	03138A16AB143DD204C94BA648D738CBED826384DF90347C51916D5F9527CA2BFAB13BE511D0BAB3E95803C36A4099E1D7CC28DEF7364184DA1FB5520C9E5443
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 30%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~..\:...:...:...)...;...?...8...?...5...?...>...?...>...)...8.......>.......>.......3...:.........=......;.......;...Rich:...........PE..L.....6N............................H~............@.................................QM..................................................X...............0!..........................................x...@...............<............................text...d}.......................... ..`.rdata...9.......@..................@..@.data...............................@....rsrc...X...........................@..@........................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\SweetIM\Messenger\default.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	462
Entropy (8bit):	5.014952940002876
Encrypted:	false
SSDEEP:	12:TMHdoIzuqDUbD54nBKZy4nBA+mO2CT4nBiU4nBTl7DT4nB30:2dVzuqidOBOA+kCTOfOTlTO30
MD5:	4A93F75295BA23D7CE7E39FFF5BDBDD5
SHA1:	55F76E394BEFFD52861FD65D3010267588F2D3C0
SHA-256:	34EB3FAFA9F5A9E754ABFC0A0334EC9B5AB83317DACA150FCD2104723763911A
SHA-512:	57D5E6B319465E5F3B4251656E87C30424093FC5C3181E030A5832D8296479DD15A118F93C41A39FA177D16653C2C3DAE4F25999EDF73E7F139B2A0B7791CFCA
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="iso-8859-1" standalone="no"?>.... ..@version: ....explain usage..-->....<Main>...<ConfigFiles.. LoggerConfigFilePath="$data_dir\conf\logger.xml" .. AdapterConfigFilePath="$data_dir\conf\adapter.xml" .. SweetIMConfigFilePath="$data_dir\conf\sweetim.xml".. SweetIMAppConfigFilePath="$data_dir\conf\sweetimapp.xml".. AutoUpdateConfigFilePath="$data_dir\conf\autoupdate.xml"/>..</Main>..

C:\Program Files (x86)\SweetIM\Messenger\mgAdaptersProxy.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	26928
Entropy (8bit):	6.305622718915669
Encrypted:	false
SSDEEP:	384:54iSq58lppUcPoCAi1PTLithGAq/yINTsXuTYJLca6j1q33eMkc7kz:54iSq50UcQCAGPTeGb/cXuSLFm4NIz
MD5:	D74C378C65BA6775A087F38606B774BE
SHA1:	8DDDF5F5F0E1D431C3867E404696A452D2480BE9
SHA-256:	2ABDCC9E5FC5A5C1C5B2489E805190F90687E8C81CA1CC90704BAFBC2CF56F38
SHA-512:	281B3B9491B5AF9C9320E1985F7764F28CC176F9A228382CD2EC514A4440411523D5E2E0384B9A8B0E6CC429F3822E1DBB338B221D86C25ACE83DD89E33AFDA3
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 26%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........^.s...s...s...{...s.......s.......s.......s.......s...{...s...{...s..kP...s...s...s...d...s...d...s..}x...s...d...s..Rich.s..........PE..L.....6N...........!.....$... ...............@......................................J................................L.......G..x....................H..0!......X...................................HD..@............@...............................text....".......$.................. ..`.rdata..a....@.......(..............@..@.data........P.......6..............@....SHARDAT.....`.......8..............@....SHARDAT.....p.......:..............@....rsrc................@..............@..@.reloc...............D..............@..B................................................................................................................................................................................................................

C:\Program Files (x86)\SweetIM\Messenger\mgArchive.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	43312
Entropy (8bit):	6.447993602664435
Encrypted:	false
SSDEEP:	768:StwifonAxmh/Z3PnIr8m6M8UAt7zBwNmhNk99aJ0qey1X4txPT8YEgLFm4P7:u1wnAxmBZ3Pvm6M8UAt7xNk99m0qeGX4
MD5:	C99FE89C079AF526095C64DED4DF80CD
SHA1:	1E9B724A77188063B44A50B21CB6C7FF9761AA80
SHA-256:	A5FCE6C2E780EADBD24229B841164E9F8EBC4D857BE60D82A51A1E9C53E97C0E
SHA-512:	9890565BE65D13644C7EADE5D63263C0B806E0391EA706ABCC7FCD3B93D6981614E7F298032CD1DE60C59FE9C28355EFAFE97D6DAD901A38D1AC8310019D1C75
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 22%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......u...1...1...1...4..3...4...2...4..3...4..7..."..3......4...1..........4......0.....0......0...Rich1...........PE..L.....6N...........!.....V...........c.......p......................................d5..........................................d.......x...............0!..............................................@............p...............................text....U.......V.................. ..`.rdata..j"...p...$...Z..............@..@.data...,............~..............@....rsrc...x...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\SweetIM\Messenger\mgFlashPlayer.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	151856
Entropy (8bit):	6.07331429118849
Encrypted:	false
SSDEEP:	1536:xqmCev3BSnb6cdSmxsfDKz7uokGS49dwhEP8oMykRDPwUKo4A:xq9eWucdSmxsfDpokGS49dwhEP8o6R9
MD5:	EEAF844217A5BA3FD233E08B796088AB
SHA1:	19B3FD71F2E3635B44AE88B7B081789E557C992C
SHA-256:	5427071D86C57CA70A36AE238C556FE14AE97DD6744E162B09A47223069B24D7
SHA-512:	4BAFC1DD1FD26C4300C9BC46247708C769CFBD9050A474D7EBA142B16BDB302FCB6E5E117AE39BE8A4C14BFA09DB0947CF878A299D6CFC176C44BB2C7446E5DC
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 26%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......,.^5h~0fh~0fh~0fmrmfj~0fmrPfi~0fmr?fi~0fmrof`~0f.vofn~0f{vmfj~0f.vmfc~0fh~1f.~0f.iPf\|~0f.ilfi~0f.unfi~0f.ijfi~0fRichh~0f........PE..L.....6N...........!.........P...............................................0..........................................{............................0..0!... ..........................................@............................................text............................... ..`.rdata........... ..................@..@.data...<...........................@....rsrc...............................@..@.reloc....... ....... ..............@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\SweetIM\Messenger\mgICQAuto.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	172336
Entropy (8bit):	6.107700126005232
Encrypted:	false
SSDEEP:	3072:dGcL35IIGfGzVXNP0PTidLbzRIF4qTY+YUE8eKAgc2X:tlpqM+YUreKlc2X
MD5:	DB522A7179B9EA8EC817E8C748349EF5
SHA1:	06B870CF458D88376C40E90931F5320E28A43878
SHA-256:	23E0598E26F10AC7815CEC0149D4609605F7701E3E53F743460169E50C592CE1
SHA-512:	99334DC2361C78512195B540DABF6121266335C83ED2A423ABAC924949BAB709CA36530A64BE4EABC4C16895681B169C61F97C98B6199758DD0083715F9C1F93
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 30%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........d.z..x)..x)..x)..')..x)..w)..x)..%)..x)...)..x)6.')..x)..%)..x)6.%)..x);.%)..x)..y)..x);..)..x);.$)..x)Y.&)..x);.")..x)Rich..x)................PE..L...x.6N...........!.....P... ......C".......`.......................................O..............................0...4#..$........@..x...............0!...P... ...c..............................8...@............`...............................text...NC.......P.................. ..`.rdata..d....`.......`..............@..@.data........0.......0..............@....rsrc...x....@.......@..............@..@.reloc..h$...P...0...P..............@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\SweetIM\Messenger\mgICQMessengerAdapter.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	303408
Entropy (8bit):	6.190684897309082
Encrypted:	false
SSDEEP:	3072:HU3gzYpvI+AY3sbsC5X3IB/8Cknjl5NVj/R94jjLKM9uefGUaVf2U2IHwKkehe1m:0WY3srldYGUefd2IHD01iLvSCtRF8Igi
MD5:	68A813528EDC76B73AEE10FC0EE11EC1
SHA1:	CC28370E1E684BB933FCA4CBD3966CB6097A213F
SHA-256:	70F356AD5EC9E11E53D6566B3281BED715CA6461E248700C3C406872DE0EEDE5
SHA-512:	CF784E7B346483C1C3FE4B03EAB1F04FC66F1F1310DFCE33E7BC28DA064BEC9FB1A4279F34FEBA0AC79F423676BE5ABEC462A2B883D6522A360C28CE86D1DC43
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 24%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........7...VkS.VkS.VkS.Z4S.VkS.ZdS.VkS.Z6S.VkS.Z.S.VkSd^4S.VkS.^6S.VkSd^6S.VkSiA6S.VkS.VjS.WkSiA.S.VkSiA7S.VkS.]5S.VkSiA1S.VkSRich.VkS................PE..L.....6N...........!....................................................................................................w...8...,.... ..................0!...0...?..................................@G..@............................................text...?........................... ..`.rdata...".......0..................@..@.data...\|...........................@....rsrc........ ....... ..............@..@.reloc...I...0...P...0..............@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\SweetIM\Messenger\mgMediaPlayer.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	82224
Entropy (8bit):	5.783241323362956
Encrypted:	false
SSDEEP:	768:sKK7qylKnoBpeQf8oYx1eLNvOLhqDUnyKBE1S0ZXrdFpHWF/nblU5a667rlrWLFu:sL7TOgeQf8FxoJGhsdX+by5T67rlao4k
MD5:	0CF54C94CBECBD7A675D841BE4F53CDF
SHA1:	D54F0AD87F806CE8533197294057B9A9EA53651C
SHA-256:	C630C04369818902FB1608FBF072CBEFBB7E91B286E1256F7F51D7BFC91A85BC
SHA-512:	0E716A79F6DC97D64ECA029F00C06F03DAE37436BBA1072AF4E64CBE7020BCB197B916A472CB72E821BC90A428AA972017854C905331106BB07A589D3DA17D61
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 26%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......tA.0 ..0 ..0 ..5,..2 ..5,..4 ..5,..8 ..5,..4 ......2 ...(..2 ..#(..2 ..0 ... ...(..= ...7..8 ...7..1 ...+..1 ...7..1 ..Rich0 ..........PE..L...v.6N...........!......................................................... ......J...............................`................................ ..0!......,...................................p...@............... ............................text...G........................... ..`.rdata...0.......@..................@..@.data...`...........................@....rsrc............ ..................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\SweetIM\Messenger\mgMsnAuto.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	44336
Entropy (8bit):	6.366902731891143
Encrypted:	false
SSDEEP:	768:vKgrJQibQP+uSSuwSv7Wnf8wQxNgSelBWTOLFm48:vKgreIYO7Wf8w0zGBWyo48
MD5:	489CA8A6A5A732A598D50E97E8471633
SHA1:	3699FD8A24AD1927522B457D132395647BAF4B04
SHA-256:	B1A2D4C0ABF5EA7372A8DF0E861DD1ED14C3D39A1F4CCB7B8A1F1DC0CBEAB8DF
SHA-512:	9D6B9FF6E9B1DB564A707A095F2B687E668864054C75139C4DF6BFA4B838AC9AD390ACA73B4C1D70E1E6877A8E4CEF04C167B5093BA939D77663F64CF4BC26F1
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 30%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......1G;Qu&U.u&U.u&U.pZ.w&U.p..s&U.p..q&U.p5.p&U.....v&U.f...w&U.....s&U..1..w&U..9_.t&U...L.v&U.u&T..&U..15.r&U..1..t&U..-..t&U..1..t&U.Richu&U.................PE..L.....6N...........!.....J...>.......T.......`......................................O5...............................\|..H....s..........x...............0!...........................................h..@............`...............................text....I.......J.................. ..`.rdata..H*...`...,...N..............@..@.data...@............z..............@....rsrc...x............\|..............@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

C:\Program Files (x86)\SweetIM\Messenger\mgMsnMessengerAdapter.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	414000
Entropy (8bit):	6.1804525885022645
Encrypted:	false
SSDEEP:	6144:Ng/42m9i59iEj1Y/0oIN6Zxwetzo9zUqfr0SFQPBs5OVjDq:Nob9iEj1Y/0H6TdSFQmyDq
MD5:	C1BE6D9B4E86AF5A2BD1B3A8B3C88338
SHA1:	B3811858A4E998C2E5B9154BF6C607909F1C761D
SHA-256:	113C84B4ED3D0E5D5CA9469C4973C35D16877DDEF010333F3E953376605F0A57
SHA-512:	1FD3831122619DC1165A2ABCE77E616072F85F105F50AB85DB95F60D56FD72B96DE217D8A6F196EEDB75A9A5AC1E4E91B698684F95C3ED74CB120677FC13B919
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 22%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......E.........................................................................[.....O....................Rich...................PE..L.....6N...........!......................... ...............................0......)l..............................`n..w....:..T.......8............0..0!.......X...................................^..@............ ...............................text...:........................... ..`.rdata...N... ...P... ..............@..@.data...\|....p.......p..............@....rsrc...8........ ..................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

C:\Program Files (x86)\SweetIM\Messenger\mgSweetIM.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	626992
Entropy (8bit):	6.2198102214919215
Encrypted:	false
SSDEEP:	12288:Bh48Tp5bVszs94qIXLzf5p18xhdDb/RCoq:T48Tp5Lqq8Rs3dDb/9q
MD5:	9470CBD794AEFDF137CDFDB858B869BC
SHA1:	36C4145249AFD45080DC1332A1E81915955449A3
SHA-256:	D61F966704DAFD381B0C9E737E76237E673D23F02E786D771128292955C110A2
SHA-512:	8504D84B92DC4F413436E0A069A0ACE45E1C030064026719FA46225FD27ADAA7430290CFFD867801BE32B41317CBABF756BE4437627E23A3A5877E462E95C373
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 23%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........^...0...0...0...o...0...?...0...m...0...P...0.m.o...0...)...0...m...0.`.o...0.`.m...0.m.m...0...1...0.`.P...0.`.l...0...n...0.`.j...0.Rich..0.........PE..L.....6N...........!................b...............................................m^..................................i............`...l...........p..0!......l...................................(9..@............................................text.............................. ..`.rdata..9!.......0..................@..@.data...Pk.......0..................@....rsrc....l...`...p... ..............@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\SweetIM\Messenger\mgUpdateSupport.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	282928
Entropy (8bit):	6.466000813422872
Encrypted:	false
SSDEEP:	6144:5noUsw7dtQtR6uGwejYBejDQ9qeM9qei5rfEdS9Rd+RdmD9lX8tB8wrPs+C:5oUlhub4awrPs+C
MD5:	82B342D1E5DC79F697E6206994017E5C
SHA1:	2EB55CE5CCE8D3445F64359F954D55B1EAA35CC3
SHA-256:	BAF6D6CAF3C455AE1ED4D0C76CDC2828F0888069A1CCD3595D14BD24F6CA87B3
SHA-512:	2F3E6458C86C3D4F55B62094DAEF6E134D9154017E3CE960C04C0167080D6B1C109A737C5DCA8EC59DD26AE093A58ABC60C421BD40249F7F3A0D5B39ACD6403F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 30%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.........r....C...C...C..uC...C..CC...C...C...C..AC...C..\|C...C4.CC...C..AC...C9.AC...C9.CC...CM..C...C4.AC...C...C0..C9.\|C...C9.@C...C[.BC...C9.FC...CRich...C........PE..L.....6N...........!.....P... ......6........`.......................................................................6...................e...........0..0!.......[......................................@............`..@............................text....L.......P.................. ..`.rdata.......`.......`..............@..@.data....\...@.......@..............@....rsrc....e.......p...P..............@..@.reloc..bo.......p..................@..B........................................................................................................................................................................................................................................................................

C:\Program Files (x86)\SweetIM\Messenger\mgYahooAuto.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	90416
Entropy (8bit):	5.464548406867268
Encrypted:	false
SSDEEP:	768:w8HbJRAhIOsA0GA2lcGe2Nolv5hN4OZXdTauNdq0NKcWALFm4h:wK0IOsA09GGlrN4IT3NU0NKcro4h
MD5:	62915C83847B316AF528CD779A9C4316
SHA1:	7270C734D80B4D6CF6EEAFE7108BA84073EEB541
SHA-256:	E03BC8F3852CC35C5FA83890D609538EC6ACAB28710A0215EE204CACF686FC05
SHA-512:	7370802AEDED3C56372E45FAB13A262BB47630AE254E493B99AFBC7E7427F195C6AE63A82178C3D25888B0D7A911ADAC05B4852260EF8EC16D3D1E46E354A336
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 29%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......R.c...............R...............P.......m.......R.......P.......P.......P...............m.......Q.......S.......W.....Rich....................PE..L...}.6N...........!.........................................................@......w...................................M...D........................@..0!... ..........................................@...............\|............................text... ........................... ..`.rdata..=D.......P..................@..@.data...L...........................@....rsrc...............................@..@.reloc....... ... ... ..............@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\SweetIM\Messenger\mgYahooMessengerAdapter.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	176432
Entropy (8bit):	5.944826993695125
Encrypted:	false
SSDEEP:	1536:HWBpDo9Hvb3fY3A4iBscQrHLhpcM3Ha8xd0getpSBsfhdfFUuSf/TfjIwbJs9I8n:H+pjw4d/r33HaOnetp8W03IwbJswe
MD5:	76ECD026609504785CCF48529EF91401
SHA1:	9F92D402C2B0763BE1AB7C354A6B467380FDD285
SHA-256:	E2C5CB1B09C39ACFD64B63754BEB1C1ACD389BA0CA0E8D93965012C7A77208E0
SHA-512:	9A330059347C75BBE5EEEDFAC64749FD3A4A08DC5E319A1E7E5245F7C22A88E343354247CA29ABAD26F921135AAE3BA8604D694E9B192611CBDA9815C20EE491
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 25%
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......A.,(..B{..B{..B{..+{..B{...{..B{..M{..B{...{..B{.."{..B{...{..B{...{..B{...{..B{..[{..B{...{..B{..C{T.B{.."{..B{...{..B{...{..B{...{..B{Rich..B{........................PE..L.....6N...........!.................b..............................................j...............................0,..y.......@....@..................0!...P...$......................................@............................................text...Fw.......................... ..`.rdata..............................@..@.data........0.......0..............@....rsrc........@.......@..............@..@.reloc...4...P...@...P..............@..B................................................................................................................................................................................................................................................................

C:\Program Files (x86)\SweetIM\Messenger\mgcommon.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	282928
Entropy (8bit):	6.3365930758329165
Encrypted:	false
SSDEEP:	6144:p155cF4U7G/+F1If/6JpSl57TLjbzrD7TLjbzrnoma5+zanBxV7d9EGWy/X/rUNR:loX5+yBzTLWSXDUm8b
MD5:	E68A5E68F3171EC36ADAD75AE6DEF903
SHA1:	050B5A22D59178CAC150CC6F00B26A6E72117B2C
SHA-256:	4038137DB80A3E86BA73DB830AED68EDA2C0E005E4A717613A005B503A5D2302
SHA-512:	C4A92540EE49E199170656BAB47A8075DB5FE65F9D99BDCD7FEB73FDE8C93DE87C545350A2550C0E0A4C4740288741819B29262FC4FC70CF086C41589B4ECB86
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 30%
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$............m.H.m.H.m.H.e.H.m.H.a.H.m.H.a.H.m.H.a.H.m.H.a.H.m.Hse.H.m.H.N.H.m.H*N.H.m.H.e.H.m.H~z.H.m.Hse.H.m.H.m.H.l.H~z.H.m.H~z.H.m.H.f.H.m.H~z.H.m.HRich.m.H................PE..L...p.6N...........!.....`..........S?.......p...............................0......<P......................................\........................0..0!.......3......................................@............p..\............................text...._.......`.................. ..`.rdata..eN...p...P...p..............@..@.data...,...........................@....rsrc...............................@..@.reloc...H.......P..................@..B................................................................................................................................................................................................................................................................

C:\Program Files (x86)\SweetIM\Messenger\mgcommunication.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	36656
Entropy (8bit):	6.566288110740887
Encrypted:	false
SSDEEP:	384:KO0jnLoBH8u0THymTvkHAqC3qmOuV8pxXQuYa940mvxDW9vXQgJOv+eN56JYJLc5:sjcj0THnIm0RXQVZ3D2eqkLFm4W
MD5:	AAD164AB006844D07B8F9F8E0BEDC1BD
SHA1:	B9ABA571D3ABA1CCD0B49BACC1465FA6258FFB0B
SHA-256:	81DAB7F6C941092C3CDE11F9C4CDB66CCB32B28FD17CF2D214396CA8F8FE4863
SHA-512:	E7CE7540FE57652C9BBCD43B827CB941A9AEB066BE809D543AC697BCCB3136EB57DE3C789B7C48037CA83091268715FC7B81302AAF2BF079F1D733CA47F32280
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 30%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........t...O..O..O.GO...O.zO...O.EO..O..O...O..O...O@.GO..OM.zO..OM.FO..O/.DO..OM.@O..ORich..O........PE..L...y.6N...........!.....<...6.......G.......P.......................................G...............................^......hW.......................n..0!...........................................T..@............P..8............................text...::.......<.................. ..`.rdata...!...P..."...@..............@..@.data...,............b..............@....rsrc................d..............@..@.reloc...............h..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\SweetIM\Messenger\mgconfig.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	65840
Entropy (8bit):	5.346825771977272
Encrypted:	false
SSDEEP:	384:qQMs0Ur3Y5Zvv97N6xAJmeaHlxZFS7/yeQFfNc+nplbPxn7ATOBvZz+RyZJWiD/b:8s/cBvBPzk7oQF177t3bJhD/tZXLFm4H
MD5:	704ECEF0D485725348E11F39B2D0F0FA
SHA1:	8AAEB423A54294EBE40C6179923D762AE10E7A1D
SHA-256:	E6DB2E99BF1D23753E885FE6619A39C1834B3AD5209D180F8F92FECEE86E3AC2
SHA-512:	27E8EFE636C6BF12820E49E1C6C10FF42C7A910225FD3F93FAAFC73880A11311BC04C9489CD8EA9F2339AC6FBA87695ED23A4753F52157653C18D75BA5C1C6DE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 27%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......)1STmP=.mP=.mP=.h\2.oP=.h\b.eP=.h\`.iP=.h\].iP=.~X`.oP=..X`.oP=..G`.hP=.mP<..P=..G].nP=..Ga.lP=..[c.lP=..Gg.lP=.RichmP=.........................PE..L...r.6N...........!.....`...p......TX.......p.................................................................................x.......................0!...........................................w..@............p...............................text....R.......`.................. ..`.rdata...7...p...@...p..............@..@.data...p...........................@....rsrc...............................@..@.reloc..f...........................@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\SweetIM\Messenger\mghooking.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	168240
Entropy (8bit):	6.137096654586006
Encrypted:	false
SSDEEP:	3072:uEFrpHLQXKo9LL7aJxNNowUEQDYWZ12PxZy7N8QOFijA:hprmKULL+xTJy7N8QW
MD5:	B7A60ED4FA88D630E14E51D5D85F25EB
SHA1:	5F6B7B23624779F0D196BFBC3B5AEE872FBB832F
SHA-256:	3F36088D34586D2F052A5B6360930EFCA972D9E854745B1F1B2FBC8F7BA67F98
SHA-512:	531EB806F6AA25522B36B365399AF84648E7AFE50E269184F951059D22C32AC6E334AA163DA6259803AD0D8913CEA6BD6328365F9084062141D684E177C26BF4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 33%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........P...>...>...>...c...>...1...>...^...>...a...>...c...>.z.c...>.w.c...>...?.[.>...>...>.w.^...>.w.b...>...`...>.w.d...>.Rich..>.........................PE..L...s.6N...........!.........................................................p......................................P................@..x............p..0!...P.......................................................................................text...3........................... ..`CODE....$.... ....... .............. ..`.rdata..[........ ..................@..@.data...$...........................@...DATA......... ....... ..............@...BSS.....i....0.......0..............@....rsrc...x....@.......@..............@..@.reloc..B....P... ...P..............@..B........................................................................................................................................................

C:\Program Files (x86)\SweetIM\Messenger\mglogger.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	37680
Entropy (8bit):	6.111808444854254
Encrypted:	false
SSDEEP:	768:qN7HU86igSN7aPN9e+AZZpJyL6lcyJuEUjDqb70MLFm4L:s08ZgSN7aPN9e+UyL6lcyJlUjDqb70Mv
MD5:	9C0ABC7CCC700856139274539B703C3F
SHA1:	A10BC23441A65123A86249EE21FC991AECD68AE9
SHA-256:	18C6CA0289D20DA99A91660C89921278217E9BCC6AE12CF793EA90E32EAC967C
SHA-512:	04872EAF3DAC8A30D60704D06B6B65F356D21EA2CADCA636D9E3FC20C62A126A1230D8D8D5D6F723B77A84D3FAA655CA8433C361DEEA556F62EE70C4B600C443
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 29%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........f[0..5c..5c..5c..hc..5c..:c..5c..Uc..5c..jc..5c..hc..5c6.hc..5c;.hc..5c..4c..5c;.Uc..5c;.ic..5cY.kc..5c;.oc..5cRich..5c........................PE..L...t.6N...........!.........j............... ...................................... ................................"..Z.... ..<....@...]...........r..0!..........................................p ..@............ ..@............................text...`........................... ..`.rdata....... ......................@..@.data...H....0......................@....rsrc....]...@...^..................@..@.reloc..t............l..............@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\SweetIM\Messenger\mgsimcommon.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	49456
Entropy (8bit):	5.0078585953099495
Encrypted:	false
SSDEEP:	768:8Ky1DWhw0+MD3DEgFjceMhcCorMDMT30UD9aLFm4Sjo:8x1DWhw0+MDTEgFjcelyCEUIo4mo
MD5:	0CA4193DC3D47E2C6B03FCFBFA83EE8E
SHA1:	6337E84F82A83AB687D79D106025D0EE2DA71F37
SHA-256:	380BF72A60B7F606C743949F85DD4EC0AD7B705F7CA063431473E4396F0CDEA6
SHA-512:	4189D45288C02194CF976BCC5C9E2DB016CEB8A8B7468A2A574A893BD0ED352292BD1D4BCEA581101EF6B2474A5F51F0E2B1CCB753F0AD6E27FCBC1864DEFBDA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 26%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........&+..Hx..Hx..Hx..Gx..Hx...x..Hx...x..Hx..(x..Hx...x..Hx2..x..Hx?..x..Hx..Ix9.Hx?.(x..Hx?..x..Hx]..x..Hx?..x..HxRich..Hx........................PE..L.....6N...........!.....0...`......P4.......@......................................................................@^.......N..........................0!...........................................E..@............@..D............................text...J+.......0.................. ..`.rdata..[)...@...0...@..............@..@.data........p.......p..............@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\SweetIM\Messenger\mgxml_wrapper.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	74032
Entropy (8bit):	5.492565135442503
Encrypted:	false
SSDEEP:	768:A8gN0Q5P1kdL3AbkkSxIIHHFx7GujLFQCBTYvKSkFaPwu2DLFm4F:A8gN0Q5P1uElInF8iLDECBFaPwBo4F
MD5:	D07D73E787BD71B90DDC05620600CCC2
SHA1:	CDAFFE368D35372036C4EE5AAF0ADA76FD96729B
SHA-256:	F2D2D2C61C6BF3B040148E76C7F49341B2C8D312507AB268739452B6D25C4839
SHA-512:	921077E197C0B7DB1F28310619B4E93E04817B951DAC69A1C963D608E20B80254FE2D9461E973F833C22E1E183F3320E9782CFC88BA101C28F31465C898E53F0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 26%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Q.........................................z......w..........[...w......w.............w......Rich....................PE..L...q.6N...........!.....p...........u..............................................4...............................p...$...@...d.......................0!..............................................@............................................text...>o.......p.................. ..`.rdata...8.......@..................@..@.data...............................@....rsrc...............................@..@.reloc..\|........ ..................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\SweetIM\Messenger\msvcp71.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	503808
Entropy (8bit):	6.4043708480235715
Encrypted:	false
SSDEEP:	12288:b692dAsfQqt4oJcRYRhUgiW6QR7t5k3Ooc8iHkC2ek:bSYACJcRYe3Ooc8iHkC2e
MD5:	A94DC60A90EFD7A35C36D971E3EE7470
SHA1:	F936F612BC779E4BA067F77514B68C329180A380
SHA-256:	6C483CBE349863C7DCF6F8CB7334E7D28C299E7D5AA063297EA2F62352F6BDD9
SHA-512:	FF6C41D56337CAC074582002D60CBC57263A31480C67EE8999BC02FC473B331EEFED93EE938718D297877CF48471C7512741B4AEBC0636AFC78991CDF6EDDFAB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........k..............C..............N......N.......N......N......N......N......N......Rich............PE..L....Q.D...........!.................-............<\|................................&[..................................?....2..<....p...........................0......8...........................(-..H............................................text............................... ..`.rdata...+.......0..................@..@.data...h!...@... ...@..............@....rsrc........p.......`..............@..@.reloc...0.......@...p..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\SweetIM\Messenger\msvcr71.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	348160
Entropy (8bit):	6.56488891304105
Encrypted:	false
SSDEEP:	6144:cPlV59g81QWguohIP/siMbo8Crn2zzwRFMciFMNrb3YgxS3bCAO5kkG:OlVvN1QWguohInJDrn8zwNF7eCr
MD5:	CA2F560921B7B8BE1CF555A5A18D54C3
SHA1:	432DBCF54B6F1142058B413A9D52668A2BDE011D
SHA-256:	C4D4339DF314A27FF75A38967B7569D9962337B8D4CD4B0DB3ABA5FF72B2BFBB
SHA-512:	23E0BDD9458A5A8E0F9BBCB7F6CE4F87FCC9E47C1EE15F964C17FF9FE8D0F82DD3A0F90263DAAF1EE87FAD4A238AA0EE92A16B3E2C67F47C84D575768EDBA43E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........v.............K.E.........S...F.x.....F......F.G.....F.D.....F.F.....F.B.....Rich............................PE..L....Q.D...........!..............................6\|.........................`......V...............................L....C......(.... .......................0..h+......8...............................H...............l............................text............................... ..`.rdata..`...........................@..@.data....h.......`..................@....rsrc........ ......................@..@.reloc..h+...0...0... ..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\SweetIM\Messenger\resources\images\AudibleButton.png

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 19 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	764
Entropy (8bit):	7.631231884636608
Encrypted:	false
SSDEEP:	12:6v/7zLrAj7Ot9ktPn3q5aYVnvkE3l+Q1DlJC4ep1EO0V/18Om93CcPHaQ+eM8nSb:6APeitP65aE8sl+QDO4ep1E//e95PFSR
MD5:	8A898701FA84C675AF171F4C7B30F86D
SHA1:	9827AABE4EE3A3BC62CFA3DA9E16FE99101D0D31
SHA-256:	7454A57C5FF219F763DFF583F954AA5A491FDC598FE8836F7F36401CFF7FAED3
SHA-512:	DF0E73A241D80916367CF81E120FDEEC4940501B4EF037958FE493E8E42A0C8C54E5ED212B5804263943EBAD23B7233F6B5FBF012FE7A5671E0F47253198BB5F
Malicious:	false
Preview:	.PNG........IHDR...............Db....gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<....IDATx.TKL.A..vw..bK.Z...C).F1\..H$.\|.\|..$z4QOBb\|...= ....x..Z....x....iBK. =....3.l4z.Ifgf...........5..$....dP,...hG$...Q.O`#........j...a-...r....p#.>.d2...2,.F(v..i..T.J....`...,L....K........9..:.F0".<.....W..,V\|..Y..P#...?.....x....0.E8##G.............=.....B..,..........oP....5#..b~a..L..O5..>.y...-..p.!H.?.....v..j..X,.........Y.f-..il.=}...;...(..r15>h...J@.u..B.....=.?5%q..KK..".E.uuu.f....+H....v]................5.T{<....j.."K...f/-Vj.+......(.x"......2.n.Ag.ULQP.....g_.B.a.Y~.0.B.....0..#.l...$\|e..W..r.k.U..u..=.)pN.<g7&&.W.\|.;<....*..... &o..9{....D.....S.:t..4L.....u.b.....i[(.?...q..cc..u..x......`..RV'.d.S....IEND.B`.

C:\Program Files (x86)\SweetIM\Messenger\resources\images\DisplayPicturesButton.png

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 19 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	897
Entropy (8bit):	7.70805588110842
Encrypted:	false
SSDEEP:	12:6v/7zL8y0/EB7tHf+oUHK2sbAhtaBZaOLz/37ZpUyTtXfNeQJ58tSOBw01/66dd9:20/EP6HfskhtaiO37NXlZ/8tM0I67T13
MD5:	B466024FBBD35B838E14D7C87A293C29
SHA1:	BDF02C976CC7E44ED88608C231B41F2A09AEF05E
SHA-256:	33B0485B1D867D4F5C7E304F64DB783E30F3568F14E0CC8A5CFD63735D90E95A
SHA-512:	01FDBBFF65A8C766329B181815A86CD4046D44E33374CCBD18055718E24A4180D297A8FBC536557B2EA86D6640F2A3466DD8B6171ACE9DA95EE8AECE35DE10F6
Malicious:	false
Preview:	.PNG........IHDR...............Db....gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<....IDATx.T.o.G.}.......Ol+V(.!....$n..'..o..D..8..[i."@\|)B..!!N.....zvv..Fi..4+...{..~o.Yk....w............O.n7.......f...4.M.s.!......y..k...q...5.l..zR...........t<.....O.R K9.H.}..z.....w.]e.p"(z..\|x#6.j.FK+...Y...#.l[..8..Gx.\|..O.`....}..&%..nM...[.kq.ub[..B..... u\|...J..d........".MSP.{...N2Xt.....'.T.8.8}.A...C./V.X.....-'./....}..=0.......%......,C.R@.r...I...P.b..K..A..._..\|N..q..(..}.3.5d......5!5..C../PW..Vpl..2.......(......AoK@....9R7.Y,..,....X..T'.1..(c..'.Fq..W..{.\bN..Ri.ScqMa+.5c..C.c..n...f.o.1...w...v..t..y.....&.-.1..4y..Td.........9.[.)...[..uL.Ch...Bj.Q.....Lj......aU....h.~!.F...}@s.1.I...B....h...h.W...T...8N.....l0.;..1.....:..;....S"v..p.+....zHq9VC...d...k..........r.1#\...O.Y.n...\|T....)......p...6....%.e.;....W.W.....J........IEND.B`.

C:\Program Files (x86)\SweetIM\Messenger\resources\images\EmoticonButton.png

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	873
Entropy (8bit):	7.661531807761159
Encrypted:	false
SSDEEP:	24:/2Qkk0iz8sF7nHTWxx8/kaMgeeeC37qlz:/D0u5BMze17M
MD5:	F9059782C69E3D29F8F6FA3F591C31BF
SHA1:	F65AF4DE4503C44BC1904F4E74FA9BBC3E96E0D4
SHA-256:	A702E4EF4CB3AA1B6E65F3C0EC6D8CC71ABFF40A5F29FF319267808D8B6A013F
SHA-512:	C99EB536F7CAEF1CFBF23E402347D96A21424F73B42B3EDFB92011EF46ED7CA3BE3FAA49F7D5507FAEE8A4C32C6DCBAB27EF7C1D1CD42E16498BC006A4765213
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<....IDATx..KHTQ....>.....gL.,.J-.)...-J.....T -".. t..Q.r!.A..z..B."..L...Lm....<..t.d....l........R....9....`.@V`.x..sq.......'..)J...-9.4.M...>......1/..b.jUs."O...r=M.....<....[...0... ..]..d.......9.%.!.j&4.`...:.2........2...C.X.$...M..FDG......T....7......:....&z~..B.hJ.&...._Vm....._....&.=..=... >}v...7...AX........;.....>gI..&.`.d..\|.......D`....wx.c.wk.4..c5g..z.)}..A..w.1.A_?.<......6.>....VK.lQ....AH...D.c.g..D.....u.R..]1.[...]...>\:cE[h..V.@..P..@T-...4.O4...l......>$&? .B..X.....).......H.xQ....?...5...I.=.a_z.......+ ........1.e....;=....F...<..{)J...&..WL...D.1..3......d4.]...=...T.......gf....o.J+..~.A$D.@.f.....X8.>..k3...iwK....%..QM7..q.r-..{..........!q.Igb@zY.`..v..*M..XR.$S..aa.ta.3...o...s.Q....)....IEND.B`.

C:\Program Files (x86)\SweetIM\Messenger\resources\images\GamesButton.png

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 26 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1352
Entropy (8bit):	7.794508116498578
Encrypted:	false
SSDEEP:	24:Aof7kh5+z0shi3OF1wF/EfdJJxCcrFYd6VD8QXhtr93Qx56dOuUZSEXCmGMMuvR8:9fAh8HU/EfdnU63Hp3Q/uAS8CmL3vRxW
MD5:	BA7A2AA8AB98BC9805D746A888529449
SHA1:	E42027C3734FC0BF1848F7A401F2985E5F34EB91
SHA-256:	C9278468A702F1E7BC25274320E7EE5B189B4F4F29411894A3310A7686819C1F
SHA-512:	1BC2FA5A2EBE2DE044B908FD0511E0394E96586DC0C14654D5B103DFD28B156ED3D85F7C9310925EE738F523AB9C82B054837CEFC4C4DF25BB9FE558667C2754
Malicious:	false
Preview:	.PNG........IHDR...............o.....gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<....IDATx.UmlSU.~..m.vk7..+.1...1....,...k..jP..(.1(.c.1h .M.?P.1@....-..apc..(tss]i.n.G?........7.....}.y.........L..2....\|2u.\|.{2..E....>....?D6Z....u....F.b...3ss...q.f'hnlfo...A..}.L.ew......p<H.;=.c/p.A...a/....$6...=...7....h=s*.N...;.o/./Cx<...[.o.<.aU.r&.. ..].=.x.hK.".g..W@;...Kg."..I.....5.. @.....}5.rM........g.....W.n.gYM.k..}.<O........[V.x.....^.#.P..WR."0.D(.#.S..h0......6c..u0.+.ly....U...MphW...J-.,\R#+...55...........`.A...\|....i.....{.>H..]......Ri.df.lIC..y.........OD.o>98-]...@....W.o..n...$.(....B++.....{t...V.....N...$a..;.).\|LA~a1....y...\|.>....8>M..t.......@........V.h......x....b.D.....01..}..a.y. K.^).0.NF.U.._...\...n:u....k...........~?4.&(.?..M".d\;.........lAhL.O..).2..@S..E.+j=...%;?.vf.(.........D.%...W...<e..~Cb..B6.:z...3.#.S..(..". #....<!U.(.......r-?:.#gpl.;<............2.1....a.#Co..\...b.l..H.+.......1..U+..b...

C:\Program Files (x86)\SweetIM\Messenger\resources\images\KeyboardButton.png

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 30 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1367
Entropy (8bit):	7.805671779066865
Encrypted:	false
SSDEEP:	24:c4Jl6uCp1AD5wxJEoLTGrjubed7gPkUl3g3tENyHvq+9xCdIIZBAlqIYK/Q:c4JlHfwxJjLTKjuegPkUiqyHvq+9xCuC
MD5:	EA7CB2CE805F51D83E019F830C1C6855
SHA1:	F4C6D90EA98FB875DA41B5849DFE8E7662802733
SHA-256:	BFB71B4CE18CE142D88C4F24810BAD4C497A56D46126376F42A8322CBCA5642D
SHA-512:	1F7CBCAB960E7AD408FA12677663F59B1BF8CCDF6021541F4AC8596C9EAC768E3A2A147BF3390F948DD4233DE85568F171752CC679C88CFF880FC99E23670055
Malicious:	false
Preview:	.PNG........IHDR..............:......tEXtSoftware.Adobe ImageReadyq.e<....IDATx.U}L.W.........r......XEQ!.U..#mjbj..M..j,6.1.6.m..Mc......CZ..Mm...S....\|T..C.......c.>...b..J..%..y.f~3of.2.....n%fK3,...D.V.9..XQ../fma.?.3....W.}.....P._.ddB....z.......a.>...O.......d...S..f.K.....}..g......k...C..._q.f....S..s8..itv..q.@t..p.10._P.'6AtWS.Y..9.......SO...n...Wy..Cr..l8.GZ..+$....._..R..8..Q...HnJNBB...I(.GB.db.MOF...t.vz.......e.^..VT.\|...{. q.D.,.3K...oH..1..:>... ....z.......e ............\|.M.NCEy\...,.c.&\y...J9l>..4.........%..<TD.M....x.J...+":9...P.u.....,g...g...wx...uXRqH..~7..g....,.d$.k~/F..v.."...g.........2.Cg..uQ. bf....}4.xK..E.$..m.X...?......?W.,.;.?...Q....../...(....\....W&.(..X....3..........E.I...v....ZJ.......a....0/-.....f.....~T..90......Y.....kkU...dM.*....v...?.A.m'.6.A......)..f,.Vc..pk.h27M9...#...1...v.D..46b"J.Vo..jU.k..(....q.....Iy..J.q~.........qi.Q..H4Ac.O.....m0=...1s..;..#..H%!<.C38.5....zS.L..0...b..q..

C:\Program Files (x86)\SweetIM\Messenger\resources\images\NudgeButton.png

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 23 x 17, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1238
Entropy (8bit):	7.79950019325555
Encrypted:	false
SSDEEP:	24:xA7ZvQo3QVTocgnL/3JssytwZrRlVblek+LFiiEY/rR6Ee8XD:q7ZvQgW8xr34wZr1l7+LFzX/rRgG
MD5:	19BCBFF4E3521B9A39DBE24611F7BACF
SHA1:	B25C9638AD238DD26B25948CEF66AE550FA0F027
SHA-256:	0F67571150B29838D1AEFFEF30992C334F6B8602F756ADB6316834D3EEAF5F36
SHA-512:	925B90495E3FCB02BBA4A39F4086A2B1BEE4EF94C12B2743DCD5462993BFB8F26E0DB575EF02A7AEF68776CDA0658F8908D53A3421F1803A61E308B2DBB9155F
Malicious:	false
Preview:	.PNG........IHDR.............6s7.....gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<...hIDATx.T[lTE.......-.lw.J...^Dl.m .......%.h\|P..c.......b$61U...bI..I.1.(.X...{....v...=..qv.)..$s...7....~.9.jJ.1..F.......`.NO....l3p.@r...[zYM.W.%1.$..WIey7.z..{.!.S.D'..._..7......d9.....[..7L....wK[..V..A:.t....'y.E.1............C..?P..0..L..y...w.`.p...m..z...og.Bj.vf.zi...U.K...IXi.0A,.K..+.. .U` .).....R.N.....{Z.K.6..z.......=.e..r.....F.B.......i.3M\.Q.....k.)j=.T.w.\..J....Z..i.. .c?h.:.iE!2..P!...._D.+.....:.Q.C^Js.d....L.:..)..r$.C .4..B%A.6......d..M....qK.%.1.......*..1Og.N.l.....F..8...#.3!.dK......A.......fm..I....+.{..C..2..8k4...m.>rlu....8.c[...G...F\|{.b...8..8..J.!u.,z....)6..%<.....n.wl..1......c..._...n.Y\|....B...+!.........^P+...0.7.h.r.........Y.....f.}.._IUA<5(&..=[...~....15).5t sA..%....w......F....e...w=.?....;.^........H.w.."p.g<..a....TU.W-...Dj@p...j...R...d8'`w...i.g#...o@...d.....=]8.s.P.h.".R..0.GN..v.Ov.t.j..a.AX.

C:\Program Files (x86)\SweetIM\Messenger\resources\images\SoundFxButton.png

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 18 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	929
Entropy (8bit):	7.687460890231212
Encrypted:	false
SSDEEP:	24:OCUTz8SYHqOqPsByTcAkfgspIoNHWtqwu7g:OCUUS+qOqfTcfg5IHWtqwu8
MD5:	189F6656DAD19FBB14BC0643AFA99929
SHA1:	4B3AB63B2B8DB139230D4411AD6F488D129B0DCF
SHA-256:	C9B1C99DFE261335DCF5C3511E37645559399920779EEB864683DCE625D64B71
SHA-512:	DB1DF920B8DA9FC4581ECD5971715B7BEF466DAA41C0E8DA668C33B05CECB3A84DCEFF333E400BD0FF2F7FCF4C3B15DDACFAC6279CC8D1C5CD4C76FA6C0F75C5
Malicious:	false
Preview:	.PNG........IHDR.............../\....gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<...3IDATx..;..U...}....x...v.l..(iR.A..R.........J..."..P.(@H...DAC....(.h!@.Gv...;3..=...{9..........g.(..a..O..>..J..5.k.4.7..v.eLJ.J...)~c@..L.......tFa&R..... ....{.m.^..-?...".!MS........,.n.'..q.3......Hg.Gj....J.p...8D7.Jh..msB.e.Pn../v[.N....wc.\|.BG...'....Iy..R0.7.. D....PdM....s....c.j..........&"~...,.....5.h...L.+.D\|A..Q.#...t.......f....^.2;@..$U.a..m/.../V.........u.......)^5M..k.+.\.\k.9...k...w.w.W...F.y.{.Y...I...:..K.}....../T6.....d.t>...S..S...N.8....t.,....t...j....F..V..q....c...GA76.j...X@.V.f..Z6...z..f.<..P..`W.A.... \|@..`..-L.w,.....!...z...7;XS.g........(...o.._'2.{..L....}......<(....E..C?pR..E..?.[..W=.t......{..`...s.3.9...g:.l..2.....~.H...!...!$...~......5..J".o.....?:........./G..C.xr..A.Oq_.<.D.d..y.I.\| .(O..0......._...7....6U.*y.~.....IEND.B`.

C:\Program Files (x86)\SweetIM\Messenger\resources\images\WinksButton.png

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 19 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	990
Entropy (8bit):	7.729663010061948
Encrypted:	false
SSDEEP:	24:PH4wl0YvPFamof2YiqLe2wJ1uJ0Y09GLgQKzogK:f4wrF0wt2SoJ0B9K3Kzo9
MD5:	EE3A4E0726081CC0F10BE3B607D34309
SHA1:	BE014BCBFD3C1A8EE845E3C9F64169486521FC45
SHA-256:	8E0FE3D5DE1260C418C5E57DDE3FA6B28BEE56D6B9062FEAAA1C0D816790E2F9
SHA-512:	9D90D6C5183CB1987C0546C15486246DD4F3BB8883112D1E4DFAC34AD3D6FD1482E29A35095D91B8CC3F68C03313A9B5FE444B5EE9F1CD80835D915ADAC6D8FB
Malicious:	false
Preview:	.PNG........IHDR...............Db....gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<...pIDATx.S]lSe.~....s`k......]..u..#Fp...!$....Da...$....bb...ib...h.@.7...S a.`Q.b...u+t.Z..Y....wJ. r.{...9...C(.xV%.G..\6.O...^...?\|...O>>........b!5...........I.....P2..k........T2....`ha..Dq$.N92..D2.4.c..2. .<M.1m......mq..9.kPU..GR.....^0.....`.D....(\|.`?3....dNY9..... .."I.-......+.N..w.3B.8...9.b.\|.n.0..d.{p.....See.8r...wv.n..;.v.V..j.e2H..H..-..r.........n(.3.UI..........3.7=~...t.G._...N.. 0.]../....C.......&...v..).`gg.Tt%.Y.~.o....\|..r.6CF....#`.....\|.yt.lG0.".N5...G..u.F.G...`.. .x...~.......@..)....G..l.Z......q..2.x..gl......^.:Z..o.U...M.h.+..o.....L....~$.+..........z. .w!..8~...@...}.:*[dt....D.^....:D.B.r.C........F>/Z.s%...$...0z6.V...u.....E.:k....p>.......p.1.um\|J...l..%e.l..xF....=0...........Hd.B.(p8+.....6vq.....e.?.\|....jZtt..O'.^.{..D{U52.........\$\|.w.....O./.O..........,...g.\...Y&.9...`..=5....`..-wG...[....IEND.B`.

C:\Program Files (x86)\SweetIM\Messenger\resources\sqlite\mgSqlite3.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	393016
Entropy (8bit):	6.826407049982154
Encrypted:	false
SSDEEP:	6144:DRU2DRRGOQ0ebQfMLkunuhoZ3Uq922DcNUzhqlxm+OCS6Cguh4s10px6fu0xQgg9:m2DRRGf0eUfMQoZZhZmxm+OGLu+s6pYm
MD5:	8A4AF3B0695F29186AD02E2FD766FA3B
SHA1:	C8F1E3F28152C6C010B7AE8FA4D167E3C388FF0C
SHA-256:	346F692DB61B1355DF431F58F0A9C4C6ED7BDF0C9AD3E2CAD42E0B3920EA44C6
SHA-512:	3C94CD08C21BCCFE66AA7C813C86F8A11672C0472DABFD12B699BB01B55741903CA73C8385F531DD2733EC70CAEE0AF3040C6B84F09F5B5E981BA12026CBB4CD
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 21%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......).Gom\|)<m\|)<m\|)<d..<w\|)<J.R<n\|)<m\|(<.\|)<d..<I\|)<d..<.\|)<d..<l\|)<s..<l\|)<d..<l\|)<Richm\|)<........PE..L...YK.L...........!.................2.......................................0...............................................{..(.......................8........!...................................v..@............................................text............................... ..`.rdata..............................@..@.data....H.......*..................@....rsrc...............................@..@.reloc...,..........................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\ClearHist.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	107312
Entropy (8bit):	5.631599875472934
Encrypted:	false
SSDEEP:	1536:hx7TXEwPHT38Ty21h5GJtNRnhYJ+uUJpp+WSo4X/:P7LwTy85G7NgJ+F+z
MD5:	BB77228C327A99C353ACC35A0F334086
SHA1:	6C6C6CD1004B1D052F759F50F149B4DB72AB6C58
SHA-256:	07AE888C94A0A3AF0561953EB01C63FD051114226DBD2345F399625DA52F8C48
SHA-512:	CC2C3580FD0165CA6AE727E0582E5965C2B0B4B84125674DDA1FAB537B9A4741194E40E42BE33C5FF927A9EC380C93B244F9AD818494318E6FA92E0637BED551
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 30%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............p..p..p.....p.....p..U...p..q...p.....p.....p.....p.Rich.p.................PE..L.....UN.............................,............@..................................G......................................l...d.......(...............0!..........`...............................p...@...............,............................text...t........................... ..`.rdata..<+.......,..................@..@.data... ...........................@....rsrc...(...........................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\Microsoft.VC90.CRT\Microsoft.VC90.CRT.manifest

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (1506), with CRLF line terminators
Category:	dropped
Size (bytes):	1860
Entropy (8bit):	5.392371898016726
Encrypted:	false
SSDEEP:	48:3SlK+vU6g49Pd09kkKKMzEAZ09kkKxrzVHNw09kkK3zY:Clt8CtdXks5ZXk8pNwXkK8
MD5:	53213FC8C2CB0D6F77CA6CBD40FFF22C
SHA1:	D8BA81ED6586825835B76E9D566077466EE41A85
SHA-256:	03D0776812368478CE60E8160EC3C6938782DB1832F5CB53B7842E5840F9DBC5
SHA-512:	E3CED32A2EABFD0028EC16E62687573D86C0112B2B1D965F1F9D0BB5557CEF5FDF5233E87FE73BE621A52AFFE4CE53BEDF958558AA899646FA390F4541CF11EB
Malicious:	false
Preview:	.<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">.. <noInheritable></noInheritable>.. <assemblyIdentity type="win32" name="Microsoft.VC90.CRT" version="9.0.30729.4148" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b"></assemblyIdentity>.. <file name="msvcr90.dll" hashalg="SHA1" hash="98e8006e0a4542e69f1a3555b927758bd76ca07d"><asmv2:hash xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#"><dsig:Transforms><dsig:Transform Algorithm="urn:schemas-microsoft-com:HashTransforms.Identity"></dsig:Transform></dsig:Transforms><dsig:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"></dsig:DigestMethod><dsig:DigestValue>+CXED+6HzJlSphyMNOn27ujadC0=</dsig:DigestValue></asmv2:hash></file> <file name="msvcp90.dll" hashalg="SHA1" hash="3aec3be680024a46813dee891a753bd58b3f3b12"><asmv2:hash xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:d

C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\Microsoft.VC90.CRT\msvcm90.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	225280
Entropy (8bit):	6.034450906226583
Encrypted:	false
SSDEEP:	3072:P5wveocziNzMLSMOYscmuW0AXLiLR4JpA86Goao1vJU87/amFYw8fF01OyAILH:hwyOMqcp3AXOLR4JpL6ft3/amiX2OyX
MD5:	67BDB40FBE6CECC320507161B58D134A
SHA1:	11EC8313BA20E96A0F776A018586CC127A451E16
SHA-256:	A15EAABBE6C32FBA34C1CACD8C0F206C28A69A8B73E619C962D812AE7FA0F844
SHA-512:	687289C5740E5316ABDAEC56BBB6C0A629FC1F374B865A61F71AE3561738B42D3C31987E53ED0DBAED0AEFD357824303B0DD7527BAA81FEE2434A4BCDEC6433D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........;...h...h...h..ah...h1.dh...h..gh...h...h...h.-.h...h...h...h..qh...h..vh...h..`h...h..fh...h..ch...hRich...h........................PE..L....LYJ...........!.....:..........Z........P....?x.........................0............@......................... 3..4....&..d...............................d...P...............................H...@...............(...........p...H............text...T9.......:.................. ..`.data........P.......>..............@....rsrc................H..............@..@.reloc...#.......$...L..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\Microsoft.VC90.CRT\msvcp90.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	569664
Entropy (8bit):	6.521726174641651
Encrypted:	false
SSDEEP:	12288:iZ/veMyZ137mSEWT0VkypLvgLehUgiW6QR7t5183Ooc8SHkC2eU8bw:iZSZ13iwJmgLq83Ooc8SHkC2efw
MD5:	B2EEE3DEE31F50E082E9C720A6D7757D
SHA1:	3322840FEF43C92FB55DC31E682D19970DAF159D
SHA-256:	4608BEEDD8CF9C3FC5AB03716B4AB6F01C7B7D65A7C072AF04F514FFB0E02D01
SHA-512:	8B1854E80045001E7AB3A978FB4AA1DE19A3C9FC206013D7BC43AEC919F45E46BB7555F667D9F7D7833AB8BAA55C9098AF8872006FF277FC364A5E6F99EE25D3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........#%..Mv..Mv..Mv.66v..Mv...v..Mv..Lv:.Mv...v..Mv...v..Mv...v..Mv...v..Mv...v..Mv...v..Mv...v..MvRich..Mv........................PE..L...~LYJ...........!.....4...p..............P....Hx......................................@..........................P..,....E..<.......................@.......43...................................%..@............................................text....2.......4.................. ..`.data...t'...P.......8..............@....rsrc................R..............@..@.reloc..HC.......D...V..............@..B................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\Microsoft.VC90.CRT\msvcr90.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	653120
Entropy (8bit):	6.883968356674239
Encrypted:	false
SSDEEP:	12288:shr4UC+UumMaIYE8EoPP1cI9xPP2OKDL9QXyG2pUmRyyvRt:cU9FNPPbxPP2OeL9Q2pUmRyyvRt
MD5:	7538050656FE5D63CB4B80349DD1CFE3
SHA1:	F825C40FEE87CC9952A61C8C34E9F6EEE8DA742D
SHA-256:	E16BC9B66642151DE612EE045C2810CA6146975015BD9679A354567F56DA2099
SHA-512:	843E22630254D222DFD12166C701F6CD1DCA4A8DC216C7A8C9C0AB1AFC90189CFA8B6499BBC46408008A1D985394EB8A660B1FA1991059A65C09E8D6481A3AF8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................6.........!.R...7.....&.....0.....6.....3...Rich..........PE..L...yLYJ...........!.....\..........@-.......p....Rx.........................0............@..............................\|..P...(.......................@........3......................................@............................................text...t[.......\.................. ..`.data....g...p...D...`..............@....rsrc...............................@..@.reloc...7.......8..................@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\conf\logger.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	882
Entropy (8bit):	5.243214210906668
Encrypted:	false
SSDEEP:	12:TMHdoIzORX/qTGL2i/8FoefZv6jurhySwcdNJDakw2l1fXqE3BqEMfhqjIMcGIMm:2dVzQX/tVOxZv66N7aoJqJ9GlHSd
MD5:	D9D2B6C50E8C263085E339C56A9AEFDA
SHA1:	B2124E53E11519DC3CEBF148B408518A00B8F099
SHA-256:	CB0368C4FAFCD1DC79B5EE240420523345CA52EFB5578B5D50DD1A0CCDEF1F3F
SHA-512:	A7F81A4FFE9ABF55C6435F1910A1FADBF84048744A9E424DD1EC652DE3CE00842812CAB038DD870911BD44B4C040B6D8FB129AB49978C8F19682E43845C9C2F2
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1" standalone="no"?>.. @version: -->.. ..Levels number index:..DEBUG = 1,..CONFIG =2,..INFO = 3,..WARNING = 4,..SEVERE = 5,..CRITICAL = 6,....ALL = 0,..OFF = 7....MinReportLevel - the min. level of reporting; ..MaxNumberOfLines - the max number of log lines to show on the window..-->..<Main>.. <ToolbarLogger>.. <WindowHandler MinReportLevel="0" MaxNumberOfLines="1000" WindowHeight="600" WindowWidth="400"/>.. <FileHandler MinReportLevel="4" MaxFileSize="20000000" MaxNumberOfFiles="1" FileName="$data_dir/logs/toolbar.log" AppendToFile="true" Unicode="false" FormatXXX="Compare" />.. <MemoryHandler MinReportLevel="0" BufferSize="1000" TargetHandler="FileHandler"/>.. <DebugHandler MinReportLevel="0"/>.. <Logger MinReportLevel="4" TargetHandler="FileHandler"/>.. </ToolbarLogger>..</Main>..

C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\default.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	202
Entropy (8bit):	4.990571735951617
Encrypted:	false
SSDEEP:	3:vFWWMNHU8LdgCIIUROELA/dFSzLrR4j3UbICmW/IE/5QgIQ4VGEDhINPy:TMVBdoIUojlF6XqDUb+054VGqSN6
MD5:	D9E8318011E4E94DFA6FD8A4511BEBD0
SHA1:	E4C475423800F14CE32CBD8184F86ECFB9265C4D
SHA-256:	01410434F72008E7DFF5E6E44559D83681168F4CE074D6FEC1AA26142C4901A8
SHA-512:	6A5FD8D12029D577D28E780FEF1400949383F5C9776A77BDD0C34D8BB64DA8BAED8C0F9064D2E26DB77BD7B3610C93A1D5C586E290591298AA39D8732C9EAF98
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1" standalone="no"?>.... ..@version: ....explain usage..-->....<Main>...<ConfigFiles.. LoggerConfigFilePath="$install_dir\conf\logger.xml" />..</Main>..

C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgHelper.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	130864
Entropy (8bit):	6.005575486286837
Encrypted:	false
SSDEEP:	3072:njcHZ0OGJtQM0SGWbh+Vte7yVduhU+9XzLFOt2dA4Erl:njGZcjx0SGWbhEeaduL1zLFOt2dAx
MD5:	6A26BF6EF74C909418830CCF21B07030
SHA1:	67F5FF90CEF520B9F2C20F4B8605D9B44F50AC20
SHA-256:	953EA239FA2BBBC12E74E2BCF09F406A1664FB6AED29528172E79CF04285EDEC
SHA-512:	7B1DDB4DBD66C349570D42DF508D3106E68568229D2F852727D2DC2A9E96A9BB38C43E949DF5B5329F3454FC89856918C57DCFE84A922D6A87EB18FB7054B447
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 29%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......._ug.............[.......l.......l.......l.......F......<.d.....<.r.............l.......l.......F.......l......Rich............................PE..L.....UN...........!.....:.........../.......P............................... .......q..............................@...................................0!...........R..............................8l..@............P..h.......@....................text...j9.......:.................. ..`.rdata..TM...P...N...>..............@..@.data...............................@....SHARED.. ......."..................@....rsrc...............................@..@.reloc..V...........................@..B................................................................................................................................................................................................................................................

C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgHelperApp.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	128816
Entropy (8bit):	5.770141765252759
Encrypted:	false
SSDEEP:	1536:Ka6s7R8pwTBkFLQI9R9CBZ35D/1hItb6o5p/tNRnhYJ+uUJpplzo4G/:KIKpwTiFLLGZulv5pVNgJ+FlG
MD5:	D75FAE09ECE929C91DE64F326661EFA6
SHA1:	9DEF40DDA676B2AF2E7A5C075E6FB00F791FC63C
SHA-256:	94DDE703E51872DE3B57D7FF7AE4C44C41BB37EAFB5C2AA7CC626BE7CEF2BFD6
SHA-512:	EAFD1338DFD45173D36FBF4B52E2A9A5E4D119B8A4E97235A7DF71C523C2A934BA884CD30247FE06DE70292729B4499C1D1BE7A1FA51440EE8078F076EAAD1FE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 32%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................e.......s.......c......;...............t.......d.......a.....Rich............................PE..L.....UN.............................H............@.......................... ..............................................D...<....`..................0!..............................................@...............X............................text............................... ..`.rdata...5.......6..................@..@.data....-...0......................@....rsrc........`.......$..............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1299248
Entropy (8bit):	6.109883545755318
Encrypted:	false
SSDEEP:	24576:cFCnTyH1ZFume2Fv4LxB/R/e0J2JUbVf9fFPA1:pTo1ZFi2FALxX20J2JcNA1
MD5:	0CB54F3AF8B0596F2010BBB1DB889530
SHA1:	B6F7F82B2743148AEEC55C8FF2D636CA8269AE04
SHA-256:	14B2734265B205E9DA3E4D8E46F2D4677007CB8C8627C6E5937CEC95C631FDA4
SHA-512:	E72E538CB70760C4E4689D9D7114D62873B129355E96F2FD783B7D6EFD5B6C7B5CF71E4C02A63E4DF2A40DF9328915FAD15903BF6C5910DE7FAD384AE8C7AB8A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 26%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W.............................................S...... ........S.........................!...........................Rich............................PE..L.....UN...........!....................................................................................................................(M..............0!......(.......................................@......................@....................text............................... ..`.rdata..p...........................@..@.data............l..................@....SHARED..............:..............@....rsrc...(M.......N...H..............@..@.reloc..b...........................@..B........................................................................................................................................................................................................................................

C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarProxy.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	115504
Entropy (8bit):	6.523186815271148
Encrypted:	false
SSDEEP:	1536:DXyjUuiHSwX7M2ZNmt86TyQUvXdj5sveW2qd92ZmN4x5a88cN6D0mo41:4ipLNmDyfZBW2qd92Za4x5agQDL
MD5:	5042FCC1013AB8158D934AAAD1C20197
SHA1:	0B1FEF9F8C1B60BFC7083A5B956710AF30A921C0
SHA-256:	3DBDA9698E04CF1B009B4B057715AC8658E126C8AEC1702A547CDC376B77C614
SHA-512:	2FFE2D1967F7B9AA6496329DA539D74AC02BA5F0DD78AC3FDEF1657D4A7EAD143096734AD6D1C2193EF4A1472F09975E92908A7AF0609233507D0D0357CC6ED6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 27%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F...'._.'._.'._.h._.'._._._.'._._._.'._._._.'._..._.'._.'._.'._._._.'._._._.'._.u._.'._._._.'._Rich.'._................PE..L.....UN...........!....."...\|......i+.......@......................................".....@..........................}..\....u..P.......0...............0!...........A...............................^..@............@..d............................text....!.......".................. ..`.rdata..<>...@...@...&..............@..@.data....1...........f..............@....rsrc...0............\|..............@..@.reloc........... ..................@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgcommon.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	279856
Entropy (8bit):	6.517008530261805
Encrypted:	false
SSDEEP:	3072:dGfLNeuutXeC/ww4UBBEwA0Y8KWKQrOwjkRcD7ZcMY7EHuyfS4QOt8IIHZHL34J7:2qtF94UBO8T7qbu/S4QOt8WYm
MD5:	F419380C797685B26BF309B7D8560585
SHA1:	D23B979D5015A3C48121BC0D001C5959F28FAD47
SHA-256:	831C428E705E82829F596C2149B7E02E335E9407B4B7D1A7560BC6B0144F9747
SHA-512:	FBC383CB381D96889531CF469DCED4D6E3CF615D8467F977953D9E9B325D89FDABE42BA6BE6D07566D98FBB4ACC09D7DFAE9C699C98EE3532FB1A007AADFCF75
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 24%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-...C..C..C.....C.8....C.....C.....C.W...C.W8..C..B..C.....C.....C.....C.....C.Rich..C.........PE..L.....UN...........!.....x..........&C.......................................`......................................pG....... .......................$..0!......,5..`............................... ...@...............<............................text....w.......x.................. ..`.rdata..$Q.......R...\|..............@..@.data...............................@....rsrc...............................@..@.reloc..LC.......D..................@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgconfig.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	55600
Entropy (8bit):	6.530763806702505
Encrypted:	false
SSDEEP:	768:cahdQ0oi9d14BUHiYtVq0z8OoEwx6G3aMOxEuqsnvOGNUIXGNAnNbEVPmF5DKkK3:F9nJHj77HRTE0F4kK7LKOyRJoQ/02o4y
MD5:	6361FDE630AAEEF88C17F4F262573C73
SHA1:	67F218081158151503E298268D2F258F3B11C671
SHA-256:	5B9344D7452B8D72CFAA28DF310A08FFAFEACF897D9A3D44E9E5E24228F8F233
SHA-512:	188459CD024B7F7E6BF45CD5A75336DAB1EEDF89DD7307EDCB7E2A65F00AD081B4A89DD74CC54951AA684EF252060481727EEC62BFC41F3722C0C5DBC734B9DE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 27%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.{.:..G:..G:..G..G;..G3.G;..G3.G7..G.SnG8..G3.G3..G:..GL..G3.G<..G3.G;..G$.G;..G3.G;..GRich:..G........PE..L.....UN...........!.....`...T......._.......p.....................................................................p.......l...x.......................0!...........r..............................pw..@............p...............................text....^.......`.................. ..`.rdata...=...p...>...d..............@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mghooking.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	153392
Entropy (8bit):	6.614181708729449
Encrypted:	false
SSDEEP:	3072:PAHoxIbTHyKoNbrbu+IRdG4wUz7kLyZlmPx4uYpcOmjZttBzt:ChTSKkbrwRHkLMuYpcOmjZP
MD5:	556D7E28E575983D03B78AC2FD5FFDB6
SHA1:	41FAB98B142F801FE3C70FEF8021EE492AA32CC8
SHA-256:	D9DDA1B3E256232DAECCDF60C4617B3EF04C0DB389EFF9A471E1214E15CAA92C
SHA-512:	2E96ACECCB7B0A337EE1C08D5BD2647CCABFBAD9F632E24FA1117BE4CB573BD84EBE3B472D72D5B439A965EBCB1A1A24D7E6C9AD951B03448C5EE92314D5B877
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 24%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\|s..8..\8..\8..\.]+\9..\1j(\9..\1j>\4..\...\0..\1j.\=..\8..\...\8..\:..\1j9\1..\1j/\9..\&@)\9..\1j,\9..\Rich8..\........................PE..L.....UN...........!.........X.......................................................................................................P...............6..0!...`.......................................................................................text...d........................... ..`CODE....$....0...................... ..`.rdata..............................@..@.data........ ......................@...DATA.........0......................@...BSS.....i....@......................@....rsrc........P......................@..@.reloc..X....`......................@..B........................................................................................................................................................................

C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mglogger.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	40240
Entropy (8bit):	6.256023899515359
Encrypted:	false
SSDEEP:	768:yP1Ar0bHg86igSN7aPN9e+AZZpJyL6lcyJuEUjDqb70rLFm4n:ydAr0bA8ZgSN7aPN9e+UyL6lcyJlUjDn
MD5:	FB1B0C6484BACACA79C1CC57C8B6A8BD
SHA1:	80CF65020779EA0D883A84974231E3AD9BB05A37
SHA-256:	16879B8B29F3E4142D71D0DF99BBB9F3BCF68E0A3881780AC7D949CF7FFE6C52
SHA-512:	A35E79765116B5855098E3A8BC7147F2FC132B8167BEAC52E3EF997AFF4C4343F80C6B8271BA86814EE915701B7FF2FEB66E1295BE4229A66E3E07228F02F407
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 25%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........A..}A..}A..}..O}@..}H.L}@..}H.Z}O..}f5.}E..}H.J}F..}A..}q..}H.]}R..}H.K}@..}_.M}@..}H.H}@..}RichA..}........................PE..L.....UN...........!.........n............... .......................................................................$..Z...\|!..<....@..x`...........\|..0!......4.................................... ..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...t....0......................@....rsrc...x`...@...b..................@..@.reloc...............x..............@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgsimcommon.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	48944
Entropy (8bit):	6.435109554262982
Encrypted:	false
SSDEEP:	768:EhI5gxOAxL7zUGTKSLTbfp/VzwN+UaJOtn8WUYpDWhFWYf5QnDLFm44g:EQgxOAxH4GTKW/GNAJOtUhUQ5Wo44g
MD5:	D0683261FB568C7DADB4B3D5AE8E4C1E
SHA1:	DF1E6FF511529CC9E481067D166193FE8E060ACF
SHA-256:	9F34167385063EB90838F5FB9407135456133331D582E5C106D200B96605A2CE
SHA-512:	015D17B885B7DC282E3ADC3D65F3C8BA97BB324F7D505755F98ED42B3598B0CB4DCDAD4EC1A6DF55630901D46E6A44F468B67E12D54FD120ACBB0ABE5FD05242
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 22%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......!..e..e..e....P.d..l.S.d..l.E.h..B@..c..l.U.b..e.....l.B.i..l.T.d..{.R.d..l.W.d..Riche..........................PE..L.....UN...........!.....R...H......9T.......p..........................................................................'...............(...............0!...........................................v..@............p...............................text...@Q.......R.................. ..`.rdata...3...p...4...V..............@..@.data...............................@....rsrc...(...........................@..@.reloc.."...........................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgxml_wrapper.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	61232
Entropy (8bit):	6.506542407066868
Encrypted:	false
SSDEEP:	1536:V0gR6lTXvMzo5aRp7SCUuBHDVkMQk7O1sCPUyTo4M:egpzoOeCU8HRkbk7O1sCPUy8
MD5:	EAA88240F201E655772462156931A703
SHA1:	1FA090B96CC391C0E695FD0BCC11CA2DCF078837
SHA-256:	0283D8512AEA672894BA4BBAFF5804C3A531D6A1A91A0CC8F1AE7B267FE46FCC
SHA-512:	2B0AB65BE3E8C5DFAAC184350155970EADA045CB9D396BF91268C285CF607C50B424DC8CD631D67C3CB16AB913A4FC202534D55F4AFEDE0C58B3A337EC788F4D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 24%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........L..RL..RL..R..HRM..RE.KRN..RE.]RA..RkQ.RN..RE.MRK..RL..R0..RE.ZRE..RE.LRM..RR.JRM..RE.ORM..RRichL..R........PE..L.....UN...........!.....r...X.......q.............................................................................p...E.......d.......8...............0!......p......................................@............................................text...Lq.......r.................. ..`.rdata...;.......<...v..............@..@.data...<...........................@....rsrc...8...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\MenuExt.html

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1068
Entropy (8bit):	4.6785592084972905
Encrypted:	false
SSDEEP:	24:RIi/5UBWDGXyS/+mBbjbBxj0h/uXNbv5Q9Zivf0R4JA7J9JQYM/:ei/mWDEO4vLoh/u9r5Q9ZivHO7J9JQP/
MD5:	37A92AC9643DF8287D000FDA83437FF5
SHA1:	7418CB17712B6315F14E27001B3EAA5B98556976
SHA-256:	B925DF28B1021889ECD078A86558F54031C8DE79485D9A4C7CE2AE992C3254A8
SHA-512:	8E735053C65554A7122AAE23C28D27E3E11E154A77F2EE391C8817CAA1FA1473AE81AD9582C63DA137D7EBEDA2108673D92809D3334D4A67921CAA8B9BB8B0EA
Malicious:	false
Preview:	<html>..<script type="text/javascript">..function trim(str)..{.. return str.replace(/^\s\s/, '').replace(/\s\s$/, '');..}....function logObject(obj)..{.. for (var key in obj).. {.. var str;.. var value = obj[key];.. alert("key = " + key + ", value = " + value);.. }..}..try..{.. if (external.menuArguments != null).. {.. var args = external.menuArguments;.. // logObject(args);.. ... .var doc = args.document;.. .var window = args.window;.. .var selectedText = "";.. .if (doc.selection).. {.. selectedText = doc.selection.createRange().text;.. selectedText = trim(selectedText);.. selectedText = escape(selectedText);.. }.. .. // navigate.. // we don't have cargo in this, as agreed by PM (i-l).. var url = "http://search.sweetim.com/search.asp?src=4&q=";.. window.location.href = url + selectedText;.. }..}..catch (exception)..{.. // alert("

C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\SmileySmile.png

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 47 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4706
Entropy (8bit):	7.939609866150524
Encrypted:	false
SSDEEP:	96:nSDZ/I09Da01l+gmkyTt6Hk8nTLTT3Aau8Z3pqoMN4t4qDhV6c:nSDS0tKg9E05TLTTHu8E4t4qDrl
MD5:	72C9881C090F7C954451691AEC0266D2
SHA1:	E0572385B740CAD95B8471A77CF1384A8A4EC687
SHA-256:	510F120EFE2F234C3662020143BC9F606EABCFCB80C901D53EA8BCA753A27E92
SHA-512:	C6A1B65EAEF3C1A3A49A53024F7E4AD898286A2AF8D779E6088B54E95C06616570D39CBCE202E48C59A05224AE41BF8AC66778B4248ED319E6F36A0FEF9FA2E6
Malicious:	false
Preview:	.PNG........IHDR.../...........&.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\SmileyWink.png

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 47 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4513
Entropy (8bit):	7.923205264207793
Encrypted:	false
SSDEEP:	96:nSDZ/I09Da01l+gmkyTt6Hk8nTJlJ0NDxK+muSJyXnmlqsOc:nSDS0tKg9E05TbaDxLmuuyXmYsOc
MD5:	A75E7B7FB7225134A01B01C6985086C3
SHA1:	C18649F3DC4CFD551CD861FFAFAB51B98B8CBCE8
SHA-256:	000D8E36A1D432D6F6C182D41DEADB3F3B051CC5C5B32AFCAC6B3A80C4D802EA
SHA-512:	590812B335FB7AC128AEB4012960377AB2E2FC1D03A1418287DDFE074874B9C12D0D76F021126EC7FB06668281C2E91ADB678DB4B3B49E612D3BE74E954DA52F
Malicious:	false
Preview:	.PNG........IHDR.../...........&.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\about.html

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2910
Entropy (8bit):	5.102327707427828
Encrypted:	false
SSDEEP:	48:ImMD4IC093zEtrut6DrnfLigw3yP/RG8JNnbRxzFatQthQtEiQh1V:SDhC+OnikRbRytQtaKiQh1V
MD5:	3EB2AA9C3DA3FD5A6307C05A62DA653C
SHA1:	22BD4928A2615A90F413E553E10747FF1E1E9E74
SHA-256:	0AE9858C98047CE3AC4D3FF7DE7466903A90AE7DCFB1F6875C0038937D037D37
SHA-512:	8B10EE9FE50F6E18561D7FD91A20F5D6517FBC10710F74769EFCE4337D129DE8E6235BAFB41882AB909FCE5A95A32540AAE3DBA97533B53DA61B272E93C82F9C
Malicious:	false
Preview:	<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">.. next line ("saved from url...") is called "Mark of the Web" (MOTW) and is used to prevent .. showing warning messages (see bug 1081). More info: http://msdn.microsoft.com/en-us/library/ms537628.aspx -->.. saved from url=(0014)about:internet -->..<html style="overflow-y:hidden">..<head>..<script language="JavaScript">..var g_objToolBar = null;..function DocumentComplete(toolBar){.. if(toolBar){ .. g_objToolBar = toolBar;.. var temp;.. .. // step 1.. temp = g_objToolBar.TBO_GetMessageById("id_msg_general_caption");.. document.getElementById("id_description").innerText = temp;.. .. // step 2.. temp = "Version: " + g_objToolBar.TBO_FileVersion();.. var log = g_objToolBar.TBO_LoggingEnabled();.. if (log).. {.. temp += " (with logs)";..

C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\affid.dat

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	6
Entropy (8bit):	1.7924812503605778
Encrypted:	false
SSDEEP:	3:MVs:Mq
MD5:	D48B2F639B5214B5D02E145D223F3C97
SHA1:	9A82B09288C5552B09AD22978AB8F6EC0D077B5E
SHA-256:	3B7B041D37D1D693C3AFE25D2AF7D56AD2EE7B98EDDB2CC1A055C1117E55542E
SHA-512:	FD213B33E1A3BC1CF1FA6B3F04BD73A9D168B0857A2971B352B91E0514ED934850B67ED9D6EB837147379B48855CBC63825AB8E9C25D69F8205FE296D18DD78F
Malicious:	false
Preview:	1000..

C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\basis.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	exported SGML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	974
Entropy (8bit):	5.256022101425163
Encrypted:	false
SSDEEP:	24:sXTeysgIUnDKysgIadWhJty8jBq8zxj8+bKj3zk120SW6lR5CU5:sXTeEIUeEIwopjzKM120SWAjx
MD5:	4CD2844E6F473DF5AD9B71330813A4AE
SHA1:	BECD78947DDD4ACC10F8C0C136022F2DD9BC5FED
SHA-256:	EC57E90FB704E828728F97B15ACFE46D91FBCB74283CB4F0BC78666EB17622DB
SHA-512:	656FF1C722F9FC9EBE511BA02F6A95C11AD5D2585E338DC0E1302383AA3576D3FEA5D59DFF579AFDC373C97ECD35EE53C1DE3A92F0D35D354273E17AAC1A750D
Malicious:	false
Preview:	'name' attribute in TOOLBAR must be in basis.xml, because used by register/unregister -->..<TOOLBAR name="SweetIM Toolbar for Internet Explorer">.. the 'settings' and these 'url's must be in basis.xml, because used by register/unregister -->.. <SETTINGS scope="0">.. <URL id="firstURL" default="http://www.sweetim.com/installbar.asp?barid=$toolbar_id;"/>.. <URL id="updateUrl" default="http://www.sweetim.com/simiebar/download/toolbar.cab"/>.. <URL id="urlAfterUpdate" default="http://www.sweetim.com/updatebar.asp"/>.. <URL id="urlAfterUninstall" default="http://www.sweetim.com/uninstallbar.asp?barid=$toolbar_id;"/>.. </SETTINGS>.. expire=1440 minutes (24 hours) -->.. <INCLUDE_XML filename="http://www.sweetim.com/simiebar/toolbar42$remote_xml_suffix;.xml?toolbar_version=$ITEM_VERSION;&barid=$toolbar_id;" expire="1440" layout="0" no_cache="0" local="toolbar.xml" id="tbs_include_xml_020834"/>..</TOOLBAR>..

C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\bing.png

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 16 x 16, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	1015
Entropy (8bit):	2.5591351559521294
Encrypted:	false
SSDEEP:	6:6v/lhPf+ItYGmh1ISlgnFm4A3pO7M+39novgHzgzSHrC2p:6v/7ueG1fliFmDT++IHTR
MD5:	8222B8B77447C3C3B09718661CF1DE45
SHA1:	035BD2996016F77DAB0A5483E8675F74E03A7EFF
SHA-256:	C2205B371DC6133F97DC1A32E63E09A0A52673F0AFFE14A96ED17C2219C67886
SHA-512:	5566CEE0467C30722DAD83BD4A92A258C3EDA68189B00F9897185688351DE90E4070C0273DC50566A7CF15019962EBB6C2A421C933FDB2C95B39F4398BD57B35
Malicious:	false
Preview:	.PNG........IHDR.............(-.S....gAMA......a.....PLTE.....$..2..A..P..m..{.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................!......pHYs..........(J.....tEXtSoftware.Paint.NET v3.5.5I......hIDAT(S.O[.. ...\|U..o;.3.%.......y._........x[.A...UO..)d7Z'.&c."..\|a[W"i0.s..6{.=.Q........ui>B.........V

C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\blue\search_button.png

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 100 x 22, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	337
Entropy (8bit):	6.970701773355069
Encrypted:	false
SSDEEP:	6:6v/lhPE7fjnDsp1sY7H3jAKSDSij7V71hVr61vKhsFRcSgSFf6jEMTeup:6v/7Kf8J7UKSDSiR1DrUyhGRTXMKc
MD5:	A448EA6E4A5C93B519DB905DF8335E0F
SHA1:	45F764BAEEF94F447DD0FDE5F6865915583C58BD
SHA-256:	2FAF68C63A126B78C5DA668E15CE8AAB37FF13116C4ECE92BC804BDA3516AFD9
SHA-512:	7EB3E2464648632C3B0F202C80A296C1949574EFC2ED3DF8A6A581B80FB3DA7A30AEBAF436E31046A19812A22D044639B32762D68866FBDC71CD50BF99D8135E
Malicious:	false
Preview:	.PNG........IHDR...d.........6.9.....tEXtSoftware.Adobe ImageReadyq.e<....IDATx...=..1...dr... .......p.v....r..^..3.^q.9.9......b.j...S2.z.z.z.b.b'%3,M..6m...8....t.....QB.z.l.....Q...}0. ......fPD\| .P......r.A.@....X.?......4!}.rB.@.&..... P ...A...-@..O....8!@......I.;$.......uB.R\|o.`.w..L..6R>7......`..X>........IEND.B`.

C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\blue\search_button_bing.png

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 28 x 22, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	546
Entropy (8bit):	7.181439595953868
Encrypted:	false
SSDEEP:	12:6v/7Ys/UJI7RGJ8CkcYcM2MTLxcEtvjhhWmb:vxJtcTLGMF
MD5:	5E751DA58811E96F7B4948102BF7FCF0
SHA1:	28B94AED3B2BD5574A08A7A1B58279FED590CA21
SHA-256:	9B27EDD9BB20190986B53E9E1F69B2210EB804EC1C00F2477E0CA54351961BEC
SHA-512:	C2CFF798484173B31BF47570425976D734183B123CFB9DD024B6138F16C1F6AE8E9203F7DEE890BC94A7AEC33210632A80B4113AB2E0DAA3CC58C6EBDCD8D0B2
Malicious:	false
Preview:	.PNG........IHDR....................sRGB.........gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....tEXtSoftware.Paint.NET v3.5.6..Z...{IDATHK..KN.0.E."....v....F.X.;`.l.&L...1C.E..+..q...H\|K.......P..'.....>N.6v......>=.z!......7.Y.1F.R...?.\.T...N5..\..\.vV8..p\|.....\|k.U..B........e.....b....,....2P..l.j..~.ne......L.-.....Z......T(4....5..`..D..u.\|.K...!kCc.u)S..ZauY...>.j....^5.<8....cAU.P..`+e ..%...........5bg..1!....5w..6@....rUcb)w../3......S..q.......!.Ko.N..m....{AV..(...x....0z....IEND.B`.

C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\blue\search_button_current.png

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 28 x 22, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	869
Entropy (8bit):	7.682052140424539
Encrypted:	false
SSDEEP:	12:6v/7Y98kuDYROKmYScK0PcgApTJFgw5v8EzhTGMyag3hDZgWAo1OuASqi04MsnqO:vE0dSP0PcgApTJFg9EF+VeRoMsnq8zz
MD5:	9928A485489003BB67AB634119139128
SHA1:	BBDA96B1E426081EB2C5C94F490D22C3BF48D49A
SHA-256:	F34E980F778BF73DDC552544223DF8731B7C689F910E144C8210838976C02496
SHA-512:	D124CE92013EFCA6FF78551BBC36D2BA7F29C943859888FAE6D0CE8BFF0F096BB50E07AD01D24C51D3EF8AB0B8C66C1B5387CBE21D192104FC7FA5AE817C2699
Malicious:	false
Preview:	.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<....IDATx.VIL.Q......e..e."(.l.....Lz05..1..A.&z1.....D...h....#.Td1Ke.....`.[:-.N....AZ...Lf.?.....D.QM.B..5RW.4w.S/...1.w0..b%..J..@\.R.....J....Ow.%i.....Cl.el....F...)/p..K.i...Z;A.M.l+..3.\w..Y._GK.R..+...-...u..>t.@........_.B.C..CV..1..pcH;E'.. -.F.....Pe.`X;..b.)J..........!%..GG.0M...8Q,T.g......(ffL....R._.naE..C...`...o.z.X'...w....p..0.w..w..^#...7.v.%R...f..>@.......~.U..m......h.....8;..;.....L...u...q.....=....8.W..V.L.s..Hpx."..drp.z).:..{.w..K!.bz.E1...e.}@E..7J,..c...n.c."...K.`3..5.n.........`.M8.8.9O..]....#..Y...3!..{xI...u...7Aav"R....LG....#;.g+..dCc.C^7O..<...iu..h...~=t#F....#.y..%.N.8L..S.q..M..zn...O..7f>\|..8'..'.`.........,\./...i(...f...D2.\:.-..cW*W...j...K.....R.R.........@j....h..>...mv.Z.\z..#..'1.v...[....IEND.B`.

C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\blue\search_button_dictionary.png

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 28 x 22, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	819
Entropy (8bit):	7.6934816895279985
Encrypted:	false
SSDEEP:	24:vO6A1675+FmziAn73M1LQxLqBVj7k1yHj+4e:G6A875+EziAnrM1kLS+Wjw
MD5:	2A2390C7AA513435A05C840C56C6991C
SHA1:	84F34275B4F045A1547B49D1C18C6C8A1F44A4EF
SHA-256:	BFAFF84D2047D887954C6CB866EAD6AC775ECA5294FF81B0D2C46FD88736AAB8
SHA-512:	93CAFA78DDDC5FA02FDCC3329A7AB9A561086D6D0CAF55D2CDBA6EA809FF8095CBF37ECFA7410F3DAD20131D5829E0AD1D4407FABAC628392D64D7A0D138A39C
Malicious:	false
Preview:	.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<....IDATx.V[H.Q....e.VW.u.XI..R.BP..CF=...>.D/.I/A>.D...O.t.H...L7.2M].Z...,..k..ev.r:.h+.B..7..f.....9..HY.."..".l.L...jF...;.,...wQ.@....G.YM.......-.6......[&V.0.Dip^..u......P38.h........:.^<...z...%..&Qf.N.X....A`c.o..;..q...v...8.}...y.].$N....%q...KK..G........0...4.P.ha.2......Y..p..W3N).M..IX.`.p......v3..g../.g......<.....e{....I.&......y./.Bum-..\....m.Y.a..BZA...8.:.L...*\a..X.....4...".......R..`B4..... I&.+....k..La...-.x...U.`[%......T.u...dq.+......C...j...}>.........xw.)...]K.f$j(.,.Il...nT..J.L..........1..c.6...H.f.u..i$.u..?...+Y.k.].....B.f....v...K...](Y..o.Ai#..}M$.4..K..]...T.lO..8.....lU3.<..FK..i...yE......".1..E.&.).o..7....'.'...=f.E&.81..N'.....Hv.4T.....[....-T..[k.....IEND.B`.

C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\blue\search_button_google.png

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 28 x 22, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1993
Entropy (8bit):	7.425064439205079
Encrypted:	false
SSDEEP:	48:HitNn2VQJ31Fqax1dfz0MpIRIUo0opMct9:I2qFJ19gMrUK9
MD5:	421501848E7575CF94532FE52E8957E8
SHA1:	61BB83C50BF471DA60E8F00F3FAA2AD06F619184
SHA-256:	7EFD78E468AED9CC3192A4B8BEBDB69E4F8B77FF26A154E434B9C2E188A4C6BB
SHA-512:	6D96CB9BBB79CCCD959E522442DA15BDFA7B3672FFE1B6A3D1CAED332639B5B0990EACB410005F777685C7698C0A7860CBF13D9B3E01EC1D4F10002D0868472D
Malicious:	false
Preview:	.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<... iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:D66FC75FB05311E0AB01B920BDB0B601" xmpMM:DocumentID="xmp.did:D66FC760B05311E0AB01B920BDB0B601"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D66FC75DB05311E0AB01B920BDB0B601" stRef:documentID="xmp.did:D66FC75EB05311E0AB01B920BDB0B601"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>h.r....?IDATx.V[L\U.].>...0....th$%$E.&..I...&...MIl....4.a..&M\|D?Zc....Mcc$...........P.2R.....}..wf....!.c......

C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\blue\search_button_hover.png

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 100 x 22, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	340
Entropy (8bit):	6.953213046047767
Encrypted:	false
SSDEEP:	6:6v/lhPE7fjnDspTAkNUvHZQQ3M1dWBBYI+a2MIDFxZBGhEYPf7YfQ35sEghZOp:6v/7Kf89A1PZppu3anYcPf7YssZI
MD5:	8321DDE1623150EE3F8A842129DFE230
SHA1:	55798EDBA21E045923E9874845C9931A2C56E022
SHA-256:	44F55FF8BA6A17CCFC72ED3212E9E8AA8E858D72D61363EB02322BCCBEFE07E9
SHA-512:	36436047D2D761AC33E41C238473DE67DA10427A7E0AC8D1E1B0255001A98D9D567276CF4D65F26EFEF512FD76A58C2DAE96513A86214706497E5A58C0DAEF21
Malicious:	false
Preview:	.PNG........IHDR...d.........6.9.....tEXtSoftware.Adobe ImageReadyq.e<....IDATx..1..0........x..=...p.g.n...(... ..$m\|..y....d.?^^B...m.@J.\G...U...LR......W.).e.L.PT..M...(x..Hb&.....1....!B(.B4...(d. D.."M..2..QB.B.H..D!..8.J..w8.J..{.!..xo1CD...3D...".IB\.E...,t. 4.,Yxrq...d...:.!.1.....L.....zz.e..v?.....Dg\|..!....IEND.B`.

C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\blue\search_button_left.png

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 10 x 22, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	315
Entropy (8bit):	6.993277687660621
Encrypted:	false
SSDEEP:	6:6v/lhP8L5nDsp322BJgxezfPrIpTDzICjBGMrbZv6YXe0X+X+DQO8bp:6v/7btzgxezfPQv/jUayYOzX+sOO
MD5:	5A102F9FE237D8E23A3F508330A5FCD0
SHA1:	BB4A1B425F11BF70D6FCA61C862C0761AE6C8FD6
SHA-256:	BC6686EF9E34FE99FE92BC13EA7270D42C74E9D38483D9F148475855E3E76633
SHA-512:	C027AB73D33E482C804C8F3FC728156C06BE531E0BDF6DC4DDAB96A4838C1A8031E63238F48EF2E92A88ED2FAD27932507E6F3F6FE8385EBD4EE274E5AF818DA
Malicious:	false
Preview:	.PNG........IHDR..............&.]....tEXtSoftware.Adobe ImageReadyq.e<....IDATx....A........D.J#....x.o...*..!....BEt($z....pQ)...1.&..l&.".t..9...l.h@\H..S.I....J.Xh.fWj2uH......S.\...../V`....I.>E.$....c8H)M...V..%......wq0.<,\|!.. ...-H..o.a.>..F+........SCo.~.`..}3...]m..;:..S.....o....AT.q}.+....IEND.B`.

C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\blue\search_button_photo.png

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 28 x 22, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	886
Entropy (8bit):	7.714127843723636
Encrypted:	false
SSDEEP:	24:vl4cFLxScCciU3Czu4lGH5dAEU62QFeTKb0hQ79ezH/5G:b8et3CHGH5dH+QIObceUHY
MD5:	5CA13955A8511CE93E012E2DDB0ED8C4
SHA1:	FE043B89F999CD47B475E5EA30DF7C44F63CBAA4
SHA-256:	EBE29C03464706B35DB69A1934C3D69DAB0804E80E97577C83588A3339EA1977
SHA-512:	6DDF992FC7B999CE8044122B19C2C758ADB0B5E25E13FCD35A0FD20503608A0A804495DB6A9D0619AEFE6A7371CA3AA47DD6562B7BE2C6F51BEBA30E4E6F8340
Malicious:	false
Preview:	.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<....IDATx.._HSQ...nN]....E..z.4M$BS.zq.d..........G.@.(.B..K`".h.$.C%.,5.t..9...t.........=...\|......;$.b.ML$.{.....Me.0X...0...%.fJ.I ...wth.{..<.."aK..z.G...a......g.7..Z..JE..J.'.G..Al../_4D.C .f..I..?.s......_#..-.....&.D..{.`..%23..........&r ..r..%%.a..)Z>...C,"pL.s.."$;...V..]].-.A..Yf$..x...=.....ev...i8).3.a....E....g..Z>e...(...q....!4xl+.@..%.r.Bd........R.Q....BDK.P.p...(...q`Jy.........Q...q...H.s..4..... KLD.........6!.a....<".LXQ7..N1yX]W...Gp......0k.F,c.k..a.J.[.\<j.T..fag.......eh...2..s..l....eNr 5'....Ie)..I..}D.V.5b...F..(.....dZ.+..`.f%.....$.R.0.b.x.../..-c...[..4.~.>.....rSx.bi.M....j{.(.m....2j.....9#\N.\|>..5;n..D.....(\|HC....=4A!.Y..NGm6........I.T.a.f.bu.?....qX.h.Za....,.>.......!6..n.(..0.i....w;..p.....P...i~.0..P>.........IEND.B`.

C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\blue\search_button_video.png

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 28 x 22, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1021
Entropy (8bit):	7.742761940787856
Encrypted:	false
SSDEEP:	24:vDnipSGoZaQwAM+7nrnbha4M1iDhBgRpjcHbn59DQAJ+5nB4V:G4GMairnbhD2tm99DO4V
MD5:	3FE859A7B4D95C2D04D7131DF51C4D57
SHA1:	84FA98BEC6D06FD6EDAFA5CBEC7B3064C2675401
SHA-256:	E32E3E903F877185662D4CBF2E82C167B5D64A3402496F326E44105B96119BEB
SHA-512:	F6B92B24D46C125B225AEE5792CBE92140D79AD7F2A6CE34F04A47E14C9C668569BE665689E337EAA55B3F31E36DEBEC3ADEF4040BC35BBD063A3EBCFF357460
Malicious:	false
Preview:	.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<....IDATx..]L.U.....my.....,..2..X.Q...e".n\8?...t...d11#.W.xa.....W&^....aH..D...2..:h;d..o[z<\|eq..kbO...8.........#.:{$.....g..q../m..Ua..`.x<)".R.8...i".P73......L^....1.5.'<1F^b..Ib1An..@.........._9q.......a.64........3.\.pM.Q4u.]./Z..U...L......[or..).H/8Y7$....\..P....j/Q.......3....6...Y...om......C.O/Qi.....N]\|..\...R......}...K..{9y.+=@)6....TN&X.:.........G...Q.N.,....;.......9+.....-....:;.sWq!qc..H,.e..BL....t`s........r.#....5!..............O30.GR1t.'......R..x>..n...B..=.SOt...-.RJq.wm..TJ.. G.._.gz.....g...7.q......M.AU..d."..........?W..-....^@ &...8...G......".*aQ)u.g......vp...}...\|.1..(...".....:....k...Y..D...A^....(.5...r...-.66WQQAkS#}..3...r.?..x....F".R,{...9G..^..:..E,.n.....F..p.q.+>.`U...^....^.,..I...1.r..DXY.bN..f.gff._....i......$..`.)..c/ro;..'.jw0g..H..d..x.........E.{....G..6.0.Y.53..J..5h.y..:z.%.~.^.2wG........R.J:.X....w?.!.g.._...o..

C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\blue\search_button_web.png

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 28 x 22, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1663
Entropy (8bit):	7.223414888446875
Encrypted:	false
SSDEEP:	24:vh1hpunQWwjx82lY2T32HEVyELyJ3VZdbGcPYFmmyA0xlQVWSrG9jdXyhQRcc0Z:HitNn2VkJ3t1PCmmyAaqVWSrG99Tcc0Z
MD5:	4580C963970070BA36D4B24268039E85
SHA1:	207D566992D8D875729ED2812104509C989AC624
SHA-256:	BF73573EB7D41ECA8F8B085236021A8C3BBA4DD885C31A21A67CBDBB072410B0
SHA-512:	6428E0B5375D99AE91FEFEDD546D47657F0CEE67A3A7EA58467D347E077D24C03A519E3464FA59270FF4DAA81289D1836F03C434DA004BE10D4E531F47078CD5
Malicious:	false
Preview:	.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<... iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:49DF915F923A11DF8A6680C405290A62" xmpMM:DocumentID="xmp.did:49DF9160923A11DF8A6680C405290A62"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:49DF915D923A11DF8A6680C405290A62" stRef:documentID="xmp.did:49DF915E923A11DF8A6680C405290A62"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>#?......IDATx.VkH.Q.~.6...[M.....ji....+..R........?...I....B.DDd.&.L......L..t.].t.-7.......~.9....U..H...di".

C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\blue\search_button_yahoo.png

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 28 x 22, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	525
Entropy (8bit):	7.206210531551433
Encrypted:	false
SSDEEP:	12:6v/7Ys/UJIMN6YozKJd6ZVn23Hdn3Cl/qXYKveKN8:vxJV6Yo+Jd6Hn23HJChav5N8
MD5:	FD785C92E542F93F0C70F3BC90663128
SHA1:	A0EDE89F1C3AD5BBED6D8F94CADD70F6844F09D8
SHA-256:	E29BB4ED2D95FFE034FD8AE4BF37A4A0B25A4D3409748056759DED5DDA6B02F2
SHA-512:	3175F7DFE7734DF8D5A0846B6ADCEA8FB7CCDC812C3A90DEDFAD86F67499EA39A05F39411B5634683DE6018F294CB99A032FCE306EA9410BC3F00492691AB8B8
Malicious:	false
Preview:	.PNG........IHDR....................sRGB.........gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....tEXtSoftware.Paint.NET v3.5.6..Z...fIDATHK...N.0.E.~...\|....%%.%......v. ...@.&...AB<W..p..l$.i..(..xN..dck7.(.o{/...%.3#7.t.6..ZF.......+4.3,.0]`........c..>}..G'B.>.E.....o.v..#......N...*\...c@.1.k...[....`$bb......A..0._....0..5..]%T....a-.@...+.m..i..@...R..aU8.)..R..C]R..Bi..%....5%m..N.......~...m[ ..F.W......".o\|]B..L.>..!....,}X.7. )=./O._O.t"..#.t..U..!kR.^V/....`E...i.G7...J......IEND.B`.

C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\clear-history.png

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	743
Entropy (8bit):	7.5996926414981605
Encrypted:	false
SSDEEP:	12:6v/72rc7MPToHoGqKu6zTtfgCMIaTRxmpdTyy5aj2+GcUMZ4et7:3cZHoTYRGIals77aj2+GWD9
MD5:	DF01C158B06C58D724EC5E65F749A34C
SHA1:	9C119B8B3A322E8CCF32C72B61F75A87D5D2EEF6
SHA-256:	89E8C7E1DB5BB1AE4F1FF78B4BBB1713F5146F61F4E8AAC48EE2A01B3A342A3A
SHA-512:	EECEF4DDF0204632E9FE5D15E812DA3556B02E88076A3C7E62181973D45456D392621E8CD9074FDAF744590B520BEB9DC3FE8CF0FFBC634E843E28A3436882E6
Malicious:	false
Preview:	.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<....IDATx.l..j.q..gw].bTm.JHI.b.(...5.!.1.'..1.....B.'........b...6DS41..u]...........o......,............J..F..#M.~T..r.\|.......V..b..yZ...mmm=Y[[;^YY....X,..`.NNN..~..D.L.S@..J..V.U. ..o.VWW?f...L&.x#5B<.............>............. ..g.F...:$.I..r.9.NC>...a3..@ ....a_.Q 0...S.. .N....N.\.%.'.....SU.....2........^....]........~.V.5.W..`...e....`c#....,/..P..L&......(..l6.9L..n...~..8....L...._.....4.. ...Z....8.6...&...f&..(..M3..t:7.......+.J.T*....\|.x..U.."."o.RU.............4M.......B5.n.......t....R......?;.v..m.&...x..X..\]....".6...............!..C.w.Y!...z..(~.q~.....8.v.TTD..@....+...i.T...I...s}~.,...B.^b60.......^..\|......IEND.B`.

C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\content-notifier-anim-over.gif

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	GIF image data, version 89a, 47 x 18
Category:	dropped
Size (bytes):	1465
Entropy (8bit):	7.691763199930813
Encrypted:	false
SSDEEP:	24:zs5TKQjA2Zd2G354mga6kOKxiL/UES56t2lDgnZQ/BMtkIy8cpZa9:zQTKLS7aaYVEI2aZQd8GC
MD5:	FA0FFBE225B678531FF437711766055A
SHA1:	252C508CC7EF192668644C2E6F1CDEA2514B4ADF
SHA-256:	AD3C9FE80BC280BD0876288F87D0EAD395353080ABB0B51DEAE5015CC4A60783
SHA-512:	44F18795BCE4BFA963A748C2B851E3093D13C7C7D3B9E3AABFFD192D7A9A5FD21FE9A9BC8DC691ECF442295C482728FF5D24C49C9F1B3C497658BD6E3FBBF6A8
Malicious:	false
Preview:	GIF89a/...........b..\............WW...........L..z.......................lhA...Z[_$"!..fmnm..................................................w..K..-..9....LI7..o..........x...........b.....W..'#,U..M.....F......k`......v~...#..$....o.......<......vd.\an....&.....D..5.....5.........}2....j.....s..........'..7.....F.....Q..........%..t@@@....M..Y\|x:..C..f........_..:.."...F?.....E..1afvpsm...ga9..h..p.............=........>...........................u..u........q,>.pu......U..X???.."...........NZ.Jb..z...G....v..,....oo........?.....u..p2Ax...X..YP...F..2.._..............cfT..Z..S..l.............`}..jv...{.#....?..%........t..F..x.........g..u..h..P..C.....................xsI.....u............I..X..@.."..........4.....<\|yt....5...!.......,..../...............l@.....#>. G...T.9.H.F^V~....O/#(...q.F..\.x.I.&..O..D0LV.2.FDX.N...HgX..H.X-1.aU...5..Hqb......*6....0Z...j..~..X..uf.j..z........$....+.p.s..G3.sg.U.....z=.0....-h...fF.7`..Qi.....

C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\content-notifier-anim.gif

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	GIF image data, version 89a, 47 x 18
Category:	dropped
Size (bytes):	5815
Entropy (8bit):	7.566394685818254
Encrypted:	false
SSDEEP:	96:acMz3t1a9ch+B2+EN1QO7eTbPGtPpbsmenY/hV3VU5ooJP5Q6SSsHK5M8Z:Rs1a9a+0/QwQG55shnsp65ooJP68M8Z
MD5:	529A553C5A89BB4ACCD6CC6E7C546AC0
SHA1:	EEF677B053E9325C915ED6C260C2A5C2377C383B
SHA-256:	12238DC1A6F9E13339D51144C2B6C77F56709AFD7289C68A66B62D7A81AC5278
SHA-512:	8909C603DD1A32A1770FBA861B8A497255AEB1CF90BD4E12EBFD2EE301BF3492CF4EA82ABBC370F0FDEA1C3F407D763FD7A6ACE89DAFB95E05F3C96AB78089C0
Malicious:	false
Preview:	GIF89a/................R.s..4.....w..&...&&)..................qq...'/R.......................klh...........v.............w.. ...@@=pu~yk$..........z.........................N......,.99..P.N......?.....<.....B..'.......qz...M....T...... ...K..d.....JPh..Oc........[\^..............\|RK(........5..W....vgmw.K.....b..@.....E...[.....m....N..m..lAM....p~...........\........S{vV..g........%.....D..............3......plT...........(..C......r..e...gaE..v..`.............k..I..\...{vA...7I......V...}...V.....Y.......K...lW...:...OSW.....n...4?d...PC.\ao.....Z..K............}zeGJS....0j_1...Zq.....v9..7........b.......b..........O..g..^.....M..e....S..........................._ua...6..6..d..K.....ooo..4.......i.........0..f.........!..NETSCAPE2.0.....!.......,..../.......)..g....5.\....PP......D0X).....RHr@....Vi(.........a...4\l.. .).aIee..7}p.*..\-.l.I.5...7k..a..18)9h%A.TJ LzD....%.(H........fBS..\|.\|.K.P2x.R...Z..".k.KI..."...@...

C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\content-notifier.js

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	13036
Entropy (8bit):	4.648844852310925
Encrypted:	false
SSDEEP:	384:kY/eWIc67favVz04sEmf0Em9ZyhcoCeprTdGGCgSTzZtF:LTIc67Sv904sEmf0EmgcoCeVSTzZtF
MD5:	4D61BE5C71C857C66263F445FC4C3CB3
SHA1:	03459E5D14A12476EC829FD58E0566F81B9EF122
SHA-256:	FA440D07C2258AD92927B6A1CDCC636922E725C7287288B304D6B3A33547109F
SHA-512:	98E0B410E686894A522DA27EC81D2932AB604F6D405E881C7F13E0C203320C6898DEA95A435CD05919FED48E9A3A4C5D050BCC9F0C89DDE1A92C5B5207D3D27D
Malicious:	false
Preview:	var g_strToolBar_Domain = null;..var g_objTargetFrameDoc = null;..var g_objTargetElement = null;..var g_bAnimated = false;..var g_strTooltip = null;..var g_strTooltipAnimated = null;..var g_strImage = null;..var g_strHotImage = null;..var g_strImageAnimated = null;..var g_strHotImageAnimated = null;....// keep name of "g_domains" as is, because it is used by QA to identify the list...// "live" use both "mail.live.com" and "live.com" (bug 1124)..var g_domains = new Array("mail.live.com", "live.com", "mail.yahoo.com", "mail.google.com", "webmail.aol.com");..//var g_domains = new Array("www.example.com");......// for debug only:..function alert(s)..{.. //if (true).. if (false).. {.. MainWindow.document.parentWindow.alert("alert:\n" + s);.. }..}....// alert with param of exception object..function alertx(s,e)..{.. var msg = "";.. for(prop in e).. {.. msg = msg + "\n" + prop+ "=" + e[prop];.. }.. alert("exception:\n" + s + "\n" + msg);..}....// sets

C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\dating.png

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3287
Entropy (8bit):	7.889386976712269
Encrypted:	false
SSDEEP:	96:bSDZ/I09Da01l+gmkyTt6Hk8nTMOtScEAE1:bSDS0tKg9E05TltSWE1
MD5:	8D8E1593BA967DE591AFDDD863902AD3
SHA1:	ABCD264C43BDDFE62D793FB566F9E457FC50A543
SHA-256:	874E098C1CE4184079E1BA21FB4498EBD3019C3CC861B26F21586592D21B5C47
SHA-512:	A69E5D8507D3B1F063B0C6D991A28A46F70252C44942E16150106CBF6E537803F0416B6299E76FE29636862DD0D4D356FA87DD1032A515161ED3B7C4E0475649
Malicious:	false
Preview:	.PNG........IHDR................a....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\dictionary.png

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3287
Entropy (8bit):	7.891546537282907
Encrypted:	false
SSDEEP:	48:b/6DocieftI9G9f6A+FIDOWu0lDl+gm7QyTtctIInQSy6IVpqlnBcODRqVwJkvMG:bSDZ/I09Da01l+gmkyTt6Hk8nTUwCvMG
MD5:	A143CA61BD925BF5831EE74BDDDF1DA4
SHA1:	D0E822D6BACEA7F506481037176E04457D719DC5
SHA-256:	54B97C1D6C6F4D704D16C953FE100D4453FC5592FD9EF5AFB33260890FDB0618
SHA-512:	104544409128871B258B9623E942F07E37CF485C5A3EB3AF0EC8BC99E0D5C756D236F2F63BB267DACA87F6D2DCC0DE03F62C99AB73BC048A0660A80B87A3F308
Malicious:	false
Preview:	.PNG........IHDR................a....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\e_cards.png

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3084
Entropy (8bit):	7.883653072602856
Encrypted:	false
SSDEEP:	48:b/6DocieftI9G9f6A+FIDOWu0lDl+gm7QyTtctIInQSy6IVpqlnBcODtMiqGi:bSDZ/I09Da01l+gmkyTt6Hk8nTtMiFi
MD5:	2441C1216B08D37666AFF709DC02B82B
SHA1:	0D7D930E67636E741BF2596C5C96DC955D4D5F4F
SHA-256:	55C9629063E18E102CD31FF21E24D7AC6B799CE876036FF9E60CC6D4F47284E2
SHA-512:	2058134A2DEEAFACF038A41EDBE6251797685EFCBCE04D0D19B78A92706502CAD8646D35E5578880B3CC29B6F46F618737292781FE23750C023EF6F6770D7C1F
Malicious:	false
Preview:	.PNG........IHDR................a....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\eye_icon.png

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 47 x 18, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2606
Entropy (8bit):	7.928462933428067
Encrypted:	false
SSDEEP:	48:JvQLjzUvsiRTSf9RU3cC9XSgtj77GhfaZ1F2Xg++BCUj/8WmQiHn0V:ZQfw0iJuTocCBtSVavkXg+Kj/8HQiH0V
MD5:	74DAA0CE476533474C8F8A276E0CDE68
SHA1:	73324E3DCF8BA64012A92C57C438E570C1D90564
SHA-256:	3908DA5BDFBDF9CBAD729E45472F615691C836FE2FD46534A7BB8ADB63CC28B2
SHA-512:	F432DEFD3F7AF19E7F3732E6F812AE9872000E27B323BDB16F433FED7167D25F740F52389B801727492F541CE4604A2AE769A9E6276EC0FFD432DB45791934EA
Malicious:	false
Preview:	.PNG........IHDR.../................tEXtSoftware.Adobe ImageReadyq.e<....IDATx..ytT...o..>.-..:.IB..I...).......RwOE..V....sZN...CE9..e....I...!1f..d.LB2..I2............\|.}......v/...4..0@.i.Zu\\....;B>'...h....;F.....X,..Q..h4".jB..F...3.z........Q....\|.a5....gg.!k....GX-.H^!.3.....q.....#6.y..7<....\|.........5.N..q....].._.......]\|..D".P(..p8".......s..IY0.Y.W.....a.#7m"...........p5.9j\.,.:U:.1<'."..PC.E.f.GBp.......>.I.....x)h..%9Y..&.... ....k?r......jm.$..X.5...x<B..........o.\|D.......O@.u...=.&.L.//[,...co..6.....p!..4....D..6t........V...~....T....:6..Y[ .. ...u....@..r.~czN....?.d.D....h.....=.[j.9.N.~.m..&..cJ..R.....%.G..+<..IfO.c..;....g.wU.E.+o........."..5.3.6.w.Z.x.}..............E.eH./...@.B..$..L.u.J{....-..'h.t^...#vx...1.?..3b....3.gO.i<.....Bq.t..4.....2.....O.G...ZuM...~.9...N.H.`._G.. .......O.k..Y..%.kWV.c.C.u\|....Y)..)\|..I....A...7".?..C.Lk.lu..._<...m.D..\|.xR....`o...{SY..d...Q.Inz=A..z\.8...O.H.b.`^n..6...S..

C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\eye_icon_over.png

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 47 x 18, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2577
Entropy (8bit):	7.9228821639390645
Encrypted:	false
SSDEEP:	48:hdDuadk2E1miEeSCWdIzo6ISYYlWqZ0ns93C2fPhiGA5d:GUk2E1miEejKV6I5Y8qZ0nstUGAX
MD5:	CFC4E6E69EBF5A4D28842E6C01BE2B3F
SHA1:	258B5E2D2639876994EF21C4CF1923EC0FA467F2
SHA-256:	01050E26F3DB1F1E6E84514D5A090B1011CC61AEA7E5E2A708647984CC6C4648
SHA-512:	1BFE646263187320F47D5B522899513515AC69FCA8D1E5887E2CE8F0A21BB59BFF48646BE218A2BAFE10A6F969C9585EAB5A4CDB84CEEB7AD61C904FF1111672
Malicious:	false
Preview:	.PNG........IHDR.../................tEXtSoftware.Adobe ImageReadyq.e<....IDATx.WytSU.....Y.&M...t/....U\@..-...Y......G....q.....92v.AV....B[.....m..M..K.$}M^2...Eg<.5_./.{....w.P.P.?C..,.. .`^..%.Y.9=.6...ER..&............k....&.(....4<<.$..],.<..#.~$.;...i.fPd$........A.....1u.F.4...'2.j4l=..#O...).xx..................4M..Z..(.U#1.Y.S.OafAJ.o.._..........Z.ZB.n...Y..J&c.A/......S.a...K\.d..s...y..G)..!....GL.O......<..L.^X.....4.j.U.oD...<....`.k.Lu.[W....rc...Q{...;8g~.d..b..._...#..O.l"....O....#.......]...d.@.....7..B......)qY..%p8.`...sx....5.b.1.a..K..6..Di....[Ou.....=.......]..#.Je....n..&F.+.x............o.xh....^......$.a.)..OO.X".1.w..o}^.....E....p...OB.!...F./.j>2Tph_.....S.>.\|(.#..+&2=x....}l_....."+%.q..D....D.{..Bq.....g0..U..[...\O.....G.?Bp...s......T8...).A[.%.....r.N..Z,M~..'.....B.T..4..'..\|.`.[VWT.?t..x.op...lg{w...^.$.1...g'.8<`.h..t8.w.g{.q...dB.&....i5.G...j.>T..9.....C.sy.j...k.....cQ..]..}..(...6..=..

C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\find.png

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3371
Entropy (8bit):	7.896512358734088
Encrypted:	false
SSDEEP:	96:bSDZ/I09Da01l+gmkyTt6Hk8nTMdfMVRfAQNq:bSDS0tKg9E05TOfM3fNq
MD5:	148C71F4C4A537A1F286ED3F40D39ADB
SHA1:	9FFDA4FBE2C432191B94A7E71A0295899513AC41
SHA-256:	AF8F54A2730DE3323D559A0D0D4272598BA2F13865C2620152AA4E78037E2048
SHA-512:	8B6B397BEC1DA5EA85E04DB3C0C4E6EB4F9DC4EDC1760EF5FDC62B970182BE4F2E61C391038F71D9F89583CCAF4786EE9CE6039C0E595CCD783C86636750BCB2
Malicious:	false
Preview:	.PNG........IHDR................a....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\free_stuff.png

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3386
Entropy (8bit):	7.896825357103357
Encrypted:	false
SSDEEP:	48:b/6DocieftI9G9f6A+FIDOWu0lDl+gm7QyTtctIInQSy6IVpqlnBcOD++nBp3Eng:bSDZ/I09Da01l+gmkyTt6Hk8nTPBpCg
MD5:	BB74506C5AD084E016FC747C234DBB6D
SHA1:	1D61C743E3B4AD135D66DA9C9A83E037F3B582B0
SHA-256:	74E8A376483FD63AAF3D79BBAED2460C09BC105CE210CDA14C318E422BFDA6A9
SHA-512:	06C933E749432C6076BD3B1CE3B09FB66E93A948B4E37081D0527523C679EDF9B389E65EC84361EDA6F63184DE67F48F9949924F8045136982F6B4C29566CEC5
Malicious:	false
Preview:	.PNG........IHDR................a....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\games.png

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 30 x 18, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1400
Entropy (8bit):	7.816074724186005
Encrypted:	false
SSDEEP:	24:A4e4wGwGyE1/9T5sbHQHL8+bztMElZd2+1Q6az/6Qh7zaOakP5SIok:PeTGwGyE3T5yI8ez/JWlh7zb5cK
MD5:	D220FC4DFCC9FE787ED7303420104E31
SHA1:	0418E6877FB8FD11EA88D475AEE481376791E73D
SHA-256:	EC60B9C434EAC51FF3BCCA593542C08C6402FC012D4454F2538A21326831A283
SHA-512:	3273F90788CB048BC762E3D65EE5E3BBB98DF6CBF62BD1EE4FD265E35F797626E87E4495DB4195F90602944C53874442A3E19A0659B917D8D1B27F74CD36D7FD
Malicious:	false
Preview:	.PNG........IHDR.............L.n.....tEXtSoftware.Adobe ImageReadyq.e<....IDATx.UklSe.~{....uk;....tl..N%...F....ab..2.....1^...........C22`.....B6..e...u.9..........u9..e!./y..;..>..y.`...T....P,w... .1......V-.........m.w...%...?..u_u.e..'$L..T.d>.m'K.[..(......F.....#B2.V.q....'.`.._.\)...'R.b.'EtE.h5.T`.(J..._.[0..78'..3.A...A.....K..k{..-..d.....Mx....!oC.+.p.....N..L..X.w$....F.1...0.........)...v..eK<t..:...U.f......G@.`...A...1j).N.\...OP....uV..y.nz......+....M2.=..2s....\......6{.f......@..~h1...(.(.p...>.\|.$.u.4".M.W.@O...O.;..\|....}.7t/.ZK.. ..r.e\|x...`=....d...$tW".\..0..h..Q..r...b .S.....~..]..a.&.o/.cI.hk..FG..f.H.W.r.'K.\............/X......<.> H...$dX.....3....\|..Z....h..i......pe\|..Aw....`H..B.rW.....\|>.....ku."U....v.a6..y...e..).T,..ZRSx.MuF.^g0@J,B-...6...5.....C$.J$..Ms.B...k>..T.......9.p.;..<,.ss4.U........`.P,.....g..xKF}..EmId.. c...K3.....++..K...et.y.....Hgg.....7...#.Ry\..^...0&.c.7Z.Uh...=T..D.E........

C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\glitter.png

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	793
Entropy (8bit):	7.684921658770102
Encrypted:	false
SSDEEP:	12:6v/72L+8ffN73xEc7iY80H2s4+JYOTdyGvOjD4Msk2TGySxq79V4Ss7FYaYXXhc:RL+Ull7MWPdJTz2D4XGySxq7ASraqc
MD5:	9A8E0C4A0B83DB004B222364B924B0B9
SHA1:	17EF8169F78077741A085EFE5EC1AC1EA8B16249
SHA-256:	E7DCB87917CD57BC4C7DCD17CEFD98482CAB366BD50C6D40662ED43BE3A893CB
SHA-512:	74A4C0724EB397B5C75042E16AD1A6D9083983AE95F7CDCDE1180CC493883B2F7A30D281BFD8687ABF771D1D65D3D4AB0CFB2E9B608FEE5700EF7B48277DCCC3
Malicious:	false
Preview:	.PNG........IHDR.............h.......IDAT8.m.[hSi...z..DA....`)..(....E2.`...S...8LR\|..y..o...D.Ia&.8.^.jG.m%.....I$6.H...x................. ..o.....(H...2.dN-.".....x...'.....4..I...^d..k.q.N......OK.EF..k.];S..{.[.D)s......%...0...`.3s.}...]...bOF.\....-...`=h..VdHj9..TW0.......E......[..`..-kX..%...)u.t....=.a`.9..0a......?..z.P\#. ]:..3t1.Lc..z..5..3...E....^..v..+s.1.`......\|..%=B.TA..;..l.M..1..S...H.....Qy3..d;..-o.......... .5..4....!..$..9AE9.0...d..#?.nP\%.S.....yY.Q]..(.O..?..x.9.."..C....D3F...b%...7.M.V.Zw....~.^.+.U...V?..l.....c.Y.h.u..VY....ed~.....5...h.I...m...W...D...n.CNf\|.T\|..7~<.#.....~.^?j..z.g.#I.P'.1.:...NOO..fajd.t_..}.../f.e}^..._...b.%8....GI.5l......O...0.+}4....._.,;0M.6..).Y4.;\|.P..;1.%...MN.#6.M9I..(....IEND.B`.

C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\google.png

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1745
Entropy (8bit):	7.314815266027697
Encrypted:	false
SSDEEP:	48:oitNn2VeFhJ3FHrrVQzhlnk3GKpwn27D6Ac:p2AfLaojRDnc
MD5:	29BEB17AB2863BD566209A6F0363E40A
SHA1:	4AF239B5174F5E25336B0AC0BC9A164E9CBE2715
SHA-256:	E5F9594945671A6937C71D14E378B96EF0C34EDA4D60659E4E48592A83518B4F
SHA-512:	E54922346645A1C619AA5CA3BAB0D143F98488C0153761359271C316BD0815D1F939451F59F105308A6B6C5BB099C95CEE8BD65D0E6CAB16F2BC23E044549D4C
Malicious:	false
Preview:	.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<... iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:2F685E1FB05411E0ADD0980960B53BD7" xmpMM:DocumentID="xmp.did:2F685E20B05411E0ADD0980960B53BD7"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:2F685E1DB05411E0ADD0980960B53BD7" stRef:documentID="xmp.did:2F685E1EB05411E0ADD0980960B53BD7"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>../...GIDATx.$.[l.U................!....`Rm.$...S.h.W....$...$...`...b\|....!.m..+......e...3;7...\|sN.9...!.cG...pG..

C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\green\search_button.png

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 100 x 22, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	441
Entropy (8bit):	7.263740582002386
Encrypted:	false
SSDEEP:	12:6v/7Kf8jgyEj2P8FS9QDTBMT81y12ipZaPeHt2yl:bgPCZtMZRpIQDl
MD5:	ABC0D3126E3374192D280163CD64A915
SHA1:	689AEBC726A058619C882C10CEE1C8A76E140DD4
SHA-256:	A115FE15384CAAA4E2C9C87C633C20A207CF26DB897E620F8998EE9606CA1BB1
SHA-512:	476450C980D6021709F9D79C0297223D7915F26503E6E1A906D99FD26289486F210D1F47969CB127817838C8507D6B4EACEA15035796E799295D4694A079412D
Malicious:	false
Preview:	.PNG........IHDR...d.........6.9.....tEXtSoftware.Adobe ImageReadyq.e<...[IDATx..1N.0...'.@ ......5.(.=C.N.........@......H]P.@b..HZ...z....''.>..~...E^. H.=.Yl.;.......e.k..j..'J..R..8L..<.GF].6DHd)....ja_..VhU.........^H.@.$I}}5.^H.&4X.Q..e..4..A+D.....".,.B.PXAH....B.WY.R..E..I9..eA...Yc...,...^....mG..... d9!....L.....1Z.......,=..,+. aBj.."...,...#...n.~:..,N.. gEH.eP...c.L.....P{...!V.#..\|.e..........`.I.[...K....IEND.B`.

C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\green\search_button_bing.png

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 28 x 22, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	550
Entropy (8bit):	7.518461776810793
Encrypted:	false
SSDEEP:	12:6v/7Y98MmHtcwvnYmiWScjIQcmC1x7ATdrBUxwXPwGpMV71:v5mHtcwgQSqCHOdlXPwOe1
MD5:	87B61E927844B5D21E81A231456C1182
SHA1:	DB54BEFD79063507056EA3789764F06E0D6DE2C7
SHA-256:	1A688ECA22B9D01950F5B3BBABC13D28ADB277CFF62A4754BA5E8E45A9865965
SHA-512:	F8415500F190E2D5672568E7A8F863E68DCB5D1484857AA9DC02D8280C96A2255C14713892E0A9E3561B7F97482104ADA85634DF3C30F6D5E27CE6094D744844
Malicious:	false
Preview:	.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<....IDATx..-L.@....v.@.:... ..3."...`p........!Q80..B.6.C......l#.XWr.\.+ta.K.m.....{eC......m..r.Uq.C.1.,.......'...4M.b.".}.......^bA.).+...ZS..) ...U.\.....=...JY.b%$........)....k.&.......%.......x8.....K..'......<...lEh<...v...s.~..Gh..]Q<U.\|R@g...!..x6wC%.,.W=.`n(...j.%...@....+.`Rh.L.i..@..$.X..g.....(.....y2.......Rd..V..p....^~.s}..9KI....M+w..LH....`.....L....7mL.O...Dn.2i.....{..G...h.v../....N..4.3.P..N.."UU.i$..`...D}.0.=;...._....IEND.B`.

C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\green\search_button_current.png

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 28 x 22, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	884
Entropy (8bit):	7.668973919709582
Encrypted:	false
SSDEEP:	24:vXz06eYuild4b16tQnmKREBREgQ2PeeM0Vz4AQTfRdN:/wiJXqmlQnAAh
MD5:	8D254084A161838D1C97C7E2CA454E24
SHA1:	6B11B8932198AA54771DFA7BAA8BD360276ABBC4
SHA-256:	5567005E32CF4D2D43AA652C93AFF7481D83F02848B3706317B87E430E3D5F43
SHA-512:	1D7F000DF38ED3E796679E24AE019ACAEFC681786F8D0550A43CF940085B91D53C277DE9818010A4473DDC706D8F30D15FBFFE375B7B432D4DE00A7C57E2817B
Malicious:	false
Preview:	.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<....IDATx.VYHTQ...3Xj.....i..F.FV..D.a.Q.i=.E.-$...shQR.V....E.2.......8.Qg.9]5}...>8...s......x.v..%...wJ(+~..G#.......Q.X.i...f.@...:{.8.2^...\|I...r...m..`.d..].N....2.z.....vYq....P......5.Z....q....%....R..})e.n"z...K<.-.,cE...HM3..+P.FQ..e.D&..$h..t...R...W...\|...I.......bD.tb..."..c(.M.....n81..F#5.."B<..........Tv.SZ.....`..`....V.,...\......:L...z..Uo....u;cO..b-t....G...D.U.l.D..B..\|D.........`O..3c..##B.R...5......).....g.'..-.,..3....)a...p2.?E.T..f..;T....Q]....X.....Z...f..c...._.q&.e.. ....i..&=.i..-u..\|..m.^.a.(.V....2s...a..5.Fd...7....&y....d.#iG...t.>yI.=.....1.-.oz ..J.P...<..";...].....pf.....`a...?z.$&&.S./...5..j+.K.3......d...Z8........u-."...._~h4n..UJ....~x.r.=..........$.R..Q......cH..?.@....J....}b Y.C.. ^..}D..`.M..,`h.D....IEND.B`.

C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\green\search_button_dictionary.png

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 28 x 22, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	832
Entropy (8bit):	7.691671953917233
Encrypted:	false
SSDEEP:	24:vOHLejMP1lBPOpZgZcfLoxvZprrBejhAwK0O1t:Gr1vmzoxBprd3wcn
MD5:	44249A5AB528EB13DA75265CA25F86A1
SHA1:	3240292B8667202AE2E90807B9A3369D2E72287F
SHA-256:	9F9018AB98B9C67675ED7F634FEEEA425178FD798A5170EA23449197167736C9
SHA-512:	BDC96FF8F51A56024612B408D1248B2AF1368F851E8611007D8A25029F978EB09CC31A89008CE0247CF9B4C4AF46ED1E5E848E175DCBBAEE63908DBB33BD65B6
Malicious:	false
Preview:	.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<....IDATx.VMHTQ.......lt.7>3FlQJ.......U..pQ m".6A....6.r.A...+)....4M.....L...q~...}NC.:2#8..sy..w.s.9.. .'!R;.K..`6]s4BH.\|.}OM.0Q..0.....A)o.IWL5.P:S.p....P..dRN...m.i.......?AC.S.5..U.C.....T;&..@+9..?.....X5.?.d....@.e.>.T`k......r......z..\|s.p.,...7....R.hm.<x.83.2...9..M..t..2....Y......S..h...S.)...q. ......7...-....[....!..@?.....j..7.X..Mb.......W......Y0..\|.d...EQ.. ..x?.:.....3\..#..i....!HR>D1._..QT........\|c .`Q.41..u...aW..G.c..<.u.`g......P..6..b.(..DP..\|.\C..=.<`..z>..N....io8.v......LM..%;..wQ.2.Y.........G..x0m.@....0\2......j.j..I.D..F...c.n.T....C....l.6a..hC.:..YW...,......RV.......R.Z..(N.......S3<...k.#jn:H...... L#.-I..fsR.A.f...O.7g/r\..F.8...n....(..62.kZ.. bMz/Q....A.[;..V@....IEND.B`.

C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\green\search_button_google.png

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 28 x 22, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1953
Entropy (8bit):	7.366577823911159
Encrypted:	false
SSDEEP:	48:HitNn2VSJ3MYKa6hwcPopGCx+lbvqVaUBdjC2zT+U2:I2tYn6xPoEx7+aSFjzSt
MD5:	912DB0DBDCDE9B1F1CF911CF92DCCF98
SHA1:	75E20787B2BC31463C4F94A271B46535198D74E6
SHA-256:	6530D068D0DDE4364D020286A5FED909BFF7D5607AE20301D94FA9E00BD6F29A
SHA-512:	C5F8E6471B35EE7418E21907EA57FB4375E9D2498E040C7D2A3EFD96369E8B0DE76D14719D49C3EE105BA8B1B0BA66B0BA87194A95521E356D7DD6B3FA09F67A
Malicious:	false
Preview:	.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<... iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:EAD94B40B05311E0B906800E1B778B7B" xmpMM:DocumentID="xmp.did:EAD94B41B05311E0B906800E1B778B7B"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:EAD94B3EB05311E0B906800E1B778B7B" stRef:documentID="xmp.did:EAD94B3FB05311E0B906800E1B778B7B"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..9M....IDATx.V[h\U.]..{.I23.IgH_:.C%.mD!H.>.B}.~...`..?.X.W[.#(.B+.?.."E......U.F...Bc.G;m.3.<..l.....8.h..}.=g...Z{.+

C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\green\search_button_hover.png

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 100 x 22, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	439
Entropy (8bit):	7.259055102899862
Encrypted:	false
SSDEEP:	6:6v/lhPE7fjnDshLUrmsg+l7+lNTxaF7nSZ3NKVm9Fx+hFLvX1RQejvyBNzeuogEw:6v/7Kf8eyglqlNTWJV+FkvXJvIR7sc
MD5:	59DA7627FE57A45C1E11C627ED6ADF34
SHA1:	F59EEE1521BFD4A0A08B84083198D0397FC046B6
SHA-256:	85B8BC720832B726CCEE9D7C5424AA980ACF115359AD4A7D2477DF342E9C5CC3
SHA-512:	E5C99E3E1477D3DCCAAEB3A421F23157BAE6AD9486DD5CFB5894D754FC186E7DA9E62D14796E0DEC30BEC84D049D285A6F688929FED01D8DD5EB65F508BD2EED
Malicious:	false
Preview:	.PNG........IHDR...d.........6.9.....tEXtSoftware.Adobe ImageReadyq.e<...YIDATx..1N.1.E...F.V...J..." Q......)..44 .....7@TYJ......i..^.{C...._....f..U;.o....y..\|...C\......[.{.%.. *.....[......'..S......P..p.cK.t @.......<...d...(....d...!Z..C0.+@.....:....!-#..!jE..".....F... <.H..x...h..y..H.......,...."......H0...aq..~.`H#...W.C....A.!..,.i,..,.b.Hj9...E...q.!.J.I......."....j.L~rHV...Fo..`...5.....0...[>5.C.....IEND.B`.

C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\green\search_button_left.png

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 10 x 22, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	498
Entropy (8bit):	7.434510372394698
Encrypted:	false
SSDEEP:	12:6v/7b9WJkI2a0eOPuNqgBUJZdfUUbb5OwQc7/:OmLFN7ufhNb8ZcT
MD5:	7100E6E2AC22FE2B56474A02FFAFC5BA
SHA1:	51F78719F7BA2B7CA98A09D8B7458899CAD10BE3
SHA-256:	CC198F8C358CA6E597FF3E4CE26098AF90EB2FDDDA43C284E0FFC04518758D49
SHA-512:	0268AD5E012BFE52827FAE10A237A3D826019BD571F9204DDAB423141EC215A428CF64A5D3B3ADCE7534077F28EFA898DDA6559460198B8177F44CE17A6268F4
Malicious:	false
Preview:	.PNG........IHDR..............&.]....tEXtSoftware.Adobe ImageReadyq.e<....IDATx.\|..J.A....Kr)E,...B.ml.,.}.{[....)\|.._@D,...$'".P.Z......:.+B..s.....fg..5......ziA.>...A.t.x.....4..A...$'...j~..mt..z.!%.?..L)A3..{...J..U(YE.&S...d..C.......d...M...B.+...CJ.Ep%...k.A.RH..".T...D.)..,.t.V.X...2.V....k..1.....M.A.F#1?.\|J.A.....6....\|...4:a..06f..[.dP.f..L.....5...6c..d<.R..0&c..M..@I.c8..!...!%...A...XC.9.>hV..............F....g.....}....V'.G.....z\|7..p..`...c{-@W....IEND.B`.

C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\green\search_button_photo.png

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 28 x 22, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	903
Entropy (8bit):	7.699385896012563
Encrypted:	false
SSDEEP:	24:vpOJ224wpwYX83/BOPNHWlFCQH1xVEiOCt:sB4wpwYXQJsWqQVx+il
MD5:	7A18E39C06768BB6CB8ED29210300762
SHA1:	86BD6DDCBED23EE06E50169EA20A19D221138D6F
SHA-256:	8A1AF48474461A3A1376B341968CE1302744328ECE642B2E5876205706CB1425
SHA-512:	9FB9754651AACF182A3B4E7EE89C32E938B411F68355F7E5A2D3A2EBE09464FDD64A3520EF3D53F5620890AD999AF472C738D71BEC5900131504D17091DEDC6F
Malicious:	false
Preview:	.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<...)IDATx..]H.Q...wftu.t[uu.,.^"7M$BS.zH#.....> .....G.@.(.B.!. 0.cS41..PI3K.uu....u.fo3...j.+....f...93..2.vn...=.PVX.m..B...g........N..,.(....'/....~o.....\n1.A.!.2r.H../..l..<.0M<...!<b7B.....x.rKQr......Wq....U...z...o.%..C.,+.[.m.`9.j$&...i....c.f.@.Wg~....i..9.>T..c.lC...x....@.V....V..A_..I&.D-?.-..+hV.l@.2.E(.r.).c6.~]...&..B.6x.u..P_.d.YP.HG7...\S4.R..../E&..13...!..U..h..,..D...A..{.)..^.h{#....A..#.......i......r@......9.....X...-K...Xt..Q....0.XXR.{..q:.....0n.E(c.g.\|a.J*...p..j...ae.....T..r...3..s.h.)...9Ar >9....N.q2.$..<....5b.6..u#3.......W.!..k.W1.w.rdM.5q1.....'......n.b.Y=..&.o.Ae."Ci..c.N8idl.Dmj.eUz.<@A.2............7..#]k...d<.~EI,...........Z,......I.k).8.r.(..\|I....X..H....i...f..<.?z.z.........3.d...@..J ......u..>FVxuG.. .Ww...G.....Esv>......IEND.B`.

C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\green\search_button_video.png

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 28 x 22, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1039
Entropy (8bit):	7.780516394558098
Encrypted:	false
SSDEEP:	24:vRix3NC7oZovG6XG2EyBkgftgT1R3+DmPNMpQpbqecnhDCulaYU:odgakG622nuYqPFPCpQwGb
MD5:	2E2C4E5CF7972F26C8EABBB4F414611B
SHA1:	529267B8D6E012E514F8A750690FF28E5A62D280
SHA-256:	14B38963B79EFC66C6A7F995AB7EE5720442F388EF7964C977942E14934C0792
SHA-512:	FA48DF1190B7A9D6C263B8994D3B7F87F1E2420831562B14F75813503EBFAF31D9BB96E2B1132712D71080FFD5F4B7C6E4AE1E094260494B35EF34766B52A181
Malicious:	false
Preview:	.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<....IDATx..mL[U.....\....61...U.50.o&.u..%.l1N....,&fd._.`........a.~ s.R0....A.cB.m........[..K..8.M.....y...9b.....7....mRH...[.&.H...=.&KX..-....I...2...j..r...=,..u3vq.........09.!.&.EE=;.I Z.7_...\|.../.=.Ass..>......f..y..N.d.k....}l.x.2V.Z..M.....o..&'N._.KZ.3.Kem..\..P..../Q..K...3...,6.......3m}Wg.w..!.&.{p...../<.a.FO...t.d. .n...2C#^...H.Pybe2==.r2.....e.....>D.k8..l..J.=...=7@../....iZz!]gXT.b..}.QT@.X.%.Kj....Sn.e[...."1%1....V.;..b..7y.s.pm...C).~....T...14.'eY......O..K.s...G........@)......T..i..g...31D..At.3.wU.+W.S~.h..'.PY. ....D.....Fpq..Eise...:.......?Nn....S...G.H.J.SJ...B!3....-.......WG4....6.1;...T...%..~K.5.b.`........X.?.!.).i."c.p...46.=0.YC..Y......7.S.HDB..9>.}......5.(f.K.P.%...../.B....z"X...7.a.s..5.A....}.x..4.V....e.....I..B+~D.0.`.*c2.t..i.........Q..\|....)S.....\....?`.?.{{.1.....W...K.f.RQ.}..-9C.UG.....Rf.o`{...%/T".H......4..v.xD

C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\green\search_button_web.png

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 28 x 22, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1673
Entropy (8bit):	7.24544963128269
Encrypted:	false
SSDEEP:	24:vh1hpunQWwjx82lY2T32HEVjCQaKLyJ3VjIqDG8G38lubWf+cKmHSQOJRtQJ8nZD:HitNn2VEJ3xHLf8zJLQyQa1
MD5:	E7B302EB06C9B0DE9779737EF99623EC
SHA1:	E4D3556B4EBF705609A27F0C5204DFE959FE633D
SHA-256:	1CEE8D4BB9726DBA70777B6266F5FB448E645B17A1E4577E3BC0DF2124786EA6
SHA-512:	95C991A7243527198B4D7A83540245FE88C9B630952AD0D1E2BC673F024CDCCB2E97F44877F5072867155A7F2E6EDD10D3B00F25AE3917DBAB8F5AF4D7ACA150
Malicious:	false
Preview:	.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<... iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:FBD0D9CF923A11DF8B1D9DEF74783ECC" xmpMM:DocumentID="xmp.did:FBD0D9D0923A11DF8B1D9DEF74783ECC"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:FBD0D9CD923A11DF8B1D9DEF74783ECC" stRef:documentID="xmp.did:FBD0D9CE923A11DF8B1D9DEF74783ECC"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>........IDATx.V]H.Q.~.6..s:..................hftQix.U..P.....X..DD`.&.L.eNCf,6..:m.zz..l.........p.s...*"...a.?..q).

C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\green\search_button_yahoo.png

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 28 x 22, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	555
Entropy (8bit):	7.2875574321583585
Encrypted:	false
SSDEEP:	12:6v/7Ys/UJIvcmmwT0zJpQjuM368DavY8XNZQ+MucUSIdZ/:vxJ0LT2J6uEDiLbMu3SIb/
MD5:	3C219E9F60486566D4DF29078138B508
SHA1:	C52F9A5A20E34C5549D84991D3EA7B016C9AEDF1
SHA-256:	3CCDB7939B0285E38749141A3985CBDB05A4E993E2FAB9BB419C172EA616E4DE
SHA-512:	56D24EA258F2C4E12062A5E99E1136D1CB31F2B25A6E8051CB68CB970B4271ABD437D36C28D345379ADC0F1926DD277801C411E69D19A670EECFA7D4761111B7
Malicious:	false
Preview:	.PNG........IHDR....................sRGB.........gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....tEXtSoftware.Paint.NET v3.5.6..Z....IDATHK...N.0..C..U...x......T....<...S...@.%.?C...@Pn}..qL#9Hq........n......v.D..CO.m]..K..>.`&.v.....u.=...$../..O..DT..(....7/.w....tN.e.,I..[D....P........2/...+\.,.{@Tq..0.qc.q..'....=.p...<...@....q]E....v....0.s.R_.5...(..@...N...w..kZ...qX...R....2...R..._..r......i.....X...F..;...&.....-T....sj.Cb.`...15?....$.>[~=..1.-..,.....P.9.M...........w[.p".bx[...+...v..Zw....IEND.B`.

C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\help.png

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3331
Entropy (8bit):	7.88082078592922
Encrypted:	false
SSDEEP:	96:bSDZ/I09Da01l+gmkyTt6Hk8nTED0bMQhtRXm:bSDS0tKg9E05TZMQvY
MD5:	5632D7B591BCEF4A4B0E4302ABC4182A
SHA1:	3DEE4B2E2FC8C80F3B3ACE7B11B8014E68CE777F
SHA-256:	B61F3712C5AD8B1C58439731A0A7DE1213870D8B127D1F61060085CA4B02794F
SHA-512:	924CA3456C2EC1CD1567A564734B584A798292D69C9C336F28A8120E01FDA013E58197E84B14F9FCA9B379E683C4FBE9978DC06CCDBE845A9D7C27094169CF98
Malicious:	false
Preview:	.PNG........IHDR................a....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\highlight.png

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3216
Entropy (8bit):	7.8906601217003995
Encrypted:	false
SSDEEP:	48:b/6DocieftI9G9f6A+FIDOWu0lDl+gm7QyTtctIInQSy6IVpqlnBcODhn1aYaZe3:bSDZ/I09Da01l+gmkyTt6Hk8nTJ11aZu
MD5:	29D046A3F81292EE314864085A63FF81
SHA1:	9B6B8A5E556B475E2E18CE6875D9561AF07DF37C
SHA-256:	B5B6674E9D6CA9441C93D1F14C1203C75DCD3F756C8AB990FB736EB8EA02D1AC
SHA-512:	93933BF98A7E2ADDE07218FF71339386A40D42C55CFDDFBAFB77C8720370999E5276007B1BF1D775D9EB0397A66A34776E081966A4FD0EBED59A1B0E086CC2B2
Malicious:	false
Preview:	.PNG........IHDR................a....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\locales.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	54427
Entropy (8bit):	4.901759562502715
Encrypted:	false
SSDEEP:	768:AbK3VVunf0hStGLaPaExmL3CBxFw2o6R9at4DNno:+6WuStGePa/Lyhwlu6wno
MD5:	B9D81EBDBAF2831187D4F2A9A8F0A8B0
SHA1:	E927C2C1951133343C8F192A8793A41DBA4610E8
SHA-256:	33F81CBA5C6816829A5A5D25CE7AAF2C7F285F1BBF96C2F3B3A96DA91F6A6A5E
SHA-512:	1BDC57D0A9BCCB08F601980B6D625296A14631449376BDCC9CDAF3CB8F71A7EB9F6E709746B7BE3CCBE4DBCEA54AB566D993CBCB444FB9EA957F17B0BA8D6C9A
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<TOOLBAR skip_attributes="true">.. <LOCALES>.. <LOCALE id="en" name="English">.. try to keep in same order as FF and also DTD and then properties-->.. dtd -->.. <STRING name="sweetim.main_menu.home.label">SweetIM Home</STRING>.. <STRING name="sweetim.main_menu.search.label">SweetIM Search</STRING>.. <STRING name="sweetim.main_menu.messageboard.label">SweetIM Forum</STRING>.. <STRING name="sweetim.main_menu.trackseraser.label">Tracks Eraser</STRING>.. <STRING name="sweetim.main_menu.help.label">Help</STRING>.. <STRING name="sweetim.main_menu.feedbcak.label">Contact Us</STRING>.. <STRING name="sweetim.main_menu.privacy.label">Privacy Information</STRING>.. <STRING name="sweetim.main_menu.options.label">Options...</STRING>.. <STRING name="sweetim.trackseraser_menu.clearCookies.label">Delete cookies</STRING>..

C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\logo_16x16.png

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3239
Entropy (8bit):	7.888643295675962
Encrypted:	false
SSDEEP:	48:b/6DocieftI9G9f6A+FIDOWu0lDl+gm7QyTtctIInQSy6IVpqlnBcODCRALs03pS:bSDZ/I09Da01l+gmkyTt6Hk8nTdLNZi
MD5:	28FDADB259A8077E09F442CA8EE1FFE5
SHA1:	9F93FD60CFC263758E2893813FC2EBD2AC3BB352
SHA-256:	9B519A9E1A1B17921268F552120BEE46DCBBC0BAA8BD888524BE0F7278172F6A
SHA-512:	E5926D42E2C79DFE415132156CADE34830B98F81D359F8AF2272F7B0B723C93770AA40F4478545ED01F7C4D23B051700641E33F36ACDF8C7E4736B0BA0102F50
Malicious:	false
Preview:	.PNG........IHDR................a....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\logo_21x18.png

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 21 x 18, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	448
Entropy (8bit):	7.095506389195432
Encrypted:	false
SSDEEP:	12:6v/7R6/UJIvPvTGYXs8pbe1nj38FivnuHgF/kyY:KTJqPvTTijMFivnfF/k5
MD5:	B7B7FBBFEE0C7819A973A39BAF5BCD4D
SHA1:	109BD82AC4898B3E55794F2FF367E1534EFB2B9A
SHA-256:	578145EE817A71932D49DC108DA43496F97C6AE27ABBE602DD41DE34B5E15D9C
SHA-512:	275D3048D4C607007C5E17040E21C2C5028469310356C368D842DAB6AA2B9FC65DC2F2F4503917EF2D5A4A04B1E9B311620C7CCD75765B2A5714A0F2FEAF97DB
Malicious:	false
Preview:	.PNG........IHDR.....................sRGB.........gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....tEXtSoftware.Paint.NET v3.5.87;.]....IDAT8O..j.A......$..........#.>......B.....v....g8.F}._f.qn].....q7...Y.'....n..5.....Q..^...1.).z..C....B.................:.....l....w...t..`dv....y.+....-.`.RW.L.Mx.........{9....g<.....~."=~......m...Uz...x..q............2...Y..}TL.&.A.MZZ".5$...c}.v%"! .R=u...{.}...q.k`.......IEND.B`.

C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\logo_32x32.png

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	907
Entropy (8bit):	7.7115682629611495
Encrypted:	false
SSDEEP:	12:6v/7iMXQbYxUmLXrR83gsck25T8crr2vU3w9lFKms5QQjsa7mwetd2xJ+qjsq+Ka:BbYxUmLXd83RMBwl9g6wo5q/+Kdpi
MD5:	CE93245253E7D87992B0BA17501BCCCE
SHA1:	EB886BDAD9250A51E1DC7C3E46E34AEA684253D0
SHA-256:	CC355E7C9F6C28CA686489EC62307BDA4BBC580D7479794B9080F48E8D1B288D
SHA-512:	CB1FB5E8F26542D22194970CCCDF575780E0D29710576DA925E03A0140FCDB443A58A8CCC0F6993968F0FADFA69D2BC2CA708AA002565A24E5D0E68A7631E6AC
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....tEXtSoftware.Adobe ImageReadyq.e<...-IDATx..W.k.Q..^.).:....\.......E#..ED...C.]...`..((h...g&....n....z..Q......\r^.....K..~?...\|...y.LrL....X.y)3==.e..r....I.....JOc)`r.D<.b.0K..rl..x......9.E......oc...g.....Y.9.>..-..'....{.q.@..\|....Nc^...9I.^.=...2.6....@..g...K...@.....D.......z../....A..b....0N......Q....V.:...@...Yu..8.....).......g...Ik......Q...zp..b.._...'}.W..$....5.M....)...[..)z....UR..<..2.F.m.W....>._i........-3..Y..._.........u.....$.x.-...L.=...g...Wf...l..0...v...J....{..iC..p..x.k!....^...^.rE..8.hFA....s..l...~@...H.#a8...)O:HX[.......p`9f...\.?.ND...rJ.1...P....nq..........a.Q_.l.X{.Z\KV..'.]0...#.Rq....o...P........>z.q.....[......,'.S."J1;.w$.s...x......s..."03.&......Rl?`..6.......-6.D.........ZDw>@....X..e.Ym.......QTgD..........4o>...=.8...,.!r..+.'........u.[...............IEND.B`.

C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\logo_about.png

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 246 x 45, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	3790
Entropy (8bit):	7.724285562203114
Encrypted:	false
SSDEEP:	96:p/9j4az+unO0LrbZW5eMI9uJ6W63PjDRr1Bhw5etccwyj0L81K:p/pdznFLrtW5eMfB6/p65eScwyjlg
MD5:	56C3D53976D3E4EE3E15D2B91459C05E
SHA1:	3DAF5A98972426AB200BD58188B5291F80C0C0A6
SHA-256:	7E7DA62FDF2457AD8112B14A1C4DF06B709219932EC43CA9C21137372E5C944C
SHA-512:	0910A42D4380EB06BA565E9F5B95F212E25D32379376A71CF43959F2EC0C3528A5E91EB60F8979994C1124DCD151DF3B10F7B8A98E6EB710BAC2E7EDE0147BF6
Malicious:	false
Preview:	.PNG........IHDR.......-......5f.....tEXtSoftware.Adobe ImageReadyq.e<....PLTE5..T.........w..G..333......).....................................LKL.......99;.........)+......[Y\...........+)DDD...www.......................fff.hf...yyz...........................mmm................^]............UUU.......64...jik...............vu...................LK.....`.....tsu...n...............XV......RQR......""".........QORecf.BA...kjlqor~}.!.#kil...@>@......%&%B@C)&HFI0/0'$(.)'%#'.&$CAC......rps......# $......DBE...rqs...=<?...b`c......~..^]_FDG868nmoNMP...GHG.....!.,/................................................{z{..........ba......WXW...........opo__`SQT...'53.........VUX...537GVT...........!.HHG.UT.........hfi..................2-+...........#/.hhhklkdbd. .....................xxx......UTW.....................Uba.........T..>....tRNS..............................................................................................................................................

C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\more-search-providers.png

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3352
Entropy (8bit):	7.8931164626831265
Encrypted:	false
SSDEEP:	48:b/6DocieftI9G9f6A+FIDOWu0lDl+gm7QyTtctIInQSy6IVpqlnBcOD8T/BbqEhZ:bSDZ/I09Da01l+gmkyTt6Hk8nToqeGM
MD5:	3D5838DF2B73465BAE62A24C4227B8DA
SHA1:	6DBC88054A5CEBC0BD528965E232ECA12B7FF841
SHA-256:	910F08F5D49FE7D48E4C04E2A2872B67E5210A16AD10611D89D23009A58AE225
SHA-512:	D6DCE4ACE8CC5823A2E54265D9207C37D84A2D5F43B57E0EBE4BB08C2EC051F507730B46F0F5AD3B90E13DB6C7D4DB1946F0FD3A7B25A5EC14A92769CCB40772
Malicious:	false
Preview:	.PNG........IHDR................a....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\music.png

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	969
Entropy (8bit):	7.762222484405286
Encrypted:	false
SSDEEP:	24:H99+nx2odKpOu5EoaHoA4JtF7yq3W4T9bx+Z6JEGY:d8x2odKpOmZ6rStF75m4Txx+ZaEGY
MD5:	6CCA94CDF2EB6A5FF419733DF8E89C8B
SHA1:	9B53E137FE7C6FE398403EED10CBFEE303CC2A83
SHA-256:	5F424A3EE5FE6892ECB699ECC07D21A8749166FD5356E6AAFBF6564B0DD0B3F3
SHA-512:	C1D45F195837E4AD1BF78F1BF5A7C418734E69D4C477D807ED34B034E079B35127757E3F29B8725070C4C93063574155A031E88E50CDECA93FF1B6789E85D2ED
Malicious:	false
Preview:	.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<...kIDATx.tS]lSe.~.s.sN.u....m...J76p..!Q.2p.h.T.....\.h.z...&^.h.d$#q.............c.m..u....==?~%$J.O.\}..\|....Gvt........l._I)...dd.S.q\..1.x..T./P].,.8......]..]..-.iL._...e.Q..hp#`.....).7L(.$...........D[?.7..n...Wg..#A2m.Z..d....Df...9g..K..W........H}5.K0+<\../;...os..y..[..k.5%..^I..V..@.1...C.cr.t..MGz./,T...#......z%.>...G5..MG.;:..u..."..,-e....J''p....v........P.....cHmj..w..d[.c...D....... ..v.Y...X..uQ..4........x.68......{..x.i.U....68..5.......s....7..w....JH.V6Q'<."....M5....<.`pFa].W.....90..{c.~...n9..52..AZA.A......h.q_.w..p...{._Kf.~."...e...e...g.Y{..]D.w.8.}.......C.Z.....p.^.j.\|S..v.J\|........Z..,t.<01..''04........l...KB)@..."...].....ja.P.....b@d.\|.!........K....$..x......+..(.L-.3..\|...ba..Q....C..Q.Z..c...h.*......V.......(...o...`.cl;z./8lf.....7.y...._WEO.;6.._..7g0...Y..a...a.....=..$M.T.S..0._.Y.S.y.....IEND.B`.

C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\news.png

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3278
Entropy (8bit):	7.893549704778689
Encrypted:	false
SSDEEP:	96:bSDZ/I09Da01l+gmkyTt6Hk8nTsS4Rlj9y:bSDS0tKg9E05TsSCls
MD5:	D4352C2BE26981D4E8898F5E849CF007
SHA1:	97F3F38E82EAD5301992151D27AD16B17D507A39
SHA-256:	9F13EADD57A09A9983A827F339BF10317966265DA6975AC70B2589BE3090C631
SHA-512:	A910B629C236BCE1350DE8AEA32FCC2A12F433B53DBADBE15FC14DDA17228E57A0BCBEF726AC1713BA4AA5810C45A35219BE1F109E44A767469A6C39E7BD0B5F
Malicious:	false
Preview:	.PNG........IHDR................a....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\options.html

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29415
Entropy (8bit):	4.490684415635435
Encrypted:	false
SSDEEP:	768:Slqu86QlPas83yyNu8zNMiXL83dPnCU8zdtX6:Slqu86Qlis83yyk8zNMiXL83dKU8zd96
MD5:	09329F11B6501E086D43C7EE10D091FE
SHA1:	5EA4D3ADF08D1E7D2833DC83DE1950262AB042E2
SHA-256:	FE22FF63F37D2E64C5CC3C04DED5571193F0887D246A35BC54510AF26F7DF7FA
SHA-512:	B5A8A6C30BE10A9831003AD6A964E7AA1031B4A7CE76D482C93D7A7856AB94AD7989288A78CAA07966D4E797294A31F4CF03944FDC38051E130B114095D53370
Malicious:	false
Preview:	<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<html xmlns="http://www.w3.org/1999/xhtml" >..<head>..<style>..body{margin:0px;font-family:Verdana;font-size:12px;overflow:hidden;background-color:#F1EFE5;}..#d{position:absolute;width:750px;height:300px;overflow:hidden;background-color:#FFF;} ..#d1{position:relative;float:left;width:750px;height:245px;overflow:hidden;}..#d1-1{postion:relative;float:left;width:200px;height:245px;overflow:hidden;background-color:#153F4F;}..#d1-2{postion:relative;float:left;width:550px;height:245px;}..#d2{position:relative;float:left;width:750px;height:55px;border-top:1px solid #A8A7BF;background-color:#F1EFE5;}..../* Navigation buttons defentition */...btnTopSpacer{position:absolute;top:0px;left:0px;width:200px;height:16px;border-right:1px solid #000;}...btnElement{width:175px;height:26px;line-height:26px;padding-left:5px;border:1px solid #000;background-color:#E5EBF9;overflow:hidde

C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\orange\search_button.png

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 100 x 22, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	460
Entropy (8bit):	7.245509888130456
Encrypted:	false
SSDEEP:	12:6v/7Kf84phqOJvMfNVQWUEOtF4v0/+tKc:pqSTVI8/+td
MD5:	4F1E15984D03F13436721C9BDF01B2A7
SHA1:	146CEA0B99EEC92210DE79FB009485C915E871CA
SHA-256:	22BD84A0FF91D471655712BE0A2CB6EC8C7F8737021D81E4E10D6CFE3958E3E2
SHA-512:	F859EA42D7976F33CDFD89FF6C0C795CDF2514A90F5BC97A867CD969471DE7A5BC7E2912ED8689D0CDD5041E5B1C676840CA4933A8C3030DB4FD1C7FB56B6E2B
Malicious:	false
Preview:	.PNG........IHDR...d.........6.9.....tEXtSoftware.Adobe ImageReadyq.e<...nIDATx...M.@.Dk>6..,.!.2 .....3....pE...i.....M.jsh.]RK.k?U...}.6....#.#...`.PU'..,.t.g.:.;k.... ".'.[.\| .#...j<.s~.X.i..Z6J4Uy..x ..5...a@tm. }_..2..D."...C ..X....j.... t..@fk..UkE......D..Q.@b,7..p...QUa...%...C.y.."2.H...gC]..$.H..n.S*..uES.e.. 2..m%.!9..j.#...$...YC..`@.#.C}.tHj....K.!..]..H.L..u .......b..(........4...Q...s.}..{......Ps#dR..$.........\|.........IEND.B`.

C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\orange\search_button_bing.png

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 28 x 22, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	449
Entropy (8bit):	7.150750157859846
Encrypted:	false
SSDEEP:	12:6v/7Y98dw5S3jnu2kMufaW3xOn0NsHMYEZrMuU:vHAnGz3Y06HMYEmj
MD5:	ADFC483E0A445D03A132D545F78C0A77
SHA1:	5178CA049680CFB50BD76F90684B6F3A7F4634A9
SHA-256:	4A2CFB0D304D4565BD442109F97C16493F1E57580275689BCDF675FF8B57C238
SHA-512:	311665270648D9607AFEAE035C798CEFD0FCC68C14A99041012227CE59A0D2B27C8F85422613F4F9942B1CDBA1B2D0BDC10C89CFB337AB631C559B8ECD83A323
Malicious:	false
Preview:	.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<...cIDATx.b..).....E.....10..OW.2..Y..(.9..#1....(>..A...V~......._...F-..bV....10...........:.6.\|..BV>.oe<...e1.lg`.9...G.d!(.A..c..+.../.A.A.+E@....W00....k...)......).s....>b.+.-.....}....0..R.e...6.-.a.P...f..e...,..%..`.....p.t.0-.%.P\.Y.O...D..H.j!(.........4L. .8..8......,.ae)..:...@.~...9,...v2..@".RL.a.d0(.\|..O.`.e..<H.........W..m.W...........,6.'....IEND.B`.

C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\orange\search_button_current.png

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 28 x 22, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	870
Entropy (8bit):	7.681632942264471
Encrypted:	false
SSDEEP:	24:vkPs41ztUapSa8s8lYXf8bSKvl+Dq4x91UxZfAEIfw:cPnCapy8Xf8O8Kxx9sFAEIfw
MD5:	E206867798C439605FFE67E8ACACBEB4
SHA1:	3EBEA11998168E4010226422B420181871530772
SHA-256:	80821899BD28DBFA390764E615DF13147940729563739E9D594CD066F26F31E3
SHA-512:	5E3F357CFD06DD24B93BC031CE57C6DAB821CD543B2F8BA36D6C18B01E01403F6E540417B17E8D34A83B44F63C44235AE4ADC5839D656D251F673A089C07C48F
Malicious:	false
Preview:	.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<....IDATx.VkH.Q.~.6.....yk....Q...j. ...(..?A...$..R.C...\DJT.,/KM.R..ks^..6u...>5......^8\|...>.=.!.ER./.H&....=._@J.. ...f....2B....k..v...x...Xc..t.R.V8."..n$g]...T.o.I..r.w.ZUB...........:...,.Z.....S.6......H.... \|.P.D..P....e..I442j.!.q.....):>....&4kB.e;.e^&..qT.U@&W!1..c.u..W.CJ\..Ft.L....V..e.i$..A.7`f....($..e..4.,d..Lf;..r.?..".......,.?...\%.../;K.r+....m..ka..@..Ad....+..^..7....H..c ...v..rWs...LL.!.y:.5.b..">..l..l.9..).ho..">....5,...N&.g.T..m..).Mu_.......s%;9........0......F...q+..8.`gMpZ'A.S.no....]...."D.Q..../&..F.._;jA.....}....4..@...4d..&8........N.....@s.}no1/.9...S91......'a.1..Q.<....[....$##...B.2..a'.~......W*..HjZ..j.R......u........a.l...P.K..2><rI.#.oiaa.--..K.c.4`...S.A..x8u.O.^...... .i...W.4.....g.[........IEND.B`.

C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\orange\search_button_dictionary.png

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 28 x 22, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	818
Entropy (8bit):	7.666146229219064
Encrypted:	false
SSDEEP:	12:6v/7Y98rxgIS7RtPzDA9eUqYUjt5moGw/AndUYqH42D63hS09SG21bKM9:vOxNS7RFfAqZt5mO++O3hSnG21eM9
MD5:	B89610163C57CB7D731826AFBC53A3CC
SHA1:	EBA3809C743A2A14BA454E0CA69D4042D34331DD
SHA-256:	D24C9EB565F1FA0BBBEF93D60416D2FBB456B742CF2A0B44CAFC0D4B4BE4B726
SHA-512:	CE9B9544D52879B2CCDDBA6A2552C7F1A1CA0F2F5D66E14A12F37A8AB4096DB2B9ADE272C711F36240715FE5EE1FD8A6237D698188ED470FC2BE23651525903B
Malicious:	false
Preview:	.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<....IDATx.V]H.Q...8......Qa..T..A.Z...S...CAo.I/A>.DE..O....`e...b...fm..R..n........--....83.2s.w.s.=./W..Y...!......H-PH....(.;).. .b.E......Lt.......$....I.?..a"EipV}E... ...@.8.hU5.:.c.U..]x..x...%S..].L..uu.;..i.".S.=......ut.........{[dY.T.L..$.[mm..}.03.1..9..O.k...su....q..n...V..`..3.).M.MI:'.(.......Z,....G....>\N@.}P...5.'%.....4.%..8.........0..`.9\|..o!.%...DQ.'...d.u..."'0.\\..]...$..d....Z...f(...R..I..3...59.J..O.}.1..R.....-....mR..&..\|.8.EDT........g:...P.....]@9.0..x.....&......D.`%..n..Q..+..5.xg..c\|.>..S..T.z...-...Qu.........z....bh...~1P.'...v.]z......(]..o.Ai#..}.$.4..G.....T..O..4...W.l.....:k.dvB.......$Lc.-I..fsZs....<S...?..C..B.d.....v2...g.N.RbYm......cSj........IEND.B`.

C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\orange\search_button_google.png

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 28 x 22, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1937
Entropy (8bit):	7.389814448833648
Encrypted:	false
SSDEEP:	48:HitNn2V1QJ31hk7eKawIcA2QPjTipNQ7n88:I2ek8w1AbKpNWF
MD5:	5D34EAF1A434DAEE65C01E946C5BC9D2
SHA1:	111D950817FE6DE90BF9E7B53AADF52CD1580914
SHA-256:	D92B0769CA8C70B5D923B51FB1D794C91F6D644A8F680F102CBC3761257B5FA5
SHA-512:	42AF4367F38687B4F4B0EC0E447A4BE65D239A886A140F4747DD375A6DD88FE3F52A7952580EEEC1359FD85F32B0BF428F2BDDE490115812F942B37128FD648A
Malicious:	false
Preview:	.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<... iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:489C6DA0B05311E0B69393730A523D9E" xmpMM:DocumentID="xmp.did:489C6DA1B05311E0B69393730A523D9E"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:489C6D9EB05311E0B69393730A523D9E" stRef:documentID="xmp.did:489C6D9FB05311E0B69393730A523D9E"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>........IDATx.V[h.U...93{.&..l.].n.P.C.(.i.K[.....K...\|.'..S[((.B+./.. E......U...mt[..\.m..M.2;.s.gv#.N^v`fvv.......?

C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\orange\search_button_hover.png

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 100 x 22, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	450
Entropy (8bit):	7.2764028108843135
Encrypted:	false
SSDEEP:	6:6v/lhPE7fjnDsdyvkXn4vJ+xJNU/NUP2w8tcS5+anwU3I0xfRqFV8sJtuzEeY37N:6v/7Kf8Yvka0JNEIycEn67UsXrpmhytN
MD5:	E59392EC8FA0EF51208AED60C9AF70F1
SHA1:	4B224E56A4D3D83A98066945B3EECA245AB92482
SHA-256:	36F0EA2450743BC49FF0C94A350EB3B80EEF0379A0A6048383BC68E7750249EE
SHA-512:	F3999E96BE203B1134BD0D4C6D6CE84C4027A31D5E3CFA5DF9182C8BA85516E2273A60D558C5D37A67D7408A7AC55EB36437AAD8220420B4C8E9F96A1047107E
Malicious:	false
Preview:	.PNG........IHDR...d.........6.9.....tEXtSoftware.Adobe ImageReadyq.e<...dIDATx..1N.@.Eg....Qr.J...8.M.@...h...G@.EZj.R.(^.....aR./.l.........:......^.......}.....".........N.+.$\...Y.I..EZhq.D.S..z.Y."..$Z)..@..b=y.[...V&..,.[N"..;......@...j-.ebv.,:$..X.<<PJ .j..).k./.[V4........+.2..........\|.H.C.1..2..O.H...!.....&...M...J>..O....9^&.).L.@.g..l~...s..vQR..:l.6,2.S..q.P?d......./.....c.y......\|#.P"HW).....`..H....g.....IEND.B`.

C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\orange\search_button_left.png

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 10 x 22, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	304
Entropy (8bit):	6.876355397632123
Encrypted:	false
SSDEEP:	6:6v/lhP8L5nDsp3AklSRi3COniR4CzKpa2Z7V0jaZeOg0jWmkFbbfB4kPtjp:6v/7bZANRiNniR4Czu76azjjWR1bfpz
MD5:	8DFE3D325B9F1841B266E3AB46D1B4C0
SHA1:	AA001471AE2799D4ED3892A56C6A2FB8DAE47F53
SHA-256:	2E41AA3D6952128865D6970DC8D702336B9AD6B8F1F69BFFE06AC4BB652A028D
SHA-512:	92D960EFEFE779504667C222C12210015CA6D263174EDC9D24DDD86539E48F8C0077DBDB6322EACCE56166A2275DEE92378EA66724F6AAF0897282778E1AFE4A
Malicious:	false
Preview:	.PNG........IHDR..............&.]....tEXtSoftware.Adobe ImageReadyq.e<....IDATx.b.......v......-#...x..?.G..eY......R....h...'../33.>....##....lF...........#V!.0..y..T..A.B...).......\|!...4..{".~'...4..5M.....?..Je.,..y.K~......._..p.W.{z..Y..?....8.2~.......Y..)a.ex.......?jFy&..i....IEND.B`.

C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\orange\search_button_photo.png

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 28 x 22, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	888
Entropy (8bit):	7.756636270721891
Encrypted:	false
SSDEEP:	24:vSqzKbSC1Kf6i4UMhbFUeeJSB+OLX1mf9z0tH:aqzBf5MhbFHzB91WdWH
MD5:	B4A751B5E30E962D795C72D4FCE0BD00
SHA1:	723E51E888D09E6F545B4A30B7DECA2E5F79EA49
SHA-256:	241B5005F36B5CD390CCF33DEE753A33E96D9356F40135AF5EE7101FBE255DAC
SHA-512:	E6B5C31C214DE63F3C04D1FAD344E21FAD4756B6B3D0C432C51F9EC6988DDDE84D978010E9D4C8E95E0EF7873FE1EAD2BF4C01F42C619A99AF42B52293E84BB5
Malicious:	false
Preview:	.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<....IDATx.._HSQ...n.....tm.%.K..Dh.C...L......+z.Q.2(...\|.z.T.X.&Fb)h.MsN.N...w.{....&.....~\.....w..2.@A..&V...*p.\|... X...0...'.3.JU \|.....op4...W...3..}.G"8<,..0....V..6.)H.^.y.^..0.....e..$.Bk.i1c..>.s...?.ix..k7!"..Cv~..%:....+0j..&....p..&bv^hb.?..b.....\|.R4}.F..XD....E.v.!.....=..o.[L5..>......S..+..J_f..y....2.......==..,.].'..)...@^...O.[. ...hBM......2.y.....J.Z.1... 6F.u...{.\}..S.3....f.&H.O...U.tC..i.......@.......9..6...C6..$..K>.zF........W....!.+...BLZ...8.z^.m%.{J..N-.,......`./.x...I...........@JF.EC.n.H..vr..c:.....w!S.......u5..@..5jp.z2.J..M..MVah....a..l4.Q..hF.fF.[M2.]N.(.Q.C2?.I....=H+kM...u.;l._.MY.q.....8q...:.\~ .!.(K.....8bI.....@..?:.L..i.I..V.....s....G%Iqq..h{{;eY.U..0......$.:.&....h..z".N....H..o.....7.o...u.=.V1P.....IEND.B`.

C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\orange\search_button_video.png

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 28 x 22, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1021
Entropy (8bit):	7.759548890836311
Encrypted:	false
SSDEEP:	24:vzOrSNxfn4V6iAG18tWRBnHozJuJFmhlLTA7:jNxwV6iut67m3I7
MD5:	601FFC7440C7047BDDC231D7F6AACBDB
SHA1:	39421348315DC36B67123FE94D75982712CE942A
SHA-256:	70179181F5C6242819942311BFBF5771D565ED48075DDB41D26D9502DC35D707
SHA-512:	09A70BC1C27EC23DD9E317D18FCC9DDB08388631C8BA1FC851E2928CC3CCD8703AC4B922916321545760ED3938BFE2653E15387C90770ECB9F68D2A7A9FC6A8B
Malicious:	false
Preview:	.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<....IDATx..mh[U...7.Iz..m.KZ.v..V'.bkU..M.C.~p...!..\|Aa..2.$...(n....I..~(s.%..X.5Mm.t.m.&Y...y;..1..x.s.r_..w...?.9J.m. .Mu.M..8..4vQAF..wX2.L+.9!.(9S.J...BW...~....i.w.....N.Q...f.X.PP."./...by1...W....._.X.5.tt.s...\|r.$#.U.!J....:.jZ{+........y.MN.8........._...G.T._..n.....!./..P....v..,&....Uo.D......8.x.c..../>.n)GK.i...T....~^}.%F}..;.c.(.5.........+.Y8...(...r..U.L_`...E!..}.o....tCaY.....sWY.I}..I..%l...EETmubw..%..d..;...$.H..S.Wq.q....w.#.......IK...$j...\|.wv...g4.#.TB.c.x..n4M..(.Pnw.nd`6...............P...,S}...5.V_".......8I'/r;..@V...W...,..<...I.....3..(..P.)....Y.t%,H..~.H..P....\|..{tv.......#...M.,.mD65..p...@.-.rLg1...+xJS.B?.%..X...imp...t...?....]....E[..j.."R.Y>....{g.....8.%a........./.F9.._\.a...\...Z......\|.....5..)a..U.....i..#.....'A.U.lV.$0...........-.ZB..f...W.....1.\.....]>...^.\UiQ-Xkjp,....ihyVC@%:/D....O....GD.#....od......f>....o..

C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\orange\search_button_web.png

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 28 x 22, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1666
Entropy (8bit):	7.203222819342804
Encrypted:	false
SSDEEP:	24:vh1hpunQWwjx82lY2T32HEVQ6soyJ3Vl4PVeGg6SsdnBqkhTkVkkm9EHFog4ftyH:HitNn2VO5rJ3Yde16SUz1kVkJ9KoJtIz
MD5:	426A10972CB0F6911EEA33000E3330CC
SHA1:	4EF213E3A740FE55DF5E7D5FF68C42DA0D37D7FA
SHA-256:	9219F2768764EC859DDC1A1E7C4D49F17946BBF4C8F64AB4E1EBA75487FF59A9
SHA-512:	C210170222E53C8C5622B06E9F3E8741BDDEE1748606F331D1E2E6BE7C8A318131C2C8120E172E982270003BFABF83D70455C740DBBC455A3EB7ECDBEE0584CC
Malicious:	false
Preview:	.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<... iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:2105D708923B11DFBCD897E917CD03A4" xmpMM:DocumentID="xmp.did:2105D709923B11DFBCD897E917CD03A4"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:2105D706923B11DFBCD897E917CD03A4" stRef:documentID="xmp.did:2105D707923B11DFBCD897E917CD03A4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>3T52....IDATx.VkH.Q...m..s...c.......K..+..R...#{...... I....B.DD`.&.J.eNK4...k.......>.v..=.....s..^...."."Q.EH

C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\orange\search_button_yahoo.png

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 28 x 22, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	525
Entropy (8bit):	7.267542920441173
Encrypted:	false
SSDEEP:	12:6v/7Ys/UJIwp8SlJGkjUeUTw+GW/orNXZDu+5l:vxJZ8GIkj1UGW/2Dj
MD5:	90DD3385128C9E6A2DBF9748FC8BF91B
SHA1:	DDF2CE412CD2A237612DD296FD2D9B13B45F9D42
SHA-256:	1BF76B93D6BCC9F131F911FA1D08BB443748980CFF34BB1E49D537BA9BFA54EE
SHA-512:	6792F54924164DC55220E249B28A6DEA22B2E3286E000AB2F450CBDAF97EC76B59345271EB762FA1C6826FE58BD6F6DB59E30D8693511A76462863A665B367D7
Malicious:	false
Preview:	.PNG........IHDR....................sRGB.........gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....tEXtSoftware.Paint.NET v3.5.6..Z...fIDATHK..;N.@..Mn..9........!.......)....x.X#E<#y.o....Kk$6..........X.mJ..<....g#1S+.3..6..^%/......36.#.0.m..f2<......?......-.....O..t.}.b..&....*....p-..2......!..`..}.....1..jv.{....~......V....P......X.....6.p.V..1'.J...U...K..z.uI....%.W...^.W..94:..x.......5m.D..=_..T.F+...u.u;09.4....>...a....t./."....,.Vn....>k.L...p.....\|D./..1TjF......IEND.B`.

C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\photos.png

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3432
Entropy (8bit):	7.890811683389906
Encrypted:	false
SSDEEP:	96:bSDZ/I09Da01l+gmkyTt6Hk8nTix2NsDd3:bSDS0tKg9E05TiAgd3
MD5:	3326F38F67E138CD40DF3036A6309F63
SHA1:	8371BACE6C48FC5AF719000E91A627F6DC0CE3AC
SHA-256:	A86EB86BE5BA9BEEA0C3303447F4BAFFF2A8BD49AC2D245F3759C31DE52018FC
SHA-512:	672FD5BDD4753F3E8EB9A30B25E18EA7231DE7208C217E9D55F3A34A794B27626C290E581418229982DEDE7975D21C46E3E9B32F265BCAC8B2FBA56926B5C841
Malicious:	false
Preview:	.PNG........IHDR................a....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\search-current-site.png

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	784
Entropy (8bit):	7.695743284796664
Encrypted:	false
SSDEEP:	12:6v/72rnSuDO0xkvVXUTDkIPr5vDeQNMV5PhSEbsqs9GaWzL6gsp2xkIoKzxV7:3SkO02dkTD3Pr5vEQI6L2+IoKF
MD5:	7D4CAAD7B62C2F69274E585D326D2A91
SHA1:	815175D8C54D86B622873FD152BDE7482B6B83D8
SHA-256:	8EF5C62F599935ED9448258366E2DCB209338870B902D803F20081494FE46E51
SHA-512:	5FB3D260220150F1461577287D5D273482207F4CDE362391FE81C643C113A598B440A413B35DDD6520DF55B2AB2C3EDB8A24B2EC2AD681FEAC6C382192A31789
Malicious:	false
Preview:	.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<....IDATx..[HTQ...}f.q4...6h$..iY.1..,...!).@.%..b..QH&./fD..`.FTf....S.My..@^f....xV.(...C...f........D....?........H.zS.mD...Pi...6.&...!a...hs5..;....j@............ZI....<...h.?.!{=.......%.<..n.,.A.....2.t...t.7E....F..H....1kB!z:A..P.s.Len^.....mp...z.:l\...LX.....`...m... .\VV..:lUI...9e8.p..f...o........q.......1...?yTb..-.\....R....X...\..IK.E...T....l..7.Im..jPB.../......B.X...L$.{2.......N6>.e'.N.../.JV\|...{s.d..5a..TK7F.q....!.6...Y.w..c/.S..l.w........qvgT.T......!.9...'. 1'I...,~O%.:.R..KHt]i>n.>..G.\.u.Q..0....&.."}....CJ....E.>....B....<VS.....a.i....0.e#.. .K.P...(....._.^i..q.4.Xk.%se.;.....3.}x.=...?;KW...B.q.al..a5._+&..F...{H}..O...@j.i.1w.....IEND.B`.

C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\shopping.png

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3157
Entropy (8bit):	7.877394765167326
Encrypted:	false
SSDEEP:	96:bSDZ/I09Da01l+gmkyTt6Hk8nTaltO/gUB:bSDS0tKg9E05TktO/B
MD5:	F0AB9A69B17612C11649995384EB5F0F
SHA1:	7C30804C11A1CE6F374093F33A2FEDA3DB1BFC23
SHA-256:	A0C4E0C0262B4D879EFA682365458B48EE02B3969EA55EC26F2ECC613BF20983
SHA-512:	CFB8DE35C8F89B42422AA88816739DEE47AE16181277BF0E21238D5FB0FA81EF62CB4242303C5385EB5B0B4060D34A999F86E0BBCA67F68035EB9E618471D0ED
Malicious:	false
Preview:	.PNG........IHDR................a....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\sweetim_text.png

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 39 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3144
Entropy (8bit):	7.8800675940165785
Encrypted:	false
SSDEEP:	96:tSDZ/I09Da01l+gmkyTt6Hk8nT32rMK0Tz/sN9:tSDS0tKg9E05T6x0Tzi9
MD5:	1BA2AD1C28A5ADB2567D1B40D77488B6
SHA1:	19661464D83FEB734DA31A368911370A64D54EBE
SHA-256:	9B37E88CED80353EEFDC697FF2B211EE2B1FF86B0E31C8C0E4D7150E22597E3A
SHA-512:	F25015416A49CCB9D2823A1E1025C0FFA4BB4E92043D39175F55BF17362C248C14579A57A38219130BDB8E27A02DCD9645E5D9433753CAE986140B804F669B9B
Malicious:	false
Preview:	.PNG........IHDR...'...........f ....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\toolbar.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (584), with CRLF line terminators
Category:	dropped
Size (bytes):	29617
Entropy (8bit):	5.178989835892454
Encrypted:	false
SSDEEP:	384:f5xLwKCRuFRs/0vdzokgysVik+rwcoRq3cWQ8LHUrsrjLP7:sKuu1xg3VikZqHrP
MD5:	CD2F2CE86EE19CF3CB901CE200403B36
SHA1:	3EBE478173BBB4553479D64A614EDD45ED4ED8A4
SHA-256:	C6B8F282ED6A48C68316332A8B669C78D9293F7BF5109EA0248AF23C28159DC7
SHA-512:	C950603FCF4C0B5D61AC6263301C44C67AACEB749857D8B2B08F7F3AE8B15240AFEDF5D1BFB821FD44782EE925A5E38B3E38AA3C1A134B124921F328B375EFDD
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<TOOLBAR height="22" expireglobal="1440" name="SweetIM Toolbar for Internet Explorer" id="tbs_toolbar_001752" redirectonquit="0">.. <SETTINGS scope="0">.. REGVALUE id="id_async_speed_optimization" name="HandleEventsAsync" value="false" overwrite="true"/ -->.. <MESSAGE id="id_msg_findword" default="$sweetim.property.button.findword.tooltip;"/>.. <MESSAGE id="id_msg_uninstall_close_instances" default="$sweetim.message.uninstall.close_instances;"/>.. <MESSAGE id="id_msg_general_caption" default="$sweetim.message.general.caption;"/>.. <MESSAGE id="id_msg_clearhist_tool" default="$sweetim.message.clearhistory_tool;"/>.. <MESSAGE id="id_msg_active_content_tooltip" default="$sweetim.button.sweetim_content.active.tooltip;"/>.. <URL id="firstURL" default="http://www.sweetim.com/installbar.asp?barid=$toolbar_id;"/>.. <URL id="serverpath" default="http://www.sweetim.com/simiebar/"/>.. <U

C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\video.png

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	869
Entropy (8bit):	7.724749684662738
Encrypted:	false
SSDEEP:	12:6v/72uhawVsXDd8HrtpLae7I6TeRg7EGrhLADjCznC9c9qtpMaPhvGklVV5KSChX:6aZXAr+jQUg4GrhLUjCLC9lP4G5KS8X
MD5:	920D3D7C15F7AB6E00F2A8C3593CA86C
SHA1:	74147628E2FCF44B2AF427A67DBE6278E8784416
SHA-256:	8D53BA3EF30AA548B8B5870EBF264863AB28BFB28BA0338337EA81FB10E931D0
SHA-512:	6108CE806BA0210A00A8250EBA0A74AAF9934F000C1EEC6E4750068A46EF4447D275C0A89053933B4E3ACE6529F5425D7F0ABBD7F8C2DDE4961A5FA32E9C0F88
Malicious:	false
Preview:	.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<....IDATx.\.[h.y....L&i:.mRl.Z/m...A...ESJ.hY..\...(..(./.y.A.X.a....VE.JD[A7].....K.\L.e2.LlK=p........}.~._.[L_.g...X.....o..s.?.=v.Q......T..G.gU.D........?...:..U.w7.`.]]?#z.^....\|Q...$M...?dr.&....K.Y...Qq...h.d2e0...\|...@.C....:I.....K.B...bo_...X,.iL.UU....]{..f..w....pL.@......9....~..#.%.....J.1....'B..U..m.[3t6....4.w......OW.Z.....!..U.g.....L.S&S...`..\N6lX_..z..m.{..$Q....Du5./.........j....dY.{MH..+@(.....O0...2..ZDg..H.4...%..>.n..x<p.6.....".,t..$.......q....o.M2...._...g.-.'...pA.\...}(..G}.&.......'...Rk7i.r...._6...3.#....u...#..s5......%...#..E6.....J...'}....9c..~.E.(!..`.T!y..B.K>.X.%<(Q...W_.......2...).). ..l.....,.,.......i.--..HhL.Q.}..$...Rf.....Hb...Cnh..T..&.?.e..?v1Q....\|...Bk..........!.................IEND.B`.

C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\web-search.png

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3337
Entropy (8bit):	7.886640514351696
Encrypted:	false
SSDEEP:	96:bSDZ/I09Da01l+gmkyTt6Hk8nTt/4E/TS:bSDS0tKg9E05T/S
MD5:	3E2E639063054CCB59DB68C2A9243AFB
SHA1:	FD9461012CFA0ABD8333645E6A55B87DC5AC6537
SHA-256:	5D79D48F3FC4EEEF3A8C46FEF30DF602BE257730F841B99BECE79F7D9356D7E6
SHA-512:	730CF2834D48BDDA697E580064DAE1060D057A9F39D33C8A632D790F7E0B3097DD70421E31C09D33A914E763CB1C39E2C75554D8F6B4EB11B45A8962E8FBBA37
Malicious:	false
Preview:	.PNG........IHDR................a....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\web-toolbar.js

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	C source, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	31069
Entropy (8bit):	4.590886812904986
Encrypted:	false
SSDEEP:	768:qMSlAWyUVxK4oNW2yP7vKSIyEW5D0SYpZHENN48JpaXf9hID:qMoXDoNqX1P54SoZHENN48JpaXf9hID
MD5:	896C0385C1D7472C8EE40762B39493DD
SHA1:	AB23DC84BCA3FF8A9536B4361CE459E0F9650352
SHA-256:	0C3848FB16840330E91AE7D1E066A4ADB0076D6CCA4C01B58C76F0E53EE364F8
SHA-512:	6FA58C3E53E743ABE1B9BF85F0D082B473BCE759626A03CBD2EFD8DD9190E7E8EEB738B369CC9BCCEF0609A663E5044842E923F84E41FAEE351CA152A501CEEA
Malicious:	false
Preview:	var g_objToolBar = null;..var g_doc = null;..var g_mainDoc = null;..var g_nButtonCounter = 0;..var g_id_sweetim_toolbar = "id_sweetim_toolbar";..var g_id_bi_include_script = "id_bi_include_script";..var g_id_bi_track_script = "id_bi_track_script";..var g_bi_url = "http://content.sweetim.com/bi/bi.js";..var g_debug = false;..var g_bLoggingEnabled = null;..var g_fileName = null;..var g_script_id = null;..var g_domain = null;..var g_yahooClassicIntervalId = 0;....// struct of a button, contains:..// 1. command id of which menu to open..// 2. url of the image of the button..// 3. tooltip string of the button..function Button(commandId, imgUrl, tooltip) ..{.. this.commandId = commandId;.. this.imgUrl = imgUrl;.. this.tooltip = tooltip;..}....// global array that contains the command id, image ural and the tooltip of each button..var g_arrButtons = [../* buttons are added dynmically to array, using xml/../.. new Button("id_command_emoticons", "http://content.sweetim.com/toolba

C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\yahoo.png

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	442
Entropy (8bit):	7.104637400753022
Encrypted:	false
SSDEEP:	12:6v/78f2s/6T6is1kJ4nnQmCOZBw4r9Ah/kmZscG2E3d:Z2s/6WR1KcnQcF9csmGF3d
MD5:	F64113435D357717C72EBF0E86B317E6
SHA1:	85CA037F08378619D4322A7F4EDBB5FC55AEFC5E
SHA-256:	A3DB26273631B16D9F68100C2C8B9096C899B320AE2C3EE787D31D6DBC0826E9
SHA-512:	F7B60E594EFFDD05E84C8583F205A32BFB87BB4CB084F0B49FDEAF5797B4128AA4B2D72A7FB1FB4FC112CAFF1958C1632E19ED658C564727656604746BECF616
Malicious:	false
Preview:	.PNG........IHDR................a....sRGB.........bKGD..............pHYs.................tIME.....;'.x.....:IDAT8..!k.@......P"B....S..G..(....eT.15..c.b?`..b.....U#...pb.....L.;r./.^u.}.......yx.Pde...UNA2..EH...7.S..dw.u.....n..G.`\|...."+....d5$.!.Jj...Qr.....J:Q@.....:=M..S.../.....>_>........r.+...s....\.f..(.d.X..mW...%5.\|.\.=.......?.y~.,.%5....%...Q..YY......c....-..N.6.6I.a...1J.\.\y.....Y...jH;.....J...v......IEND.B`.

C:\ProgramData\SweetIM\Messenger\conf\adapter.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	225
Entropy (8bit):	5.068773421445466
Encrypted:	false
SSDEEP:	6:TMVBdoIUojlF6XqDUbUi/IA/4olBroHKbFk:TMHdoIzuqDUbHz/4oloAFk
MD5:	FD274CA061D166764AEE95F6875DE16F
SHA1:	9A2D8F3D07A2BEE7DCEE006BE14F3EF3F5A1DBF1
SHA-256:	5AF5F0AA2C2643FD07FABA2C9641F764810BC6BE27CB937F89B6393D32965313
SHA-512:	B6B6EC21B95F86AB454DD0A74630B0AEB521ED4BC81574C8B48777927C1DFE78A07075D05B5E3226BBDC1318DDEBDC7CCDD8C525425085E4ABB38F042E1219D1
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1" standalone="no"?>.... ..@version: ....explain usage..-->....<Main>...<Plugins>....<Modules Number="1"/>....<Module1 Location="$install_dir\mgSweetIM.dll"/>...</Plugins>..</Main>..

C:\ProgramData\SweetIM\Messenger\conf\autoupdate.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	533
Entropy (8bit):	5.365013433339208
Encrypted:	false
SSDEEP:	12:TMHdY9ML8Q/z2lyn3Ug08RCrz2lyMgpWkSs64dB/+Vf5BuEdM43:2dj8Ji3UJ85n0WYD/0GEdM43
MD5:	C2EFB572BA7F1953909C401DB5AC8765
SHA1:	63A66651D881FE6D35B7CC1AA316089CCA53A9AB
SHA-256:	F9CD2AC229D0E66BDC7D81EE489FECD75ED847C4BF016F886617FD609CFE0691
SHA-512:	B7598E4583FBD79D4ECCA76CC5613A5614B34A4878C405387130EF111D7B8AD8BD41EF270A895CA3B955C6F0D0F1F919B9A9807F3A73C31B0F129AFC4A503957
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" ?>..<AutoUpdate>.. <QUERYSERVERS HTTPTIMEOUTSEC="60">.. <SERVER URL="http://www.sweetim.com/autoupdate/u.asp" PRIORITY="1"/>.. </QUERYSERVERS>.. <DOWNLOADSERVERS>.. <SERVER URL="http://www.sweetim.com/download/install/SweetIMSetup.exe" PRIORITY="1" />.. </DOWNLOADSERVERS>.. <LOCAL DIRECTORY="$data_dir\update\" FILE="sweetimsetup.exe" CRC="0" />.. <PING HOST="www.sweetim.com" CHECKUPDATEINTERVALSEC="43200" ESTABLISHCONNECTIONINTERVALSEC="60" />..</AutoUpdate>..

C:\ProgramData\SweetIM\Messenger\conf\contentpackages.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	104
Entropy (8bit):	4.712378786866583
Encrypted:	false
SSDEEP:	3:DML3BMQTAGMNHU78AWeGRzBK/GMTA7GOEKpIQENMOZoKbn:cBBFMVW8AWeG0biGOOlNVp
MD5:	6D0EDE08B21272C8502FF9C7E3ECA6F9
SHA1:	C5F78B0AF519C8865D65F07645039345805EDF28
SHA-256:	50B52506D3420912AB9E7A5EEE27A5FF3BAA57AF8AC952C83E854AE6C78AF985
SHA-512:	AB47A91813D2FB03AADD476A60040B486575612E5878E740B818858B73707E545CDCD49D6F020C48835453EC8513F4EC3B2E4629F26D46E264B8E6A748B8A74C
Malicious:	false
Preview:	<Main><Configuration version="1.0"><Files ActivePackages="active_packages.xml" /></Configuration></Main>

C:\ProgramData\SweetIM\Messenger\conf\logger.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8142
Entropy (8bit):	5.013041253192573
Encrypted:	false
SSDEEP:	192:sFHJWHJ0HJ4HJlHJJHJgHJUHJdHJqHJBHJKHJPHJDHJPHJS:sn
MD5:	CA844223E112A4404D3FA9C3302B39B7
SHA1:	80C7EDF057CAC1EEE0DA1EFA4A63FAEBC5422201
SHA-256:	4A814DA2B9164DC4E18040C2F26869C77E483C21B23CEECE31C326627D81A53F
SHA-512:	50622BF360DC8485456A7E75E10F1316E1358B433D6BA6F710B3D27661E4461234792B673E2D70D93A28FFFE57EDCBC80BD1B184F8527679F3F18D81120AF11F
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1" standalone="no"?>.. @version: -->.. ..Levels number index:.....DEBUG = 1,...CONFIG =2,...INFO = 3,...WARNING = 4,...SEVERE = 5,...CRITICAL = 6,.....ALL = 0,...OFF = 7..........MinReportLevel - the min. level of reporting; ..MaxNumberOfLines - the max number of log lines to show on the window..-->..<Main>.. <MSNMessengerAdapterLogger>.. <WindowHandler MinReportLevel="0" MaxNumberOfLines="1000" WindowHeight="600" WindowWidth="400"/>.. <FileHandler MinReportLevel="0" MaxFileSize="5000000" MaxNumberOfFiles="1" FileName="$data_dir/logs/MSNAdapter.log" AppendToFile="true"/>.. <MemoryHandler MinReportLevel="0" BufferSize="1000" TargetHandler="FileHandler"/>.. <DebugHandler MinReportLevel="0"/>.. <Logger MinReportLevel="0" TargetHandler="FileHandler"/>.. </MSNMessengerAdapterLogger>.. <MSNMessengerAutoLogger>.. <WindowHandler MinReportLevel="0" MaxNumberOfLines="1000" WindowHeight="600" WindowW

C:\ProgramData\SweetIM\Messenger\conf\messages.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1802
Entropy (8bit):	4.959307221582724
Encrypted:	false
SSDEEP:	24:pjxZR4Kh1KlSWOjMjMI4Jr59Gk8SB2hHzBOiUQhpZAgj:7aA5wk8SoHzBOiUQhp6gj
MD5:	82911B83E6266C597230503F1B00AA73
SHA1:	49860EC23DE7555A9A5FC073DB423B02799CE7FC
SHA-256:	061E982CEDBA8DB7000DFF75B576D509F7FA9558CDEDE8648DE2C08E89584C8C
SHA-512:	167430B7B9771B0419EB037DFD78B44F037C490CAC156E87187A16C059F1E1ACD738383C729923C966D83F5FEAEB92954351C714CCC81E56834150261E4DF4BA
Malicious:	false
Preview:	<Main>...<GeneralMessages>.. <M1000 Text="Error #12: Please exit the messenger and re-enter. If the problem still exists, contact SweetIM: support@sweetim.com"/>.. <M1001 Text="Error #13: Please exit the messenger and re-enter. If the problem still exists, contact SweetIM: support@sweetim.com"/>.. <M1003 Text="Play: (\@LB%s\@LE[%d,%d,%d])"/>.. <M1004 Text="Play Nudge: (\@LB%s\@LE[%d,%d,%d])"/>.. <M1005 Text="You cannot use shortcuts for emoticons in this chat, since your buddy doesn't have SweetIM."/>.. <M1006 Text="Error #11: Please exit the messenger and re-enter. If the problem still exists, contact SweetIM: support@sweetim.com"/>.. <M1007 Text="Get the newest version of SweetIM -- www.sweetim.com "/>.. <M1008 Text="You must upgrade to the newest version of SweetIM -- www.sweetim.com "/>.. <M1009 Text="You have invited %s to play %s. Please wait for a response or \@LBCancel\@LE[%d,%d,%d] invitation."/>.. <M1010 Te

C:\ProgramData\SweetIM\Messenger\conf\sweetim.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1206
Entropy (8bit):	5.178687684033766
Encrypted:	false
SSDEEP:	24:2dVzuqi0VOCwMt4w/sgmNtaesut/tORPIs00WCsySr+:cVqcECwg4wEgmNtae/eT0i
MD5:	C3CF094F86C5EB6BC5F592AC735549A7
SHA1:	3D8E4B2F181730C53EFE985462584A44123D5CC5
SHA-256:	98D43D8D8379A925C791B0B30DBA997C1A89E2ECA8D02BE40FAA231C10EE0AC0
SHA-512:	664A750DED7EDD56288F1B0ACE495C941E3F6629496CFC9669E2DE8B6E5F4F0A1B066F4E7C3911FA12AB2A7C82B956573C70611EF266A041809F1068CF031CB7
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1" standalone="no"?>.... ..@version: ....explain usage..-->....<Main>.. <Chat>.. <Menu Width="346" Height="220"/>.. </Chat>.. <ConfigFiles.. MessagingConfigFilePath="$data_dir\conf\messages.xml" .. UserConfigPath="$data_dir\conf\users\"....MainUserConfigFile="main_user_config.xml"....AllUsersConfigPath="$data_dir\conf\users\AllUsers\"....PackagesConfigPath="$data_dir\conf\contentpackages.xml"/>.. <Content>.. <Database .. CacheDirectory="$data_dir\data\contentdb\" .. CacheIndex="cache_indx.dat"/>.. </Content>.. <Resources>.. GDIPlus Path="$install_dir\gdiplus.dll"/-->.. <Images Path="$install_dir\resources\images\"/>.. </Resources>...<Dispatcher>....<Communication .....ServerAddress="app.sweetim.com" .....ServerPort="80" .....SIMVD="sweetim/dispatcher".....HTTPTimeOutSec="120".....AttemptConnect="false".....PingIntervalSec="15".....PingCount="3".....Sleep

C:\ProgramData\SweetIM\Messenger\conf\sweetimapp.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	214
Entropy (8bit):	4.87921790023908
Encrypted:	false
SSDEEP:	3:vFWWMNHU8LdgCIIUROELA/dFSzLrR4j3UbIh1IqGwpOnUYIP9MM3NFmEqGwp69y:TMVBdoIUojlF6XqDUbY1ISMnU/l1nzSX
MD5:	B7754D9BDCE3C62E0B9E8E1774106875
SHA1:	C8D7B4DD4A696D0111B5DBF2D3D442A7139BF179
SHA-256:	D356149A0AD5322F4597CC1E97B840402D41ECF3F25C05AACD985C438126FC5E
SHA-512:	C8356C68545AE0368E342CC425583FAD706181954F2285138E829CF5C0A50D196BA53FB57D361DBD594D3E23125D0BF59942D8EC948329865BB22BFD363D0666
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1" standalone="no"?>.... ..@version: ....explain usage..-->....<Main>.. <AutomaticUpdate>.. <Manager AgentKeepAliveSec="900"/>.. </AutomaticUpdate>..</Main>..

C:\ProgramData\SweetIM\Messenger\conf\users\main_user_config.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	594
Entropy (8bit):	5.030453485747072
Encrypted:	false
SSDEEP:	12:TMHdoIzuqDUbJNB2J/23nzvi/gGOHgiWqJGr6qQOweq2liWq/KliWqnL+:2dVzuqit2keAWqVq/wgEWAKEWcL+
MD5:	F2FE00F312CA046FD886C726A61C8964
SHA1:	F8FD9C0A8135A24E038FC6736A804F62D5E850E6
SHA-256:	DAFBD5750994583D2F879AD5E1A9AD1B6334ED9EED3318E46A74F6D21245A600
SHA-512:	B51BD49B75D0ACDA0A304A206687373DBF7058C87E2886E891201F91185740CB26B085C01A431854418B96255D888687728DD5961A9EA7D19282AC6E27E6D0E3
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1" standalone="no"?>.... ..@version: ....explain usage..-->..<Main>.. <Configuration version="1.0">.. <UserConfigFiles EmoticonsShortCut="emoticons_shortcut.xml" UserConfig="user_config.xml" ContentUpdateNotification="content_update_notification.xml"/>.. </Configuration>.. <MSNTAB Active="1" ImageURL="http://content.sweetim.com/msntab/images/msntablogo.png" Name="SweetIM" ToolTip="SweetIM" ContentURL="http://content.sweetim.com/msntab/t.asp" HitURL="http://content.sweetim.com/msntab/images/hit.gif" />..</Main>..

C:\ProgramData\SweetIM\Messenger\data\Bars\Default\100\bar.html

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	HTML document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1321
Entropy (8bit):	5.293105930708076
Encrypted:	false
SSDEEP:	24:gi0gAwfuCsAyvUZsC/4PVxMMN7e5yrFMULG9zA5ki0exFMNiNVML5:gNg9yvUZsC/4tVN7eYr+UyikNex+NtL5
MD5:	F46B534329D6FD6DA8DF4007B73EB152
SHA1:	308FC8EC1C74C9CC7E3D8DDCB23B69BE8209ABF4
SHA-256:	DEE64F34FBD1CD62D103E60BC7904586293DCA648AC694534C15C3E01DBD350E
SHA-512:	3159B0431676464D783D68CD3879D439082BB2FDFA24B26929844B7C527D44B2CB4D938064E70B89B37FB48FD51B121A4449ED1591CD720A02DC24E316B17D45
Malicious:	false
Preview:	.<html>..<head>.....<script type="text/javascript">... ...function window_onload() {....return true;...}.. ...function imbar_DoFSCommand(command, args) {....if(command == "link_cmd") {.....OpenExternalURL(args);....}.....else {......window.external.Flash_FSCommand(command , args);....}...}......function SweetIMVerification(args){....if(args=="SweetIM") {.....return 1;....}....else {.....return 0;....}...}......function SweetIMSetVersion(version){....return 1;...}......function MSNMessengerSetVersion(version) {....return 1;...}.....function IMSetVersion(version){....return 1;...}.....function OpenExternalURL(url) {....if(url != null) {.....if(window.external.IE_NewWinEnable("", "") == 1){.......window.open(url);......}....}...}...-->...</script>...<script language="VBScript">...On Error Resume Next...Sub imbar_FSCommand(ByVal command, ByVal args)....call imbar_DoFSCommand(command, args)...end sub...</script>.....</head>..<body bgcolor="#eef3fa" style="margin:0px" scroll="no" langua

C:\ProgramData\SweetIM\Messenger\data\Bars\Default\100\bar.js

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	658
Entropy (8bit):	5.308390075339653
Encrypted:	false
SSDEEP:	12:FkY6SGSfKZeENb3Z63iJKyh0eI+cKePweK9e6ojcRp:/Uhtf1hrImp
MD5:	6BFA07FCC2ECB46B7452E4A08BA43048
SHA1:	D806CD0C04B277AEA705E5048612600DBE6D3097
SHA-256:	51C8FCC7DFEDBFB2B683D9A477AB1A2F9028ED252E05D485D600BBE3601541C5
SHA-512:	6BBCDBF9D533371F89D4E8473C4C5CCDACAD94CBDD931B1A13AE3D4FC194C7A28C3637EE8F45936F9EA066C411A9E53DFFC03BCDD22F5EBA9EFA0ACCB8061235
Malicious:	false
Preview:	.document.write('<object classid="clsid:d27cdb6e-ae6d-11cf-96b8-444553540000" ');..document.write('codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=8,0,0,0" ');..document.write('width="100%" ');..document.write('height="100%" ');..document.write('id="imbar" ');..document.write('align="top">');..document.write('<param name="allowScriptAccess" value="sameDomain" />');..document.write('<param name="movie" value="' + _fl + '?BAROffsetX=' + _offsetX + '" />');..document.write('<param name="quality" value="high" />');..document.write('<param name="bgcolor" value="' + _bgColor + '" />');..document.write('</object>');..

C:\ProgramData\SweetIM\Messenger\data\Bars\Default\100\bar.swf

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Macromedia Flash data (compressed), version 8
Category:	dropped
Size (bytes):	53874
Entropy (8bit):	7.9959082761869
Encrypted:	true
SSDEEP:	768:Mhsbz1/08uuoH5mOxUJpki3XjqqPqCpcmWygwxsOS80EBBpV3GFW+niZPTuDaS17:wstMTuolYpkIXjzTO80EBBPGFQZaR
MD5:	4A5648990EB842621BB5EC6103FCFAB9
SHA1:	9F6CE2C7F9B23E49ACA8E8640299367462F0A556
SHA-256:	4166F5D44351BEF154DAA41D9192CCEF1869B4E83C5710392FE3AA1E890B240B
SHA-512:	D4F21FED7574DD055357EBD6BD352146EEF4EA41A475654D793F3BD4CA6627373ADFC1C9D94ED90968238CA92BA424A1FE421BDF19E8558966177496BA8BABCF
Malicious:	false
Preview:	CWS.....x..}.<U..:.<f.2.$S...y.C.<e..JN..R.#$...(B....T.(.2UJ......{............w?k..z....Y..}..t..`................P..0.....u.@ .....].d.K..J.ei<@.3uz..^.C..Oh..U...N..hd..X..)JF....^..>.~....0.V.[...r....5.i.-b.w.....$.A.@.=....3s3...f.....6..f.:.zZ.&6..+\.-...;.+...z.E..z..(`....B.#.<..N?O.B.zsp`.[..Q.#....x...W.@r.}...p?.. ..,..$C..]H.b.~A.D1D..\\|;(...k.}..b.O.0..?.D,.7x.."T.hkY.......e...tM.m.7..Y.l...7.r.v.f......]h...j.....chma...ba....j..k...Z&..}-....u...t~.6......-.6.k./.....hSH..PK.... ....-..'84.P.P.V..........@..S....U.3...SRa..A..Y`...1..!.."T.X@..Qcx.C..3...F.....F.J....xa1r3}...xB...)..(. i.?K.O.V...L.....4..0H......c..c..@.@..HT.a^A...P..E....Y.WP8.'2.....+.`<......'..KT.%.2..>...P..2C...(0.Ar@MG.!...P...3....2..l.K."K;h...3\.g.L..P.....o.....L../)j.x.. s...#<"...+...%W..<-..%..H...R9T..wap.#(4I1.&).......3.T.9F.....XD.>..N...H.<T...T..S^J.)......t*@%.AO..\.(..).h.QAa...C.E.q....\B.....J._.W............<..<.."..B.<.........r..Z

C:\ProgramData\SweetIM\Messenger\data\Bars\Default\200\bar.html

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	HTML document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1321
Entropy (8bit):	5.293105930708076
Encrypted:	false
SSDEEP:	24:gi0gAwfuCsAyvUZsC/4PVxMMN7e5yrFMULG9zA5ki0exFMNiNVML5:gNg9yvUZsC/4tVN7eYr+UyikNex+NtL5
MD5:	F46B534329D6FD6DA8DF4007B73EB152
SHA1:	308FC8EC1C74C9CC7E3D8DDCB23B69BE8209ABF4
SHA-256:	DEE64F34FBD1CD62D103E60BC7904586293DCA648AC694534C15C3E01DBD350E
SHA-512:	3159B0431676464D783D68CD3879D439082BB2FDFA24B26929844B7C527D44B2CB4D938064E70B89B37FB48FD51B121A4449ED1591CD720A02DC24E316B17D45
Malicious:	false
Preview:	.<html>..<head>.....<script type="text/javascript">... ...function window_onload() {....return true;...}.. ...function imbar_DoFSCommand(command, args) {....if(command == "link_cmd") {.....OpenExternalURL(args);....}.....else {......window.external.Flash_FSCommand(command , args);....}...}......function SweetIMVerification(args){....if(args=="SweetIM") {.....return 1;....}....else {.....return 0;....}...}......function SweetIMSetVersion(version){....return 1;...}......function MSNMessengerSetVersion(version) {....return 1;...}.....function IMSetVersion(version){....return 1;...}.....function OpenExternalURL(url) {....if(url != null) {.....if(window.external.IE_NewWinEnable("", "") == 1){.......window.open(url);......}....}...}...-->...</script>...<script language="VBScript">...On Error Resume Next...Sub imbar_FSCommand(ByVal command, ByVal args)....call imbar_DoFSCommand(command, args)...end sub...</script>.....</head>..<body bgcolor="#eef3fa" style="margin:0px" scroll="no" langua

C:\ProgramData\SweetIM\Messenger\data\Bars\Default\200\bar.js

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	658
Entropy (8bit):	5.308390075339653
Encrypted:	false
SSDEEP:	12:FkY6SGSfKZeENb3Z63iJKyh0eI+cKePweK9e6ojcRp:/Uhtf1hrImp
MD5:	6BFA07FCC2ECB46B7452E4A08BA43048
SHA1:	D806CD0C04B277AEA705E5048612600DBE6D3097
SHA-256:	51C8FCC7DFEDBFB2B683D9A477AB1A2F9028ED252E05D485D600BBE3601541C5
SHA-512:	6BBCDBF9D533371F89D4E8473C4C5CCDACAD94CBDD931B1A13AE3D4FC194C7A28C3637EE8F45936F9EA066C411A9E53DFFC03BCDD22F5EBA9EFA0ACCB8061235
Malicious:	false
Preview:	.document.write('<object classid="clsid:d27cdb6e-ae6d-11cf-96b8-444553540000" ');..document.write('codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=8,0,0,0" ');..document.write('width="100%" ');..document.write('height="100%" ');..document.write('id="imbar" ');..document.write('align="top">');..document.write('<param name="allowScriptAccess" value="sameDomain" />');..document.write('<param name="movie" value="' + _fl + '?BAROffsetX=' + _offsetX + '" />');..document.write('<param name="quality" value="high" />');..document.write('<param name="bgcolor" value="' + _bgColor + '" />');..document.write('</object>');..

C:\ProgramData\SweetIM\Messenger\data\Bars\Default\200\bar.swf

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Macromedia Flash data (compressed), version 8
Category:	dropped
Size (bytes):	53874
Entropy (8bit):	7.9959082761869
Encrypted:	true
SSDEEP:	768:Mhsbz1/08uuoH5mOxUJpki3XjqqPqCpcmWygwxsOS80EBBpV3GFW+niZPTuDaS17:wstMTuolYpkIXjzTO80EBBPGFQZaR
MD5:	4A5648990EB842621BB5EC6103FCFAB9
SHA1:	9F6CE2C7F9B23E49ACA8E8640299367462F0A556
SHA-256:	4166F5D44351BEF154DAA41D9192CCEF1869B4E83C5710392FE3AA1E890B240B
SHA-512:	D4F21FED7574DD055357EBD6BD352146EEF4EA41A475654D793F3BD4CA6627373ADFC1C9D94ED90968238CA92BA424A1FE421BDF19E8558966177496BA8BABCF
Malicious:	false
Preview:	CWS.....x..}.<U..:.<f.2.$S...y.C.<e..JN..R.#$...(B....T.(.2UJ......{............w?k..z....Y..}..t..`................P..0.....u.@ .....].d.K..J.ei<@.3uz..^.C..Oh..U...N..hd..X..)JF....^..>.~....0.V.[...r....5.i.-b.w.....$.A.@.=....3s3...f.....6..f.:.zZ.&6..+\.-...;.+...z.E..z..(`....B.#.<..N?O.B.zsp`.[..Q.#....x...W.@r.}...p?.. ..,..$C..]H.b.~A.D1D..\\|;(...k.}..b.O.0..?.D,.7x.."T.hkY.......e...tM.m.7..Y.l...7.r.v.f......]h...j.....chma...ba....j..k...Z&..}-....u...t~.6......-.6.k./.....hSH..PK.... ....-..'84.P.P.V..........@..S....U.3...SRa..A..Y`...1..!.."T.X@..Qcx.C..3...F.....F.J....xa1r3}...xB...)..(. i.?K.O.V...L.....4..0H......c..c..@.@..HT.a^A...P..E....Y.WP8.'2.....+.`<......'..KT.%.2..>...P..2C...(0.Ar@MG.!...P...3....2..l.K."K;h...3\.g.L..P.....o.....L../)j.x.. s...#<"...+...%W..<-..%..H...R9T..wap.#(4I1.&).......3.T.9F.....XD.>..N...H.<T...T..S^J.)......t*@%.AO..\.(..).h.QAa...C.E.q....\B.....J._.W............<..<.."..B.<.........r..Z

C:\ProgramData\SweetIM\Messenger\data\Bars\Default\400\bar.html

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	HTML document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1321
Entropy (8bit):	5.293105930708076
Encrypted:	false
SSDEEP:	24:gi0gAwfuCsAyvUZsC/4PVxMMN7e5yrFMULG9zA5ki0exFMNiNVML5:gNg9yvUZsC/4tVN7eYr+UyikNex+NtL5
MD5:	F46B534329D6FD6DA8DF4007B73EB152
SHA1:	308FC8EC1C74C9CC7E3D8DDCB23B69BE8209ABF4
SHA-256:	DEE64F34FBD1CD62D103E60BC7904586293DCA648AC694534C15C3E01DBD350E
SHA-512:	3159B0431676464D783D68CD3879D439082BB2FDFA24B26929844B7C527D44B2CB4D938064E70B89B37FB48FD51B121A4449ED1591CD720A02DC24E316B17D45
Malicious:	false
Preview:	.<html>..<head>.....<script type="text/javascript">... ...function window_onload() {....return true;...}.. ...function imbar_DoFSCommand(command, args) {....if(command == "link_cmd") {.....OpenExternalURL(args);....}.....else {......window.external.Flash_FSCommand(command , args);....}...}......function SweetIMVerification(args){....if(args=="SweetIM") {.....return 1;....}....else {.....return 0;....}...}......function SweetIMSetVersion(version){....return 1;...}......function MSNMessengerSetVersion(version) {....return 1;...}.....function IMSetVersion(version){....return 1;...}.....function OpenExternalURL(url) {....if(url != null) {.....if(window.external.IE_NewWinEnable("", "") == 1){.......window.open(url);......}....}...}...-->...</script>...<script language="VBScript">...On Error Resume Next...Sub imbar_FSCommand(ByVal command, ByVal args)....call imbar_DoFSCommand(command, args)...end sub...</script>.....</head>..<body bgcolor="#eef3fa" style="margin:0px" scroll="no" langua

C:\ProgramData\SweetIM\Messenger\data\Bars\Default\400\bar.js

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	658
Entropy (8bit):	5.308390075339653
Encrypted:	false
SSDEEP:	12:FkY6SGSfKZeENb3Z63iJKyh0eI+cKePweK9e6ojcRp:/Uhtf1hrImp
MD5:	6BFA07FCC2ECB46B7452E4A08BA43048
SHA1:	D806CD0C04B277AEA705E5048612600DBE6D3097
SHA-256:	51C8FCC7DFEDBFB2B683D9A477AB1A2F9028ED252E05D485D600BBE3601541C5
SHA-512:	6BBCDBF9D533371F89D4E8473C4C5CCDACAD94CBDD931B1A13AE3D4FC194C7A28C3637EE8F45936F9EA066C411A9E53DFFC03BCDD22F5EBA9EFA0ACCB8061235
Malicious:	false
Preview:	.document.write('<object classid="clsid:d27cdb6e-ae6d-11cf-96b8-444553540000" ');..document.write('codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=8,0,0,0" ');..document.write('width="100%" ');..document.write('height="100%" ');..document.write('id="imbar" ');..document.write('align="top">');..document.write('<param name="allowScriptAccess" value="sameDomain" />');..document.write('<param name="movie" value="' + _fl + '?BAROffsetX=' + _offsetX + '" />');..document.write('<param name="quality" value="high" />');..document.write('<param name="bgcolor" value="' + _bgColor + '" />');..document.write('</object>');..

C:\ProgramData\SweetIM\Messenger\data\Bars\Default\400\bar.swf

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Macromedia Flash data (compressed), version 8
Category:	dropped
Size (bytes):	53673
Entropy (8bit):	7.995428299378701
Encrypted:	true
SSDEEP:	1536:AGnEE3lFGqTbwerl30peikaEd8raqt4MbiJU66TjNsAv:AGlDtTprV0pei/cMgKjNsK
MD5:	83F8E5A29FB110CA0579DE9AB53B8DEC
SHA1:	0F96C316DCEA9CFC5B120CF96E079F8F0632F94E
SHA-256:	E1099174DD3B60140FEFC201B202125FA9ABAE1727B90C7B5EC30CFC105921D5
SHA-512:	CB0426A3E35268727BFADE2FFA7E829CC3AE37E1A471D556078AFB28EF359CB0A3D805133C74451091293BD175D273BB10F56212C227E4EBC3EDE28F29E6D9A9
Malicious:	false
Preview:	CWS.....x..}.<U.....!..TQ....y..).5O.B.[i4.L...$C.H.....BE...I...{....>........?O..t.....w...Zko.....M.Xk.?.h...:v..........0......D"`...@q...j.4.3(.e3]..@...0.o...fy.b8%@.....BO..f.@..;dz..-.........z...y.,.. yU...........T).P.p.>f...4r2...F..&.....F...Zj........)...5......}..\|..C(0t.r..~....a...t.e.......D.s.q.~.x_..J../......p..%.H.. .....@.......".!"......n...I...\<.I7.=...@w....Pq.].<>...@..o..44..U762wPW...66..V.F....v..P....n.................;.&..j...m5...5....i..,t4.5.]....i/\|"V..hCH......A.....)........h`+...z.y.... ..(..X.`%.J....4..?h.2+.v...!c.....M..P.g....3q%.C...Z.2.Qp%Q.J.Z.^X..H..."....A.-j3H.........p%Q.ZZZ:Jjm.\..))..c..c..C.@...U..x_.M.. }Q..,t......D...8..{...._ ..X/...$.QC..(.ss......e%+..........2J...OE:c..L(._,)...#.........?3d.K..$.F.\|./...g...IQ...]...&..A....\..../.r..i../..@.4....8x...2.B...d.b.&...<?3.MPbT.&h.H.l.OW.`..4..S..J..j.*.)/.5.....\|.OCK>.......4.$.....4..@i...C'.1"../.8...... ..\|....pp........=..\|.}.\|.".....5.{....

C:\ProgramData\SweetIM\Messenger\data\contentdb\cache_indx.dat

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	17
Entropy (8bit):	3.146286370662105
Encrypted:	false
SSDEEP:	3:DML69y:4
MD5:	C3DAF1B5C21294F22A37417A2D7FC927
SHA1:	80EF4C2FF09137B25D655E2989475A7F88375E33
SHA-256:	CE399EE42336381D151F94FBFF7126FE6DEBC5956EE6D581B24E55EFDF7E1392
SHA-512:	9D2DB1E2CDE4FC8060F40AF1343424CD07B33569127A132926F7E3EAD33F470D4043E4F245A09DC4B08C4BA318959FED962A4B4854198E1B60F87C5665895836
Malicious:	false
Preview:	<Main>..</Main>..

C:\ProgramData\SweetIM\Messenger\data\packages\FailDialog\activationFail.htm

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	HTML document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	3316
Entropy (8bit):	4.829458731107662
Encrypted:	false
SSDEEP:	48:RmMq1YRx/11co2kMukbw1f5HErHlkeJ5E8QcxMGj6IJDHz:pIY3d1co2kMukkFRuFkIE8QEfjbf
MD5:	55AF945CC675BC60A80C9F04F8762E24
SHA1:	8D4047C5738CC6B4E500350EDE101C19178044BC
SHA-256:	03CE1564461146FB06FAB2CBA25ECEA7108284D66BBFD618D3597D854FE98D47
SHA-512:	9BAC191C8CF75DCABD2AAF2B0B66E251B04FCA2B5823B7A86FABC9489FDA7B2FD92AE0DAFB4A9A9B2E34679C5C79069644AB5FF4F3C656A237BC21A2A23F872C
Malicious:	false
Preview:	.<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<html xmlns="http://www.w3.org/1999/xhtml">..<head> .... <script type="text/javascript">... ...//ondocument loaded...function SweetIMVerification(args){....if(args=="SweetIM") {........return 1;.......}....else {.. .....return 0;.....}...}......function SweetIMSetVersion(version){....return 1;...}......function IMSetVersion(version){....return 1;...}.....function SIM_DocumentComplete() {....SetDialogSize();...}.....function SIM_DocumentUnload() {.......}.....function window_onload() {....return true;...} .. ...function getQueryParam(paramName) {....var result = null;...try {...var qs = window.location.search;...if(qs.charAt(0) == "?") {....qs = qs.substr(1);...}...var pairs = qs.split("&");...var param;...if(pairs) {....for(var i = 0, count = pairs.length; i < count; i++) {.....param = pairs[i].split("=");.....if(param && param[0] == paramName) {

C:\ProgramData\SweetIM\Messenger\data\packages\FailDialog\close_but.gif

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	GIF image data, version 89a, 38 x 38
Category:	dropped
Size (bytes):	908
Entropy (8bit):	7.625698581546624
Encrypted:	false
SSDEEP:	24:9lCw2vKPvjkQxzSo3agsU0XfQd6t/VQSLguSA8jyx:iwwKP3hSo3agafAPLyx
MD5:	C17A25AA54FFE590CC641393863AF1C9
SHA1:	122CDAD63E0D6557B989BBCDCA9C869EE7A7A243
SHA-256:	F7BA5F88D66827A1F16903E1BD0BF672166B5C3BA5F4BEA7657FAAD17F0F6BD9
SHA-512:	66839CA9FC0FEE9BA737DC0E96DB3F3A83D533F62611063C879C2277EDA3C9C105DDC69C2A06A60EEFA98C47562853741EB002C330CAA373D3E7780EE7BF51FB
Malicious:	false
Preview:	GIF89a&.&..{....6Wk...:\p.............5?>U^0OcTkt.....j..2Rf_v~1Qe1Pd0Pd1QdCj}Em./Nb9\oY..U..W............m.....R}.3JT>buu..2QeCj\|6Xkh..5WjDk~Bh{'@I...3Th:]pQ{.\|.....x........5Vj......f.....0Pc7Yl...Kt.^..Gp.Lv....{..T~.S}......Bi\|...I`i...z.....Fm._.....}..[..Dl~...8Zn...Fn.r..Kt.Js.Dk}Mw....Go.k.....Lu.l........X..Gn.Js.a..P{.Fn....4Ui`...........\..............Mx..4Oz..../Nb............!.....{.,....&.&.....{...........(m.....Xy.....y+....k....,...h..`u.....eRnE....&w...!z.....; .<.._.Pa....q.F.I.'.Sv...91..{."5....c.+{..)C..zQ..{..d..KcI..KW..8P..... .[X....[,......x..3..O.j.,...... ?&.C......X...%..K..9.g1.yxZ.y.&..r..Y..S.Q.&.J..U<Y.m...jH.2}y5.\..........iw+^.C..}{..1.W...kxb.!...[..P.O......1.#..Lw..K0.X.B.3.a.2O.c...KL.... ...N..0j...$,q..OY..,.a....K..X...z.j..`)K...l0%..%.o..;...T{P\.D...rX....`p..4p....6...>.0G."X".....E).f....."...vx..!....$<q.0.(...`..'...;

C:\ProgramData\SweetIM\Messenger\data\packages\FailDialog\failure_dialog_BG.jpg

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS3 Windows, datetime=2010:10:19 11:17:13], baseline, precision 8, 548x426, components 3
Category:	dropped
Size (bytes):	72670
Entropy (8bit):	7.8400818396253635
Encrypted:	false
SSDEEP:	1536:xXJtXR6zVgTMx9x34rGWiJRTDVY35S4ZO8613YSZ5K:xX3XQzVgsX3yGWEm35ScO3YMK
MD5:	A914E1126A5132E8965C5B5B7EBB47AB
SHA1:	7172B4284BF10739631D9356C6C8F72FB9818F50
SHA-256:	0F053089CCC6934D0DFD8BF8B72B6E126920531636069E9D627FB50A302CD024
SHA-512:	AA78CDE9B58153D468875CFF129BC23F77DBE118AD4E161D84729F8F429AE88F4CF798E938203CF3D54C7E3E140CF3912714F8D6EBCCF1D80615FFB5140ED3FB
Malicious:	false
Preview:	......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i....................'.......'.Adobe Photoshop CS3 Windows.2010:10:19 11:17:13............................$.......................................................&.(.................................P.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d.................................................................................................................................................\|...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?...p......:..#....r...O'.......G.[..;Q.&"D.n.S.'..JPc.'.i...............H..$..d..4.N..O....za-%.L.BJ^...x.w..<.O.@..@..

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Preferences

Download File

Process:	C:\Users\user\Desktop\BundleSweetIMSetup.exe
File Type:	ASCII text, with very long lines (3003)
Category:	dropped
Size (bytes):	11053
Entropy (8bit):	5.327513941705984
Encrypted:	false
SSDEEP:	192:yq0F3AltzdbuJwAKxRQ+V+F5lnfmIWd0KZq9ZtZCEXqT0/CZE9:yFFQrBasxZGHnOIWdVetZpXqT0/C0
MD5:	EB82867BAF0AE3C289F2E167697A921D
SHA1:	479B30676CDB0B5667ABCE5ED21F13EF2450352F
SHA-256:	BDA3E1DB8953CBF66FF95D6247581FA2DB8EA01A19D6AC700EF8196FE6D80277
SHA-512:	B20594547791B6AA751C305550638A1AAB959CDEFFB10D0119E21F509A9DE2233A6B9E79B0CD1A5B04286BD5EE10C1BFC2E6C6A3A6D4F967FBC294D7AC0B0493
Malicious:	true
Preview:	{. "NewTabPage":{"PrevNavigationTime":"13340886961014896"},. "account_tracker_service_last_update":"13340807398438930",. "alternate_error_pages":{"backup":true},. "announcement_notification_service_first_run_time":"13340807398295099",. "apps":{"shortcuts_arch":"","shortcuts_version":0},. "autocomplete":{"retention_policy_last_version":117},. "browser":{"has_seen_welcome_page":false,"should_reset_check_default_browser":false,"window_placement":{"bottom":974,"left":10,"maximized":false,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},. "commerce_daily_metrics_last_update_time":"13340807423268579",. "countryid_at_install":17224,. "default_apps_install_state":3,. "dips_timer_last_update":"13340886830181789",. "domain_diversity":{"last_reporting_timestamp":"13340881757303313"},. "download":{"directory_upgrade":true,"always_open_pdf_externally":true,"extensions_to_open":"pdf:doc:docx:docxm:docm:xls:xlsx:xlsxm

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Preferences.bad (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3003)
Category:	dropped
Size (bytes):	11053
Entropy (8bit):	5.327513941705984
Encrypted:	false
SSDEEP:	192:yq0F3AltzdbuJwAKxRQ+V+F5lnfmIWd0KZq9ZtZCEXqT0/CZE9:yFFQrBasxZGHnOIWdVetZpXqT0/C0
MD5:	EB82867BAF0AE3C289F2E167697A921D
SHA1:	479B30676CDB0B5667ABCE5ED21F13EF2450352F
SHA-256:	BDA3E1DB8953CBF66FF95D6247581FA2DB8EA01A19D6AC700EF8196FE6D80277
SHA-512:	B20594547791B6AA751C305550638A1AAB959CDEFFB10D0119E21F509A9DE2233A6B9E79B0CD1A5B04286BD5EE10C1BFC2E6C6A3A6D4F967FBC294D7AC0B0493
Malicious:	false
Preview:	{. "NewTabPage":{"PrevNavigationTime":"13340886961014896"},. "account_tracker_service_last_update":"13340807398438930",. "alternate_error_pages":{"backup":true},. "announcement_notification_service_first_run_time":"13340807398295099",. "apps":{"shortcuts_arch":"","shortcuts_version":0},. "autocomplete":{"retention_policy_last_version":117},. "browser":{"has_seen_welcome_page":false,"should_reset_check_default_browser":false,"window_placement":{"bottom":974,"left":10,"maximized":false,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},. "commerce_daily_metrics_last_update_time":"13340807423268579",. "countryid_at_install":17224,. "default_apps_install_state":3,. "dips_timer_last_update":"13340886830181789",. "domain_diversity":{"last_reporting_timestamp":"13340881757303313"},. "download":{"directory_upgrade":true,"always_open_pdf_externally":true,"extensions_to_open":"pdf:doc:docx:docxm:docm:xls:xlsx:xlsxm

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Preferences~RF3711a.TMP (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3003)
Category:	dropped
Size (bytes):	11053
Entropy (8bit):	5.327513941705984
Encrypted:	false
SSDEEP:	192:yq0F3AltzdbuJwAKxRQ+V+F5lnfmIWd0KZq9ZtZCEXqT0/CZE9:yFFQrBasxZGHnOIWdVetZpXqT0/C0
MD5:	EB82867BAF0AE3C289F2E167697A921D
SHA1:	479B30676CDB0B5667ABCE5ED21F13EF2450352F
SHA-256:	BDA3E1DB8953CBF66FF95D6247581FA2DB8EA01A19D6AC700EF8196FE6D80277
SHA-512:	B20594547791B6AA751C305550638A1AAB959CDEFFB10D0119E21F509A9DE2233A6B9E79B0CD1A5B04286BD5EE10C1BFC2E6C6A3A6D4F967FBC294D7AC0B0493
Malicious:	false
Preview:	{. "NewTabPage":{"PrevNavigationTime":"13340886961014896"},. "account_tracker_service_last_update":"13340807398438930",. "alternate_error_pages":{"backup":true},. "announcement_notification_service_first_run_time":"13340807398295099",. "apps":{"shortcuts_arch":"","shortcuts_version":0},. "autocomplete":{"retention_policy_last_version":117},. "browser":{"has_seen_welcome_page":false,"should_reset_check_default_browser":false,"window_placement":{"bottom":974,"left":10,"maximized":false,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},. "commerce_daily_metrics_last_update_time":"13340807423268579",. "countryid_at_install":17224,. "default_apps_install_state":3,. "dips_timer_last_update":"13340886830181789",. "domain_diversity":{"last_reporting_timestamp":"13340881757303313"},. "download":{"directory_upgrade":true,"always_open_pdf_externally":true,"extensions_to_open":"pdf:doc:docx:docxm:docm:xls:xlsx:xlsxm

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Preferences~RF3bb62.TMP (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3003)
Category:	dropped
Size (bytes):	11053
Entropy (8bit):	5.327513941705984
Encrypted:	false
SSDEEP:	192:yq0F3AltzdbuJwAKxRQ+V+F5lnfmIWd0KZq9ZtZCEXqT0/CZE9:yFFQrBasxZGHnOIWdVetZpXqT0/C0
MD5:	EB82867BAF0AE3C289F2E167697A921D
SHA1:	479B30676CDB0B5667ABCE5ED21F13EF2450352F
SHA-256:	BDA3E1DB8953CBF66FF95D6247581FA2DB8EA01A19D6AC700EF8196FE6D80277
SHA-512:	B20594547791B6AA751C305550638A1AAB959CDEFFB10D0119E21F509A9DE2233A6B9E79B0CD1A5B04286BD5EE10C1BFC2E6C6A3A6D4F967FBC294D7AC0B0493
Malicious:	false
Preview:	{. "NewTabPage":{"PrevNavigationTime":"13340886961014896"},. "account_tracker_service_last_update":"13340807398438930",. "alternate_error_pages":{"backup":true},. "announcement_notification_service_first_run_time":"13340807398295099",. "apps":{"shortcuts_arch":"","shortcuts_version":0},. "autocomplete":{"retention_policy_last_version":117},. "browser":{"has_seen_welcome_page":false,"should_reset_check_default_browser":false,"window_placement":{"bottom":974,"left":10,"maximized":false,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},. "commerce_daily_metrics_last_update_time":"13340807423268579",. "countryid_at_install":17224,. "default_apps_install_state":3,. "dips_timer_last_update":"13340886830181789",. "domain_diversity":{"last_reporting_timestamp":"13340881757303313"},. "download":{"directory_upgrade":true,"always_open_pdf_externally":true,"extensions_to_open":"pdf:doc:docx:docxm:docm:xls:xlsx:xlsxm

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Preferences~RF43082.TMP (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3003)
Category:	dropped
Size (bytes):	11053
Entropy (8bit):	5.327513941705984
Encrypted:	false
SSDEEP:	192:yq0F3AltzdbuJwAKxRQ+V+F5lnfmIWd0KZq9ZtZCEXqT0/CZE9:yFFQrBasxZGHnOIWdVetZpXqT0/C0
MD5:	EB82867BAF0AE3C289F2E167697A921D
SHA1:	479B30676CDB0B5667ABCE5ED21F13EF2450352F
SHA-256:	BDA3E1DB8953CBF66FF95D6247581FA2DB8EA01A19D6AC700EF8196FE6D80277
SHA-512:	B20594547791B6AA751C305550638A1AAB959CDEFFB10D0119E21F509A9DE2233A6B9E79B0CD1A5B04286BD5EE10C1BFC2E6C6A3A6D4F967FBC294D7AC0B0493
Malicious:	false
Preview:	{. "NewTabPage":{"PrevNavigationTime":"13340886961014896"},. "account_tracker_service_last_update":"13340807398438930",. "alternate_error_pages":{"backup":true},. "announcement_notification_service_first_run_time":"13340807398295099",. "apps":{"shortcuts_arch":"","shortcuts_version":0},. "autocomplete":{"retention_policy_last_version":117},. "browser":{"has_seen_welcome_page":false,"should_reset_check_default_browser":false,"window_placement":{"bottom":974,"left":10,"maximized":false,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},. "commerce_daily_metrics_last_update_time":"13340807423268579",. "countryid_at_install":17224,. "default_apps_install_state":3,. "dips_timer_last_update":"13340886830181789",. "domain_diversity":{"last_reporting_timestamp":"13340881757303313"},. "download":{"directory_upgrade":true,"always_open_pdf_externally":true,"extensions_to_open":"pdf:doc:docx:docxm:docm:xls:xlsx:xlsxm

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\track[1].htm

Download File

Process:	C:\Users\user\Desktop\BundleSweetIMSetup.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	167
Entropy (8bit):	4.459637879457414
Encrypted:	false
SSDEEP:	3:qVoB3tUROGclXqyvXboAcMBXqWSZUXqXlIVLmEUjA/CqwcWWGu:q43tISl6kXiMIWSU6XlI5KktpfGu
MD5:	F5D40B7259645010F9A248858AD14178
SHA1:	B3051D17A6EC8C9E166BF09A62B48261AB86957B
SHA-256:	7F5007068D2B56EA9735E2490D60CFF2E72CAE312024AC1F6C91158EBA47D05D
SHA-512:	1E82BC2D067F726670B3E6054D73E57868F6E7C50EB979696BF927DAEEF699F2D8F8DE201E8252B86B0E9F86DC69E5037FC9FA08EF6C271B033F29D4F0F4C1AA
Malicious:	false
Preview:	<html>..<head><title>301 Moved Permanently</title></head>..<body>..<center><h1>301 Moved Permanently</h1></center>..<hr><center>CloudFront</center>..</body>..</html>..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\track[1].htm

Download File

Process:	C:\Users\user\Desktop\BundleSweetIMSetup.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	167
Entropy (8bit):	4.459637879457414
Encrypted:	false
SSDEEP:	3:qVoB3tUROGclXqyvXboAcMBXqWSZUXqXlIVLmEUjA/CqwcWWGu:q43tISl6kXiMIWSU6XlI5KktpfGu
MD5:	F5D40B7259645010F9A248858AD14178
SHA1:	B3051D17A6EC8C9E166BF09A62B48261AB86957B
SHA-256:	7F5007068D2B56EA9735E2490D60CFF2E72CAE312024AC1F6C91158EBA47D05D
SHA-512:	1E82BC2D067F726670B3E6054D73E57868F6E7C50EB979696BF927DAEEF699F2D8F8DE201E8252B86B0E9F86DC69E5037FC9FA08EF6C271B033F29D4F0F4C1AA
Malicious:	false
Preview:	<html>..<head><title>301 Moved Permanently</title></head>..<body>..<center><h1>301 Moved Permanently</h1></center>..<hr><center>CloudFront</center>..</body>..</html>..

C:\Users\user\AppData\Local\Temp\1714110143_4764500_750.tmp

Download File

Process:	C:\Users\user\Desktop\BundleSweetIMSetup.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3935664
Entropy (8bit):	7.869671937471047
Encrypted:	false
SSDEEP:	98304:R1BGPcIfEmnydhSldFORddm2ibra9AMYzXtE0wX:R1BixjyzqHKHqbm9mX20wX
MD5:	CED6A16415E6AE2243ACC2B776B9D965
SHA1:	1C2AFF84C79F3A6163F745B018AE700F07DD685F
SHA-256:	879D67E7E8C34DA226B13B91FDF3BC7C36C53C8A9937E97BCEFD68E35C15AF57
SHA-512:	4D1CD0CED181675CE2BD5693EB67EDF30DC01A81252CF7ED3A398B0E9D6359FB1DA271708C79D5B620C510B111BF55B30EE63CF7B264E8EB1606444A6959B041
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 17%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Vd.L7..L7..L7..7+..N7...+..l7..#(...7..#(..C7..../.N7..J...M7..L7...6....._7..J...`7...1..M7..RichL7..........PE..L....&F.................P...0......l........`....@..................................w<..............................................p...W............;.0!...........................................................`..h............................text...RB.......P.................. ..`.rdata..&m...`...p...`..............@..@.data............`..................@....rsrc....W...p...`...0..............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1714110143_4764625_750.tmp

Download File

Process:	C:\Users\user\Desktop\BundleSweetIMSetup.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3410880
Entropy (8bit):	7.852929734038305
Encrypted:	false
SSDEEP:	98304:E1BGP55KeGzIK08BR+0h0lBI+0W0AUrPm+JL2NP16wjz9XPfI:E1Bi55KeGIKpBXhIBuh++nwjpfw
MD5:	4E3FCE1D8BE37088E4E40B829DA24091
SHA1:	59FC7C3F2DEDEBE3CFFD4AEAAFED3063273CA35B
SHA-256:	08884773C4C606741771205FAFDC74BEEC1A3D18F8019968689954728176326C
SHA-512:	15AAEEEB929E698A894FFF643D20BB24DABB0332C6520A04B569F102D841FFDBAD934315AD35A911ECFECEE5619D1C1F601EB1EE7A6EA6FAB328CACDAD4514A6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 16%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Vd.L7..L7..L7..7+..N7...+..l7..#(...7..#(..C7..../.N7..J...M7..L7...6....._7..J...`7...1..M7..RichL7..........PE..L....&F.................P...0......l........`....@.................................D.5..............................................p...W............3.0!...........................................................`..h............................text...RB.......P.................. ..`.rdata..&m...`...p...`..............@..@.data............`..................@....rsrc....W...p...`...0..............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1714110143_4764703_750.tmp

Download File

Process:	C:\Users\user\Desktop\BundleSweetIMSetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	542036
Entropy (8bit):	6.56751373563397
Encrypted:	false
SSDEEP:	6144:Jaxeh07OAImJjRrJQ6XEaEubw1BhkqKLc7GM4StJ1mGB5tnmZS9rXOYqgi3nm4BL:JyJ1ua1bw1gqKLc6etJ1m0pXLqJ7V/T
MD5:	B637C198FA977E3FB44BE8B6563FA57D
SHA1:	07FE04B3990EF759551AC4FE5996EA1C7B9B122F
SHA-256:	91F1216D6CD6A0355A6D3B314366993FA531A285D91A6C1E14BF8505B0C7FA1A
SHA-512:	5CFF6DC1BC3FE3FC376A8028339C130F8317D6DA12962F57612925A95E7E4C0BB10022F3FE68DDC63BD5D8BC6A88D5A2B6763746144F23FC09D78FA9A2181CF3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....rL........... ...8.r.........................`.........................P................ ..................................................................!...................................................................................text....q.......r..................`..`.data...X............v..............@....bss.....................................edata..............................@....idata..............................@....reloc...!......."..................@....stab...l..............................B.stabstra....0.........................B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1714110143_4764718_750.tmp

Download File

Process:	C:\Users\user\Desktop\BundleSweetIMSetup.exe
File Type:	Macromedia Flash data (compressed), version 9
Category:	dropped
Size (bytes):	45328
Entropy (8bit):	7.993429163936794
Encrypted:	true
SSDEEP:	768:i8qetPOl0k7K21COqKuiH6AFyFR7OikC1kr0C3SW+c4eUahZ9mHg2:iGkjK21C/KdaAFyvOb063UaJmHN
MD5:	082CEE2F16A62D4642711F1EEA0BDF76
SHA1:	D82B1B952F378B9B022D7071C44B2433CA045AB3
SHA-256:	353BF8B47EB53F4D9733F0503A7E44B58BB9B7943AE7B9F8F0FBB2D71C95DF75
SHA-512:	A8856AFCE96DFE5C4EB1833504FF51F0007FD554DF53D6E79168634E7EB986AC9E449D348DEEF641F3AD0D5AA9532022389CE41068AC7A08D4375E5618D7A996
Malicious:	false
Preview:	CWS.....x..{.X]......Kp........www..Hp.;.........z.$..w.}.._.\|=.7=]l.U.V..vU..Vm..... ..@.....I....7..B.....0g..0..R+`,......`...E..3....'.p]..j'.'n9......P...~........!b2.........\b...v.....Z".:....i."...m..%O..#..j..H-x!.Do7...<....wg.$....@.I..lW].....D.y?W........5N...3......d.....!..$....I }X.Gtr.;.m....bF.h.d_....b..d..:-.\.=-L...N.D.^....D...6.E.<s.....s....g..Lq.e.l.....*..l..UDP..}...\|\..[%...7+....e.'.....`.K..FhN..tBW8ZK.aTD_.O\..(.tx...v....o#J..;>`.q.Sc..~.[.f.x....QQ..S...E9..g=..7..&..c.VV(>.s+.\|)?...3..Fq...S.S......,....O......7D..{^E..q".._iv..I...{@)-..i.....9m.w..>.}J...T.)...\|......`...........`.=..P.L'.W,.A..hq.{.X.cT.o.A.._.D[o...z.<.........J..YL.()....O..._9 ..j.....g.5..lq)W..=..\.T.I$.R...(`2.a......Gp.Q....1..e.....4......7R.~. .-d-..6.FR..b..D.^.....=6..7......N.)....M......c.A.m..wQ.3..m..a..=...D..TU^...%..^..x..,gh.=.......j.......u..}..M.Y..........q.>......<...".?......3.............g=..M.(>J].h....

C:\Users\user\AppData\Local\Temp\SweetIESetup.exe (copy)

Download File

Process:	C:\Users\user\Desktop\BundleSweetIMSetup.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3410880
Entropy (8bit):	7.852929734038305
Encrypted:	false
SSDEEP:	98304:E1BGP55KeGzIK08BR+0h0lBI+0W0AUrPm+JL2NP16wjz9XPfI:E1Bi55KeGIKpBXhIBuh++nwjpfw
MD5:	4E3FCE1D8BE37088E4E40B829DA24091
SHA1:	59FC7C3F2DEDEBE3CFFD4AEAAFED3063273CA35B
SHA-256:	08884773C4C606741771205FAFDC74BEEC1A3D18F8019968689954728176326C
SHA-512:	15AAEEEB929E698A894FFF643D20BB24DABB0332C6520A04B569F102D841FFDBAD934315AD35A911ECFECEE5619D1C1F601EB1EE7A6EA6FAB328CACDAD4514A6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 16%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Vd.L7..L7..L7..7+..N7...+..l7..#(...7..#(..C7..../.N7..J...M7..L7...6....._7..J...`7...1..M7..RichL7..........PE..L....&F.................P...0......l........`....@.................................D.5..............................................p...W............3.0!...........................................................`..h............................text...RB.......P.................. ..`.rdata..&m...`...p...`..............@..@.data............`..................@....rsrc....W...p...`...0..............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\SweetIMSetup.exe (copy)

Download File

Process:	C:\Users\user\Desktop\BundleSweetIMSetup.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3935664
Entropy (8bit):	7.869671937471047
Encrypted:	false
SSDEEP:	98304:R1BGPcIfEmnydhSldFORddm2ibra9AMYzXtE0wX:R1BixjyzqHKHqbm9mX20wX
MD5:	CED6A16415E6AE2243ACC2B776B9D965
SHA1:	1C2AFF84C79F3A6163F745B018AE700F07DD685F
SHA-256:	879D67E7E8C34DA226B13B91FDF3BC7C36C53C8A9937E97BCEFD68E35C15AF57
SHA-512:	4D1CD0CED181675CE2BD5693EB67EDF30DC01A81252CF7ED3A398B0E9D6359FB1DA271708C79D5B620C510B111BF55B30EE63CF7B264E8EB1606444A6959B041
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 17%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Vd.L7..L7..L7..7+..N7...+..l7..#(...7..#(..C7..../.N7..J...M7..L7...6....._7..J...`7...1..M7..RichL7..........PE..L....&F.................P...0......l........`....@..................................w<..............................................p...W............;.0!...........................................................`..h............................text...RB.......P.................. ..`.rdata..&m...`...p...`..............@..@.data............`..................@....rsrc....W...p...`...0..............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\SweetIM_Temp_Folder_4779843\META-INF\manifest.mf

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	13547
Entropy (8bit):	5.600589013116383
Encrypted:	false
SSDEEP:	192:9ycDu2ADT0g95uCs/GJVzbix/urF8g1YDLbax6kTTLSh:93C2A30g95js/GJFk2N1YDLb+l+
MD5:	810FA593D44397BD13FEB001B684EAE2
SHA1:	8223EFAA0D30A289A20B864CA1FC622852AB8201
SHA-256:	35A08311303FA255B0A9793F438C1229FF9DF946E759D52646093727007DD82E
SHA-512:	42008E31A4370D4A94B3F6FA0CF985341EE9E12D850AD06EC7379B6A71814F094F76075894A486756A3BC0B21F4FD54B6710813CE0A8ABC2612CF2B0685107BE
Malicious:	false
Preview:	Manifest-Version: 1.0.Created-By: Signtool (signtool 1.3).Comments: PLEASE DO NOT EDIT THIS FILE. YOU WILL BREAK IT...Name: chrome/sweetim-toolbar/content/addonlistener.js.Digest-Algorithms: MD5 SHA1.MD5-Digest: CNsMWcvyVJA/R2OJD6jx7A==.SHA1-Digest: CQFIbsAHoE930lqhuKYzr0G75EY=..Name: chrome/sweetim-toolbar/content/addonmanager.js.Digest-Algorithms: MD5 SHA1.MD5-Digest: cM97qpn/6M3P29jecDGsCQ==.SHA1-Digest: HGRfWAVRf6I1fjqtqjZlUY7bcvs=..Name: chrome/sweetim-toolbar/content/bindings.xml.Digest-Algorithms: MD5 SHA1.MD5-Digest: IzUsJtYOU3KF6RykwlY6lA==.SHA1-Digest: XjsqnQzlqCFErToou6kmfniWJFE=..Name: chrome/sweetim-toolbar/content/chevron.js.Digest-Algorithms: MD5 SHA1.MD5-Digest: ZK/MV+wuXVbLbSGv6ayLog==.SHA1-Digest: 0HFQT6/U9YtyFnqydQ3XPVRX/bM=..Name: chrome/sweetim-toolbar/content/commands.js.Digest-Algorithms: MD5 SHA1.MD5-Digest: ZX2m/MJXYRHfOXcj/QPKWQ==.SHA1-Digest: 7MjtzoexiMvSnp6aGpMF/6HcHGQ=..Name: chrome/sweetim-toolbar/content/config.js.Digest-Algorithms: MD5 SHA1.MD5-Digest: p

C:\Users\user\AppData\Local\Temp\SweetIM_Temp_Folder_4779843\META-INF\zigbert.sf

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	13655
Entropy (8bit):	5.6040651112820905
Encrypted:	false
SSDEEP:	96:WkA5g0iCoVcI/jdhBJNmDm+lP/eBSjSesuBVyOK6+ZEb5Mw7T4+sKr8tTciJcoC9:P37LBJNmDfB/eBSjnsLKwzF8J2M1
MD5:	59EC97C3D819001C0A897B38A7624473
SHA1:	D535037A3EC3601C7307EADFCD0AFE52747FB830
SHA-256:	13D9271BA7EBBE28508A4EBFCD6775BC1DD3459C5A9D4D8C1CF7F79E7323DDA8
SHA-512:	21A80FDA8D9F3B8EF957F94B7F4F429CD8D37637490DFB3D1C4E941D3F9DE59835162D7DE7C992C1B57B3AB0064655AA19E44AA93D30C3308413D87BBD03E1BA
Malicious:	false
Preview:	Signature-Version: 1.0.Created-By: Signtool (signtool 1.3).Comments: PLEASE DO NOT EDIT THIS FILE. YOU WILL BREAK IT..Digest-Algorithms: MD5 SHA1.MD5-Digest: f2XP9lsoHe04PBOvuFXL5g==.SHA1-Digest: 8RHZ0uUrxScBNJtHgI/t7stA9yA=..Name: chrome/sweetim-toolbar/content/addonlistener.js.Digest-Algorithms: MD5 SHA1.MD5-Digest: w8i3Rt3DxPL6b05cKNpsPw==.SHA1-Digest: 3odNPduNL9VoljP4mprIcpgF4zc=..Name: chrome/sweetim-toolbar/content/addonmanager.js.Digest-Algorithms: MD5 SHA1.MD5-Digest: 2YvLgsIg6k332XHkG6KEFA==.SHA1-Digest: ZvTVKYjibgcpdMsLQbe+A93OY1M=..Name: chrome/sweetim-toolbar/content/bindings.xml.Digest-Algorithms: MD5 SHA1.MD5-Digest: 1pyJGkn2pnE1+gMPhWrmww==.SHA1-Digest: 1uXwwQEdM+fCinL2psHcZId2oMc=..Name: chrome/sweetim-toolbar/content/chevron.js.Digest-Algorithms: MD5 SHA1.MD5-Digest: lOla/YC5L6pzcewNgLywJw==.SHA1-Digest: vPI+B5kuDtUVY4PRGNE0z84Fnl0=..Name: chrome/sweetim-toolbar/content/commands.js.Digest-Algorithms: MD5 SHA1.MD5-Digest: AK1Es9lxyQoNYOJwLNf3SA==.SHA1-Digest: RUAGcms4e0

C:\Users\user\AppData\Local\Temp\SweetIM_Temp_Folder_4779843\chrome.manifest

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.884991274360526
Encrypted:	false
SSDEEP:	12:4yp61ZTeXK17sZSaK1vZW29F1211e71KwobrZ19M91Z+1WEA61nlHKgs0KIk1kv9:47uXKRVlFYq5c1bQCIaPKgsBI191IIv
MD5:	BE04EC8D2EC3BAE591464CD1B717CA38
SHA1:	91920930B8512885B18B76B94DFE74401B95D299
SHA-256:	011A1E4C9C00DE7D49EF66FFF9A0F28AB3BFEDA738CCCE95A046B6B0B6255FA8
SHA-512:	7B026AE4564DAEFB3AEA64351ADF9AA23FAD571DFA4B08AA1700BBE20DA586D33F170B8CB29609F10D07B3828B47F5F0D443300C2501EBA58E9C2A328976BEA2
Malicious:	false
Preview:	content sweetim-toolbar chrome/sweetim-toolbar/content/..locale sweetim-toolbar de-DE chrome/sweetim-toolbar/locale/de-DE/..locale sweetim-toolbar en-US chrome/sweetim-toolbar/locale/en-US/..locale sweetim-toolbar es-ES chrome/sweetim-toolbar/locale/es-ES/..locale sweetim-toolbar fr-FR chrome/sweetim-toolbar/locale/fr-FR/..locale sweetim-toolbar it-IT chrome/sweetim-toolbar/locale/it-IT/..locale sweetim-toolbar nl-NL chrome/sweetim-toolbar/locale/nl-NL/..overlay chrome://browser/content/browser.xul chrome://sweetim-toolbar/content/sweetim-toolbar.xul..skin sweetim-toolbar classic/1.0 chrome/sweetim-toolbar/skin/....# from gecko 2 (FF 4), we need to explicitly register components..# auto complete component:..component {EEE6C362-6118-11DC-9C72-001320C79847} components/SIMAutoCompleteSearch.js..contract @mozilla.org/autocomplete/search;1?name=sweetim-autocomplete {EEE6C362-6118-11DC-9C72-001320C79847}..

C:\Users\user\AppData\Local\Temp\SweetIM_Temp_Folder_4779843\chrome\sweetim-toolbar\content\addonlistener.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4131
Entropy (8bit):	4.625588950617717
Encrypted:	false
SSDEEP:	48:742dJHodJ1k18XJxrWQMJzfZJTnJs4Gocs/vT8udODZiQrOQJy5JCZnRkg6ARkAp:z8hu8LCC4Gob78BBCg9ChK
MD5:	08DB0C59CBF254903F4763890FA8F1EC
SHA1:	0901486EC007A04F77D25AA1B8A633AF41BBE446
SHA-256:	7A84952782D85681375BF0EEF6E0861B81DAF6AC6230E86082E49BC6FB49B2F8
SHA-512:	D738192F28BE485E860CA632D60BC92D0C07D881AA0AE5F39E986F60D8870B0B6D62612A0A27D464BB1E5A2B3A5930F13EBBEE6B1E37DD71887833F190E975AA
Malicious:	false
Preview:	..// "AddonListener" was introduced in Gecko 2 (FF4)....var g_sim_AddonListener = {.. onEnabling: function (addon, needsRestart) {.. //dump("\n XXX onEnabling \n");.. },.. onEnabled: function (addon) {.. //dump("\n XXX onEnabled \n");.. },.. onDisabling: function (addon, needsRestart) {.. //dump("\n XXX onDisabling \n");.. },.. onDisabled: function (addon) {.. //dump("\n XXX onDisabled \n");.. },.. onInstalling: function (addon, needsRestart) {.. //dump("\n XXX onInstalling \n");.. },.. onInstalled: function (addon) {.. //dump("\n XXX onInstalled \n");.. },.. onUninstalling: function (addon, needsRestart) {.. //dump("\n XXX onUninstalling \n");.. try {.. logEnter();.. if (addon.id == g_SWEETIM_EXTENSION_UUID) {.. sim_g_SIMUninstallData = simOnUninstallConfirmedByUser();.... // since we cant receive "onUninstalled" event, we continue the un-i

C:\Users\user\AppData\Local\Temp\SweetIM_Temp_Folder_4779843\chrome\sweetim-toolbar\content\addonmanager.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3052
Entropy (8bit):	4.531395341231766
Encrypted:	false
SSDEEP:	48:VUNczcsspPiyV1Db+mCOZODrZX05IcNY2Wa+l1A:nAB0OgDVAINN11A
MD5:	70CF7BAA99FFE8CDCFDBD8DE7031AC09
SHA1:	1C645F5805517FA2357E3AADAA3665518EDB72FB
SHA-256:	113EEF2B585C045A77C0253B0201FFBC970A4CAF3033D38627D45C90939378CE
SHA-512:	B613B1F8FEFCF0FC8AB6C02D00E0141D988EC5F95B05030CE5FF97E1C6C889AC48090AE3DAE8883551EBCB56110E828549C0B854EF2AAB8D6CFC81A2B546E1C7
Malicious:	false
Preview:	..// wrapper for addons manager data...// for FF4 and later we use "AddonManager.jsm" (introduced only on Gecko 2, FF4)..// for FF3 and before, we use "extensions/manager;1"......// globals, used for getting version in FF4..var sim_g_addon_version = null;..var sim_g_addon_name = null;..var sim_g_event = null;....function simAddonManagerCallback(addon) {.. try {.... logEnter();.... if (sim_g_event != null) {.. // step 1.. // set global value.. sim_g_addon_version = addon.version;.. sim_g_addon_name = addon.name;.... // step 2.. // set evant.. sim_g_event.value = true;.. } else {.. logSevere("sim_g_event is null, we got here too late or too early");.. }.. } catch (e) {.. logSevere2(e);.. }..}....function SIMAddonDetails() {.. this._version = null;.. this._name = null;..}....// gets the addon details, in a way relevent to FF version,..// and puts result

C:\Users\user\AppData\Local\Temp\SweetIM_Temp_Folder_4779843\chrome\sweetim-toolbar\content\bindings.xml

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1519
Entropy (8bit):	4.410561293172547
Encrypted:	false
SSDEEP:	24:8TX667LYXcAr/NHxq0+3GAQY7RR1tY2T6RtY86p9WRctqUyn:xJ7r/f5yLT6eCRcJyn
MD5:	23352C26D60E537285E91CA4C2563A94
SHA1:	5E3B2A9D0CE5A82144AD3A28BBA9267E78962451
SHA-256:	6BE86B7E71BEE837C855C48032E525677BA5071961D03FFD6D1676168A642142
SHA-512:	991CE985948A1CAEC21CB616F46138BD3A44D3EF08E02C34CA8EE5146BABDDAB62D37D4B873A8010D0B89599C431AC2810B6D6BA2BFEB7ADC8B443B6694DFC88
Malicious:	false
Preview:	.<?xml version="1.0"?>..<bindings id="SweetIMBindings".. xmlns="http://www.mozilla.org/xbl".. xmlns:html="http://www.w3.org/1999/xhtml".. xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul".. xmlns:xbl="http://www.mozilla.org/xbl">.... <binding id="sweetim-autocomplete-result-popup".. extends="chrome://global/content/bindings/autocomplete.xml#autocomplete-result-popup">.. .<implementation implements="nsIAutoCompletePopup">.....<property name="showCommentColumn".. onget="return this.mShowCommentColumn;">.. <setter>.. <![CDATA[.. var treecolValue = document.getElementById("treecolAutoCompleteValue");.. if (!val && this.mShowCommentColumn).. {.. treecolValue.setAttribute("flex", 1);.. this.removeColumn("treecolAutoCompleteComment");.. }.

C:\Users\user\AppData\Local\Temp\SweetIM_Temp_Folder_4779843\chrome\sweetim-toolbar\content\chevron.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	13924
Entropy (8bit):	4.6059793934114515
Encrypted:	false
SSDEEP:	192:iVftcobtdfWZDSH555lKQI8xkWaD5+BtidxccSqaF5hxtCGsRlVbF:iV15Jdb6+Bti31SqaF5vtC9lVbF
MD5:	64AFCC57EC2E5D56CB6D21AFE9AC8BA2
SHA1:	D071504FAFD4F58B72167AB2750DD73D5457FDB3
SHA-256:	F878C7FFAC03B2C60BA419E7F8D074AB9693D5C4CE6DC4C5B16B7077194279CA
SHA-512:	6C859A0EC91A688F1E07684F7EB9F20FAB7678B16DF7F2FC281C15BD3D47040C6FC2733F51C383128C8AC9C2C3085D7BC2B7ADDC8156054594FE8E9B386A8394
Malicious:	false
Preview:	..function simClearChevronMenu()..{.. try.. {.. var oMenu = simMyGetElementById('sim_chevron_menu');.. while (oMenu.firstChild).. {.. oMenu.removeChild(oMenu.firstChild);.. }.. }.. catch(e).. {.. logSevere2(e);.. }..}....function simGetCountChevronMenu()..{.. var result = 0;.. try.. {.. var oMenu = simMyGetElementById('sim_chevron_menu');.. result = oMenu.childNodes.length;.. }.. catch(e).. {.. logSevere2(e);.. }.. return result;..}......// TODO move this functiosn to new "utils.js"..function simGetChildElementById(parent, id)..{.. for (var i=0; i<parent.childNodes.length; i++).. {.. if (parent.childNodes[i].id == id).. {.. return parent.childNodes[i];.. }.. }.. return null;..}......function simGetElemWidthForNotCollapsed(oElem)..{.. var width;.. .. if (oElem.hasAttribute('collapsed') && oElem.getAttribute('collapsed')).. {

C:\Users\user\AppData\Local\Temp\SweetIM_Temp_Folder_4779843\chrome\sweetim-toolbar\content\commands.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3720
Entropy (8bit):	4.732388643383319
Encrypted:	false
SSDEEP:	48:H8cFlhDSbeaUrYCp/zse1RLDvyjz985VH0UfkliWeVHV9xx2hMVNeVZENVvIsH:ccFlxSKaaDFm/98b6xeVtNbH
MD5:	657DA6FCC2576111DF397723FD03CA59
SHA1:	ECC8EDCE87B188CBD29E9E9A1A9305FFA1DC1C64
SHA-256:	93E512E98EFDE14499E6373115E2565ECAF4E26EF920BD039FEDC73768DEABD7
SHA-512:	BA284D75D27D520894BD8A3FB1728C3F198945738A8B3D759837CF2FEC7FAF24CD95653716DEC3E6FE309AE5040575B31CD97C67881C252D17DB988C475B1648
Malicious:	false
Preview:	..// trying to be close to code in IE....function simParseAllVars(url)..{.. try.. {.. if (url.indexOf("%sim_search_combo")>=0).. {.. var searchTermsEncoded;.. searchTermsEncoded = simOnSearch();.. url = url.replace("%sim_search_combo", searchTermsEncoded);.. }.. if (url.indexOf("%domain")>=0).. {.. var domain = simGetSelectedTabHost();.. url = url.replace("%domain", domain);.. }.. if (url.indexOf("%toolbar_id")>=0).. {.. var appid = simGetConfigString("simapp_id");.. url = url.replace("%toolbar_id", appid);.. }.. }.. catch(e).. {.. logSevere2(e);.. }.. .. return url;.. ..}....function simNavigateToURL(url)..{.. try.. {.. logEnter ();.. .. // parse vars.. url = simParseAllVars(url);.. .. // Set the browser window's location to the incoming URL.. window._content.docu

C:\Users\user\AppData\Local\Temp\SweetIM_Temp_Folder_4779843\chrome\sweetim-toolbar\content\config.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5896
Entropy (8bit):	4.541238924519937
Encrypted:	false
SSDEEP:	96:XjE3geVhCa6rHUjwYOJY62Nod0qLdYNne4DLM5tYDUkeCalqN85q:zpeVhCa6rHU0YOJYv20jNeycegkZ9Uq
MD5:	A53978F00A102A62E01A3E43CB5EBDBE
SHA1:	E829F60DA3F8105C0D65F7EFE139C629468172C4
SHA-256:	C1B7491D50D19286166CD2511984736368315D4ABAE7C3B8E3836351543749A0
SHA-512:	9083FD8E4C4D8E4E9444EE1DCD99FFEFB9AD6E2DE6D5F68DE008DCEAE3CFFE510866B6E4C76AF17A04C51F8C15827225361C8F7916BECA40C8C5E243D4128268
Malicious:	false
Preview:	....// local helper..function simGetPreferences()..{.. if (sim_g_iPreferences != null).. return sim_g_iPreferences;.. try .. {.. sim_g_iPreferences = kCC["@mozilla.org/preferences-service;1"].getService(kCI.nsIPrefService);.. }.. catch(e).. {.. logSevere2(e);.. }.. .. return sim_g_iPreferences; ..}....// debug helper..function logBranch(branch)..{.. try .. {.. var count;.. var array = new Array();.. var obj = new Object();.. .. .. // see http://developer.mozilla.org/en/docs/nsIPrefBranch.. array = branch.getChildList("", obj);.. count = obj.value;.. .. for(var i=0; i<count; i++).. {.. logInfo("[item " +i+ " ]" + array[i]);.. }.. }.. catch(e).. {.. logSevere2(e);.. }..}....function simDeleteBranch(name)..{.. var prefs;.. var branch;.. .. try.. {.. prefs = simGetPreferences();.. branch = prefs.getBran

C:\Users\user\AppData\Local\Temp\SweetIM_Temp_Folder_4779843\chrome\sweetim-toolbar\content\contentmenu-handler.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	16022
Entropy (8bit):	5.164579735638881
Encrypted:	false
SSDEEP:	384:oJPA3ed6vyJNKMZEYZKK/bTE4tv/j95JM5JV7osxmS7TJLQwlKeMuuC2suizrf7:ePA3edmQNKMZEYZKK/bTE4tv/xMrVRm8
MD5:	2B4FD08FBBE235E21CB29060CE159459
SHA1:	B7FB723D552129FEEAAE7CCA46EDB18A54849C44
SHA-256:	148B0E27BC88BFB16BA9FA0B1963B5F3FB6FA14D4B971EDB3E85268386644B0B
SHA-512:	EC60097A623E9CEAE81AC0D819BABF4B48CFE277B7B6BD2B1625904AB897330DC31D67B850E77C2721159542B4F28EF5EE1DB5BB90144FE6F07D37E64014261E
Malicious:	false
Preview:	/* Constants /..const SIM_BROWSERCOMP_MENU_ID = "id_browser_sim_content_menu";..const SIM_TOOLBAR_BUTTON_ID = "sim_sweetim_btn";....const BRW_NOTIFY_STATE_DOCUMENT = Components.interfaces.nsIWebProgress.NOTIFY_STATE_DOCUMENT;..const BRW_NOTIFY_LOCATION = Components.interfaces.nsIWebProgress.NOTIFY_LOCATION;....const BRW_STATE_START = Components.interfaces.nsIWebProgressListener.STATE_START;..const BRW_STATE_STOP = Components.interfaces.nsIWebProgressListener.STATE_STOP;..const BRW_STATE_TRANSFERRING = Components.interfaces.nsIWebProgressListener.STATE_TRANSFERRING;..const BRW_STATE_IS_DOCUMENT = Components.interfaces.nsIWebProgressListener.STATE_IS_DOCUMENT;..../ End Constants /..../ Members */..var sim_mouseOut = true;..var sim_closeBubbleWindow = false;....//Listen to browser navigation, progress, netvork, security events..var sim_bubbleBrowserProgressListener = ..{...QueryInterface: function(aIID) {....var result = null;....if(aIID.equals(Components.interfaces.nsIWeb

C:\Users\user\AppData\Local\Temp\SweetIM_Temp_Folder_4779843\chrome\sweetim-toolbar\content\contentmenu.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3711
Entropy (8bit):	4.586487379339707
Encrypted:	false
SSDEEP:	48:Vv7HHeL0tgDxRILL1BtH/N0kZp/V6bZ6+oCyhXHbgB1RulleK9s19j/h1OLXy:pIdE1BtZZSloL9sB1o/ZCj/rmXy
MD5:	089FBACD08F66ACB256605630CAEB58C
SHA1:	6A2156806CADD3144F4655F6D688DA27FE89EF73
SHA-256:	29C510DA7814E46549C31EAA84204B88CE3616343E1EC7535ED0EF2DF828A786
SHA-512:	CA32B03181E9D398B025F2E35BBCE0D64C2A086C1606EFAB97B1F6CDA4A4F29AA380403736A56F6F4DDBA778507F186BF579ACE3C148C510B43B40F663E5C34F
Malicious:	false
Preview:	..const SIM_TOOLBAR_BUTTON_ID = "sim_sweetim_btn";..var sim_g_wndContentMenu = null;....function simPreventDefaultProcessing(event)..{...try...{....if (sim_g_wndContentMenu.simTargetWindow)....{.....event.preventDefault();.....event.stopPropagation();.....event.target.parentNode.open = false;....}...}...catch(e)...{....logSevere2(e);...}..}....function SIMPoint()..{.. this._x = 0;.. this._y = 0; ..}....function simComputeContentMenuLocation()..{.. var oPoint = null;.... // step 1.. // get button.. var oButton = simMyGetElementById(SIM_TOOLBAR_BUTTON_ID);.. if (oButton != null).. {.. // step 2.. // check if current tab is opened with addons manager.. var bAddonsManagerTab;.. bAddonsManagerTab = simIsCurrentTabOfAddonManager();.. if (bAddonsManagerTab){.. // !! we get here also for "empty" tab.. // we should hide the menu.. // this is done by caller, when he gets point as null.. }..

C:\Users\user\AppData\Local\Temp\SweetIM_Temp_Folder_4779843\chrome\sweetim-toolbar\content\cookies.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8608
Entropy (8bit):	4.625604721501032
Encrypted:	false
SSDEEP:	192:J8WDV0lxkzQMqZRCdvWyx5c+KQby7DwcsF8cm:T+4dY
MD5:	1F46872FF3A64F893C4E43C081D375C8
SHA1:	DC24DFE5A9FC509A78E57F0CB4516B646D98CD30
SHA-256:	BFF21988F70894E777229045F3B70D50659F084658CCC5424F534D175E2651E4
SHA-512:	79451B08E2695B19A6B09BB45AE291C5F3176FC582969498A946ADF6662D43A2A0380A87B3B3548BFB1E7471631F645C94C53ABBA766048CF74100B63003FB50
Malicious:	false
Preview:	..const SIM_COOKIE_NAME = "SIMAPPID";..const SIM_COOKIE_HOST = ".sweetim.com";......// In 1.9+ and later there is new param "httpOnly"..// to nsICookieManager2:add..function simGetIsGecko19OrLater()..{.. var isGecko19 = false;.. if (kCI.nsIXULAppInfo).. {.. var appInfo = kCC["@mozilla.org/xre/app-info;1"].getService(kCI.nsIXULAppInfo);.. var versionChecker = kCC["@mozilla.org/xpcom/version-comparator;1"].getService(kCI.nsIVersionComparator);.. if (versionChecker.compare(appInfo.platformVersion, "1.9") >= 0).. {.. isGecko19 = true;.. }.. }.. return isGecko19;..}....var sim_g_CookiesObserver = {....// members.._registered: false,....// method: observe..observe : function(subject, topic, data)..{.. try.. {.. if (topic == "cookie-changed").. {.. // see http://developer.mozilla.org/En/NsICookieService.. if(data == "cleared" \|\| data == "deleted").. {.. var verify =

C:\Users\user\AppData\Local\Temp\SweetIM_Temp_Folder_4779843\chrome\sweetim-toolbar\content\domainutils.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	C source, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.556954689157478
Encrypted:	false
SSDEEP:	24:5YPwVFM/wVMMQq8EwK04sA1jFBAZFtJ5stxNYUXi5MIm4gz21icL:5YSFMCMMzZF04sSBqFtJ5stxN4Zm4gK/
MD5:	3A394379FE27CCBEE9FCACAD25A89624
SHA1:	9573282380AF9404FBE89F87E4A8AB2C8EA5A785
SHA-256:	8F87D2A1D2B63DCCED8AE3219A905A22129A5C9D05CCFE80123A1DFA8EAA4CC2
SHA-512:	7FD6A89AA8439F686222320E41F443CDD529662CC1B08D991BF41CC092C3971EDA0FA0B98E8AB6605F6F4D554A29694F061C05654435BA9590B5AE6BE6BD7D44
Malicious:	false
Preview:	function getDomainNameFromURL(sURL) {.. sURL = sURL.replace("http://", "");.. sURL = sURL.replace("https://", "");.. var slash = sURL.indexOf("/");.. if (slash > 0) {.. sURL = sURL.substring(0, slash);.. }.. return sURL;..}....function getSecondLevelDomain(sURL) {.. var sDomain;.. var sSecondDomain = "";.. var arr;.. if (sURL != null) {.. sDomain = getDomainNameFromURL(sURL);.. arr = sDomain.split(".");.. if (arr.length > 2) {.. sSecondDomain = arr[1];.. }.. else {.. sSecondDomain = arr[0];.. }.. }.. return sSecondDomain;..}....function CompareSecondLevelDomains(sURL_1, sURL_2) {.. var result = false;.. try {.. var sSecondDomain1;.. var sSecondDomain2;.. sSecondDomain1 = getSecondLevelDomain(sURL_1);.. sSecondDomain2 = getSecondLevelDomain(sURL_2);.. if (sSecondDomain1 == sSecondDomain2) {.. result = true;.. }.. }..

C:\Users\user\AppData\Local\Temp\SweetIM_Temp_Folder_4779843\chrome\sweetim-toolbar\content\dynamic.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3140
Entropy (8bit):	4.472854553394219
Encrypted:	false
SSDEEP:	96:HuKNuu1ywyvw8WU5Nuu1ywGz7vFlNuu1ywy:HuwaQw2wwy
MD5:	01AD57D140DA3C93803DD9D700373C52
SHA1:	3458CD2EDE13733C9B8447251DED6CDB5B6B182D
SHA-256:	A899595EF19B413A9099A9540852BE1013EBFA18379F31E65D9ACEEAEA52A163
SHA-512:	8E74CA4104F02318B659C67A34DD259681D8CC4F0971FA6F5B6165A1FEDEEEC79180A9C1BD33340607881818349697492EDA9B96580132A4A979F54AEF778FBF
Malicious:	false
Preview:	..// small helper..function..simInsertAfter(newChild, refChild)..{ ...var oParent;...oParent = refChild.parentNode;.. oParent.insertBefore(newChild, refChild.nextSibling); ..}....function..simAddSeperator(id, insertAfterId)..{.. try.. {.. var oNewElem;.. var oElemExist;.. .. // create new element.. oNewElem = document.createElement('toolbarseparator');.. oNewElem.setAttribute('id', id);.. .. // add it.. oElemExist = simMyGetElementById(insertAfterId);.. simInsertAfter(oNewElem, oElemExist);.. return oNewElem;.. }.. catch(e).. {.. logSevere2(e);.. return null;.. }..}....function..simAddBanner(id, url, insertAfterId, name, width, height, bAddPadding)..{.. try.. {.. var oNewElem;.. var oElemExist;.. var oParent;.. var style;.. .. // create new element of banner.. oNewElem = document.createElement('iframe');.. oNewElem.setAtt

C:\Users\user\AppData\Local\Temp\SweetIM_Temp_Folder_4779843\chrome\sweetim-toolbar\content\file.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	7243
Entropy (8bit):	4.667029972880432
Encrypted:	false
SSDEEP:	96:1Ume45J4xbfd3QMs3LfHSVoLlHVcn1EoV5HAVcj/qr8S8G0oRoccNd+:TeRpfXQLHcoBHK1D5Hac7qwvGLx0d+
MD5:	B0B4F17785E11927B144C61C3148E2AC
SHA1:	260A37C06BC8294D79C72A329C261E187E9555BA
SHA-256:	85E23241F5A8301CCF224AF5C30DD58CD6D9584E731259147E3561813F78AEF5
SHA-512:	D9F29D4AF899D6E2D7AC5F3E6F0D4BDAA09B9ED4E3B546EA257B5D65E3E319153EC67A657756899404C3BFEAEE4129F98E249B546BE4067E80F9B19A42A5FEAD
Malicious:	false
Preview:	..// TODO2 - check this: dont put log bcz it recurse..function simGetFileSize(filename)..{.. var result = 0;.. try.. {.. var file;.. .. file = kCC["@mozilla.org/file/local;1"].createInstance(kCI.nsILocalFile);.. file.initWithPath(filename);.. .. if (file.exists()).. result = file.fileSize;.. else.. result = -1; .. }.. catch(e).. {.. simAssert(eSeverity.eSEVERE, e);.. }.. return result;..}....function simReadFileToString(filename) {.. .. var result = null;.. .. try {.. var file;.. var cstream;.. var fstream;.. var data = "";.... logEnter();.... file = kCC["@mozilla.org/file/local;1"].createInstance(kCI.nsILocalFile);.. fstream = kCC["@mozilla.org/network/file-input-stream;1"].createInstance(kCI.nsIFileInputStream);.. cstream = kCC["@mozilla.org/intl/converter-input-stream;1"].createInstance(kCI.nsIConverterInputSt

C:\Users\user\AppData\Local\Temp\SweetIM_Temp_Folder_4779843\chrome\sweetim-toolbar\content\findword.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3434
Entropy (8bit):	4.555949304243929
Encrypted:	false
SSDEEP:	48:1foLrnEe2o1349x0nrnE9zMZJH7Cb+KQGj8HmGF/hfqj:16oeBMuo9zMLHU+KQG4HzYj
MD5:	613B6833DCC4E6ABD2412016F8533729
SHA1:	2A8DD9827A4EF50AEF9BAD4A08697B2E953CF785
SHA-256:	D31BE0E9CDB8B1460D6E4F621EDE0C81E657B95D41D59B45BEA6127E43F61E4A
SHA-512:	A2FBE1B2E9A3D97F5FBD71FBC931D9672A8703B939BE0EFD7F70F895CDD77EBB32C0963BAAFD7635A9CD88DE420A57AC408EE7072C773A819D80D9E61B768E39
Malicious:	false
Preview:	..function simRemoveFindWordButtons() {.. try {.. logEnter();.... var oFindWordButton;.. var oFindWordItem;.... oFindWordItem = simMyGetElementById('sim_find_words_item');.. while (oFindWordItem.firstChild) {.. oFindWordItem.removeChild(oFindWordItem.firstChild);.. }.. }.. catch (e) {.. logSevere2(e);.. }..}....function simAddOneFindWordButton(oFindWordItem, label) {.. var oNewButton;.. var tooltipText;.. oNewButton = document.createElement('toolbarbutton');.. oNewButton.setAttribute('label', label);.. oNewButton.setAttribute('id', 'sim_id_for_find_word_' + label);.. //newButton.setAttribute('crop', 'end');.. oNewButton.setAttribute('class', 'sim_find_word'); // alse sets max width.. oNewButton.setAttribute('oncommand', 'simFindNextWord(event);');.. tooltipText = simGetFormattedStringFromBundle('sweetim.property.button.findword.tooltip', [label]);.. oNewButton.setAttribute('tooltiptext

C:\Users\user\AppData\Local\Temp\SweetIM_Temp_Folder_4779843\chrome\sweetim-toolbar\content\generalobserver.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1430
Entropy (8bit):	4.474103530814768
Encrypted:	false
SSDEEP:	24:KX0t8sqp5raTuJ/fwo84vnUO0qRy67wf7o84vnM0qBQltydbjee5DRB6ykibjLeM:KE3U5J/fwopvnUO0Eyiwf7opvnM0SQPs
MD5:	EE7A229CBDB7F4F3023ACCC1A12CC8BB
SHA1:	AF5F336C583C51CD6FDB8D2FC960B525EEAA5B80
SHA-256:	8C4EA863D577011A2AACB884A18BE53C9599B3CA9B212AC893CA987DA5E2EC11
SHA-512:	C974CC5D0E5079BA1928CED96A64F3F1791079545FA983D4FA66918F5A5DFBF7D9B473AD45CD29AC3FAA9D9A86DC0F93CAD12AA42EED2ABFD5C206F759A1BDF2
Malicious:	false
Preview:	..var sim_g_GeneralObserver = {.... // members.. _registered: false,.... // method: observe.. observe: function (subject, topic, data) {.. try {.. if (topic == "quit-application-requested") {.. simOnQuitApplicationRequested();.. }.. }.. catch (e) {.. logSevere2(e);.. }.. },.... // method: register.. register: function () {.. if (!this._registered) {.. var observerService = kCC["@mozilla.org/observer-service;1"].getService(kCI.nsIObserverService);.. observerService.addObserver(this, "quit-application-requested", false);.... this._registered = true;.. }.. },.... // method: unregister.. unregister: function () {.. if (this._registered) {.. var observerService = kCC["@mozilla.org/observer-service;1"].getService(kCI.nsIObserverService);.. observerService.removeObserver(this, "quit-application-requested");..

C:\Users\user\AppData\Local\Temp\SweetIM_Temp_Folder_4779843\chrome\sweetim-toolbar\content\global-namespace.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	814
Entropy (8bit):	4.8948254611600035
Encrypted:	false
SSDEEP:	12:EfYCIaDJIDD7FsoKI78kLLrpbhoc5tA1iVCYKOHsgp7cbUNnIHYK30JWM/qGwY8s:ErIa/o18kzpb81zLa1nMEJWMiGWs
MD5:	F94995DEAE7ABCDFCE3A3C9BB5F5EC01
SHA1:	4D3C7CB0EA579AD062EDADD18D52EDBD54A331DD
SHA-256:	E3A1E261E542BB984064D9F1B02A72720A4F238BFB3EC8D76BD5407D5FEDB6D2
SHA-512:	B903EB8183214EE0F8F152478AB99B002746A29575AA3B2214153E2C050295C2D37CC28406432452D33F2D12751A5079DEE927CD49CF1EE0686145E434B7359A
Malicious:	false
Preview:	..// loaded in "global namespace", bcz function already "SIMTB_Navigate" in use by ppcbully banner,..// without use of namespace....// called from ppcbully banner, in order to open ad in _current_ or _new_ tab, instead of in new window..// (cannot be done directly using JS, without helper function)..function ..SIMTB_Navigate(url) {.. try {.. NAMESPACE_SIM_TB.logEnter();.... var target = NAMESPACE_SIM_TB.simGetConfigString("ppcbully.target");.. if (target != null && target == "new-tab") {.. NAMESPACE_SIM_TB.simNaviagteToUrlInNewTab(url, false).. }.. else { // no value, or "current-tab", as default -> open in current tab.. NAMESPACE_SIM_TB.simNavigateToURL(url);.. }.. }.. catch (e) {.. NAMESPACE_SIM_TB.logSevere2(e);.. }..}

C:\Users\user\AppData\Local\Temp\SweetIM_Temp_Folder_4779843\chrome\sweetim-toolbar\content\globals.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with very long lines (3538), with CRLF line terminators
Category:	dropped
Size (bytes):	5929
Entropy (8bit):	5.118606362873504
Encrypted:	false
SSDEEP:	96:PT7FggKebtnL/6q0P7ETojlQXdMdnL2D5JeMp6ncwGTSM3YtlPLg:PT7VKStnT6DxhSD5+gYtts
MD5:	95C9B565B9F126BA7B38D804AFF23F3B
SHA1:	7A591C7532742665FCD9BA582C7D619B0728C698
SHA-256:	0544D0A22B2AE4A1F47EE22CBA892C28D3C40AD20D46C87040A78232F5315E2B
SHA-512:	2D799781037E44944571243D6924F5CA457ECDF3B450FEE035A48DF9F5F1CBC59E49A29E26213329B53A67913C3A04D176F62337B749425BA3D3BB04DE30CD3F
Malicious:	false
Preview:	..// urls..const SIM_URL_SEARCH = "http://search.sweetim.com/search.asp"..const SIM_URL_WWW = "http://www.sweetim.com";..const SIM_URL_HOME = "http://home.sweetim.com";..const SIM_URL_FORUM = "http://www.sweetim.com/forum/";..const SIM_URL_HELP_FF = "http://www.sweetim.com/help_simff.asp";..const SIM_URL_HELP_ABOUT = "http://www.sweetim.com/about_overview.asp";..const SIM_URL_HELP_UNINSTALL_FF = "http://www.sweetim.com/uninstallhelpff.asp";..const SIM_URL_FEEDBACK = "http://www.sweetim.com/help_contact.asp";..const SIM_URL_PRIVACY = "http://www.sweetim.com/eula.html#privacy";..const SIM_URL_AFTER_INSTALL = "http://www.sweetim.com/installbar.asp?barid=%toolbar_id";..const SIM_URL_AFTER_UNINSTALL = "http://www.sweetim.com/uninstallbar.asp?barid=%toolbar_id";..const SIM_URL_AFTER_UPDATE = "http://www.sweetim.com/updatebar.asp";..const SIM_URL_SEARCH_FOR_DS = "http://search.sweetim.com/?src

C:\Users\user\AppData\Local\Temp\SweetIM_Temp_Folder_4779843\chrome\sweetim-toolbar\content\gui.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	994
Entropy (8bit):	5.055837583663413
Encrypted:	false
SSDEEP:	24:1nNRePft2xlRewMoHPiRoBioxNjoKweJiJ2nNRRXAofYRRm5YrRR2Re7Uh2JE:1nNEnt2xHxM4iaBioxNj2J2nNbAogmYY
MD5:	B21915268656A59AB1FEFDB73060C116
SHA1:	11029F793F81E05A5666D90367E4DE17D489ED9F
SHA-256:	F18C604A4AC3C9E331EE4CCDD5B9064392C7AE1F53068FD20F990500BE961752
SHA-512:	FCB822F6BDFFB744A74B6CF7B92F89B4A86059959B79DCB98ED2D8DAA3AA51F17290F432A4619FD3B0286D3A038D0F1C7656310D9D579087AC9E40F2D9CBEA5A
Malicious:	false
Preview:	..function simMyGetElementByIdImpl(oParent, id){.....var oElem = null;...if (oParent != null && oParent.hasChildNodes()) {....var children = oParent.childNodes;....for (var i = 0; i < children.length; i++) {.....var oChild = children[i];.....if (oChild.id == id) {......oElem = oChild;......break;.....}.....else {......// try to recurse......oElem = simMyGetElementByIdImpl(oChild, id);......if (oElem !== null)......{.......break;......}.....}....}...}...else{....//alert("children.length = 0");...}...return oElem;..}....function simMyGetElementById(id){...if (false) { // orig, but in correct when we also have TB running along side FB,....// bcz they use same ids....var obj;....obj = document.getElementById(id);....//alert("obj = " + obj);....return obj;...}......var oParent;...var oElem = null;...oParent = document.getElementById(SIM_TOOLBAR_ID);...oElem = simMyGetElementByIdImpl(oParent, id);...if (oElem == null) {....// alert("oElem null for id = " + id);...}...return oElem;..}..

C:\Users\user\AppData\Local\Temp\SweetIM_Temp_Folder_4779843\chrome\sweetim-toolbar\content\highlight.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	11741
Entropy (8bit):	4.718561487895601
Encrypted:	false
SSDEEP:	192:M4waE6qTeRNKsTVyJnd9M6sTaQqIqIPejICyIK4+WPgGMo3acYkXwx:NRqpTeejmazycM
MD5:	19C91355F834A826C848D1FAE11C5FAF
SHA1:	8EE43CDE546F9CB1BF8A4C3B4FBB0BD1A669112C
SHA-256:	8FB0A6DA582D7BE18DF253731ED0EF4136C9609064ACF8FF83B7CBD4F26F9A6C
SHA-512:	908A9B95FA8E26485027B85B94B46C84DB1FD487CC315547FB6B8E6D0720FA3EF917C091C7F33CFF5C091C35DF0B022875EFD10D52829FD96566392C4FEA2B9D
Malicious:	false
Preview:	..var sim_g_arrColors = null;....// private..function simGetHighlightButton()..{ .. var oButtonHighlight;.. oButtonHighlight = simMyGetElementById('sim_highlight_btn_id');.. return oButtonHighlight;..}....// private..function simGetHighlightButtonChecked()..{ .. var oButtonHighlight;.. var bChecked;.. .. oButtonHighlight = simGetHighlightButton();.. if (oButtonHighlight.hasAttribute('checked')).. {.. bChecked = oButtonHighlight.getAttribute('checked') == 'true';.. }.. else.. {.. bChecked = false;.. } .. return bChecked;..}....// private..function simSetHighlightButtonDisabled(bDisabled)..{.. var oButtonHighlight;.. .. oButtonHighlight = simGetHighlightButton();.. oButtonHighlight.disabled = bDisabled;..}....// private..function simSetHighlightButtonChecked(bChecked)..{ .. var oButtonHighlight;.. .. oButtonHighlight = simGetHighlightButton();.. oButtonHighlight.setAttribute('checked', bChecked);..}.

C:\Users\user\AppData\Local\Temp\SweetIM_Temp_Folder_4779843\chrome\sweetim-toolbar\content\history.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2980
Entropy (8bit):	4.13201368175262
Encrypted:	false
SSDEEP:	48:1suFOFuLDFEFEnXU8cCVVIdk2W7zdXO4DOWlCuTMCSz:TFOcPFEFoflSI3JHD2qgz
MD5:	2A1BE640289F613777A831410130DB4D
SHA1:	BDAF40DC75C69F30799DF9A4B2428930F30F3624
SHA-256:	4B747F43C14B6C95EB37EB2340072B40125C57999DA530FFADBCB999D81ED393
SHA-512:	DDFC32305F9C0FAE715BBE4C918007E6ACD3AFC94FF0054FE47021E8EBD9B4048DC9F1F296DE2EAC76779BFC6D3ACF5E406AD47D5650FF07DCEAB4A32B1C340C
Malicious:	false
Preview:	..function simGetSearchHistory()..{.. var result = null;.. try.. {.. var arrEncoded;.. var sHistoryItems = "";.. if (simGetIsConfigExists("search.history")).. sHistoryItems = simGetConfigString("search.history");.. if (sHistoryItems && sHistoryItems.length > 0).. {.. result = new Array();.. arrEncoded = sHistoryItems.split(",");.. for(var key in arrEncoded).. {.. var encoded;.. var decoded;.. .. encoded = arrEncoded[key];.. decoded = decodeURIComponent(encoded);.. logDebug("key="+key+",encoded="+encoded+",decoded="+decoded);.. result.push(decoded);.. }.. }.. }.. catch(e).. {.. dump("simGetSearchHistory= "+e);.. //logSevere2(e);.. }.. return result; // array of decoded..}....// param text shouldNT be encoded..function simAddToSearchHistory(

C:\Users\user\AppData\Local\Temp\SweetIM_Temp_Folder_4779843\chrome\sweetim-toolbar\content\inject.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	6637
Entropy (8bit):	4.38577654837664
Encrypted:	false
SSDEEP:	96:YXyv7ijuSlT3gChurexw6Z7VNsOAojOWkhkCnHSBFRs+Mz2CNN:nvjquWwy7NOWqkCyBFRs+MqG
MD5:	560EFC94BF82CD40EDFA51D0EC7A8ED5
SHA1:	991B9B36CBF729632310D8B862EC92928F20D43D
SHA-256:	0A8AAB29CAFA7055F99DBAE359400B8EF187EC181F8976F7B7748CDEA4AAD88E
SHA-512:	2517F88D6F4FE557F2D894D64F9697F4FFC162F64C4E4D943B09024EDDD7CBB2E37D240CB684FE656348E082DAD011E3DEA0955BA1AB3BBB8063A4B741B9ACD4
Malicious:	false
Preview:	..// TODOZ: future use..function SIMScriptInfo() {.. this._sRegexp = "";.. this._sURL = "";..}....var g_sim_strScriptURL = "http://sc.sweetim.com/apps/in/fb/infb.js";....function simAddScriptToDocument(oDocument) {.... try {.. var SCRIPT_ELM_ID = "id_script_sim_fb";.... var objScript = oDocument.getElementById(SCRIPT_ELM_ID);.. if (!objScript) {.. var head = oDocument.getElementsByTagName('head')[0] \|\| document.documentElement;.. var scriptElement = oDocument.createElement('script');.. var url = simGetConfigString("urls.ScriptUrlFB"); // same name as used in IE.. if (url == null \|\| url == undefined \|\| url == "") {.. url = g_sim_strScriptURL;.. }.. scriptElement.src = url;.. scriptElement.type = "text/javascript";.. scriptElement.language = "JavaScript";.. scriptElement.id = SCRIPT_ELM_ID;.. head.insertBefore(scriptEl

C:\Users\user\AppData\Local\Temp\SweetIM_Temp_Folder_4779843\chrome\sweetim-toolbar\content\install.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	22273
Entropy (8bit):	4.567586678614434
Encrypted:	false
SSDEEP:	384:N44hc4vQNQMq2ygMZr87jmnH5dgRTHR4/bKfn+E:N4A1ZeSm
MD5:	4F697EF09E80937BD0321C81800CA48F
SHA1:	B58FA1875961D22E5E3534225F7B7D17E5530308
SHA-256:	43729CF4EC878E3B12B60A1CD19A78516BC79CFBAAA0E289DDA2432EF25E248D
SHA-512:	8FD1CFD5E02F753519A142F0DDEF5CB32ED6C59C12D1BDDC6CCDC7E1CD9CCFCC478EF5E9673543F113FD419B90C0B7B1C860499461D848A53E853F7D3C2BDE24
Malicious:	false
Preview:	..function simOnInstall()..{.. try.. {.. logEnter();.. simAddDefaultConfig();.. simUpdateVersionFromRDFInPrefs();.. }.. catch(e).. {.. logSevere2(e); .. }..}....function simGetPrefsArray()..{.. var arrPrefs = new Array();.. .. // keyword url.. arrPrefs.push( {prefName:"keyword.URL", prefSweetIMValue:"http://search.sweetim.com"} );.. .. // default search.. arrPrefs.push( {prefName:"browser.search.defaultenginename", prefSweetIMValue:SIM_SEARCH_ENGINE_NAME} );.. arrPrefs.push( {prefName:"browser.search.selectedEngine", prefSweetIMValue:SIM_SEARCH_ENGINE_NAME} );.. .. // homepage.. // get the value which was added by setup, as homepage.. // was stored also here for comparsion. see c++: SetFFDefaultHomePageUsingPrefsFile.. var sSweetIMHomePage = simGetConfigString("urls.homepage");.. arrPrefs.push( {prefName:"browser.startup.homepage", prefSweetIMValue:sSweetIMHomePage} );.... return ar

C:\Users\user\AppData\Local\Temp\SweetIM_Temp_Folder_4779843\chrome\sweetim-toolbar\content\logger.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	10479
Entropy (8bit):	4.595467703826516
Encrypted:	false
SSDEEP:	192:danfRLbJ1A0MASuHvLLKO9LJOq2/pOq6pdyJFIZMGt4Z:dsbQaLLKO9LYZ/UJPaZ
MD5:	5329A994D60FB712F6D18F9D69C0B29B
SHA1:	F0E9AE0F6EE68BEE731176871741836A4F400715
SHA-256:	CA3540B7DD00EE74126562A027B6C11A3DF3E6155313D9D39DF3F48409635BBD
SHA-512:	034147BE48FEC3A3B40F74C8835FB158A8A01BEC52394DA431F5B8C614FA38C7B9DB9AFF3D34A455060E35FD0BC1860B3E6196760A9380C437A53D85222710F2
Malicious:	false
Preview:	// for eSeverity original definition, see Level.h..var.eSeverity =..{.. eALL:0,.. eDEBUG:1,.. eCONFIG:2,.. eINFO:3,.. eWARNING:4,.. eSEVERE:5,.. eCRITICAL:6,.. eOFF:7..};....var g_loggerInit = false;....var g_FileHandler_FileName = null;..var g_FileHandler_MinReportLevel = null;..var g_FileHandler_MaxFileSize = null;..var g_ConsoleHandler_MinReportLevel = null;....var sim_g_loggerDisabled = false;.. ..function initializeLogger()..{.. // TODO - the strings of prefs names, appear also in config.js => put them in one place only.. .. if (simHasConfigPrefs()).. { .. g_FileHandler_FileName = simGetConfigString("logger.FileHandler.FileName");.. g_FileHandler_MinReportLevel = simGetConfigString("logger.FileHandler.MinReportLevel");.. g_FileHandler_MaxFileSize = simGetConfigString("logger.FileHandler.MaxFileSize");.. g_ConsoleHandler_MinReportLevel = simGetConfigString("logger.ConsoleHandler.MinReportLevel"

C:\Users\user\AppData\Local\Temp\SweetIM_Temp_Folder_4779843\chrome\sweetim-toolbar\content\main.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2761
Entropy (8bit):	4.585147185811158
Encrypted:	false
SSDEEP:	48:G3JhY6Boz41aDkkaYMjNgr3AetwWOzBT4JF5Ay6:G3JOXDlazjN+w2OBMWf
MD5:	2E2A156B39E9712A9009685B01C32097
SHA1:	E1A475D4A5630873BBB4385130F7AB784BDEB90C
SHA-256:	5A7F42C79EF674479812DB4A4AF9A0F8C419AF9042D51542174E64BA9CE9276E
SHA-512:	C8AE2C1FFD66C613D5F20B957120BCE25C436A0C5EC9D42C0202781DC78EC3C4B67AABD2EA5D3546F6E1E4C7AF69FD328D0FDAD1BCA8957872093083012C6188
Malicious:	false
Preview:	..var NAMESPACE_SIM_TB = {};....NAMESPACE_SIM_TB.loadScripts = function () {.. // load external JS files, into gloabl object "NAMESPACE_SIM_TB", which is used as namespace.. try {.. var path = "chrome://sweetim-toolbar/content/";.. var loader = Components.classes["@mozilla.org/moz/jssubscript-loader;1"].........getService(Components.interfaces.mozIJSSubScriptLoader);.. var files = new Array(.. "sweetim-toolbar.js",.. "registry.js",.. "config.js",.. "search.js",.. "searchguard.js",.. "searchservice.js",.. "logger.js",.. "commands.js",.. "highlight.js",.. "tabinfo.js",.. "tabinfo-array.js",.. "webprogresslistener.js",.. "contentmenu.js",.. "splitter.js",.. "chevron.js",.. "uninstallobserver.js",.. "version.js",.. "install.js",.. "globals.js",.. "history.js",.. "file.js",.. "stringbundles.js",.. "tooltip

C:\Users\user\AppData\Local\Temp\SweetIM_Temp_Folder_4779843\chrome\sweetim-toolbar\content\messagebox.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	790
Entropy (8bit):	4.552759257474942
Encrypted:	false
SSDEEP:	12:xb7gDv5WyDfcoXNWiB14/7+KI5hoG2tyUovprDzpTz8yhphzFnATpJx37GpJcL:1kv5BDUoX/4TNlkpp3NTwOhFmXYcL
MD5:	EBBDC1D24F91354112CE613C5FF079D4
SHA1:	9E6902E98BB070AC14A53476B830F546BCD41E4F
SHA-256:	822A4FADA8538D2365EB806AF58516D76C5E00E49FFB4B81261BFA14F13DCB3B
SHA-512:	DA18275FF3A33E93ED7D827BCB9697492A6AEEB83C5265F3A470CED73DE3DC361F39A16EB90D1C39FBBAC1BF59F002DD9EFF24F68C397DD1726D7F65DEF32F96
Malicious:	false
Preview:	..function simMessageBox_OkCancel(sCaption, sText) {.... var result = null;.. try {.. // show message, ask user if to keep settings.. var promptService = kCC["@mozilla.org/embedcomp/prompt-service;1"].getService(kCI.nsIPromptService);.. var flags = promptService.STD_OK_CANCEL_BUTTONS;.. var check = { value: false };.. var button = promptService.confirmEx(window, sCaption, sText, flags, null, null, null, null, check);.... // set the value that user selected in result.. if (button == 1) // user selected "pos_1" button => no.. {.. result = false;.. }.. else {.. result = true;.. }.. }.. catch (e) {.. logSevere2(e);.. return null;.. }.... return result;..}

C:\Users\user\AppData\Local\Temp\SweetIM_Temp_Folder_4779843\chrome\sweetim-toolbar\content\ppcbully.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	3.7605520099280896
Encrypted:	false
SSDEEP:	24:JyBoNLxRRtU3dLqRRdv7f+fOpLfy8fHUwBc1P+urxpZhzZDb:kB4x+opDGmB5WmuLPh
MD5:	D0D9DDC7A4FCEC37560A070DFA13BF5E
SHA1:	ABBDD24BB2BF5C915F3037F8CDB5675D6A9F331A
SHA-256:	B28E9EDE8088E44E68C13BF1AA7B540924A6D18C0F25B015D4CABC02E3F6AD3B
SHA-512:	598A7B9F07F25E0A606431F3A93D618885CD803233B29465869E754285666CA2212B53BE3BB997A48F272617618B4EB5FE799E004ECB948E941AA767D84A189B
Malicious:	false
Preview:	..// notifies ppcbully banner on every document complete...// called from rc.html..function..simNotifyPPCBullyBannerOfDocumentComplete(bannerId, url)..{.. try {.... logDebug("params: bannerId = " + bannerId + ", url = " + url);.. .. var oToolbar;.. var oBanner;.. oToolbar = document.getElementById(SIM_TOOLBAR_ID);.. if (oToolbar.collapsed == false) // check if toolbar is hidden.. {.. oBanner = simMyGetElementById(bannerId);.. if (oBanner).. {.. if (oBanner.contentWindow != null && oBanner.contentWindow).. {.. if (oBanner.contentWindow.pbNavigateComplete != undefined) {.. try {.. oBanner.contentWindow.pbNavigateComplete(url);.. }.. catch (e2) {.. logSevere2(e2);.. }.. }.. el

C:\Users\user\AppData\Local\Temp\SweetIM_Temp_Folder_4779843\chrome\sweetim-toolbar\content\registry.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5801
Entropy (8bit):	4.664439405681212
Encrypted:	false
SSDEEP:	96:XnVid/DwfTNCDKUTisuLpBXPJjH9BL3rqzx5GH1zTNb1Lx1+:XVid/DwfT2KUTi7/XPJTbL3rqzx5GzTG
MD5:	8008F72ECA33168113BF191E38503787
SHA1:	E955FA0F508421836DF1DE60B9405CC310B1399C
SHA-256:	7744FCB23B17BAD1F7D66574158B06AF918590F13E0EBCE1550E86E2CD41388C
SHA-512:	C66418A1B16C88D205CDE3D154F907AF743DBBD4DD81CBA4870E2BE32C70784E9EE55B32670AAB984935F071BAB3D9F0C76C7551FCF9FF9FAD0CE6BCB591D4C8
Malicious:	false
Preview:	..// rootKey > HKCU, HKCR or HKLM..// subKey - string..// sAccess > "ACCESS_READ", "ACCESS_WRITE" or "ACCESS_ALL"..function simOpenRegsitryKey(rootKey, subKey, sAccess)..{.. var result = null;.. var rootKey2 = null;.. var access;.. .. try.. {.. result = kCC["@mozilla.org/windows-registry-key;1"].createInstance(kCI.nsIWindowsRegKey);.. .. switch (rootKey).. {.. case "HKCU":.. rootKey2 = result.ROOT_KEY_CURRENT_USER;.. break;.. case "HKCR":.. rootKey2 = result.ROOT_KEY_CLASSES_ROOT;.. break;.. case "HKLM":.. rootKey2 = result.ROOT_KEY_LOCAL_MACHINE;.. break;.. } .. switch (sAccess).. {.. case "ACCESS_READ":.. access = result.ACCESS_READ;.. break;.. case "ACCESS_WRITE":.. access = result.ACCESS_WRITE;.

C:\Users\user\AppData\Local\Temp\SweetIM_Temp_Folder_4779843\chrome\sweetim-toolbar\content\release.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	146
Entropy (8bit):	4.767727345085542
Encrypted:	false
SSDEEP:	3:8WlPUNFDMJ9+fkVLLxIWJVJM9BeqFHQLvC8uVL3DfFn:8WlcSJ97LRbJM9xFwL6tF3Dtn
MD5:	747594BE6C4F3CAD60FD041F4D6B2F7F
SHA1:	7281CE747E33CF70A00FA454BBD8C0757A8534B1
SHA-256:	0C82D59157B3985CBF6F254CA12A63AE86AE08EFF432EE423D0F630D7B58D123
SHA-512:	D3822A112247C1C6B5E405B6405693D52225326C1B1DCCEF44127A828C16517ADFEBD6F1E09D4EE5A983C1452361A708E9B08ADCBF004FB90A3588623B53E111
Malicious:	false
Preview:	..// see relavent .h file..// "__ENABLE_LOGGING__" is not used anymore, to simplify and make only one build..// const __ENABLE_LOGGING__ = false;

C:\Users\user\AppData\Local\Temp\SweetIM_Temp_Folder_4779843\chrome\sweetim-toolbar\content\remote.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2866
Entropy (8bit):	3.9577654921496856
Encrypted:	false
SSDEEP:	48:fUjX/azHQrw/Mt8vjVopMQDAGpORxQTho:kvaNjVo2CYH
MD5:	4D7F123CAD5ADDBBCD24532A7DA71839
SHA1:	A3E202D2E2E5E521DEE6C234AABFB3130108823F
SHA-256:	043DD5866F912585FAD932DF1735E702E904465BD8ABF04C7B62F257A5888B59
SHA-512:	FD4157D0889934B385FE3723C6230B259DDCAD93ED171C2486E5B462DE9BB806D60928AB16E4A11716CB60A8B1D0310F725034BA80B44EE9712AA6BAEFE94C78
Malicious:	false
Preview:	..var sim_g_scriptOnDocumemntComplete = null;....function simInitializeRemoteControl()..{ .. try.. { .. // MOVE to download complte of "control banner" ???/.. // step 1.. // get object of remote control web page.. var oElem = document.getElementById(SIM_REMOTE_CONTROL_ID);.. if (oElem) {.... if (oElem.contentWindow && oElem.contentWindow.SIMRC_getCodeForOnLoad) {.. // step 2.. // get script from remote control web page .. var script;.. script = oElem.contentWindow.SIMRC_getCodeForOnLoad();.. //alert("script = " + script);.... try {.. // step 3.. // execute script.. eval(script);.. }.. catch (e) {.. //alert("e = " + e.message);.. logSevere2(e);.. }.. }.. else {.. log

C:\Users\user\AppData\Local\Temp\SweetIM_Temp_Folder_4779843\chrome\sweetim-toolbar\content\search.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	13939
Entropy (8bit):	4.490104471837317
Encrypted:	false
SSDEEP:	192:hz4NrMFE5ypxxPgANkYser6lUljfT5wfimNN5h5Up:Pl5v6KtfT5wamNw
MD5:	A381E5306EA29348EB9965719A4F37E5
SHA1:	2602001F45E3EC3B07CD5E595843A20ACD3F9DCE
SHA-256:	7A5F71914DA2546E0C9D00B64A3CD3945312AA143768A8D7D2B8C472A38ED346
SHA-512:	0431AD475B09A019C3A1DFD730D97C0A07534A5BB8D9B9040092DC3350CBBD1BE47D302A5DAE94C6825B2F20C3C006EE4FD2D945D38D69F26A41EA667455756D
Malicious:	false
Preview:	....var sim_g_historyCapacity = null;..var sim_g_arrExteranlSearch = null;....// trims start and end..function simTrimString(string)..{.. // If the incoming string is invalid, or nothing was passed in, return empty.. if (!string).. return "";.... string = string.replace(/^\s+/, ''); // Remove leading whitespace.. string = string.replace(/\s+$/, ''); // Remove trailing whitespace.... return string; // Return the altered value..}....////////////////////////////////////////////////////////////////////////////////..// 1) Calls "simTrimString" to trim start and end..// 2) Removd "runs" - and convert all runs of more than one whitespace..// character into a single space. ..// The altered string gets returned...////////////////////////////////////////////////////////////////////////////////..function simTrimStringAndRemoveRuns(string)..{.. // If the incoming string is invalid, or nothing was passed in, return empty.. if (!string).. return

C:\Users\user\AppData\Local\Temp\SweetIM_Temp_Folder_4779843\chrome\sweetim-toolbar\content\searchguard.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	15169
Entropy (8bit):	4.471034320295774
Encrypted:	false
SSDEEP:	384:1jHSjKtnD3TbQDzFPswdXNpF+KdoWkln6yBQdLJqKW87ZE0dhrBBhB4XqIh:ZyjKZD3vQDzFpXv3oWun6yBQdLJqKW8g
MD5:	AD60C046850E849FDE33AC00B901E559
SHA1:	663FD643D2640A319F759985BFAD727CDB26CABD
SHA-256:	39F6887369282791F458CA901DAA9690639931208CA08C7555601AA76CFC46E1
SHA-512:	42631BA9213413F857F3DAC4AABCA400D26A9303AA427D9E408FE8FF5923132E1F6D21E08DAE58B0879E07D0B49EE531D87239AF4C62EFF0FC82A513C17D1441
Malicious:	false
Preview:	..const SIM_SEARCH_GUARD_PARAM = "st";....function simUnhideSearchEngine() {.. logEnter();.... try{.. var engine = simGetSearchEngine();.. if (engine!= null && engine.hidden == true) {.. engine.hidden = false;.. }.. }catch(e) {.. logSevere2(e);.. }..}....// checks if param exists in url of search provider (plugin)..// it is found under os:Param tag, in XML of search plugin...// didn't fidn a way to check this using API/XPCOM etc...function simCheckIfParamExistsInSearchProviderURL(paramName) {.. logEnter();.. .. var exists = false;.. try {.. var engine;.. var SP;.. var xml;.. .. engine = simGetSearchEngine();.. if (engine != null) {.. SP = simGetSearchPluginFile();.. if (SP.exists()) {.. xml = simReadFileToString(SP.path);.. if (xml != null && xml != "") {.. // we also check for prefix of &, bcz this is how we ad

C:\Users\user\AppData\Local\Temp\SweetIM_Temp_Folder_4779843\chrome\sweetim-toolbar\content\searchservice.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1970
Entropy (8bit):	4.240138604578698
Encrypted:	false
SSDEEP:	24:1ME/NbNZ4DmHfknInl/2gbNmK8hxo3i14DpWitBxgWoQfhRos2iQRpbX3HY:1MEwKsInf4ThK3iykit3Zhqs2iQfnHY
MD5:	D84A32AC7348C138C959B8DED416E3BE
SHA1:	7D3636316AE54ECD3950D7C041E54D9028C5C56F
SHA-256:	7057A6C5AA02C8C89957FC9688585B9D5484C0E739722BD714FA619FFB312BB8
SHA-512:	723B1C032C5151E9A285683830C07F687A9408252F71E2277D2C312EC640352D798C494D9A952CC26CA1488504E52359285767F322289A1A7D9F0DD9461C0C01
Malicious:	false
Preview:	..function simGetSearchEngine() {.. var searchService = null;.. var engine = null;.... logEnter();.... try {.. searchService = kCC["@mozilla.org/browser/search-service;1"].getService(kCI.nsIBrowserSearchService);.. if (searchService != null) {.. engine = searchService.getEngineByName(SIM_SEARCH_ENGINE_NAME);.. }.. } catch (e) {.. logSevere2(e);.. }.. .. return engine;..}....function simAddSearchEngine() {.. .. var searchService = null;.. var engine = null;.. var bResult = false;.... logEnter();.... try {.. // step 1.. // check if engine already exists.. engine = simGetSearchEngine();.. if (engine != null) {.. logInfo("engine already exists");.. engine = null;.. }.. else {.. // step 2.. searchService = kCC["@mozilla.org/browser/search-service;1"].getService(kCI.nsIBrowserSearchService);.. if (searchService != nu

C:\Users\user\AppData\Local\Temp\SweetIM_Temp_Folder_4779843\chrome\sweetim-toolbar\content\splitter.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3044
Entropy (8bit):	4.67890442222015
Encrypted:	false
SSDEEP:	48:QTHlWfqcTUJrzQ2fgFDQtgM8irSjXgmcCHwZoOkKT0wTx:ucSdhzD0oYgmEX/x
MD5:	6AFA89C5ED43D559D7503C6C1C826FBC
SHA1:	83BBA8FDD394CFC46ABD3E093F177DFDD85FBBA5
SHA-256:	F0DA29B0A1584D22E79D24E278C1DF28BDADE53867D769AD0A7E27188EDAD3BA
SHA-512:	3E2806E1E9C11DEDD6F745C89F7A2F8058D09F3ED44DD638C9417F45C4DB4B7D89FD604BCA40E4D2D80D2A9279B13FCD70CB0EE659A313DA3F825435C7441AFA
Malicious:	false
Preview:	// From: http://developer.mozilla.org/en/docs/XUL_Tutorial:More_Event_Handlers..// "The button and detail properties only apply to the mouse button related events,..// not mouse movement events...// For the mousemove event, for example, both properties will be set to 0."....var sim_g_dragging = false;..var sim_g_lastX = 0;..var sim_g_splitter_at_max = false;....function simInitializeSplitter()..{.. try.. {.. var oSplitter = simMyGetElementById("sim_toolbar_splitter");.. oSplitter.addEventListener('mousedown', simOnSplitterMouseDown, false);.. window.addEventListener('mousemove', simOnGlobalMouseMove, false);.. window.addEventListener('mouseup', simOnGlobalMouseUp, false);.. }.. catch(e).. {.. logSevere2(e);.. }..}....function simOnGlobalMouseMove(event)..{.. if (sim_g_dragging).. {.. simUpdateSplitter(event);.. sim_g_lastX = event.screenX;.. }..}....function simOnSplitterMouseDown(event)..{.. //logEnter();..

C:\Users\user\AppData\Local\Temp\SweetIM_Temp_Folder_4779843\chrome\sweetim-toolbar\content\stringbundles.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.738627059733319
Encrypted:	false
SSDEEP:	48:8G7y6KggRBGVcIgy6wLvOjR7oaupozmc4soM4zfEce:dG6KRqVT6wzwtmkj/
MD5:	E030A1FFDA7407FB1C06FDB448BD7571
SHA1:	2DF2D30A384A1C19C56391C8C16A31828621B5EC
SHA-256:	AE8F9E51B3FF22C151D3E6FCE7B5DC603D29716D773AEFFF8B20FC75C7E3EA76
SHA-512:	F0F02A7492C4D23E9C7B5BC2A69BFC757A4D3C7F051C0774F15431895C4D892017D4AE882D7FBA301240723723058C37B8149A74C650CAA769F6614D658E2810
Malicious:	false
Preview:	..var sim_g_StringBundle = null;..var sim_g_nsIStringBundle = null;....// should be called from XUL, or JS, where "document" object is defined..function simGetStringFromBundle(name)..{.. var result = "";.. .. try.. {.. if (!sim_g_StringBundle).. {.. sim_g_StringBundle = document.getElementById('sim_stringbundle');.. }.. result = sim_g_StringBundle.getString(name);.. }.. catch(e) {.. logWarning("exception for name: " + name);.. logSevere2(e);.. }.. return result;..}....// should be called from components, such as SIMAutoCompleteSearch.js,..// where "document" object is NOT defined..function simGetStringFromBundle2(name)..{.. var result = "";.. .. try.. {.. if (!sim_g_nsIStringBundle).. {.. // load bundle directly.. // see "Creating the bundle via XPConnect".. // (http://books.mozdev.org/html/mozilla-chp-11-sect-3.html).. var src = 'chrome://s

C:\Users\user\AppData\Local\Temp\SweetIM_Temp_Folder_4779843\chrome\sweetim-toolbar\content\sweetim-contentmenu.xul

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	653
Entropy (8bit):	5.057236170457901
Encrypted:	false
SSDEEP:	12:TMG8NWF77hHEdBMBMh5I9XoCtLDAHjxAHXq6tW0N1ZHXO+gcWqSVJIsXGvc8:38kX9E6BWI9X7LqINrOaW7gsc
MD5:	BB5DF7BCC2B69614EAA5111958390C72
SHA1:	14D1A1BF2E69F338B09382EB2E1B564D0CADC02B
SHA-256:	83492D77CA972E1D2D07A7842C836A78F64F49A753E8344354F16C61AAACF820
SHA-512:	711CADB3715B729E6A91560A098504D71CF64A19528173DF0017CA839738B4F654FFF97EDAC0534E3FF68E0BC2E2201DF4806AAF96DEBB698645D16268E5868A
Malicious:	false
Preview:	<?xml version="1.0"?>..<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>......<window id="id_window_sim_content_menu"... title=""... orient="horizontal"... hidechrome="true"... xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"... onload="simContentMenuWindowOnLoad(event);"... onunload="simContentMenuWindowOnUnload(event);">.... <script type="application/x-javascript" src="chrome://sweetim-toolbar/content/contentmenu-handler.js" />......<browser id="id_browser_sim_content_menu".. ..src="http://content.sweetim.com/sim/mfftb20.html".. ..width="420px".. ..height="440px">...</browser>..</window>

C:\Users\user\AppData\Local\Temp\SweetIM_Temp_Folder_4779843\chrome\sweetim-toolbar\content\sweetim-toolbar.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	12636
Entropy (8bit):	4.680240080485856
Encrypted:	false
SSDEEP:	192:XVCcV9nwupCxD5AcVl1MMoRgYjVY3kPZR8qsXdW4B8aHdivE/FF:kM9w/l57KR6atSLlFF
MD5:	63448F76A72B0C3858601365E5083946
SHA1:	EFDD6D0BAF4F2E1ACE8D1E7AD5918BCD9AF4D998
SHA-256:	088BB06B17A050D1CA7D6EF082130E4B1752CB36D49E2184F4B207CA43813B02
SHA-512:	65C10E8507688ABBCF27403ED338D488314961DCEC5E145E96FD4B1E5392D6D748404353810BA6E58F5AC34FAE3C3AC86B8490BC8418A5B8FBAC0D1578D04590
Malicious:	false
Preview:	..var g_sim_onload_completed = false;....function simOnFirstRun()..{.. try.. {.. logEnter();.. .. simOnInstall();.. }.. catch(e).. {.. logSevere("catch: " + e.message);.. }..}....function simIsFirstRun()..{.. var result = true;.. var has;.. .. try.. {.. logEnter();.. .. has = simHasConfigPrefs();.. result = !has;.. }.. catch(e).. {.. logSevere2(e);.. }.. .. return result;..}....function simOnToolbarDOMAttrModified(event)..{.. try.. { .. //logEnter();.. .. if (event.attrName == 'collapsed').. {.. var bCollapsed = event.newValue == 'true';.. simOnToolbarCollapsed(bCollapsed);.. }.. }.. catch(e).. {.. logSevere2(e);.. }..}......// we get here, when user has hidden the toobar using..// "View"/"Toolbars" and the uncheck out toolbar..function simOnToolbarCollapsed(bCollapsed)..{.. try.. { .

C:\Users\user\AppData\Local\Temp\SweetIM_Temp_Folder_4779843\chrome\sweetim-toolbar\content\sweetim-toolbar.xul

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	17033
Entropy (8bit):	4.649335724543702
Encrypted:	false
SSDEEP:	192:NYebeeVIOFtAkvocIhzBeLdGrRY6hl6gfHZbOB71oOGJ:NYYSi4lZ+717GJ
MD5:	C5E042E981DB5DC014E02AAD88A1DE44
SHA1:	2DC36BD5A53B298A5C18672F1EECC9EB72DCCC69
SHA-256:	DBAB041CFA5D8696FC6830F7814848DABE75AC2BEE7F537A54F75D16CFB28A1E
SHA-512:	C87C57DC1E2A58EC2A0121F6DFE647C1B0734BAD53DDD08BDD2483E50888DDE5DE17A8518EB11C16E4A186A83099EA12478319502CBACD4754B5CAA85807C748
Malicious:	false
Preview:	<?xml version="1.0"?>....<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>..<?xml-stylesheet href="chrome://sweetim-toolbar/skin/sweetim-toolbar.css" type="text/css"?>....<!DOCTYPE overlay SYSTEM "chrome://sweetim-toolbar/locale/sweetim-toolbar.dtd">....<overlay id="sweetim_overlay".. xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">.. .. <script type="application/x-javascript" src="chrome://sweetim-toolbar/content/main.js" />.. <script type="application/x-javascript" src="chrome://sweetim-toolbar/content/global-namespace.js" />.... <stringbundleset id="stringbundleset">.. <stringbundle.id="sim_stringbundle" .. src="chrome://sweetim-toolbar/locale/sweetim-toolbar.properties"/>.. </stringbundleset>.. .. not used since fix of RNDTBFF-56.. <popupset id="mainPopupSet">.. <popup.id="sweetim_popup_history".. type="autocomplete"/>.. </popupset>.. --> ....

C:\Users\user\AppData\Local\Temp\SweetIM_Temp_Folder_4779843\chrome\sweetim-toolbar\content\tabinfo-array.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2353
Entropy (8bit):	4.4133762029710155
Encrypted:	false
SSDEEP:	24:/lQx+UoGfwVGhCyVj8Y1PXDKQDu1BjCxCto6qPlRPd9tfDQnZic4EwKCu9w+zauA:/UBoGfwoht8YF21IfLFDQ4c4kSJzQQ
MD5:	EDE3C37AA333FA205B96194440176B3A
SHA1:	550F751348470DCB586DA42834C26457A4B711B1
SHA-256:	8C2D75157683F82FD0F36058F73B68F924CA0BCA79F5F04D6EE51D31D020970F
SHA-512:	C8FF1992EE4C6C4C10422E67BE140BF7129D9D15F1E250689AEC8742E32BB65821B4BB6CEDC1BDB5447E2B2EB0D3D201546F73CE3FE7C0051D63CE22EC2667D4
Malicious:	false
Preview:	..var sim_g_arrTabInfo = null;....function simGetTabInfo(tabId) {.. var oTabInfo = null;.... if (tabId != undefined && tabId != null && tabId != "") {.. oTabInfo = sim_g_arrTabInfo[tabId];.. if (oTabInfo == undefined) {.. logWarning("oTabInfo is undefined");.. }.. }.. else {.. logWarning("tabId not valid");.. }.. return oTabInfo;..}....// adds SIMTabInfo to array, for relevant tabId;..// returns the web progress listener object, which is associated with this tab..function simAddTabInfoToArray(tabId) {.. var result = null;.. try {.. if (tabId != null && tabId != "") {.. // step 1.. // create array, if not created already.. if (sim_g_arrTabInfo == null) {.. sim_g_arrTabInfo = new Array;.. }.... // step 2.. // create progress listener.. var oWPListener = new SIMWebProgressListener(tabId);.... // step 3.. //

C:\Users\user\AppData\Local\Temp\SweetIM_Temp_Folder_4779843\chrome\sweetim-toolbar\content\tabinfo.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	11111
Entropy (8bit):	4.412389992855388
Encrypted:	false
SSDEEP:	96:O0+++rWl/S5vHvXm0kqs1zeGY097hKBIBfI/RvWvXHcnmsccCiivJftPk9XCxjM:Ov++O/S5fv1zezi0pMOfn4iBkN
MD5:	603652891F4165AD4CE73E9B4AE82901
SHA1:	AB08428843B571051EB4F15EE2AD03408A04FAE9
SHA-256:	8D5BC4EC85859DD72D92552E8B5EEC890D41DDEB6F42DE4289564F6CB6E0C7FA
SHA-512:	6CA0C10601E1F83392CFEAF84E5BC3BDE60B9BD1B6D247C207CCEC6CF3E9215EE996C2C953A13B2C1ECE95781909B3D2A433CEED6EA6960022E89C765A2D8E75
Malicious:	false
Preview:	..function SIMTabInfo()..{.. this._webProgressListener = null;.. this._sSearchString = ""; .. this._bHighlight = false;..}....function simGetSelectedTabBrowser() {.... var index = null;.. var oBrowser = null;.... index = gBrowser.mTabContainer.selectedIndex;.. if (index != null) {.. oBrowser = gBrowser.getBrowserAtIndex(index);.. if (oBrowser == null) {.. logWarning("oBrowser == null");.. }.. }.. .. return oBrowser;..}....function simGetSelectedTabURI()..{.. var oBrowser;.. var oUri;.. .. oBrowser = simGetSelectedTabBrowser();.. oUri = oBrowser.currentURI;.. .. return oUri;..}....function simGetSelectedTabHost()..{.. var oUri = null;.. var oResult = null;.... oUri = simGetSelectedTabURI();.. if (oUri != null) {.. try {.. oResult = oUri.host;.. } catch (e) {.. // we get here when tab is opened with "Addons Manager", in FF4.. // or when tab is e

C:\Users\user\AppData\Local\Temp\SweetIM_Temp_Folder_4779843\chrome\sweetim-toolbar\content\tooltip.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3243
Entropy (8bit):	4.391385132766343
Encrypted:	false
SSDEEP:	96:ijC31Dmdj5UY2c6Q6gm6aL6eN76bL6z/S:ijQ1Dmdj5J2PzgFa+eNub+z/S
MD5:	3CB6E2DE74E1DBA38BF405DD21786908
SHA1:	0E0B2EA4AF92DFF76FCBBA0F83D1659C6BB6A229
SHA-256:	155DF0BA4DFB6E9792D291B1C58B738EC0F908665E594205BA1445CC6EAF55B8
SHA-512:	E7A84B89EA6B18DE5298FE5632C71601423D989D17009D6D85E4B550848541838C9F2F8027938E379644E5D72802880B8576CF10B76338DC62B7AE413F70ADA5
Malicious:	false
Preview:	....// Explenation: why we use "simOnTooltipNeedText" for dropmarkers:..// This method is used to set a tooltip to a dropmarker,..// Since setting "tooltiptext" doesn't work...// This code was used (and didn't work):..// oDropmarker = document.getAnonymousElementByAttribute(oButton, 'class', 'toolbarbutton-menubutton-dropmarker');..// oDropmarker.setAttribute('tooltiptext', strTooltip);..// As said, it doesnt't work (apparently requires adding xbl binding), so the trick with..// "simOnTooltipNeedText" is used instead....function simIsFromDropmarker(node)..{.. var result = false;.. try.. {.. // this "trick" is not documented... // it is by trial-and-error, and comparing all.. // atrributes of the button, when the mouse is over.. // the button itself VS mouse is over the dropmarker.. if (node.hasAttribute("buttonover")).. result = false;.. else.. result = true; .. }.. catch(e).. {.. logS

C:\Users\user\AppData\Local\Temp\SweetIM_Temp_Folder_4779843\chrome\sweetim-toolbar\content\uninstallobserver.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	6308
Entropy (8bit):	4.322938270187311
Encrypted:	false
SSDEEP:	96:FizaB32QhH8Ocuzwa5o4KQqkhJzyjz35UAlxlONyOopRQMVD:xNlWVv5zkCZjlxAqzQMVD
MD5:	D6F084EB3DB05BC7DE868C5A43266E22
SHA1:	31EDAEE1B293F2304AFEAA1F8DC655FAE8D97947
SHA-256:	D3144F66CA27D00ADD929B16A377EB4197BE80403F104FB577E48EE7CBB02A1A
SHA-512:	B4F2382A0473755FB495ECD00EBF3C4FAB00163BC07F2DDEC737E3358EE7F922399834416DE1C6A5AFAD47D68D1F3F10319F4DACA02D33BB232B99121F37C933
Malicious:	false
Preview:	..// based on:..// Creating an uninstall script for an extension..// http://xulsolutions.blogspot.com/2006/07/creating-uninstall-script-for.html....const g_SWEETIM_EXTENSION_UUID = "{EEE6C361-6118-11DC-9C72-001320C79847}";....function simInitializeUninstallObserver(){.. .. logEnter();.. .. try{.. var bFF4 = simIsFirefox4BetaOrLater();.. if (bFF4){.. simAddAddonListener();.. }.. else{.. sim_g_UninstallObserver.register();.. }.. }catch(e){.. logSevere2(e);.. }..}....function simUninitializeUninstallObserver(){.. .. logEnter();.... try{.. var bFF4 = simIsFirefox4BetaOrLater();.. if (bFF4){.. simRemoveAddonListener();.. }.. else{.. sim_g_UninstallObserver.unregister();.. }.. }catch(e) {.. logSevere2(e);.. }..}....var sim_g_extensionManager = null;....// gets the extensions manager ("addons dialog")..function simGetExtensionsManang

C:\Users\user\AppData\Local\Temp\SweetIM_Temp_Folder_4779843\chrome\sweetim-toolbar\content\version-ff.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3189
Entropy (8bit):	4.859823909450792
Encrypted:	false
SSDEEP:	96:yNLUXUmNLUdUoNLUuUhNLUYUGNLUbUxVGs+:y+km+Oo+5h+PG+IxVGs+
MD5:	626EC7868806436521619FFA2D4C43AE
SHA1:	7CC61D0CF2655750D4DE24A019EB68C49F24F9C3
SHA-256:	23A71210EAEE3F9CE45FA18C4066469D1D08246228999A32FDE68AB7A04A21ED
SHA-512:	A6C43FDB39890D82140DA955FCEDF33EAC0B1195ADE82A865C8DF4AE8397989C1696A400DAE5BBC38CC3AED590A041F1314C42E7B0DC5CB2A8A5C14AB914E46C
Malicious:	false
Preview:	....// geckgo version < param version..function simGeckoVersionLessThan(version) {.. var result = false;.... if (kCI.nsIXULAppInfo) {.. var appInfo = kCC["@mozilla.org/xre/app-info;1"].getService(kCI.nsIXULAppInfo);.. var versionChecker = kCC["@mozilla.org/xpcom/version-comparator;1"].getService(kCI.nsIVersionComparator);.. if (versionChecker.compare(appInfo.platformVersion, version) < 0) {.. result = true;.. }.. }.. else {.. logSevere("kCI.nsIXULAppInfo");.. }.. return result;..}....// geckgo version > param version..function simGeckoVersionGreaterThan(version) {.. var result = false;.... if (kCI.nsIXULAppInfo) {.. var appInfo = kCC["@mozilla.org/xre/app-info;1"].getService(kCI.nsIXULAppInfo);.. var versionChecker = kCC["@mozilla.org/xpcom/version-comparator;1"].getService(kCI.nsIVersionComparator);.. if (versionChecker.compare(appInfo.platformVersion, version) > 0) {.. result = true;

C:\Users\user\AppData\Local\Temp\SweetIM_Temp_Folder_4779843\chrome\sweetim-toolbar\content\version.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1864
Entropy (8bit):	4.240060812234503
Encrypted:	false
SSDEEP:	24:lrzBe/hEjROmSYbh/VQB3tE2kDZeD2ex1ckibN2TaSDpzt7/R4V3Dnce:5IcrRhdQptEVeEO767ce
MD5:	2871DC9B99AEEB281122611968CFF89A
SHA1:	3FEBAD1B619F1E00C4D028D4BF6EAD1C68BF8BAD
SHA-256:	D26BEA9835FD7449906E44DCD8A390C8FB6F1A56D3BBA76D8F0331C36ED01CD3
SHA-512:	43489D6C1ECC3C3A34B421D13893F1BF5BD1A074F79C050965B3CD2950333FAF8D10A4E5B9751C11A737B09EACF975A9694186A0AFA612DB3E3788282F797B45
Malicious:	false
Preview:	....// globals, used for getting version in FF4..var sim_g_version = null;..var sim_g_event = null;....function simAddonManagerCallback(addon) {.. try {.. // step 1.. // set global value.. sim_g_version = addon.version;.. // step 2.. // set evant.. sim_g_event.value = true;.. } catch (e) {.. logSevere2(e);.. }..}....function simGetVersionFromRDF() {.. .. var version = "";.. try {.. logEnter();.... var oDetails = null;.. oDetails = simGetAddonDetails();.. if (oDetails != null) {.. version = oDetails._version;.. }.. else {.. logWarning("oDetails != null");.. }.. }.. catch (e) {.. logSevere2(e);.. }.... return version;..}....function simUpdateVersionFromRDFInPrefs()..{.. try.. {.. var version = simGetVersionFromRDF();.. simSetConfigValue("version", version);.. }.. catch(e).. {.. logSevere2(e); ..

C:\Users\user\AppData\Local\Temp\SweetIM_Temp_Folder_4779843\chrome\sweetim-toolbar\content\wait.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.159322508675548
Encrypted:	false
SSDEEP:	24:1nI9uwAoWL0vDaGH557rFqiVvHZfcaUsicL:1n4u9S5vEi55kaucL
MD5:	29473F2C75F43F49572F1BF8868B9C74
SHA1:	17091A09EFC714CF73A0C0211CDE5B4670624148
SHA-256:	F336277ED0859E586E814110D7260345BBB9531DD0914A1B9F72A27BCEBB8286
SHA-512:	C071FD05145916BAF91F572D0DBECF91931D11E7126C7354AB0BF61C2A0DEBE6CF7D1EC58BD240A876C08E633D7EA8D76B8C1F2F233DC9F67425C2925A782A5D
Malicious:	false
Preview:	..function simMyEvent() {.. this.value = false;..}....// waits till the param event value is set to true..// returns true if event coccured, false if timeout reached..function simWaitForEvent(oMyEvent, timeout) {.... var result = null;.. try {.. var loops = 0; // used only for debug.. var start;.. var now;.. var elapsedMillSecs;.. var thread = kCC["@mozilla.org/thread-manager;1"].getService(kCI.nsIThreadManager).currentThread;.... // step 1.. // take snapshot of current time.. start = new Date();.... // step 2.. // while event not set to true.. while (oMyEvent.value != true) {.. loops++;.... // step 3.. // check if timeout elapesed.. now = new Date();.. elapsedMillSecs = now.getTime() - start.getTime();.. if (elapsedMillSecs > timeout) {.. // if timeout elapsed -> break.. result = false;.. br

C:\Users\user\AppData\Local\Temp\SweetIM_Temp_Folder_4779843\chrome\sweetim-toolbar\content\webprogresslistener.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2992
Entropy (8bit):	4.687458025277307
Encrypted:	false
SSDEEP:	48:V7BcIl2uVA1wbXMJGOPbySbKH/JWRU8rSWTeAgn9:5BRwKHhWRJSWTeh9
MD5:	D7AC8AA1B5ED24A1CE649258252D0184
SHA1:	CC9B641450B84CDE7D0936043836B4E7C53F42FC
SHA-256:	E3B25502DCA1B164A6F01F087EF913F9F7B869989BF09FE70EFF747D0BA59CBA
SHA-512:	DCAAE7CC5FB24346BECD5B11F244EFBED30625404048F7ECB9678F0567BAF627D8C4D5A205C7A79425D14DC561856D258F56E0FAD2DB7EAE1223439A7DD96ED0
Malicious:	false
Preview:	..const WP_NOTIFY_STATE_NETWORK = Components.interfaces.nsIWebProgress.NOTIFY_STATE_NETWORK;..const WP_NOTIFY_STATE_DOCUMENT = Components.interfaces.nsIWebProgress.NOTIFY_STATE_DOCUMENT;..const WPL_STATE_IS_NETWORK = Components.interfaces.nsIWebProgressListener.STATE_IS_NETWORK;..const WPL_STATE_IS_DOCUMENT = Components.interfaces.nsIWebProgressListener.STATE_IS_DOCUMENT;..const WPL_STATE_START = Components.interfaces.nsIWebProgressListener.STATE_START;..const WPL_STATE_STOP = Components.interfaces.nsIWebProgressListener.STATE_STOP;......//..// Object SIMWebProgressListener..//....// Listener which catches events when page is being loaded within a tab...function SIMWebProgressListener(tabId)..{.. if (!tabId).. {.. // get current tab id.. tabId = simGetSelectedTabId();.. if (tabId==null \|\| tabId=="").. {.. logWarning("invalid tabId");.. }.....}.. this.tabId = tabId;..}....// Listener object - designe

C:\Users\user\AppData\Local\Temp\SweetIM_Temp_Folder_4779843\chrome\sweetim-toolbar\locale\de-DE\sweetim-toolbar.dtd

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	3226
Entropy (8bit):	4.968367102212091
Encrypted:	false
SSDEEP:	48:wt3gCoVqrKAh+1zqI1tKSUyjBCS43IBAdTSmTHCow3pCeVLLv:OMYL0zqOIbAAVTQpBV3v
MD5:	343E720BF01C524700FD1371E25ED76F
SHA1:	4513CE9406E22284E73D8235807B8EC341801FAC
SHA-256:	E5F0DC1A6B2A6B251C616B05A18AA0E56CAB386646F7806B2753C3D1BEE63BFB
SHA-512:	0794397E3706E3CBBEF9473E03DD6CBC3594A818458FC6EF2E33E9B53EAA4C85F5F40E7BF0426255D68DFC13B881B6925CF884D07E756081073D098A80EA9D9E
Malicious:	false
Preview:	<!ENTITY sweetim.main_menu.home.label "SweetIM Start">..<!ENTITY sweetim.main_menu.search.label "SweetIM Suche">..<!ENTITY sweetim.main_menu.messageboard.label "SweetIM Message Board">..<!ENTITY sweetim.main_menu.messageboard.tooltip "Zu den SweetIM Foren gehen">..<!ENTITY sweetim.main_menu.trackseraser.label "Tracks Eraser">..<!ENTITY sweetim.main_menu.help.label "Hilfe">..<!ENTITY sweetim.main_menu.feedbcak.label "Feedback Schicken">..<!ENTITY sweetim.main_menu.feedbcak.tooltip "Kontaktieren Sie uns in allen Fragen rund um die SweetIM Toolbar f.r Firefox">..<!ENTITY sweetim.main_menu.privacy.label "Datenschutz">..<!ENTITY sweetim.main_menu.privacy.tooltip "Datenschutzinformationen zur SweetIM Toolbar f.r Firefox">..<!ENTITY sweetim.trackseraser_menu.clearCookies.label "Cookies l.schen">..<!ENTITY sweetim.trackseraser_menu.clearCookies.tooltip "Hier k.nnen Sie Ihre Cookies l.schen">..<!ENTITY sweetim.trackseraser_menu.clearCache.label "Cache

C:\Users\user\AppData\Local\Temp\SweetIM_Temp_Folder_4779843\chrome\sweetim-toolbar\locale\de-DE\sweetim-toolbar.properties

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	1618
Entropy (8bit):	4.780426889876654
Encrypted:	false
SSDEEP:	24:E915lh2Z3IlUPDmTGEcLvKESsO96yTiTXKo8HqybkE/rOeopllQPVY:kuIWShmvKETOEHkqA3mt
MD5:	A9B471175D46F7E036E663F420F7B8F1
SHA1:	FB4BF0AC6393BBF9D10E8243F0660A1B0E86165F
SHA-256:	C0493FC117448470EA45CC0C303FC24597B6F73DBC3B5CEC823A34ACEAC3A224
SHA-512:	C0DA03C559E677F9D566575FCA19522064D6D6BD048644143DF1DEE606E89072E950C593A3F8052412BDD9627926FDEC5EA845C8EA58C7928B714E20A0B204B2
Malicious:	false
Preview:	sweetim.property.button.highlight.enabled.tooltip=Hervorhebung der Suchbegriffe auf dieser Seite umschalten..sweetim.property.button.highlight.disabled.tooltip=Text im Suchfeld eingeben um ihn hervorzuheben..sweetim.property.button.findword.tooltip=N.chstes Vorkommen von '%1$S' im aktuellen Dokument finden..sweetim.property.history=Chronik..sweetim.property.button.main_menu.tooltip=Zu SweetIM Suche gehen..sweetim.property.button.main_menu.dropmarker.tooltip=SweetIM Men...sweetim.property.button.search.tooltip=Web-Suche..sweetim.property.button.search.dropmarker.tooltip=Klicken Sie zur Auswahl anderer Sucharten ..sweetim.property.menuitem.chevron.highlight.label=Highlights..sweetim.property.uninstall.title=%S deinstallieren..sweetim.property.uninstall.text=M.chten Sie die SweetIM Homepage und SweetIM Sucheinstellungen beibehalten, so dass Sie weiterhin schnellen Zugriff auf leistungsstarke Internetsuche genie.en k.nnen?..sweetim.property.searchguard.hp.caption=Homepage-Einstellunge

C:\Users\user\AppData\Local\Temp\SweetIM_Temp_Folder_4779843\chrome\sweetim-toolbar\locale\en-US\sweetim-toolbar.dtd

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3103
Entropy (8bit):	4.908927731948598
Encrypted:	false
SSDEEP:	48:1BMMgluIHzUgLA9k3tgxmHMdT8fdLMMB4ZqBMMwMCtMVLuMv:/j+VzUCYUsqlwujnPVNv
MD5:	2B62306DADAAC6BC5992539D32CEE068
SHA1:	AEF00558ED94D83E35FE470EE31574201D02ABC4
SHA-256:	B79F50D22CB081A3C96AFAAB7E362A60C2259C0A76B82B94DDFAF2370A9A8E36
SHA-512:	C7B39C09C9FF5B2BA75634DD79D199F4189784192F5FFCF933B3CA4AA049E65EC1308D63C3BD3A65C0E369C6291DC80A37397AD1CCDB528B134F9C6F9466BD4C
Malicious:	false
Preview:	<!ENTITY sweetim.main_menu.home.label "SweetIM Home">..<!ENTITY sweetim.main_menu.search.label "SweetIM Search">..<!ENTITY sweetim.main_menu.messageboard.label "SweetIM Message Board">..<!ENTITY sweetim.main_menu.messageboard.tooltip "Go to SweetIM Forums">..<!ENTITY sweetim.main_menu.trackseraser.label "Tracks Eraser">..<!ENTITY sweetim.main_menu.help.label "Help">..<!ENTITY sweetim.main_menu.feedbcak.label "Contact Us">..<!ENTITY sweetim.main_menu.feedbcak.tooltip "Contact us in all matters relating to SweetIM Toolbar for Firefox">..<!ENTITY sweetim.main_menu.privacy.label "Privacy Information">..<!ENTITY sweetim.main_menu.privacy.tooltip "SweetIM Toolbar for Firefox privacy information">..<!ENTITY sweetim.trackseraser_menu.clearCookies.label "Clear Cookies">..<!ENTITY sweetim.trackseraser_menu.clearCookies.tooltip "This will erase your cookies">..<!ENTITY sweetim.trackseraser_menu.clearCache.label "Clear Cache">..<!ENTITY sweetim.trackserase

C:\Users\user\AppData\Local\Temp\SweetIM_Temp_Folder_4779843\chrome\sweetim-toolbar\locale\en-US\sweetim-toolbar.properties

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1535
Entropy (8bit):	4.634286586985755
Encrypted:	false
SSDEEP:	24:E9Gs82eGZumVva6g3VreT3un57aoPUakT+4bXakT+f5oLJhbB:F6uYvIreT0GoCTLlT8qJn
MD5:	F328392AF820D3B5E73CFCB4982270AE
SHA1:	741DCA0A4BE0FC3F9F43ADE15FABA882243CF785
SHA-256:	04AEB167614D959F0EE1FBA37D10018D3CE8D77C0AC8336E0A2C388DDEF63AF5
SHA-512:	74BE6B647AEEEB2DAE2B7160ABDE358B9A208E4F6DB7D8DDF69147E7831CEBAD9171A1E311264143CA6528FA8B1CE80C1CC13EAE2549707A685BC517234AB87F
Malicious:	false
Preview:	sweetim.property.button.highlight.enabled.tooltip=Toggle highlighting of search terms on this page..sweetim.property.button.highlight.disabled.tooltip=Enter text in the search box to highlight it..sweetim.property.button.findword.tooltip=Find next occurrence of '%1$S' in current document..sweetim.property.history=History..sweetim.property.button.main_menu.tooltip=Go to SweetIM search..sweetim.property.button.main_menu.dropmarker.tooltip=SweetIM Menu..sweetim.property.button.search.tooltip=Search the Web..sweetim.property.button.search.dropmarker.tooltip=Click to select other search types..sweetim.property.menuitem.chevron.highlight.label=Highlight..sweetim.property.uninstall.title=Uninstall %S..sweetim.property.uninstall.text=Would you like to keep the SweetIM homepage and SweetIM search settings so you can continue enjoying quick access to powerful internet search?..sweetim.property.searchguard.hp.caption=Home page Settings Change..sweetim.property.searchguard.hp.message=Your default

C:\Users\user\AppData\Local\Temp\SweetIM_Temp_Folder_4779843\chrome\sweetim-toolbar\locale\es-ES\sweetim-toolbar.dtd

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	3363
Entropy (8bit):	4.953586806232814
Encrypted:	false
SSDEEP:	48:el1K9muYgYqOHznSNEnlZoY8rSYQhfY3cThI/5s7YFfLC:Y5zKEgSI/5OYFf2
MD5:	DA4E42A8F0D9CB3FE917D9B08DFF4E44
SHA1:	9224598E58A628E1125683A8C17823B269380DF9
SHA-256:	3B2597E3A3995619AD16ED69829FA0990CDFFB97B7F6525E3D9F05C2BF46D83C
SHA-512:	B3D36A91B073CFC63CC6CE4A9759564D9825E49B89140C4A0170C6654E61B43C0781524218BA6694F522B0D71FC50F86AB3537F9D8C2D62C462B43E632AB90A4
Malicious:	false
Preview:	<!ENTITY sweetim.main_menu.home.label "Inicio SweetIM">..<!ENTITY sweetim.main_menu.search.label "B.squeda SweetIM">..<!ENTITY sweetim.main_menu.messageboard.label "Panel de mensajes SweetIM">..<!ENTITY sweetim.main_menu.messageboard.tooltip "Ir a Foros SweetIM">..<!ENTITY sweetim.main_menu.trackseraser.label "Borrador de pistas">..<!ENTITY sweetim.main_menu.help.label "Ayuda">..<!ENTITY sweetim.main_menu.feedbcak.label "Cont.ctenos">..<!ENTITY sweetim.main_menu.feedbcak.tooltip "P.ngase en contacto con nosotros en lo relacionado con la barra de herramientas SweetIM par Firefox">..<!ENTITY sweetim.main_menu.privacy.label "Informaci.n de privacidad">..<!ENTITY sweetim.main_menu.privacy.tooltip "Informaci.n de privacidad para la barra de herramientas SweetIM para Firefox">..<!ENTITY sweetim.trackseraser_menu.clearCookies.label "Borrar cookies">..<!ENTITY sweetim.trackseraser_menu.clearCookies.tooltip "Borrar. sus cookies">..<!ENTITY sweetim.tr

C:\Users\user\AppData\Local\Temp\SweetIM_Temp_Folder_4779843\chrome\sweetim-toolbar\locale\es-ES\sweetim-toolbar.properties

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	1805
Entropy (8bit):	4.692581821283924
Encrypted:	false
SSDEEP:	24:E9zIxp2HNZB46N8vLcJxcyRIE2BZwuu39Aue1SXi9n4uevlXe9hue+:2IxiNZB4xvLMxvaK9AueN9n4ues9hue+
MD5:	390E575C828684329B97619EB451ED83
SHA1:	651CBB3F2C1C8A360CBAE4D00E77AD3FAF24A330
SHA-256:	67FD3B472B8243E1B101BA54427E78C0C3C0DCC1EE61E1389A6C0BFA70CE5A9C
SHA-512:	6F7BA65224DE94A5D388D6CAF23B544A95FBE9B059680743C2D48D979B4BAFD4D1A8897E2E97415E1D77AD8AD4ACC5952C981E757428730456714FFF81D5F571
Malicious:	false
Preview:	sweetim.property.button.highlight.enabled.tooltip=Alternar el resaltado de los t.rminos de b.squeda en esta p.gina..sweetim.property.button.highlight.disabled.tooltip=Introducir texto en el cuadro de b.squeda para resaltarlo..sweetim.property.button.findword.tooltip=Buscar la siguiente aparici.n de '%1$S' en este documento..sweetim.property.history=Historial..sweetim.property.button.main_menu.tooltip=Ir a b.squeda SweetIM Search..sweetim.property.button.main_menu.dropmarker.tooltip=Men. SweetIM ..sweetim.property.button.search.tooltip=Buscar en la web..sweetim.property.button.search.dropmarker.tooltip=Hacer clic para seleccionar otros tipos de b.squedas..sweetim.property.menuitem.chevron.highlight.label=Resaltar..sweetim.property.uninstall.title=Desinstalar %S..sweetim.property.uninstall.text=.Le gustar.a conservar la configuraci.n de la p.gina de inicio SweetIM y de b.squeda SweetIM de manera que pueda seguir disfrutando de un r.pido acceso a una potente b.squeda de Int

C:\Users\user\AppData\Local\Temp\SweetIM_Temp_Folder_4779843\chrome\sweetim-toolbar\locale\fr-FR\sweetim-toolbar.dtd

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	3386
Entropy (8bit):	4.946143805128272
Encrypted:	false
SSDEEP:	48:YUOGEF59RzwDJXc3Ga9jwTfBtVdgs5zglLXMa:gRzwDJCj8fwsIga
MD5:	4FA0C67A5376147914F61095F68FF413
SHA1:	467B3B262F1803CF4CB11F0DF1189305CCA6493C
SHA-256:	38A9AAE24ABCF3ED24EA64E8A1A3831DA557C6B60582A70E3973E4F78B97E8A3
SHA-512:	A53D7BE419CE82A65314FF5404F51CAA9DBDDD999D0B4315095FDFBBCF2E33A2FF26750E39913BD52E15CEF557F26A9076CB2B6DA6394884B8D37093C2865622
Malicious:	false
Preview:	<!ENTITY sweetim.main_menu.home.label "Accueil SweetIM">..<!ENTITY sweetim.main_menu.search.label "Rerchercher dans SweetIM">..<!ENTITY sweetim.main_menu.messageboard.label "Forum SweetIM">..<!ENTITY sweetim.main_menu.messageboard.tooltip "Aller aux forums SweetIM">..<!ENTITY sweetim.main_menu.trackseraser.label "Effacer mes traces">..<!ENTITY sweetim.main_menu.help.label "Aide">..<!ENTITY sweetim.main_menu.feedbcak.label "Contactez-nous">..<!ENTITY sweetim.main_menu.feedbcak.tooltip "Contactez-nous pour toutes les questions li.es . la barre d'outils SweetIM pour Firefox">..<!ENTITY sweetim.main_menu.privacy.label "Charte de confidentialit.">..<!ENTITY sweetim.main_menu.privacy.tooltip "Charte de confidentialit. sur la barre d'outils SweetIM pour Firefox">..<!ENTITY sweetim.trackseraser_menu.clearCookies.label "Effacer les cookies">..<!ENTITY sweetim.trackseraser_menu.clearCookies.tooltip "Ceci effacera vos cookies">..<!ENTITY sweetim.trackser

C:\Users\user\AppData\Local\Temp\SweetIM_Temp_Folder_4779843\chrome\sweetim-toolbar\locale\fr-FR\sweetim-toolbar.properties

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	1943
Entropy (8bit):	4.7702687098251415
Encrypted:	false
SSDEEP:	24:E9Zk52rt7rzISjGKvkN9wqXvljqrKAYsjHZTCQAKYWYaPpT4QPOD0YWIKWl:0NtcSjRvCvljqm+1aaXPYK+
MD5:	4431C2790194EF7E437143F23CDC29E4
SHA1:	7BF58B987029638CF9DE413DC2086E842F429290
SHA-256:	BD64BB1D5964DDA5DCCC0E25ED26C51A10F6F3393DC8F608B7C1EC6F51B352E8
SHA-512:	0C72707E11613C8D3F4794B3FAC82D8CBFC8F1825BA721B5D08F5B718B5CEC8735FE0CA5C9886297F8EAA02189BC08A7A83E5AA030F48545177BFD5B10D91487
Malicious:	false
Preview:	sweetim.property.button.highlight.enabled.tooltip=Activer/d.sactiver le surlignage des mots recherch.s sur cette page..sweetim.property.button.highlight.disabled.tooltip=Saisir le texte dans la fen.tre de recherche pour le surligner..sweetim.property.button.findword.tooltip=Rechercher l.occurrence suivante de '%1$S' dans le document actuel..sweetim.property.history=Historique..sweetim.property.button.main_menu.tooltip=Aller . la recherche SweetIM..sweetim.property.button.main_menu.dropmarker.tooltip=Menu SweetIM..sweetim.property.button.search.tooltip=Rechercher sur le Web..sweetim.property.button.search.dropmarker.tooltip=Cliquer pour choisir d'autres types de recherche..sweetim.property.menuitem.chevron.highlight.label=Surligner..sweetim.property.uninstall.title=D.sinstallation de %S..sweetim.property.uninstall.text=Souhaitez-vous conserver la page d.accueil SweetIM et les param.tres de recherche SweetIM afin de continuer . profiter d.un acc.s rapide . une recherche In

C:\Users\user\AppData\Local\Temp\SweetIM_Temp_Folder_4779843\chrome\sweetim-toolbar\locale\it-IT\sweetim-toolbar.dtd

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	3350
Entropy (8bit):	4.8917769951145
Encrypted:	false
SSDEEP:	48:IfLNtmvDvLn05w5rzbQryFfDCBJvfToBep+ILYMa:IKbTn05wZzbQGVevcBlITa
MD5:	7AEE63481187ECEE6DB55617A6B75C56
SHA1:	77323755C9533660E759681FBDAEAB3175AA1886
SHA-256:	AD9DC46F37E945240BD28DCE8F0B7E930DBDE6071658A7D1CF2A77C2D1AA8685
SHA-512:	B412F7AFB983D5DB746A3FBEA849D8D6551D5CB632325E2574DFD6FEBADBFA17C0FAD8E7BF2E508BC409C330A28F8270BBCE45FFA43B3C5A145C3048DD64C572
Malicious:	false
Preview:	<!ENTITY sweetim.main_menu.home.label "SweetIM Home">..<!ENTITY sweetim.main_menu.search.label "Cerca con SweetIM">..<!ENTITY sweetim.main_menu.messageboard.label "Area messaggi SweetIM">..<!ENTITY sweetim.main_menu.messageboard.tooltip "Vai ai forum SweetIM">..<!ENTITY sweetim.main_menu.trackseraser.label "Cancella tracce navigazione">..<!ENTITY sweetim.main_menu.help.label "Aiuto">..<!ENTITY sweetim.main_menu.feedbcak.label "Invia commenti">..<!ENTITY sweetim.main_menu.feedbcak.tooltip "Contattaci per qualsiasi problema/quesito relativo alla barra degli strumenti SweetIM per Firefox">..<!ENTITY sweetim.main_menu.privacy.label "Informazioni sulla privacy">..<!ENTITY sweetim.main_menu.privacy.tooltip "Informazioni sulla privacy della barra SweetIM per Firefox">..<!ENTITY sweetim.trackseraser_menu.clearCookies.label "Cancella cookie">..<!ENTITY sweetim.trackseraser_menu.clearCookies.tooltip "L'operazione canceller. i cookie">..<!ENTITY sweetim.tr

C:\Users\user\AppData\Local\Temp\SweetIM_Temp_Folder_4779843\chrome\sweetim-toolbar\locale\it-IT\sweetim-toolbar.properties

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1607
Entropy (8bit):	4.584285505783685
Encrypted:	false
SSDEEP:	24:E9YN2z/BC7vGlvPljRuq67EVhocEzZGwPFuOpEhoPyY7L:7uiv2vx0q6Q/oLz9OoqY7L
MD5:	E812535CE93B3877F4414DADF040B5F3
SHA1:	2D99203C28D900F4A891D7F0AC1C3B2B12168714
SHA-256:	4E8785F17DBEA4756212BD7705E98DA81A8D850F083E0ED0D97F83370DDCF101
SHA-512:	CED8B831D8117127F593FDB60EB24B7F96AED1E1E5B867886D4BBDC6F127D1B1F8E5413254802B2037537DAE913900877114FE51BC1D8D8A6218192142622BBF
Malicious:	false
Preview:	sweetim.property.button.highlight.enabled.tooltip=Attiva l'evidenziazione dei termini della ricerca su questa pagina..sweetim.property.button.highlight.disabled.tooltip=Inserisci il testo nella casella della ricerca per evidenziarlo..sweetim.property.button.findword.tooltip=Trova la successiva occorrenza di '%1$S' nel documento attuale..sweetim.property.history=Storico..sweetim.property.button.main_menu.tooltip=Vai a Cerca con SweetIM..sweetim.property.button.main_menu.dropmarker.tooltip=Menu SweetIM..sweetim.property.button.search.tooltip=Cerca nel web..sweetim.property.button.search.dropmarker.tooltip=Fai clic per selezionare altri tipi di ricerca..sweetim.property.menuitem.chevron.highlight.label=Evidenzia..sweetim.property.uninstall.title=Disinstalla %S..sweetim.property.uninstall.text=Vuoi salvare la home page SweetIM e le impostazioni di ricerca SweetIM per accedere rapidamente alla nostra potente ricerca Internet?..sweetim.property.searchguard.hp.caption=Cambio impostazioni Home

C:\Users\user\AppData\Local\Temp\SweetIM_Temp_Folder_4779843\chrome\sweetim-toolbar\locale\nl-NL\sweetim-toolbar.dtd

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	3273
Entropy (8bit):	4.947891556350373
Encrypted:	false
SSDEEP:	24:f2r110JZGwl/a61lQsO1zscYDB0wyPzoSH51UJ+MOl7T+RisLcyFQLtl6WyI76DD:f2rICoEzTq0wyZ1g+fl7TBsaVVm/Lv
MD5:	01AC12BC348313FC5737F0C433088AD5
SHA1:	5C3F83C74ED43303D2A45070237911823DC06624
SHA-256:	B24408110B993F10E2205EA02E71EE66F5D5416304AFE1445F817B956B61A737
SHA-512:	3A0C823819BE7AEA64CC418A583B2974CA35D27573375028F386AEF1473088F172B4582C742C216736338C3126059B6A1457C5DADCAFED0940DF4422E5CE7FDC
Malicious:	false
Preview:	<!ENTITY sweetim.main_menu.home.label "SweetIM Home">..<!ENTITY sweetim.main_menu.search.label "SweetIM Zoekfunctie">..<!ENTITY sweetim.main_menu.messageboard.label "SweetIM Mededelingenbord">..<!ENTITY sweetim.main_menu.messageboard.tooltip "Ga naar SweetIM Forums">..<!ENTITY sweetim.main_menu.trackseraser.label "Sporenuitwisser">..<!ENTITY sweetim.main_menu.help.label "Help">..<!ENTITY sweetim.main_menu.feedbcak.label "Contact-informatie">..<!ENTITY sweetim.main_menu.feedbcak.tooltip "Neem contact met ons op over alles wat te maken heeft met SweetIM Taakbalk voor Firefox">..<!ENTITY sweetim.main_menu.privacy.label "Privacy informatie">..<!ENTITY sweetim.main_menu.privacy.tooltip "SweetIM Taakbalk voor Firefox privacy-informatie">..<!ENTITY sweetim.trackseraser_menu.clearCookies.label "Verwijder cookies ">..<!ENTITY sweetim.trackseraser_menu.clearCookies.tooltip "Dit zal uw cookies wissen">..<!ENTITY sweetim.trackseraser_menu.clearCache.label "Ve

C:\Users\user\AppData\Local\Temp\SweetIM_Temp_Folder_4779843\chrome\sweetim-toolbar\locale\nl-NL\sweetim-toolbar.properties

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1692
Entropy (8bit):	4.595629503022333
Encrypted:	false
SSDEEP:	24:E9R2Xa+CgtWLmDvCwu0D+34bIcgPsVrPbjhgMhgPBQqPpTkg:s5gtgIvnD+tLgbrSTdkg
MD5:	582BEFD8357EB62BD9ADA8CA3F4D3E02
SHA1:	C6F8C959A779F90C99947956E1F38CA1429D08D5
SHA-256:	68513E080CD6D3B3CC9B1D55E5A3EFC40D341E6B7E2C29392A3C0AE046E20BB6
SHA-512:	FA4E7D22912E20ACC1B23214A60C343EA88DA0A20860F061599EE3113D2077964BF356B7ED5028D735911CB942D6359ADF81268BAA28B86AA0CF350F4C280618
Malicious:	false
Preview:	sweetim.property.button.highlight.enabled.tooltip=Markeren van in- en uitschakelen van zoekonderwerpen op deze pagina..sweetim.property.button.highlight.disabled.tooltip=Voer tekst in bij de zoekbox om die te markeren..sweetim.property.button.findword.tooltip=Vind de volgende keer dat het '%1$S' voorkomt in het huidige document..sweetim.property.history=Geschiedenis..sweetim.property.button.main_menu.tooltip=Ga naar de SweetIM zoekfuntie..sweetim.property.button.main_menu.dropmarker.tooltip=SweetIM Menu..sweetim.property.button.search.tooltip=Zoek op het web..sweetim.property.button.search.dropmarker.tooltip=Klik voor het kiezen van andere zoekfuncties..sweetim.property.menuitem.chevron.highlight.label=Markeer..sweetim.property.uninstall.title=%S de-installeren..sweetim.property.uninstall.text=Zou je de SweetIM homepage en SweetIM-zoekinstellingen willen bewaren, zodat je plezier kunt blijven hebben van een snelle toegang tot een krachtige internet-zoekfunctie?..sweetim.property.search

C:\Users\user\AppData\Local\Temp\SweetIM_Temp_Folder_4779843\chrome\sweetim-toolbar\skin\SmileySmile.png

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PNG image data, 47 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4706
Entropy (8bit):	7.939609866150524
Encrypted:	false
SSDEEP:	96:nSDZ/I09Da01l+gmkyTt6Hk8nTLTT3Aau8Z3pqoMN4t4qDhV6c:nSDS0tKg9E05TLTTHu8E4t4qDrl
MD5:	72C9881C090F7C954451691AEC0266D2
SHA1:	E0572385B740CAD95B8471A77CF1384A8A4EC687
SHA-256:	510F120EFE2F234C3662020143BC9F606EABCFCB80C901D53EA8BCA753A27E92
SHA-512:	C6A1B65EAEF3C1A3A49A53024F7E4AD898286A2AF8D779E6088B54E95C06616570D39CBCE202E48C59A05224AE41BF8AC66778B4248ED319E6F36A0FEF9FA2E6
Malicious:	false
Preview:	.PNG........IHDR.../...........&.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Users\user\AppData\Local\Temp\SweetIM_Temp_Folder_4779843\chrome\sweetim-toolbar\skin\SmileyWink.png

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PNG image data, 47 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4513
Entropy (8bit):	7.923205264207793
Encrypted:	false
SSDEEP:	96:nSDZ/I09Da01l+gmkyTt6Hk8nTJlJ0NDxK+muSJyXnmlqsOc:nSDS0tKg9E05TbaDxLmuuyXmYsOc
MD5:	A75E7B7FB7225134A01B01C6985086C3
SHA1:	C18649F3DC4CFD551CD861FFAFAB51B98B8CBCE8
SHA-256:	000D8E36A1D432D6F6C182D41DEADB3F3B051CC5C5B32AFCAC6B3A80C4D802EA
SHA-512:	590812B335FB7AC128AEB4012960377AB2E2FC1D03A1418287DDFE074874B9C12D0D76F021126EC7FB06668281C2E91ADB678DB4B3B49E612D3BE74E954DA52F
Malicious:	false
Preview:	.PNG........IHDR.../...........&.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Users\user\AppData\Local\Temp\SweetIM_Temp_Folder_4779843\chrome\sweetim-toolbar\skin\bing.png

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	318
Entropy (8bit):	6.864702191037678
Encrypted:	false
SSDEEP:	6:6v/lhPmNp1ZsRgPkHK9SQQxL95uLcIR5lgxmWZ2/vFvgUl7dp:6v/7uNpLmgPe4SQQL9+lggWM/NDz
MD5:	CAF9A4DFDDFD2568B37781AFB55DF16D
SHA1:	60405FE8FE085DC0062B77450A9CE9049552AACB
SHA-256:	05F666FCBD4A108C0DFAEE4BFA0414294694014C35E0603A2E944182C6DA7F2E
SHA-512:	73F133C02944F6FBEB2CD2DD142E2A2808017A1C8153AF8DB2B47143A2BCBFE0FA8E9FFBCC1DA84DC544D8E14FDAF8B34FC1EFF89E60792E84A780D28C32CD38
Malicious:	false
Preview:	.PNG........IHDR...............h6....IDATx.c..L....H..A..V~....._!N....1+.W.........A@...f'....P..'..,..'..n.bxu.C..\|}.p....c 6P.R.T.(x".C.P.\-..(6(F0XL.1....A.V.]5..5......5...9..M..F..A...X.....`......{.................h.n.[.@....*./...0.@c..........P..10.O.A..5-..........@......%>R....{..,......IEND.B`.

C:\Users\user\AppData\Local\Temp\SweetIM_Temp_Folder_4779843\chrome\sweetim-toolbar\skin\clear-history.png

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3279
Entropy (8bit):	7.900863279277824
Encrypted:	false
SSDEEP:	96:CXHt+JcNgOSiS4XsAYNpf2ESN5B6Ee1rEV:2oONgOLPXsAYnIB6Ee1G
MD5:	55FE3A0B1E9F8B4FDB84FC3E206276A2
SHA1:	669B6C3560552027D0C7E4737E1703E52A7D77C0
SHA-256:	5E443B66113C0ED5D2B49EA60E681D9D8B561798ED60C8E53441E63250740E6D
SHA-512:	85E3FBBDE3444D3E8304CA490A9A251D92AE575FE2A0B9A6DE9E86952D958ADF648C106C5DC929B3B2EE2D44114FAEE23635BD57AFEE54F9455FC6A5E642CE5A
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA....\|.Q.... cHRM...........R...@..}y.....<.....s<.w...9iCCPPhotoshop ICC profile..H..wTT....wz..0.R.....{.^Ea..`(..34.!...ED."HP..P$VD...T..$.(1.ET,oF.........o......Z..../...K......<....Qt.....`.).LVF._.{......!r._...zX..p..3.N....Y.\|......9.,...8%K.......,f.%f.(A..9a..>.,....<...9..S.b...L!G....3..,....F.0.+.7..T.3...Il.pX."6.1...."....H._q.W,.d..rIK..s...t......A..d.p....&+..g.].R.......Y2...EE.4...4432..P.u.oJ..Ez...g.........`.j..-....-....b.8....o....M</..A...qVV....2.....O.....g$>...]9.La.....+-%M.g.3Y.......u..A.x....E.....K.......i<:...............Pc...u@~..(.. ...]..o..0 ~y...s..7.g...%...9.%(....3........H....@...C`...-p.n.......V..H.....@....A1....jP..A3h..A'8..K....n..`.L.g`......a!2D..!.H... .d..A.P....B....By.f.....z....:....@..]h...~....L.............C.Up.......p%....;...5.6<.?.........."....G..x...G.....iE..>.&2.. oQ...EG..lQ..P......U..F.Fu.zQ7Qc.Y.G4....G......t...].nB../.o.'.1.......xb"1I.

C:\Users\user\AppData\Local\Temp\SweetIM_Temp_Folder_4779843\chrome\sweetim-toolbar\skin\dictionary.png

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3287
Entropy (8bit):	7.891546537282907
Encrypted:	false
SSDEEP:	48:b/6DocieftI9G9f6A+FIDOWu0lDl+gm7QyTtctIInQSy6IVpqlnBcODRqVwJkvMG:bSDZ/I09Da01l+gmkyTt6Hk8nTUwCvMG
MD5:	A143CA61BD925BF5831EE74BDDDF1DA4
SHA1:	D0E822D6BACEA7F506481037176E04457D719DC5
SHA-256:	54B97C1D6C6F4D704D16C953FE100D4453FC5592FD9EF5AFB33260890FDB0618
SHA-512:	104544409128871B258B9623E942F07E37CF485C5A3EB3AF0EC8BC99E0D5C756D236F2F63BB267DACA87F6D2DCC0DE03F62C99AB73BC048A0660A80B87A3F308
Malicious:	false
Preview:	.PNG........IHDR................a....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Users\user\AppData\Local\Temp\SweetIM_Temp_Folder_4779843\chrome\sweetim-toolbar\skin\finance.png

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3410
Entropy (8bit):	7.894828125786389
Encrypted:	false
SSDEEP:	96:bSDZ/I09Da01l+gmkyTt6Hk8nTBqBXTmTIDY:bSDS0tKg9E05TB
MD5:	E1A82CF04E37B212A2843D9967FC12C4
SHA1:	F096383C90B7C3A8A397671A2E96F81C2958FB0B
SHA-256:	B866837AB746FAFF5D2C6201A270CECC14D7A57A311ABE5AEA4D32C7E02A1CA8
SHA-512:	965FD8C91B4FFE9D0FEFF9FF416057C9651F05A34FCBCF7EB2B4B15F1B36C01C2DF2E169483BC545CDDBF8478ADCA89298E8A4EF7F344BF2AB7170D058C21AC4
Malicious:	false
Preview:	.PNG........IHDR................a....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Users\user\AppData\Local\Temp\SweetIM_Temp_Folder_4779843\chrome\sweetim-toolbar\skin\find.png

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3371
Entropy (8bit):	7.896512358734088
Encrypted:	false
SSDEEP:	96:bSDZ/I09Da01l+gmkyTt6Hk8nTMdfMVRfAQNq:bSDS0tKg9E05TOfM3fNq
MD5:	148C71F4C4A537A1F286ED3F40D39ADB
SHA1:	9FFDA4FBE2C432191B94A7E71A0295899513AC41
SHA-256:	AF8F54A2730DE3323D559A0D0D4272598BA2F13865C2620152AA4E78037E2048
SHA-512:	8B6B397BEC1DA5EA85E04DB3C0C4E6EB4F9DC4EDC1760EF5FDC62B970182BE4F2E61C391038F71D9F89583CCAF4786EE9CE6039C0E595CCD783C86636750BCB2
Malicious:	false
Preview:	.PNG........IHDR................a....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Users\user\AppData\Local\Temp\SweetIM_Temp_Folder_4779843\chrome\sweetim-toolbar\skin\google.png

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	3341
Entropy (8bit):	7.887714626414327
Encrypted:	false
SSDEEP:	96:nT2SDZ/I09Da01l+gmkyTt6Hk8nTno/AW0QE+H:T2SDS0tKg9E05TnoIy
MD5:	A66632B80FC122541E246BAD41A3E0EE
SHA1:	2BACE9CCC0D1E4BBDF578755718FB61E60190AB7
SHA-256:	8257229ACA8F9E1BA64A9D881A16817B216A429867E7FB9DF7D15915663B7E67
SHA-512:	0E2F088B7E681C5172548A57F5D175701F9873B8D56ADB06ED633A724AE94FA6E659D80A3A9BFC9FCDF59B311E6CB5A85513FE47DF33A2025073F95A88830BDF
Malicious:	false
Preview:	.PNG........IHDR...............h6....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Users\user\AppData\Local\Temp\SweetIM_Temp_Folder_4779843\chrome\sweetim-toolbar\skin\highlight-disabled.png

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3217
Entropy (8bit):	7.892286714994252
Encrypted:	false
SSDEEP:	96:bSDZ/I09Da01l+gmkyTt6Hk8nTgQCZuEaGOo2:bSDS0tKg9E05TqZaGc
MD5:	DC3494FFF24914D9D2D021BD8D25D6DD
SHA1:	D291D3FFE012D546353FEAA032DE8F427B37C5A5
SHA-256:	974907293EC367914CDAE7AA701000790AC63F1AFE977E06F3A16D4DA37932A5
SHA-512:	2E8612ACCB12FB144C4C656C9664123A68311C115960DD9AA91CF344C6A7ED73C4574E916DD2FB4B56560C3897A39C128F280A5DA1182E0B48DF8A6FA41B8EC4
Malicious:	false
Preview:	.PNG........IHDR................a....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Users\user\AppData\Local\Temp\SweetIM_Temp_Folder_4779843\chrome\sweetim-toolbar\skin\highlight.png

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3216
Entropy (8bit):	7.8906601217003995
Encrypted:	false
SSDEEP:	48:b/6DocieftI9G9f6A+FIDOWu0lDl+gm7QyTtctIInQSy6IVpqlnBcODhn1aYaZe3:bSDZ/I09Da01l+gmkyTt6Hk8nTJ11aZu
MD5:	29D046A3F81292EE314864085A63FF81
SHA1:	9B6B8A5E556B475E2E18CE6875D9561AF07DF37C
SHA-256:	B5B6674E9D6CA9441C93D1F14C1203C75DCD3F756C8AB990FB736EB8EA02D1AC
SHA-512:	93933BF98A7E2ADDE07218FF71339386A40D42C55CFDDFBAFB77C8720370999E5276007B1BF1D775D9EB0397A66A34776E081966A4FD0EBED59A1B0E086CC2B2
Malicious:	false
Preview:	.PNG........IHDR................a....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Users\user\AppData\Local\Temp\SweetIM_Temp_Folder_4779843\chrome\sweetim-toolbar\skin\logo.png

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3239
Entropy (8bit):	7.888643295675962
Encrypted:	false
SSDEEP:	48:b/6DocieftI9G9f6A+FIDOWu0lDl+gm7QyTtctIInQSy6IVpqlnBcODCRALs03pS:bSDZ/I09Da01l+gmkyTt6Hk8nTdLNZi
MD5:	28FDADB259A8077E09F442CA8EE1FFE5
SHA1:	9F93FD60CFC263758E2893813FC2EBD2AC3BB352
SHA-256:	9B519A9E1A1B17921268F552120BEE46DCBBC0BAA8BD888524BE0F7278172F6A
SHA-512:	E5926D42E2C79DFE415132156CADE34830B98F81D359F8AF2272F7B0B723C93770AA40F4478545ED01F7C4D23B051700641E33F36ACDF8C7E4736B0BA0102F50
Malicious:	false
Preview:	.PNG........IHDR................a....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Users\user\AppData\Local\Temp\SweetIM_Temp_Folder_4779843\chrome\sweetim-toolbar\skin\logo_32x32.png

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	907
Entropy (8bit):	7.7115682629611495
Encrypted:	false
SSDEEP:	12:6v/7iMXQbYxUmLXrR83gsck25T8crr2vU3w9lFKms5QQjsa7mwetd2xJ+qjsq+Ka:BbYxUmLXd83RMBwl9g6wo5q/+Kdpi
MD5:	CE93245253E7D87992B0BA17501BCCCE
SHA1:	EB886BDAD9250A51E1DC7C3E46E34AEA684253D0
SHA-256:	CC355E7C9F6C28CA686489EC62307BDA4BBC580D7479794B9080F48E8D1B288D
SHA-512:	CB1FB5E8F26542D22194970CCCDF575780E0D29710576DA925E03A0140FCDB443A58A8CCC0F6993968F0FADFA69D2BC2CA708AA002565A24E5D0E68A7631E6AC
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....tEXtSoftware.Adobe ImageReadyq.e<...-IDATx..W.k.Q..^.).:....\.......E#..ED...C.]...`..((h...g&....n....z..Q......\r^.....K..~?...\|...y.LrL....X.y)3==.e..r....I.....JOc)`r.D<.b.0K..rl..x......9.E......oc...g.....Y.9.>..-..'....{.q.@..\|....Nc^...9I.^.=...2.6....@..g...K...@.....D.......z../....A..b....0N......Q....V.:...@...Yu..8.....).......g...Ik......Q...zp..b.._...'}.W..$....5.M....)...[..)z....UR..<..2.F.m.W....>._i........-3..Y..._.........u.....$.x.-...L.=...g...Wf...l..0...v...J....{..iC..p..x.k!....^...^.rE..8.hFA....s..l...~@...H.#a8...)O:HX[.......p`9f...\.?.ND...rJ.1...P....nq..........a.Q_.l.X{.Z\KV..'.]0...#.Rq....o...P........>z.q.....[......,'.S."J1;.w$.s...x......s..."03.&......Rl?`..6.......-6.D.........ZDw>@....X..e.Ym.......QTgD..........4o>...=.8...,.!r..+.'........u.[...............IEND.B`.

C:\Users\user\AppData\Local\Temp\SweetIM_Temp_Folder_4779843\chrome\sweetim-toolbar\skin\more-search-providers.png

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3352
Entropy (8bit):	7.8931164626831265
Encrypted:	false
SSDEEP:	48:b/6DocieftI9G9f6A+FIDOWu0lDl+gm7QyTtctIInQSy6IVpqlnBcOD8T/BbqEhZ:bSDZ/I09Da01l+gmkyTt6Hk8nToqeGM
MD5:	3D5838DF2B73465BAE62A24C4227B8DA
SHA1:	6DBC88054A5CEBC0BD528965E232ECA12B7FF841
SHA-256:	910F08F5D49FE7D48E4C04E2A2872B67E5210A16AD10611D89D23009A58AE225
SHA-512:	D6DCE4ACE8CC5823A2E54265D9207C37D84A2D5F43B57E0EBE4BB08C2EC051F507730B46F0F5AD3B90E13DB6C7D4DB1946F0FD3A7B25A5EC14A92769CCB40772
Malicious:	false
Preview:	.PNG........IHDR................a....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Users\user\AppData\Local\Temp\SweetIM_Temp_Folder_4779843\chrome\sweetim-toolbar\skin\music.png

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	969
Entropy (8bit):	7.762222484405286
Encrypted:	false
SSDEEP:	24:H99+nx2odKpOu5EoaHoA4JtF7yq3W4T9bx+Z6JEGY:d8x2odKpOmZ6rStF75m4Txx+ZaEGY
MD5:	6CCA94CDF2EB6A5FF419733DF8E89C8B
SHA1:	9B53E137FE7C6FE398403EED10CBFEE303CC2A83
SHA-256:	5F424A3EE5FE6892ECB699ECC07D21A8749166FD5356E6AAFBF6564B0DD0B3F3
SHA-512:	C1D45F195837E4AD1BF78F1BF5A7C418734E69D4C477D807ED34B034E079B35127757E3F29B8725070C4C93063574155A031E88E50CDECA93FF1B6789E85D2ED
Malicious:	false
Preview:	.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<...kIDATx.tS]lSe.~.s.sN.u....m...J76p..!Q.2p.h.T.....\.h.z...&^.h.d$#q.............c.m..u....==?~%$J.O.\}..\|....Gvt........l._I)...dd.S.q\..1.x..T./P].,.8......]..]..-.iL._...e.Q..hp#`.....).7L(.$...........D[?.7..n...Wg..#A2m.Z..d....Df...9g..K..W........H}5.K0+<\../;...os..y..[..k.5%..^I..V..@.1...C.cr.t..MGz./,T...#......z%.>...G5..MG.;:..u..."..,-e....J''p....v........P.....cHmj..w..d[.c...D....... ..v.Y...X..uQ..4........x.68......{..x.i.U....68..5.......s....7..w....JH.V6Q'<."....M5....<.`pFa].W.....90..{c.~...n9..52..AZA.A......h.q_.w..p...{._Kf.~."...e...e...g.Y{..]D.w.8.}.......C.Z.....p.^.j.\|S..v.J\|........Z..,t.<01..''04........l...KB)@..."...].....ja.P.....b@d.\|.!........K....$..x......+..(.L-.3..\|...ba..Q....C..Q.Z..c...h.*......V.......(...o...`.cl;z./8lf.....7.y...._WEO.;6.._..7g0...Y..a...a.....=..$M.T.S..0._.Y.S.y.....IEND.B`.

C:\Users\user\AppData\Local\Temp\SweetIM_Temp_Folder_4779843\chrome\sweetim-toolbar\skin\photos.png

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3432
Entropy (8bit):	7.890811683389906
Encrypted:	false
SSDEEP:	96:bSDZ/I09Da01l+gmkyTt6Hk8nTix2NsDd3:bSDS0tKg9E05TiAgd3
MD5:	3326F38F67E138CD40DF3036A6309F63
SHA1:	8371BACE6C48FC5AF719000E91A627F6DC0CE3AC
SHA-256:	A86EB86BE5BA9BEEA0C3303447F4BAFFF2A8BD49AC2D245F3759C31DE52018FC
SHA-512:	672FD5BDD4753F3E8EB9A30B25E18EA7231DE7208C217E9D55F3A34A794B27626C290E581418229982DEDE7975D21C46E3E9B32F265BCAC8B2FBA56926B5C841
Malicious:	false
Preview:	.PNG........IHDR................a....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Users\user\AppData\Local\Temp\SweetIM_Temp_Folder_4779843\chrome\sweetim-toolbar\skin\search-current-site.png

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	784
Entropy (8bit):	7.695743284796664
Encrypted:	false
SSDEEP:	12:6v/72rnSuDO0xkvVXUTDkIPr5vDeQNMV5PhSEbsqs9GaWzL6gsp2xkIoKzxV7:3SkO02dkTD3Pr5vEQI6L2+IoKF
MD5:	7D4CAAD7B62C2F69274E585D326D2A91
SHA1:	815175D8C54D86B622873FD152BDE7482B6B83D8
SHA-256:	8EF5C62F599935ED9448258366E2DCB209338870B902D803F20081494FE46E51
SHA-512:	5FB3D260220150F1461577287D5D273482207F4CDE362391FE81C643C113A598B440A413B35DDD6520DF55B2AB2C3EDB8A24B2EC2AD681FEAC6C382192A31789
Malicious:	false
Preview:	.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<....IDATx..[HTQ...}f.q4...6h$..iY.1..,...!).@.%..b..QH&./fD..`.FTf....S.My..@^f....xV.(...C...f........D....?........H.zS.mD...Pi...6.&...!a...hs5..;....j@............ZI....<...h.?.!{=.......%.<..n.,.A.....2.t...t.7E....F..H....1kB!z:A..P.s.Len^.....mp...z.:l\...LX.....`...m... .\VV..:lUI...9e8.p..f...o........q.......1...?yTb..-.\....R....X...\..IK.E...T....l..7.Im..jPB.../......B.X...L$.{2.......N6>.e'.N.../.JV\|...{s.d..5a..TK7F.q....!.6...Y.w..c/.S..l.w........qvgT.T......!.9...'. 1'I...,~O%.:.R..KHt]i>n.>..G.\.u.Q..0....&.."}....CJ....E.>....B....<VS.....a.i....0.e#.. .K.P...(....._.^i..q.4.Xk.%se.;.....3.}x.=...?;KW...B.q.al..a5._+&..F...{H}..O...@j.i.1w.....IEND.B`.

C:\Users\user\AppData\Local\Temp\SweetIM_Temp_Folder_4779843\chrome\sweetim-toolbar\skin\social-networks.png

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3248
Entropy (8bit):	7.891399431000833
Encrypted:	false
SSDEEP:	96:bSDZ/I09Da01l+gmkyTt6Hk8nT5c656Pp:bSDS0tKg9E05T5cy6B
MD5:	C9E37BF72E41F4266CD7BDC875EA61BE
SHA1:	5D808714D82BC227D2B2F973540B2374D3212367
SHA-256:	88CC5CFDD1B66EDC992A9A348634C641A49626EB06116C1247E349DF5089140B
SHA-512:	DBBAFEAC3A52A2F9CC2E69D7E95CF5D0EE6DEA12E42DA4C3DCB7FD1E754CF9B24D2D31309A529885537EB46C14342965C3AD184D606800773D2B481C94E74F7C
Malicious:	false
Preview:	.PNG........IHDR................a....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Users\user\AppData\Local\Temp\SweetIM_Temp_Folder_4779843\chrome\sweetim-toolbar\skin\splitter.png

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PNG image data, 11 x 24, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3056
Entropy (8bit):	7.8853902232584545
Encrypted:	false
SSDEEP:	48:Q/6DocieftI9G9f6A+FIDOWu0lDl+gm7QyTtctIInQSy6IVpqlnBcOD5d101/hu7:QSDZ/I09Da01l+gmkyTt6Hk8nT5Q1JVO
MD5:	AEF0A911384F19305EA555EE444D37BC
SHA1:	5EA082A01AF0E52F12EF89B0D675426C8608B581
SHA-256:	68AFC90D338327ABCAC854A19D8C81EB1F9AA4AE7BFB1F53DBBDE899B4FC9E64
SHA-512:	4A669417979F96D72D0E8CC930E48C3F30C4DE4797C525D21CFCBA5C4D02588C804BA30F03595949E8C4C61B67D712D67E96AA2095EE81AC9EE4F4AE03D1FB27
Malicious:	false
Preview:	.PNG........IHDR.............,.......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Users\user\AppData\Local\Temp\SweetIM_Temp_Folder_4779843\chrome\sweetim-toolbar\skin\sweetim-toolbar.css

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4994
Entropy (8bit):	5.055953897720054
Encrypted:	false
SSDEEP:	96:NHpNbWeC/ElNLI/Qdyc04k4bOoz+Vfh1+4FsXC8Y+b1Ska:NHrS5WNL6Td4k4bOog7+4FsSmpSt
MD5:	73B01090E40193CC727A5FDC58A87FB8
SHA1:	6E1A8174F945A280F7D56B3099206ADAF04D2532
SHA-256:	B60F9FB3F97751D5D05C32DC3F2A417BC086ADE2F7C229D2F95CCD574A8042A2
SHA-512:	C3851B64AE8D3A0BE72EF2ED3C5B700D379A5CCD9FAECBF7F6E5EBC2A80EDF73A38C6FC88F14672B1CD0FDB13DAE409EC0A00970E5946E05EA58B5D1A06E7C04
Malicious:	false
Preview:	@namespace url("http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul");..@namespace html url("http://www.w3.org/1999/xhtml");..@namespace xbl url("http://www.mozilla.org/xbl");......#sim_main_menu_btn_id {.. list-style-image: url("chrome://sweetim-toolbar/skin/logo.png");..}....#sim_search_btn_id ..{.. list-style-image: url("chrome://sweetim-toolbar/skin/web-search-button-glass.png");.. -moz-appearance: none !important;.. -moz-box-orient: horizontal !important;.. /* color for FF 3.6 and later/.. /background: -moz-linear-gradient(top, red,yellow,yellow,orange) !important;*/.. background-image: url("chrome://sweetim-toolbar/skin/web-search-button-bg.png");.. -moz-border-radius: 4px;.. border-width: 1px !important;.. border-color: ThreeDShadow !important;.. border-style: solid;.. color: -moz-Text !important;.. font-weight: bold;.. margin-top: 2px !important;.. margin-bottom: 2px !important;.. padding-left: 4px !important;.. pa

C:\Users\user\AppData\Local\Temp\SweetIM_Temp_Folder_4779843\chrome\sweetim-toolbar\skin\video.png

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	869
Entropy (8bit):	7.724749684662738
Encrypted:	false
SSDEEP:	12:6v/72uhawVsXDd8HrtpLae7I6TeRg7EGrhLADjCznC9c9qtpMaPhvGklVV5KSChX:6aZXAr+jQUg4GrhLUjCLC9lP4G5KS8X
MD5:	920D3D7C15F7AB6E00F2A8C3593CA86C
SHA1:	74147628E2FCF44B2AF427A67DBE6278E8784416
SHA-256:	8D53BA3EF30AA548B8B5870EBF264863AB28BFB28BA0338337EA81FB10E931D0
SHA-512:	6108CE806BA0210A00A8250EBA0A74AAF9934F000C1EEC6E4750068A46EF4447D275C0A89053933B4E3ACE6529F5425D7F0ABBD7F8C2DDE4961A5FA32E9C0F88
Malicious:	false
Preview:	.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<....IDATx.\.[h.y....L&i:.mRl.Z/m...A...ESJ.hY..\...(..(./.y.A.X.a....VE.JD[A7].....K.\L.e2.LlK=p........}.~._.[L_.g...X.....o..s.?.=v.Q......T..G.gU.D........?...:..U.w7.`.]]?#z.^....\|Q...$M...?dr.&....K.Y...Qq...h.d2e0...\|...@.C....:I.....K.B...bo_...X,.iL.UU....]{..f..w....pL.@......9....~..#.%.....J.1....'B..U..m.[3t6....4.w......OW.Z.....!..U.g.....L.S&S...`..\N6lX_..z..m.{..$Q....Du5./.........j....dY.{MH..+@(.....O0...2..ZDg..H.4...%..>.n..x<p.6.....".,t..$.......q....o.M2...._...g.-.'...pA.\...}(..G}.&.......'...Rk7i.r...._6...3.#....u...#..s5......%...#..E6.....J...'}....9c..~.E.(!..`.T!y..B.K>.X.%<(Q...W_.......2...).). ..l.....,.,.......i.--..HhL.Q.}..$...Rf.....Hb...Cnh..T..&.?.e..?v1Q....\|...Bk..........!.................IEND.B`.

C:\Users\user\AppData\Local\Temp\SweetIM_Temp_Folder_4779843\chrome\sweetim-toolbar\skin\web-search-button-bg-hover.png

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PNG image data, 10 x 26, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	976
Entropy (8bit):	2.7857896514822174
Encrypted:	false
SSDEEP:	6:6v/lhP0ul0+wP6fn7FmT/2NA39NF3wKuNR431pXp:6v/7RyP6n7FmqC9/3luNR61T
MD5:	B1E5876DB65289C13C4977F89810E8A3
SHA1:	1060397CE54CD3F14D37263D0BB87A502F18F300
SHA-256:	F238F4D203FC49E5F80F63F98937F0D599CEFC6C8DE8318F08592BCD88B21D18
SHA-512:	B0247636B355B68576AAE88179D3D5A8B8507203D714DC4284748C98C21F9082A0C04CD6B9333699ADE661BEE58EFB2F554FB9004D4876E2BF6659749E07B1B6
Malicious:	false
Preview:	.PNG........IHDR..............:=.....gAMA....7.......PLTE.........................."..'..'..(..(../..3..4..;..6..;..<..>..C..D..F..C..G..V..h..i..y.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................z0.....tEXtSoftware.Paint.NET v3.5.2..iC...VIDAT(SE....P.C.+.2.w.T...L.&\O..w..8..m.h.,n.....x....NT".7.).Q."]R.51.cd.$.y.,1../.$..........IEND.B`.

C:\Users\user\AppData\Local\Temp\SweetIM_Temp_Folder_4779843\chrome\sweetim-toolbar\skin\web-search-button-bg.png

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PNG image data, 10 x 26, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	981
Entropy (8bit):	2.888407959176497
Encrypted:	false
SSDEEP:	12:6v/7RIy6QksPeAbLJ7G9vcC37KT1ZlyT7NV:dyxAAHJgEO7KbwTRV
MD5:	496F02D84BDCBF2EEF447CA153D1896D
SHA1:	9500DF7258DD9112C24D54772D550E26739EC2A5
SHA-256:	04FD558E122BDD2E2D40AE2BCBB82FAE73F5C9BCB19DED56BDD6C1DD39355B8F
SHA-512:	AA49E9FB7B6255E2EDB72754EFB62C08CA486378824DCF349305B625B9B7731321D12FED396833467A7B5AE231BAF2B5BBF400F51C9D5D72B0DEC2497EE4BB95
Malicious:	false
Preview:	.PNG........IHDR..............:=.....gAMA....7.......PLTE..................................................'....+..;..<..3../..4..5..8..=..O..@..A..b..c..s..{...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................G.R....tEXtSoftware.Paint.NET v3.5.2..iC...[IDAT(SE...P...!)Iqr.T..%.......3...h.....(N..........7.....\|..Y.R.E..Y.....7..C4.1..^....v.....IEND.B`.

C:\Users\user\AppData\Local\Temp\SweetIM_Temp_Folder_4779843\chrome\sweetim-toolbar\skin\web-search-button-glass.png

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PNG image data, 18 x 19, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	808
Entropy (8bit):	7.5250979472444355
Encrypted:	false
SSDEEP:	12:6v/7fwb9aXjZ9t8epIzfIgZsZQc8PXbfTNKmJ6SXE8CBxkuDCfwwxxnXNWxUec:Db9azftTaIZQrbf4mJxXEJ4f3xnXL
MD5:	6863D0B8DD6CB1DAA8F024340EBEF2EC
SHA1:	153107E528C2531A48F3297171A94A6172F4B5D3
SHA-256:	AA79352FEDB4FC20672861188C1D241EFD5236937978EBA04878F6AF5732791F
SHA-512:	EBE4F11A56497EA51546EF581D84705298B0C54DDEF801B14CA754572545134C61C32D3A118A9BF45A68E09F0452D8D8F2F86BE32CB5CAC307B6042A791CA15E
Malicious:	false
Preview:	.PNG........IHDR...............].....gAMA.....Z.... cHRM..xZ..o=......z...H.......9....q@T......pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.2..iC...yIDAT8O..]HSq..W.}Bu.UT7.tSQA%EtQ.....1FY.uLd..v.:57ga.N(...}AP..Xu....B.......=..v".gI]t..=......>..(...2.KH..=8hv...~.Z........E....0;...u..;...q .D....H.......(.\.,...7..4..W....{..E?`..FU..R..;..a.;2..I`.[~.~rE."..s.B....Z#.9..9:.}.w........=.O....#W..0..HZ....`.3.v..Cb...S....}.ls.........g.K-..n....OY`.2..8...wG....Z.di.._..8.n..0./...q.=.5.GG.g...\h..;..............K_).~\.0@p.@..DK...(.....@06.[k4..4.d......0b'.@....?..;.6O4.x.i..z..R..)O....-8G3!...\|..ju..-._a+i.....S....}.gC".#....b..f....y:<j>7...g.......Y.^u=-.)Y_,;../.A..T(s.....Z.......hK5.G.BmF.3e.{.u.d.d...-.^"..!r.....\..VI...r.....Bh.+.....IEND.B`.

C:\Users\user\AppData\Local\Temp\SweetIM_Temp_Folder_4779843\chrome\sweetim-toolbar\skin\web-search.png

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3337
Entropy (8bit):	7.886640514351696
Encrypted:	false
SSDEEP:	96:bSDZ/I09Da01l+gmkyTt6Hk8nTt/4E/TS:bSDS0tKg9E05T/S
MD5:	3E2E639063054CCB59DB68C2A9243AFB
SHA1:	FD9461012CFA0ABD8333645E6A55B87DC5AC6537
SHA-256:	5D79D48F3FC4EEEF3A8C46FEF30DF602BE257730F841B99BECE79F7D9356D7E6
SHA-512:	730CF2834D48BDDA697E580064DAE1060D057A9F39D33C8A632D790F7E0B3097DD70421E31C09D33A914E763CB1C39E2C75554D8F6B4EB11B45A8962E8FBBA37
Malicious:	false
Preview:	.PNG........IHDR................a....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Users\user\AppData\Local\Temp\SweetIM_Temp_Folder_4779843\chrome\sweetim-toolbar\skin\yahoo.png

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	442
Entropy (8bit):	7.104637400753022
Encrypted:	false
SSDEEP:	12:6v/78f2s/6T6is1kJ4nnQmCOZBw4r9Ah/kmZscG2E3d:Z2s/6WR1KcnQcF9csmGF3d
MD5:	F64113435D357717C72EBF0E86B317E6
SHA1:	85CA037F08378619D4322A7F4EDBB5FC55AEFC5E
SHA-256:	A3DB26273631B16D9F68100C2C8B9096C899B320AE2C3EE787D31D6DBC0826E9
SHA-512:	F7B60E594EFFDD05E84C8583F205A32BFB87BB4CB084F0B49FDEAF5797B4128AA4B2D72A7FB1FB4FC112CAFF1958C1632E19ED658C564727656604746BECF616
Malicious:	false
Preview:	.PNG........IHDR................a....sRGB.........bKGD..............pHYs.................tIME.....;'.x.....:IDAT8..!k.@......P"B....S..G..(....eT.15..c.b?`..b.....U#...pb.....L.;r./.^u.}.......yx.Pde...UNA2..EH...7.S..dw.u.....n..G.`\|...."+....d5$.!.Jj...Qr.....J:Q@.....:=M..S.../.....>_>........r.+...s....\.f..(.d.X..mW...%5.\|.\.=.......?.y~.,.%5....%...Q..YY......c....-..N.6.6I.a...1J.\.\y.....Y...jH;.....J...v......IEND.B`.

C:\Users\user\AppData\Local\Temp\SweetIM_Temp_Folder_4779843\components\SIMAutoCompleteSearch.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	9648
Entropy (8bit):	4.9386302416157895
Encrypted:	false
SSDEEP:	192:BJYDxEranuKJKKgbK7dAKyK+i2vRJx7fhhg9pJt1dR0M5:BJegKkKgbK76KyKQJxlhq5
MD5:	C646B5F72E465DD579A4485EBD5518E5
SHA1:	0696375F062FCED5BBB07146D3B21B319B19E862
SHA-256:	9413FD6BF893C926EB6D6908E494A1BB710EA8A9CEA355011D5E3C4249D63F32
SHA-512:	6E1C68587441512974EE6B2654FB05D59D571343234B0EDC3069AD7A5E3D96DEB4751BB18881C799CEE9121D14BB98E95694AB81D849C7D86042F09023153CAB
Malicious:	false
Preview:	..// original file:..// "How to implement custom autocomplete search component"..// http://developer.mozilla.org/en/docs/How_to_implement_custom_autocomplete_search_component....// logs an exception..function logException(e)..{.. var message;.. message = "Exception:";.. .. if (e.name).. message += ", name=" + e.name;.. if (e.message).. message += ", message=" + e.message;.. if (e.number).. message += ", number=" + e.number;.. if (e.lineNumber).. message += ", lineNumber=" + e.lineNumber;.. if (e.stack).. message += ", stack=" + e.stack; .. .. if (!e.message).. message += ", full=" + e.toString();.. // dump(message);..}....// load external JS files...// the component is loaded in different namespace than browser..// (e.g. "gBrowser" is not defined here), so we _dont_ need to explictly load it in..// a dedicated namespace object, as done in main.js..var loader = null;..try{.. loader = Components.classes["@mozi

C:\Users\user\AppData\Local\Temp\SweetIM_Temp_Folder_4779843\install.rdf

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1630
Entropy (8bit):	5.50969037695185
Encrypted:	false
SSDEEP:	48:kYH7siLPNKP4p9LN4peoVAHd7wORaN008mZ863VA:bHfDQelSOMNH8Ue
MD5:	C2DD6535605B8AECA43BCBF777F96262
SHA1:	1A037398321F63475887809CD2E1A4A92036DC98
SHA-256:	C3541B4C8C083B134158D839BF5348204E02C48546FB88B4A9933506DE6B5DA3
SHA-512:	84A4B20FE3B354F33F0023F21BB264095F4CE16830D18A0FA24B967E9E974B9D57AA4135E97B6599053DFAB6CCAAB8681956FF2E590E9A9567FA5D3B8A22ECD8
Malicious:	false
Preview:	<?xml version="1.0"?>....<RDF xmlns="http://www.w3.org/1999/02/22-rdf-syntax-ns#".. xmlns:em="http://www.mozilla.org/2004/em-rdf#">.... <Description about="urn:mozilla:install-manifest">.... Required Items -->.. <em:id>{EEE6C361-6118-11DC-9C72-001320C79847}</em:id>.. <em:name>SweetIM Toolbar for Firefox</em:name>.. <em:version>1.3.0.1</em:version>..... Firefox -->.. <em:targetApplication>.. <Description>.. <em:id>{ec8030f7-c20a-464f-9b0e-13a3a9e97384}</em:id>.. <em:minVersion>2.0.0.0</em:minVersion>.. <em:maxVersion>7.0.*</em:maxVersion>.. </Description>.. </em:targetApplication>.... Optional Items -->.. <em:creator>SweetIM Technologies LTD.</em:creator>.. <em:description>all about fun</em:description>.. <em:iconURL>chrome://sweetim-toolbar/skin/logo_32x32.png</em:iconURL>.. <em:homepageURL>http://www.sweetim.com</em:homepa

C:\Users\user\AppData\Local\Temp\final.swf (copy)

Download File

Process:	C:\Users\user\Desktop\BundleSweetIMSetup.exe
File Type:	Macromedia Flash data (compressed), version 9
Category:	dropped
Size (bytes):	45328
Entropy (8bit):	7.993429163936794
Encrypted:	true
SSDEEP:	768:i8qetPOl0k7K21COqKuiH6AFyFR7OikC1kr0C3SW+c4eUahZ9mHg2:iGkjK21C/KdaAFyvOb063UaJmHN
MD5:	082CEE2F16A62D4642711F1EEA0BDF76
SHA1:	D82B1B952F378B9B022D7071C44B2433CA045AB3
SHA-256:	353BF8B47EB53F4D9733F0503A7E44B58BB9B7943AE7B9F8F0FBB2D71C95DF75
SHA-512:	A8856AFCE96DFE5C4EB1833504FF51F0007FD554DF53D6E79168634E7EB986AC9E449D348DEEF641F3AD0D5AA9532022389CE41068AC7A08D4375E5618D7A996
Malicious:	false
Preview:	CWS.....x..{.X]......Kp........www..Hp.;.........z.$..w.}.._.\|=.7=]l.U.V..vU..Vm..... ..@.....I....7..B.....0g..0..R+`,......`...E..3....'.p]..j'.'n9......P...~........!b2.........\b...v.....Z".:....i."...m..%O..#..j..H-x!.Do7...<....wg.$....@.I..lW].....D.y?W........5N...3......d.....!..$....I }X.Gtr.;.m....bF.h.d_....b..d..:-.\.=-L...N.D.^....D...6.E.<s.....s....g..Lq.e.l.....*..l..UDP..}...\|\..[%...7+....e.'.....`.K..FhN..tBW8ZK.aTD_.O\..(.tx...v....o#J..;>`.q.Sc..~.[.f.x....QQ..S...E9..g=..7..&..c.VV(>.s+.\|)?...3..Fq...S.S......,....O......7D..{^E..q".._iv..I...{@)-..i.....9m.w..>.}J...T.)...\|......`...........`.=..P.L'.W,.A..hq.{.X.cT.o.A.._.D[o...z.<.........J..YL.()....O..._9 ..j.....g.5..lq)W..=..\.T.I$.R...(`2.a......Gp.Q....1..e.....4......7R.~. .-d-..6.FR..b..D.^.....=6..7......N.)....M......c.A.m..wQ.3..m..a..=...D..TU^...%..^..x..,gh.=.......j.......u..}..M.Y..........q.>......<...".?......3.............g=..M.(>J].h....

C:\Users\user\AppData\Local\Temp\sqlite3.dll (copy)

Download File

Process:	C:\Users\user\Desktop\BundleSweetIMSetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	542036
Entropy (8bit):	6.56751373563397
Encrypted:	false
SSDEEP:	6144:Jaxeh07OAImJjRrJQ6XEaEubw1BhkqKLc7GM4StJ1mGB5tnmZS9rXOYqgi3nm4BL:JyJ1ua1bw1gqKLc6etJ1m0pXLqJ7V/T
MD5:	B637C198FA977E3FB44BE8B6563FA57D
SHA1:	07FE04B3990EF759551AC4FE5996EA1C7B9B122F
SHA-256:	91F1216D6CD6A0355A6D3B314366993FA531A285D91A6C1E14BF8505B0C7FA1A
SHA-512:	5CFF6DC1BC3FE3FC376A8028339C130F8317D6DA12962F57612925A95E7E4C0BB10022F3FE68DDC63BD5D8BC6A88D5A2B6763746144F23FC09D78FA9A2181CF3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....rL........... ...8.r.........................`.........................P................ ..................................................................!...................................................................................text....q.......r..................`..`.data...X............v..............@....bss.....................................edata..............................@....idata..............................@....reloc...!......."..................@....stab...l..............................B.stabstra....0.........................B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B}\0x0409.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\SweetIMSetup.exe
File Type:	Generic INItialization configuration [Languages]
Category:	dropped
Size (bytes):	6187
Entropy (8bit):	4.969637598735067
Encrypted:	false
SSDEEP:	96:VXoB2A2ul8/T3INLfRtMx76U0KOFWgVQMG2Uub0QAg80SbtEBapIx0KsLK3E0bT3:J0YT3wLfRA0v/tBAvCSEB90K
MD5:	26A9B54F250E00693773481B837E03CC
SHA1:	554A407BF23984026785430E3BBDFFDD1285BE06
SHA-256:	2A5EB805543B141D77CE7192C5F7E4E10FFB56DE0A5A66905C79298DFC5FFBD5
SHA-512:	A9F141F96F7BB498C4326CAB2E846CE0715830EC86B04A311CCB0C7F3EB6ADCC62EC1412CBD8D230B957CD923AB3A81AF34B40294297773395D53D8AA73F9073
Malicious:	false
Preview:	..[0x0409]..TITLE=Choose Setup Language..DESCRIPTION=Select the language for this installation from the choices below...REBOOTMESSAGE=The installer must restart your system to complete configuring the Windows Installer service. Click Yes to restart now or No if you plan to restart later...ONUPGRADE=This setup will perform an upgrade of '%s'. Do you want to continue?..LATERVERSIONINSTALLED=A later version of '%s' is already installed on this machine. The setup cannot continue...OK=OK..Cancel=Cancel..Password=Password:..Install=Install..1100=Setup Initialization Error..1101=%s..1102=%s Setup is preparing the %s, which will guide you through the program setup process. Please wait...1103=Checking Operating System Version..1104=Checking Windows(R) Installer Version..1105=Configuring Windows Installer..1106=Configuring %s..1107=Setup has completed configuring the Windows Installer on your system. The system needs to be restarted in order to continue with the installation. Please click Rest

C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B}\Setup.INI

Download File

Process:	C:\Users\user\AppData\Local\Temp\SweetIMSetup.exe
File Type:	Generic INItialization configuration [Startup]
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	5.4199870652330056
Encrypted:	false
SSDEEP:	48:HP3Y5z3vy0g9UWhXvCm6mJGCN6FTaRUTc2X4s:HPY1/tg9xhXvCm6wGCZUTcXs
MD5:	A33DA307C449C168CE22135BD2BDEF53
SHA1:	1B42519C3205908D8EE4E4B0750B21BD99AE57B8
SHA-256:	3E4C42F56E784FDEE149B21D3ABDF1A58704E1B1DBBF2D87B5060F700D91BF91
SHA-512:	73447F047865D2B8E31E0EAA2630F49B2182BE79A3B79A608DC1CE2A07E8324F722D92CF265CB530AF744A9632C8F04076DE6E83C357D6F342AB6752BDAD273E
Malicious:	false
Preview:	[Info]..Name=INTL..Version=1.00.000..DiskSpace=8000.;DiskSpace requirement in KB....[Startup]..CmdLine=/qn..SuppressWrongOS=N..ScriptDriven=0..ScriptVer=1.0.0.1..DotNetOptionalInstallIfSilent=N..OnUpgrade=0..RequireExactLangMatch=0404,0804..Product=SweetIM for Messenger 3.6..PackageName=SweetIMSetup.msi..EnableLangDlg=N..LogResults=N..UI=1000..DoMaintenance=N..ProductCode={A81A974F-8A22-43E6-9243-5198FF758DA1}..ProductVersion=3.6.0002..LauncherName=SweetIMSetup.exe..PackageCode={88655337-61D8-45FF-9B01-BB29C2AAFDE6}....[MsiVersion]..2.0.2600.0=SupportOS....[SupportOSMsi11] ;Supported platforms for MSI 1.1..Win95=1..Win98=1..WinNT4SP3=1....[SupportOSMsi12] ;Supported platforms for MSI 1.2..Win95=1..Win98=1..WinME=1..WinNT4SP3=1....[SupportOS] ;Supported platforms for MSI 2.0..Win95=1..Win98=1..WinME=1..WinNT4SP6=1..Win2K=1....[SupportOSMsi30] ;Supported platforms for MSI 3.0..Win2KSP3=1..WinXP=1..Win2003Server=1....[Win95]..MajorVer=4..MinorVer=0..MinorVerMax=1..BuildNo=950..PlatformId=

C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B}\SweetIMSetup.msi

Download File

Process:	C:\Users\user\AppData\Local\Temp\SweetIMSetup.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, MSI Installer, Number of Characters: 0, Last Saved By: InstallShield, Number of Words: 0, Title: Installation Database, Comments: This installer database contains the logic and data required to install SweetIM, Keywords: Installer,MSI,Database, SweetIM, MSN Messenger, Yahoo Messenger, ICQ, Subject: SweetIM for Messenger 3.6, Author: SweetIM Technologies Ltd., Security: 1, Number of Pages: 200, Name of Creating Application: InstallShield 2008 - Professional Edition 14, Last Saved Time/Date: Mon Aug 1 15:43:36 2011, Create Time/Date: Mon Aug 1 15:43:36 2011, Last Printed: Mon Aug 1 15:43:36 2011, Revision Number: {88655337-61D8-45FF-9B01-BB29C2AAFDE6}, Code page: 1252, Template: Intel;1033
Category:	dropped
Size (bytes):	3552768
Entropy (8bit):	7.4010672025598465
Encrypted:	false
SSDEEP:	98304:FYyGQnzszN2qXKdtDCSWBXM0BXEhUQM5V3kS8HqSd:SQnzszN2qUONXjAUQMXkZK
MD5:	54D2F6EC72B0A9F8F85E07137F6D098A
SHA1:	5AC5FD5824446DFB7D7FDAE0ED1729D821B1DB73
SHA-256:	A03C61372030D38A2046666E840F25E460F6E3F25DE6583EC4E2FDB28227F484
SHA-512:	F838BEBBC3FDA7EBF93264208B0A89D69B58090509A912DE0F31EBB9E9250678B152FA0616D61B797C20AE582EACD9A8AAFD5BAE4BD0DC6AF54ECC69D46AB3AA
Malicious:	false
Preview:	......................>...................7...............8...........................}...............................................................................................................................................................................................................................................................................................................................................................................................................................................<...............................................................................................................!... ...'..."...#...$...%...&...)...(...5...*.......,...-......./...0...1...2...3...4...G...6...7...>...I...:...;...=...........?...@...A...B...C...D...E...F...J...H...T.......K...L...M...N...O...P...Q...R...S...V...U...b...W...X...Y...Z...[...\...]...^..._...`...a...d...c.......e...f...g...h...i...j...k...l...m...n...o...p...u...r...s...t.......v...w...x...y...z...

C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B}\_ISMSIDEL.INI

Download File

Process:	C:\Users\user\AppData\Local\Temp\SweetIMSetup.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	11
Entropy (8bit):	3.0957952550009344
Encrypted:	false
SSDEEP:	3:Pivn:Kvn
MD5:	3FDD2635AA94921522AF8186F3C3D736
SHA1:	0FE63553E9F993C0CB2CB36B8CDCFBA4F4A2650D
SHA-256:	17AD78845C9C6A8E97A5BD14BE56700A51EE85867C979ED6CF538E1FED82CF7C
SHA-512:	EBDBEEFBDC777937FCE516A1CBD9AF7C305FC242091D695AD919A27C98FAC5B6B16B44130BDF97DBFD10561CCE701180B1FBB303D848944C3B33B8A3C058653A
Malicious:	false
Preview:	[Files]....

C:\Users\user\AppData\Local\Temp\{A7BC02AF-1128-4A31-BCF8-1A3EE803D3B3}\SweetIMToolbar.xpi

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	161276
Entropy (8bit):	7.920344044176985
Encrypted:	false
SSDEEP:	3072:KGhdZ7DFhE9hqry2Dhm/pmAKWeCPGpTYdJD36nol:zdDb6kwxDnPGpUdrl
MD5:	C6B21C46B2EBA0297A43ECD9E8E737DE
SHA1:	B2157B4134B6779854D27E9B6E5022BF801E3842
SHA-256:	75F9D007B627208EFAFFC926763C790E94B7FEEC46CAC7FFC676265A83316899
SHA-512:	754B33A9A57DD98369EF4FAB3EFF2E29E231D885CD06C6412E1B5910196FFEDC4493117088C1D8984E6983090BFD68DE2CF60D7AD9D40EC0BBFF940F33BD5310
Malicious:	false
Preview:	PK..........6?....[...W5......META-INF/zigbert.sf...........6,...A...BLb.1n.......YY..k....M..>....~0......?..........jc.............?_..!...U.e\.....H...qQ>d..A_........o..b~.(~.u..>....Y.w.'Y.u.........ap.....?...G.;Qt5.C.zV.q.c........_....f;..Y..\....Ib!...o._......c.......".[0.....@?.........6.Nx..=r.U...c(.M.N.%D.HV.A.....Z6-.6)...].._..>@....S,G...r..h..+.7.,.}dA.6..Z..$.(.A...dU.Ui.m...t.f..y.7.}.RI..m9..;..4it$...U".t\...\K.............A.:.X...IN.e...F....\|......4..Q...l..WQ.....tG....\'QN.c...I.a.1T...od.tx.....~N.t...z.....1+.....J7L..\|.M...A...{...8.......$4\|.....v.fi&..P5...U?.....'x....I._$......O.L..8....[.1......5K..c...w...P.Rf5LpqT..4...C.:..].w..L...p.<..]0}..U.1:..#..qa874I...1j'.V..........'.W..a.M..-.....Yi'?sW.E.<...e\..1.x,&.Y.h..2...Y...u...._b..ET..KR..u.A...v..9_..F\|...wIV.{.\Jd^..7...S..G.XU[..Rk...\5........H.`sNI.b..h.....\|K.SP.R*w.)S.....J8!....j"9>x[#T...p.w...u.....x.tw..6L...(....(n..f...4..V?..K@.s.

C:\Users\user\AppData\Local\Temp\{A7BC02AF-1128-4A31-BCF8-1A3EE803D3B3}\mgSqlite3.dll

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	393016
Entropy (8bit):	6.826407049982154
Encrypted:	false
SSDEEP:	6144:DRU2DRRGOQ0ebQfMLkunuhoZ3Uq922DcNUzhqlxm+OCS6Cguh4s10px6fu0xQgg9:m2DRRGf0eUfMQoZZhZmxm+OGLu+s6pYm
MD5:	8A4AF3B0695F29186AD02E2FD766FA3B
SHA1:	C8F1E3F28152C6C010B7AE8FA4D167E3C388FF0C
SHA-256:	346F692DB61B1355DF431F58F0A9C4C6ED7BDF0C9AD3E2CAD42E0B3920EA44C6
SHA-512:	3C94CD08C21BCCFE66AA7C813C86F8A11672C0472DABFD12B699BB01B55741903CA73C8385F531DD2733EC70CAEE0AF3040C6B84F09F5B5E981BA12026CBB4CD
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 21%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......).Gom\|)<m\|)<m\|)<d..<w\|)<J.R<n\|)<m\|(<.\|)<d..<I\|)<d..<.\|)<d..<l\|)<s..<l\|)<d..<l\|)<Richm\|)<........PE..L...YK.L...........!.................2.......................................0...............................................{..(.......................8........!...................................v..@............................................text............................... ..`.rdata..............................@..@.data....H.......*..................@....rsrc...............................@..@.reloc...,..........................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{A7BC02AF-1128-4A31-BCF8-1A3EE803D3B3}\sweetim.xml

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with very long lines (3547), with CRLF line terminators
Category:	dropped
Size (bytes):	3915
Entropy (8bit):	4.5039484079313326
Encrypted:	false
SSDEEP:	96:65Vc7FggKebtnL/6q0P7ETojlQXdMdnL2DD:6nc7VKStnT6DxhSDD
MD5:	EF691DD0310399372EAD6FACEEDBE1BB
SHA1:	4F1FA12B9751F78D8B3BF648AEB72C8AC2AB069D
SHA-256:	75E16E17C0299FD6BA42BB0BA8C8AA465634D6395C8DBAEC6E97066468C22AC1
SHA-512:	370EB8D795AB0B676D45602D8750193D795CF455C5492062B6475579EC52BA817A4138A51829EDF028E52DAA216B63B93A7FEDABB552907E0BA0C8A15AFD2A4E
Malicious:	false
Preview:	<SearchPlugin xmlns="http://www.mozilla.org/2006/browser/search/">...<ShortName>SweetIM Search</ShortName>...<Description>Use SweetIM to search the Web.</Description>...<InputEncoding>UTF-8</InputEncoding>.. <Image width="16" height="16">data:image/x-icon;base64,AAABAAMAEBAAAAEAGABoAwAANgAAABAQAAABAAgAaAUAAJ4DAAAQEBAAAQAEACgBAAAGCQAAKAAAABAAAAAgAAAAAQAYAAAAAABAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAG5ubkZGRjY2Njs7O1dXV4aGhgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAH19fSAgIAAKQQATegAUhQAUiwAQawYKHE5OTgAAAAAAAAAAAAAAAAAAAAAAAHt7ewoMHgAbtQAWmAAHLwADFQAGKAAVjgAj6AAQajs7OwAAAAAAAAAAAAAAAJOTkxoaHwAcvQARcAAFHQAVkQAezgAcvgARbgAOXgAi5gAOW2BgYAAAAAAAAAAAAF5eXgAJPAAi6wAUiQAj8AAm/wAl+gAl/AAm/wAg3QAh4AAdwxgYGZWVlQAAAAAAAC4uLgAKQQAm/wAm/wAk9gAk9AAk9AAk9AAk9AAk9wAm/wAdyAAAAnd3dwAAAAAAAB4eHgACDQAf0wAm/wAk8wAk9gAl+QAk9wAk9AAk9QAn/wASdQAAAGdnZwAAAI2NjRMTEwAAAAAHLgAg2AAo/wAh4AEYpgAe0AAn/wAm/wAVjwABBAAAAxcXG3d3dyYnLAAdwwAWkwAAAAAVjgARcgAZqw

C:\Users\user\AppData\Local\Temp\{A81A974F-8A22-43E6-9243-5198FF758DA1}\VistaCookiesCollector.exe

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	65840
Entropy (8bit):	6.591447120361006
Encrypted:	false
SSDEEP:	1536:ZMBHI7P9tsUuT4lPpdJEy+e9/7AzMEyl55tgoxEo4N:ZMBHILjsXUl6yfEylvt7M
MD5:	8E11C6FCF30B1DC4C7069144B80C2709
SHA1:	796237843D9E6D1BFFA63A3DECE935746F66829A
SHA-256:	540F67373141A90AEA561B17C053B3491AC381CD8897CAE24C3C9B3D876E1E45
SHA-512:	50B73492668ABFF39A00DA3C8A3876C5FC1C9889CFE7571D833651713F773AF8610681273CAB0991660CA02695F2F2ECD8C7D33AE2DA2D375B898252062F6446
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 18%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........IX.D.X.D.X.D..K.O.D.....D.K...Z.D....].D.X.E...D..$.J.D.....Y.D....Y.D.RichX.D.........................PE..L.....6N.....................R.......6............@..........................0......\i......................................4...<.... ..................0!..............................................@............................................text............................... ..`.rdata..t ......."..................@..@.data....'..........................@....rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{A81A974F-8A22-43E6-9243-5198FF758DA1}\mgSqlite3.dll

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	393016
Entropy (8bit):	6.826407049982154
Encrypted:	false
SSDEEP:	6144:DRU2DRRGOQ0ebQfMLkunuhoZ3Uq922DcNUzhqlxm+OCS6Cguh4s10px6fu0xQgg9:m2DRRGf0eUfMQoZZhZmxm+OGLu+s6pYm
MD5:	8A4AF3B0695F29186AD02E2FD766FA3B
SHA1:	C8F1E3F28152C6C010B7AE8FA4D167E3C388FF0C
SHA-256:	346F692DB61B1355DF431F58F0A9C4C6ED7BDF0C9AD3E2CAD42E0B3920EA44C6
SHA-512:	3C94CD08C21BCCFE66AA7C813C86F8A11672C0472DABFD12B699BB01B55741903CA73C8385F531DD2733EC70CAEE0AF3040C6B84F09F5B5E981BA12026CBB4CD
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 21%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......).Gom\|)<m\|)<m\|)<d..<w\|)<J.R<n\|)<m\|(<.\|)<d..<I\|)<d..<.\|)<d..<l\|)<s..<l\|)<d..<l\|)<Richm\|)<........PE..L...YK.L...........!.................2.......................................0...............................................{..(.......................8........!...................................v..@............................................text............................... ..`.rdata..............................@..@.data....H.......*..................@....rsrc...............................@..@.reloc...,..........................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{B3CA5B4C-F637-458C-81D6-CD8DADBE9841}\0x0409.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\SweetIESetup.exe
File Type:	Generic INItialization configuration [Languages]
Category:	dropped
Size (bytes):	6187
Entropy (8bit):	4.969637598735067
Encrypted:	false
SSDEEP:	96:VXoB2A2ul8/T3INLfRtMx76U0KOFWgVQMG2Uub0QAg80SbtEBapIx0KsLK3E0bT3:J0YT3wLfRA0v/tBAvCSEB90K
MD5:	26A9B54F250E00693773481B837E03CC
SHA1:	554A407BF23984026785430E3BBDFFDD1285BE06
SHA-256:	2A5EB805543B141D77CE7192C5F7E4E10FFB56DE0A5A66905C79298DFC5FFBD5
SHA-512:	A9F141F96F7BB498C4326CAB2E846CE0715830EC86B04A311CCB0C7F3EB6ADCC62EC1412CBD8D230B957CD923AB3A81AF34B40294297773395D53D8AA73F9073
Malicious:	false
Preview:	..[0x0409]..TITLE=Choose Setup Language..DESCRIPTION=Select the language for this installation from the choices below...REBOOTMESSAGE=The installer must restart your system to complete configuring the Windows Installer service. Click Yes to restart now or No if you plan to restart later...ONUPGRADE=This setup will perform an upgrade of '%s'. Do you want to continue?..LATERVERSIONINSTALLED=A later version of '%s' is already installed on this machine. The setup cannot continue...OK=OK..Cancel=Cancel..Password=Password:..Install=Install..1100=Setup Initialization Error..1101=%s..1102=%s Setup is preparing the %s, which will guide you through the program setup process. Please wait...1103=Checking Operating System Version..1104=Checking Windows(R) Installer Version..1105=Configuring Windows Installer..1106=Configuring %s..1107=Setup has completed configuring the Windows Installer on your system. The system needs to be restarted in order to continue with the installation. Please click Rest

C:\Users\user\AppData\Local\Temp\{B3CA5B4C-F637-458C-81D6-CD8DADBE9841}\Setup.INI

Download File

Process:	C:\Users\user\AppData\Local\Temp\SweetIESetup.exe
File Type:	Generic INItialization configuration [Startup]
Category:	dropped
Size (bytes):	2696
Entropy (8bit):	5.408867080976921
Encrypted:	false
SSDEEP:	48:HP3i5z+zoUOVUWhXvCm6mJGCN6FTaRUTc2Xw0:HPi1+zoUOVxhXvCm6wGCZUTcP0
MD5:	B01A2E1F9F46A840E2853D9EC3D8DA8E
SHA1:	55A7B7D8073D215B50D2FF33E9FEA477BF779E2F
SHA-256:	4AE9D1253C31835D75A634EDB70F49B590CE8C3362AFE5392AF71CFA116D9734
SHA-512:	E96A1EB67F4A32CFF2BDC7A96C1FA6277C9FD6A334E3B60D92FD74D2D65BD34BB824688300D447576DC570EE26E17CC3CAA7F7AF8710CB145AEC71C668AA9C34
Malicious:	false
Preview:	[Info]..Name=INTL..Version=1.00.000..DiskSpace=8000.;DiskSpace requirement in KB....[Startup]..CmdLine=..SuppressWrongOS=N..ScriptDriven=0..ScriptVer=1.0.0.1..DotNetOptionalInstallIfSilent=N..OnUpgrade=0..RequireExactLangMatch=0404,0804..Product=SweetIM Toolbar for Internet Explorer 4.2..PackageName=SweetIESetup.msi..EnableLangDlg=N..LogResults=N..UI=1000..DoMaintenance=N..ProductCode={A7BC02AF-1128-4A31-BCF8-1A3EE803D3B3}..ProductVersion=4.2.0004..LauncherName=SweetIESetup.exe..PackageCode={F44840C4-6708-42BA-807E-138D61C83EB9}....[MsiVersion]..2.0.2600.0=SupportOS....[SupportOSMsi11] ;Supported platforms for MSI 1.1..Win95=1..Win98=1..WinNT4SP3=1....[SupportOSMsi12] ;Supported platforms for MSI 1.2..Win95=1..Win98=1..WinME=1..WinNT4SP3=1....[SupportOS] ;Supported platforms for MSI 2.0..Win95=1..Win98=1..WinME=1..WinNT4SP6=1..Win2K=1....[SupportOSMsi30] ;Supported platforms for MSI 3.0..Win2KSP3=1..WinXP=1..Win2003Server=1....[Win95]..MajorVer=4..MinorVer=0..MinorVerMax=1..BuildNo=950

C:\Users\user\AppData\Local\Temp\{B3CA5B4C-F637-458C-81D6-CD8DADBE9841}\SweetIESetup.msi

Download File

Process:	C:\Users\user\AppData\Local\Temp\SweetIESetup.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, MSI Installer, Number of Characters: 0, Last Saved By: InstallShield, Number of Words: 0, Title: Installation Database, Comments: This installer database contains the logic and data required to install SweetIM Toolbar For Internet Explorer, Keywords: Installer,MSI,Database, SweetIM, MSN Messenger, Yahoo Messenger, AIM, SweetIE, SweetIM Toolbar For Internet Explorer, SweetIM Toolbar, SweetIM Toolbar For FireFox, Subject: SweetIM Toolbar for Internet Explorer 4.0, Author: SweetIM Technologies Ltd., Security: 1, Number of Pages: 200, Name of Creating Application: InstallShield 2008 - Professional Edition 14, Last Saved Time/Date: Thu Sep 22 19:26:45 2011, Create Time/Date: Thu Sep 22 19:26:45 2011, Last Printed: Thu Sep 22 19:26:45 2011, Revision Number: {F44840C4-6708-42BA-807E-138D61C83EB9}, Code page: 1252, Template: Intel;1033
Category:	dropped
Size (bytes):	3027968
Entropy (8bit):	7.344776703975813
Encrypted:	false
SSDEEP:	49152:AWRYyZU3zs91c3fvDas3AgA7Rru1ZQxsxUx4x9rsyPJtAPAGuvwDju00/W6d:dYyZ4oVaAQ1yyUax9rsyPnAbcwPu00/B
MD5:	0FD2EF6954C43CE4D2C1E93825355AFB
SHA1:	981D1C9A6F54053EE736688F562D1C859D9EEE66
SHA-256:	2905553661E5BC69797337318D0DD0A7173A5191C6A7968FB89AB9F0F668D269
SHA-512:	B883393FDF11F4D4370C4E16B7FCC0ED557C5094420E47CFA1D0B3E2FEA0D7CE6B83953FC1197DA306318C807724C1F4A27B93231D53DDBE299607311FE35D7B
Malicious:	false
Preview:	......................>.................../...............8...................................................}.......................................................................................................................................................................................................................................................................................................................................................................................................................<.......................................................................................................#........... ...!..."...%...$.../...&.......(...)...*...+...,...-.......1...0...3...2...M...4...5...6...7...B...I...:...;...=.......>.......@...A.......C...D...E...F...W...H...J.......K...L.......V...O...P...Q...R...S...T...U...G...a...X...Y...Z...[...\...]...^..._...`...c...b.......d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\AppData\Local\Temp\{B3CA5B4C-F637-458C-81D6-CD8DADBE9841}\_ISMSIDEL.INI

Download File

Process:	C:\Users\user\AppData\Local\Temp\SweetIESetup.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	11
Entropy (8bit):	3.0957952550009344
Encrypted:	false
SSDEEP:	3:Pivn:Kvn
MD5:	3FDD2635AA94921522AF8186F3C3D736
SHA1:	0FE63553E9F993C0CB2CB36B8CDCFBA4F4A2650D
SHA-256:	17AD78845C9C6A8E97A5BD14BE56700A51EE85867C979ED6CF538E1FED82CF7C
SHA-512:	EBDBEEFBDC777937FCE516A1CBD9AF7C305FC242091D695AD919A27C98FAC5B6B16B44130BDF97DBFD10561CCE701180B1FBB303D848944C3B33B8A3C058653A
Malicious:	false
Preview:	[Files]....

C:\Users\user\AppData\Local\Temp\~C073.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\SweetIMSetup.exe
File Type:	Generic INItialization configuration [Startup]
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	5.4199870652330056
Encrypted:	false
SSDEEP:	48:HP3Y5z3vy0g9UWhXvCm6mJGCN6FTaRUTc2X4s:HPY1/tg9xhXvCm6wGCZUTcXs
MD5:	A33DA307C449C168CE22135BD2BDEF53
SHA1:	1B42519C3205908D8EE4E4B0750B21BD99AE57B8
SHA-256:	3E4C42F56E784FDEE149B21D3ABDF1A58704E1B1DBBF2D87B5060F700D91BF91
SHA-512:	73447F047865D2B8E31E0EAA2630F49B2182BE79A3B79A608DC1CE2A07E8324F722D92CF265CB530AF744A9632C8F04076DE6E83C357D6F342AB6752BDAD273E
Malicious:	false
Preview:	[Info]..Name=INTL..Version=1.00.000..DiskSpace=8000.;DiskSpace requirement in KB....[Startup]..CmdLine=/qn..SuppressWrongOS=N..ScriptDriven=0..ScriptVer=1.0.0.1..DotNetOptionalInstallIfSilent=N..OnUpgrade=0..RequireExactLangMatch=0404,0804..Product=SweetIM for Messenger 3.6..PackageName=SweetIMSetup.msi..EnableLangDlg=N..LogResults=N..UI=1000..DoMaintenance=N..ProductCode={A81A974F-8A22-43E6-9243-5198FF758DA1}..ProductVersion=3.6.0002..LauncherName=SweetIMSetup.exe..PackageCode={88655337-61D8-45FF-9B01-BB29C2AAFDE6}....[MsiVersion]..2.0.2600.0=SupportOS....[SupportOSMsi11] ;Supported platforms for MSI 1.1..Win95=1..Win98=1..WinNT4SP3=1....[SupportOSMsi12] ;Supported platforms for MSI 1.2..Win95=1..Win98=1..WinME=1..WinNT4SP3=1....[SupportOS] ;Supported platforms for MSI 2.0..Win95=1..Win98=1..WinME=1..WinNT4SP6=1..Win2K=1....[SupportOSMsi30] ;Supported platforms for MSI 3.0..Win2KSP3=1..WinXP=1..Win2003Server=1....[Win95]..MajorVer=4..MinorVer=0..MinorVerMax=1..BuildNo=950..PlatformId=

C:\Users\user\AppData\Local\Temp\~E783.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\SweetIESetup.exe
File Type:	Generic INItialization configuration [Startup]
Category:	dropped
Size (bytes):	2696
Entropy (8bit):	5.408867080976921
Encrypted:	false
SSDEEP:	48:HP3i5z+zoUOVUWhXvCm6mJGCN6FTaRUTc2Xw0:HPi1+zoUOVxhXvCm6wGCZUTcP0
MD5:	B01A2E1F9F46A840E2853D9EC3D8DA8E
SHA1:	55A7B7D8073D215B50D2FF33E9FEA477BF779E2F
SHA-256:	4AE9D1253C31835D75A634EDB70F49B590CE8C3362AFE5392AF71CFA116D9734
SHA-512:	E96A1EB67F4A32CFF2BDC7A96C1FA6277C9FD6A334E3B60D92FD74D2D65BD34BB824688300D447576DC570EE26E17CC3CAA7F7AF8710CB145AEC71C668AA9C34
Malicious:	false
Preview:	[Info]..Name=INTL..Version=1.00.000..DiskSpace=8000.;DiskSpace requirement in KB....[Startup]..CmdLine=..SuppressWrongOS=N..ScriptDriven=0..ScriptVer=1.0.0.1..DotNetOptionalInstallIfSilent=N..OnUpgrade=0..RequireExactLangMatch=0404,0804..Product=SweetIM Toolbar for Internet Explorer 4.2..PackageName=SweetIESetup.msi..EnableLangDlg=N..LogResults=N..UI=1000..DoMaintenance=N..ProductCode={A7BC02AF-1128-4A31-BCF8-1A3EE803D3B3}..ProductVersion=4.2.0004..LauncherName=SweetIESetup.exe..PackageCode={F44840C4-6708-42BA-807E-138D61C83EB9}....[MsiVersion]..2.0.2600.0=SupportOS....[SupportOSMsi11] ;Supported platforms for MSI 1.1..Win95=1..Win98=1..WinNT4SP3=1....[SupportOSMsi12] ;Supported platforms for MSI 1.2..Win95=1..Win98=1..WinME=1..WinNT4SP3=1....[SupportOS] ;Supported platforms for MSI 2.0..Win95=1..Win98=1..WinME=1..WinNT4SP6=1..Win2K=1....[SupportOSMsi30] ;Supported platforms for MSI 3.0..Win2KSP3=1..WinXP=1..Win2003Server=1....[Win95]..MajorVer=4..MinorVer=0..MinorVerMax=1..BuildNo=950

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\META-INF\manifest.mf

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	13547
Entropy (8bit):	5.600589013116383
Encrypted:	false
SSDEEP:	192:9ycDu2ADT0g95uCs/GJVzbix/urF8g1YDLbax6kTTLSh:93C2A30g95js/GJFk2N1YDLb+l+
MD5:	810FA593D44397BD13FEB001B684EAE2
SHA1:	8223EFAA0D30A289A20B864CA1FC622852AB8201
SHA-256:	35A08311303FA255B0A9793F438C1229FF9DF946E759D52646093727007DD82E
SHA-512:	42008E31A4370D4A94B3F6FA0CF985341EE9E12D850AD06EC7379B6A71814F094F76075894A486756A3BC0B21F4FD54B6710813CE0A8ABC2612CF2B0685107BE
Malicious:	false
Preview:	Manifest-Version: 1.0.Created-By: Signtool (signtool 1.3).Comments: PLEASE DO NOT EDIT THIS FILE. YOU WILL BREAK IT...Name: chrome/sweetim-toolbar/content/addonlistener.js.Digest-Algorithms: MD5 SHA1.MD5-Digest: CNsMWcvyVJA/R2OJD6jx7A==.SHA1-Digest: CQFIbsAHoE930lqhuKYzr0G75EY=..Name: chrome/sweetim-toolbar/content/addonmanager.js.Digest-Algorithms: MD5 SHA1.MD5-Digest: cM97qpn/6M3P29jecDGsCQ==.SHA1-Digest: HGRfWAVRf6I1fjqtqjZlUY7bcvs=..Name: chrome/sweetim-toolbar/content/bindings.xml.Digest-Algorithms: MD5 SHA1.MD5-Digest: IzUsJtYOU3KF6RykwlY6lA==.SHA1-Digest: XjsqnQzlqCFErToou6kmfniWJFE=..Name: chrome/sweetim-toolbar/content/chevron.js.Digest-Algorithms: MD5 SHA1.MD5-Digest: ZK/MV+wuXVbLbSGv6ayLog==.SHA1-Digest: 0HFQT6/U9YtyFnqydQ3XPVRX/bM=..Name: chrome/sweetim-toolbar/content/commands.js.Digest-Algorithms: MD5 SHA1.MD5-Digest: ZX2m/MJXYRHfOXcj/QPKWQ==.SHA1-Digest: 7MjtzoexiMvSnp6aGpMF/6HcHGQ=..Name: chrome/sweetim-toolbar/content/config.js.Digest-Algorithms: MD5 SHA1.MD5-Digest: p

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\META-INF\zigbert.sf

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	13655
Entropy (8bit):	5.6040651112820905
Encrypted:	false
SSDEEP:	96:WkA5g0iCoVcI/jdhBJNmDm+lP/eBSjSesuBVyOK6+ZEb5Mw7T4+sKr8tTciJcoC9:P37LBJNmDfB/eBSjnsLKwzF8J2M1
MD5:	59EC97C3D819001C0A897B38A7624473
SHA1:	D535037A3EC3601C7307EADFCD0AFE52747FB830
SHA-256:	13D9271BA7EBBE28508A4EBFCD6775BC1DD3459C5A9D4D8C1CF7F79E7323DDA8
SHA-512:	21A80FDA8D9F3B8EF957F94B7F4F429CD8D37637490DFB3D1C4E941D3F9DE59835162D7DE7C992C1B57B3AB0064655AA19E44AA93D30C3308413D87BBD03E1BA
Malicious:	false
Preview:	Signature-Version: 1.0.Created-By: Signtool (signtool 1.3).Comments: PLEASE DO NOT EDIT THIS FILE. YOU WILL BREAK IT..Digest-Algorithms: MD5 SHA1.MD5-Digest: f2XP9lsoHe04PBOvuFXL5g==.SHA1-Digest: 8RHZ0uUrxScBNJtHgI/t7stA9yA=..Name: chrome/sweetim-toolbar/content/addonlistener.js.Digest-Algorithms: MD5 SHA1.MD5-Digest: w8i3Rt3DxPL6b05cKNpsPw==.SHA1-Digest: 3odNPduNL9VoljP4mprIcpgF4zc=..Name: chrome/sweetim-toolbar/content/addonmanager.js.Digest-Algorithms: MD5 SHA1.MD5-Digest: 2YvLgsIg6k332XHkG6KEFA==.SHA1-Digest: ZvTVKYjibgcpdMsLQbe+A93OY1M=..Name: chrome/sweetim-toolbar/content/bindings.xml.Digest-Algorithms: MD5 SHA1.MD5-Digest: 1pyJGkn2pnE1+gMPhWrmww==.SHA1-Digest: 1uXwwQEdM+fCinL2psHcZId2oMc=..Name: chrome/sweetim-toolbar/content/chevron.js.Digest-Algorithms: MD5 SHA1.MD5-Digest: lOla/YC5L6pzcewNgLywJw==.SHA1-Digest: vPI+B5kuDtUVY4PRGNE0z84Fnl0=..Name: chrome/sweetim-toolbar/content/commands.js.Digest-Algorithms: MD5 SHA1.MD5-Digest: AK1Es9lxyQoNYOJwLNf3SA==.SHA1-Digest: RUAGcms4e0

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome.manifest

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.884991274360526
Encrypted:	false
SSDEEP:	12:4yp61ZTeXK17sZSaK1vZW29F1211e71KwobrZ19M91Z+1WEA61nlHKgs0KIk1kv9:47uXKRVlFYq5c1bQCIaPKgsBI191IIv
MD5:	BE04EC8D2EC3BAE591464CD1B717CA38
SHA1:	91920930B8512885B18B76B94DFE74401B95D299
SHA-256:	011A1E4C9C00DE7D49EF66FFF9A0F28AB3BFEDA738CCCE95A046B6B0B6255FA8
SHA-512:	7B026AE4564DAEFB3AEA64351ADF9AA23FAD571DFA4B08AA1700BBE20DA586D33F170B8CB29609F10D07B3828B47F5F0D443300C2501EBA58E9C2A328976BEA2
Malicious:	false
Preview:	content sweetim-toolbar chrome/sweetim-toolbar/content/..locale sweetim-toolbar de-DE chrome/sweetim-toolbar/locale/de-DE/..locale sweetim-toolbar en-US chrome/sweetim-toolbar/locale/en-US/..locale sweetim-toolbar es-ES chrome/sweetim-toolbar/locale/es-ES/..locale sweetim-toolbar fr-FR chrome/sweetim-toolbar/locale/fr-FR/..locale sweetim-toolbar it-IT chrome/sweetim-toolbar/locale/it-IT/..locale sweetim-toolbar nl-NL chrome/sweetim-toolbar/locale/nl-NL/..overlay chrome://browser/content/browser.xul chrome://sweetim-toolbar/content/sweetim-toolbar.xul..skin sweetim-toolbar classic/1.0 chrome/sweetim-toolbar/skin/....# from gecko 2 (FF 4), we need to explicitly register components..# auto complete component:..component {EEE6C362-6118-11DC-9C72-001320C79847} components/SIMAutoCompleteSearch.js..contract @mozilla.org/autocomplete/search;1?name=sweetim-autocomplete {EEE6C362-6118-11DC-9C72-001320C79847}..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\content\addonlistener.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4131
Entropy (8bit):	4.625588950617717
Encrypted:	false
SSDEEP:	48:742dJHodJ1k18XJxrWQMJzfZJTnJs4Gocs/vT8udODZiQrOQJy5JCZnRkg6ARkAp:z8hu8LCC4Gob78BBCg9ChK
MD5:	08DB0C59CBF254903F4763890FA8F1EC
SHA1:	0901486EC007A04F77D25AA1B8A633AF41BBE446
SHA-256:	7A84952782D85681375BF0EEF6E0861B81DAF6AC6230E86082E49BC6FB49B2F8
SHA-512:	D738192F28BE485E860CA632D60BC92D0C07D881AA0AE5F39E986F60D8870B0B6D62612A0A27D464BB1E5A2B3A5930F13EBBEE6B1E37DD71887833F190E975AA
Malicious:	false
Preview:	..// "AddonListener" was introduced in Gecko 2 (FF4)....var g_sim_AddonListener = {.. onEnabling: function (addon, needsRestart) {.. //dump("\n XXX onEnabling \n");.. },.. onEnabled: function (addon) {.. //dump("\n XXX onEnabled \n");.. },.. onDisabling: function (addon, needsRestart) {.. //dump("\n XXX onDisabling \n");.. },.. onDisabled: function (addon) {.. //dump("\n XXX onDisabled \n");.. },.. onInstalling: function (addon, needsRestart) {.. //dump("\n XXX onInstalling \n");.. },.. onInstalled: function (addon) {.. //dump("\n XXX onInstalled \n");.. },.. onUninstalling: function (addon, needsRestart) {.. //dump("\n XXX onUninstalling \n");.. try {.. logEnter();.. if (addon.id == g_SWEETIM_EXTENSION_UUID) {.. sim_g_SIMUninstallData = simOnUninstallConfirmedByUser();.... // since we cant receive "onUninstalled" event, we continue the un-i

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\content\addonmanager.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3052
Entropy (8bit):	4.531395341231766
Encrypted:	false
SSDEEP:	48:VUNczcsspPiyV1Db+mCOZODrZX05IcNY2Wa+l1A:nAB0OgDVAINN11A
MD5:	70CF7BAA99FFE8CDCFDBD8DE7031AC09
SHA1:	1C645F5805517FA2357E3AADAA3665518EDB72FB
SHA-256:	113EEF2B585C045A77C0253B0201FFBC970A4CAF3033D38627D45C90939378CE
SHA-512:	B613B1F8FEFCF0FC8AB6C02D00E0141D988EC5F95B05030CE5FF97E1C6C889AC48090AE3DAE8883551EBCB56110E828549C0B854EF2AAB8D6CFC81A2B546E1C7
Malicious:	false
Preview:	..// wrapper for addons manager data...// for FF4 and later we use "AddonManager.jsm" (introduced only on Gecko 2, FF4)..// for FF3 and before, we use "extensions/manager;1"......// globals, used for getting version in FF4..var sim_g_addon_version = null;..var sim_g_addon_name = null;..var sim_g_event = null;....function simAddonManagerCallback(addon) {.. try {.... logEnter();.... if (sim_g_event != null) {.. // step 1.. // set global value.. sim_g_addon_version = addon.version;.. sim_g_addon_name = addon.name;.... // step 2.. // set evant.. sim_g_event.value = true;.. } else {.. logSevere("sim_g_event is null, we got here too late or too early");.. }.. } catch (e) {.. logSevere2(e);.. }..}....function SIMAddonDetails() {.. this._version = null;.. this._name = null;..}....// gets the addon details, in a way relevent to FF version,..// and puts result

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\content\bindings.xml

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1519
Entropy (8bit):	4.410561293172547
Encrypted:	false
SSDEEP:	24:8TX667LYXcAr/NHxq0+3GAQY7RR1tY2T6RtY86p9WRctqUyn:xJ7r/f5yLT6eCRcJyn
MD5:	23352C26D60E537285E91CA4C2563A94
SHA1:	5E3B2A9D0CE5A82144AD3A28BBA9267E78962451
SHA-256:	6BE86B7E71BEE837C855C48032E525677BA5071961D03FFD6D1676168A642142
SHA-512:	991CE985948A1CAEC21CB616F46138BD3A44D3EF08E02C34CA8EE5146BABDDAB62D37D4B873A8010D0B89599C431AC2810B6D6BA2BFEB7ADC8B443B6694DFC88
Malicious:	false
Preview:	.<?xml version="1.0"?>..<bindings id="SweetIMBindings".. xmlns="http://www.mozilla.org/xbl".. xmlns:html="http://www.w3.org/1999/xhtml".. xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul".. xmlns:xbl="http://www.mozilla.org/xbl">.... <binding id="sweetim-autocomplete-result-popup".. extends="chrome://global/content/bindings/autocomplete.xml#autocomplete-result-popup">.. .<implementation implements="nsIAutoCompletePopup">.....<property name="showCommentColumn".. onget="return this.mShowCommentColumn;">.. <setter>.. <![CDATA[.. var treecolValue = document.getElementById("treecolAutoCompleteValue");.. if (!val && this.mShowCommentColumn).. {.. treecolValue.setAttribute("flex", 1);.. this.removeColumn("treecolAutoCompleteComment");.. }.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\content\chevron.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	13924
Entropy (8bit):	4.6059793934114515
Encrypted:	false
SSDEEP:	192:iVftcobtdfWZDSH555lKQI8xkWaD5+BtidxccSqaF5hxtCGsRlVbF:iV15Jdb6+Bti31SqaF5vtC9lVbF
MD5:	64AFCC57EC2E5D56CB6D21AFE9AC8BA2
SHA1:	D071504FAFD4F58B72167AB2750DD73D5457FDB3
SHA-256:	F878C7FFAC03B2C60BA419E7F8D074AB9693D5C4CE6DC4C5B16B7077194279CA
SHA-512:	6C859A0EC91A688F1E07684F7EB9F20FAB7678B16DF7F2FC281C15BD3D47040C6FC2733F51C383128C8AC9C2C3085D7BC2B7ADDC8156054594FE8E9B386A8394
Malicious:	false
Preview:	..function simClearChevronMenu()..{.. try.. {.. var oMenu = simMyGetElementById('sim_chevron_menu');.. while (oMenu.firstChild).. {.. oMenu.removeChild(oMenu.firstChild);.. }.. }.. catch(e).. {.. logSevere2(e);.. }..}....function simGetCountChevronMenu()..{.. var result = 0;.. try.. {.. var oMenu = simMyGetElementById('sim_chevron_menu');.. result = oMenu.childNodes.length;.. }.. catch(e).. {.. logSevere2(e);.. }.. return result;..}......// TODO move this functiosn to new "utils.js"..function simGetChildElementById(parent, id)..{.. for (var i=0; i<parent.childNodes.length; i++).. {.. if (parent.childNodes[i].id == id).. {.. return parent.childNodes[i];.. }.. }.. return null;..}......function simGetElemWidthForNotCollapsed(oElem)..{.. var width;.. .. if (oElem.hasAttribute('collapsed') && oElem.getAttribute('collapsed')).. {

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\content\commands.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3720
Entropy (8bit):	4.732388643383319
Encrypted:	false
SSDEEP:	48:H8cFlhDSbeaUrYCp/zse1RLDvyjz985VH0UfkliWeVHV9xx2hMVNeVZENVvIsH:ccFlxSKaaDFm/98b6xeVtNbH
MD5:	657DA6FCC2576111DF397723FD03CA59
SHA1:	ECC8EDCE87B188CBD29E9E9A1A9305FFA1DC1C64
SHA-256:	93E512E98EFDE14499E6373115E2565ECAF4E26EF920BD039FEDC73768DEABD7
SHA-512:	BA284D75D27D520894BD8A3FB1728C3F198945738A8B3D759837CF2FEC7FAF24CD95653716DEC3E6FE309AE5040575B31CD97C67881C252D17DB988C475B1648
Malicious:	false
Preview:	..// trying to be close to code in IE....function simParseAllVars(url)..{.. try.. {.. if (url.indexOf("%sim_search_combo")>=0).. {.. var searchTermsEncoded;.. searchTermsEncoded = simOnSearch();.. url = url.replace("%sim_search_combo", searchTermsEncoded);.. }.. if (url.indexOf("%domain")>=0).. {.. var domain = simGetSelectedTabHost();.. url = url.replace("%domain", domain);.. }.. if (url.indexOf("%toolbar_id")>=0).. {.. var appid = simGetConfigString("simapp_id");.. url = url.replace("%toolbar_id", appid);.. }.. }.. catch(e).. {.. logSevere2(e);.. }.. .. return url;.. ..}....function simNavigateToURL(url)..{.. try.. {.. logEnter ();.. .. // parse vars.. url = simParseAllVars(url);.. .. // Set the browser window's location to the incoming URL.. window._content.docu

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\content\config.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5896
Entropy (8bit):	4.541238924519937
Encrypted:	false
SSDEEP:	96:XjE3geVhCa6rHUjwYOJY62Nod0qLdYNne4DLM5tYDUkeCalqN85q:zpeVhCa6rHU0YOJYv20jNeycegkZ9Uq
MD5:	A53978F00A102A62E01A3E43CB5EBDBE
SHA1:	E829F60DA3F8105C0D65F7EFE139C629468172C4
SHA-256:	C1B7491D50D19286166CD2511984736368315D4ABAE7C3B8E3836351543749A0
SHA-512:	9083FD8E4C4D8E4E9444EE1DCD99FFEFB9AD6E2DE6D5F68DE008DCEAE3CFFE510866B6E4C76AF17A04C51F8C15827225361C8F7916BECA40C8C5E243D4128268
Malicious:	false
Preview:	....// local helper..function simGetPreferences()..{.. if (sim_g_iPreferences != null).. return sim_g_iPreferences;.. try .. {.. sim_g_iPreferences = kCC["@mozilla.org/preferences-service;1"].getService(kCI.nsIPrefService);.. }.. catch(e).. {.. logSevere2(e);.. }.. .. return sim_g_iPreferences; ..}....// debug helper..function logBranch(branch)..{.. try .. {.. var count;.. var array = new Array();.. var obj = new Object();.. .. .. // see http://developer.mozilla.org/en/docs/nsIPrefBranch.. array = branch.getChildList("", obj);.. count = obj.value;.. .. for(var i=0; i<count; i++).. {.. logInfo("[item " +i+ " ]" + array[i]);.. }.. }.. catch(e).. {.. logSevere2(e);.. }..}....function simDeleteBranch(name)..{.. var prefs;.. var branch;.. .. try.. {.. prefs = simGetPreferences();.. branch = prefs.getBran

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\content\contentmenu-handler.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	16022
Entropy (8bit):	5.164579735638881
Encrypted:	false
SSDEEP:	384:oJPA3ed6vyJNKMZEYZKK/bTE4tv/j95JM5JV7osxmS7TJLQwlKeMuuC2suizrf7:ePA3edmQNKMZEYZKK/bTE4tv/xMrVRm8
MD5:	2B4FD08FBBE235E21CB29060CE159459
SHA1:	B7FB723D552129FEEAAE7CCA46EDB18A54849C44
SHA-256:	148B0E27BC88BFB16BA9FA0B1963B5F3FB6FA14D4B971EDB3E85268386644B0B
SHA-512:	EC60097A623E9CEAE81AC0D819BABF4B48CFE277B7B6BD2B1625904AB897330DC31D67B850E77C2721159542B4F28EF5EE1DB5BB90144FE6F07D37E64014261E
Malicious:	false
Preview:	/* Constants /..const SIM_BROWSERCOMP_MENU_ID = "id_browser_sim_content_menu";..const SIM_TOOLBAR_BUTTON_ID = "sim_sweetim_btn";....const BRW_NOTIFY_STATE_DOCUMENT = Components.interfaces.nsIWebProgress.NOTIFY_STATE_DOCUMENT;..const BRW_NOTIFY_LOCATION = Components.interfaces.nsIWebProgress.NOTIFY_LOCATION;....const BRW_STATE_START = Components.interfaces.nsIWebProgressListener.STATE_START;..const BRW_STATE_STOP = Components.interfaces.nsIWebProgressListener.STATE_STOP;..const BRW_STATE_TRANSFERRING = Components.interfaces.nsIWebProgressListener.STATE_TRANSFERRING;..const BRW_STATE_IS_DOCUMENT = Components.interfaces.nsIWebProgressListener.STATE_IS_DOCUMENT;..../ End Constants /..../ Members */..var sim_mouseOut = true;..var sim_closeBubbleWindow = false;....//Listen to browser navigation, progress, netvork, security events..var sim_bubbleBrowserProgressListener = ..{...QueryInterface: function(aIID) {....var result = null;....if(aIID.equals(Components.interfaces.nsIWeb

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\content\contentmenu.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3711
Entropy (8bit):	4.586487379339707
Encrypted:	false
SSDEEP:	48:Vv7HHeL0tgDxRILL1BtH/N0kZp/V6bZ6+oCyhXHbgB1RulleK9s19j/h1OLXy:pIdE1BtZZSloL9sB1o/ZCj/rmXy
MD5:	089FBACD08F66ACB256605630CAEB58C
SHA1:	6A2156806CADD3144F4655F6D688DA27FE89EF73
SHA-256:	29C510DA7814E46549C31EAA84204B88CE3616343E1EC7535ED0EF2DF828A786
SHA-512:	CA32B03181E9D398B025F2E35BBCE0D64C2A086C1606EFAB97B1F6CDA4A4F29AA380403736A56F6F4DDBA778507F186BF579ACE3C148C510B43B40F663E5C34F
Malicious:	false
Preview:	..const SIM_TOOLBAR_BUTTON_ID = "sim_sweetim_btn";..var sim_g_wndContentMenu = null;....function simPreventDefaultProcessing(event)..{...try...{....if (sim_g_wndContentMenu.simTargetWindow)....{.....event.preventDefault();.....event.stopPropagation();.....event.target.parentNode.open = false;....}...}...catch(e)...{....logSevere2(e);...}..}....function SIMPoint()..{.. this._x = 0;.. this._y = 0; ..}....function simComputeContentMenuLocation()..{.. var oPoint = null;.... // step 1.. // get button.. var oButton = simMyGetElementById(SIM_TOOLBAR_BUTTON_ID);.. if (oButton != null).. {.. // step 2.. // check if current tab is opened with addons manager.. var bAddonsManagerTab;.. bAddonsManagerTab = simIsCurrentTabOfAddonManager();.. if (bAddonsManagerTab){.. // !! we get here also for "empty" tab.. // we should hide the menu.. // this is done by caller, when he gets point as null.. }..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\content\cookies.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8608
Entropy (8bit):	4.625604721501032
Encrypted:	false
SSDEEP:	192:J8WDV0lxkzQMqZRCdvWyx5c+KQby7DwcsF8cm:T+4dY
MD5:	1F46872FF3A64F893C4E43C081D375C8
SHA1:	DC24DFE5A9FC509A78E57F0CB4516B646D98CD30
SHA-256:	BFF21988F70894E777229045F3B70D50659F084658CCC5424F534D175E2651E4
SHA-512:	79451B08E2695B19A6B09BB45AE291C5F3176FC582969498A946ADF6662D43A2A0380A87B3B3548BFB1E7471631F645C94C53ABBA766048CF74100B63003FB50
Malicious:	false
Preview:	..const SIM_COOKIE_NAME = "SIMAPPID";..const SIM_COOKIE_HOST = ".sweetim.com";......// In 1.9+ and later there is new param "httpOnly"..// to nsICookieManager2:add..function simGetIsGecko19OrLater()..{.. var isGecko19 = false;.. if (kCI.nsIXULAppInfo).. {.. var appInfo = kCC["@mozilla.org/xre/app-info;1"].getService(kCI.nsIXULAppInfo);.. var versionChecker = kCC["@mozilla.org/xpcom/version-comparator;1"].getService(kCI.nsIVersionComparator);.. if (versionChecker.compare(appInfo.platformVersion, "1.9") >= 0).. {.. isGecko19 = true;.. }.. }.. return isGecko19;..}....var sim_g_CookiesObserver = {....// members.._registered: false,....// method: observe..observe : function(subject, topic, data)..{.. try.. {.. if (topic == "cookie-changed").. {.. // see http://developer.mozilla.org/En/NsICookieService.. if(data == "cleared" \|\| data == "deleted").. {.. var verify =

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\content\domainutils.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	C source, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.556954689157478
Encrypted:	false
SSDEEP:	24:5YPwVFM/wVMMQq8EwK04sA1jFBAZFtJ5stxNYUXi5MIm4gz21icL:5YSFMCMMzZF04sSBqFtJ5stxN4Zm4gK/
MD5:	3A394379FE27CCBEE9FCACAD25A89624
SHA1:	9573282380AF9404FBE89F87E4A8AB2C8EA5A785
SHA-256:	8F87D2A1D2B63DCCED8AE3219A905A22129A5C9D05CCFE80123A1DFA8EAA4CC2
SHA-512:	7FD6A89AA8439F686222320E41F443CDD529662CC1B08D991BF41CC092C3971EDA0FA0B98E8AB6605F6F4D554A29694F061C05654435BA9590B5AE6BE6BD7D44
Malicious:	false
Preview:	function getDomainNameFromURL(sURL) {.. sURL = sURL.replace("http://", "");.. sURL = sURL.replace("https://", "");.. var slash = sURL.indexOf("/");.. if (slash > 0) {.. sURL = sURL.substring(0, slash);.. }.. return sURL;..}....function getSecondLevelDomain(sURL) {.. var sDomain;.. var sSecondDomain = "";.. var arr;.. if (sURL != null) {.. sDomain = getDomainNameFromURL(sURL);.. arr = sDomain.split(".");.. if (arr.length > 2) {.. sSecondDomain = arr[1];.. }.. else {.. sSecondDomain = arr[0];.. }.. }.. return sSecondDomain;..}....function CompareSecondLevelDomains(sURL_1, sURL_2) {.. var result = false;.. try {.. var sSecondDomain1;.. var sSecondDomain2;.. sSecondDomain1 = getSecondLevelDomain(sURL_1);.. sSecondDomain2 = getSecondLevelDomain(sURL_2);.. if (sSecondDomain1 == sSecondDomain2) {.. result = true;.. }.. }..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\content\dynamic.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3140
Entropy (8bit):	4.472854553394219
Encrypted:	false
SSDEEP:	96:HuKNuu1ywyvw8WU5Nuu1ywGz7vFlNuu1ywy:HuwaQw2wwy
MD5:	01AD57D140DA3C93803DD9D700373C52
SHA1:	3458CD2EDE13733C9B8447251DED6CDB5B6B182D
SHA-256:	A899595EF19B413A9099A9540852BE1013EBFA18379F31E65D9ACEEAEA52A163
SHA-512:	8E74CA4104F02318B659C67A34DD259681D8CC4F0971FA6F5B6165A1FEDEEEC79180A9C1BD33340607881818349697492EDA9B96580132A4A979F54AEF778FBF
Malicious:	false
Preview:	..// small helper..function..simInsertAfter(newChild, refChild)..{ ...var oParent;...oParent = refChild.parentNode;.. oParent.insertBefore(newChild, refChild.nextSibling); ..}....function..simAddSeperator(id, insertAfterId)..{.. try.. {.. var oNewElem;.. var oElemExist;.. .. // create new element.. oNewElem = document.createElement('toolbarseparator');.. oNewElem.setAttribute('id', id);.. .. // add it.. oElemExist = simMyGetElementById(insertAfterId);.. simInsertAfter(oNewElem, oElemExist);.. return oNewElem;.. }.. catch(e).. {.. logSevere2(e);.. return null;.. }..}....function..simAddBanner(id, url, insertAfterId, name, width, height, bAddPadding)..{.. try.. {.. var oNewElem;.. var oElemExist;.. var oParent;.. var style;.. .. // create new element of banner.. oNewElem = document.createElement('iframe');.. oNewElem.setAtt

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\content\file.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	7243
Entropy (8bit):	4.667029972880432
Encrypted:	false
SSDEEP:	96:1Ume45J4xbfd3QMs3LfHSVoLlHVcn1EoV5HAVcj/qr8S8G0oRoccNd+:TeRpfXQLHcoBHK1D5Hac7qwvGLx0d+
MD5:	B0B4F17785E11927B144C61C3148E2AC
SHA1:	260A37C06BC8294D79C72A329C261E187E9555BA
SHA-256:	85E23241F5A8301CCF224AF5C30DD58CD6D9584E731259147E3561813F78AEF5
SHA-512:	D9F29D4AF899D6E2D7AC5F3E6F0D4BDAA09B9ED4E3B546EA257B5D65E3E319153EC67A657756899404C3BFEAEE4129F98E249B546BE4067E80F9B19A42A5FEAD
Malicious:	false
Preview:	..// TODO2 - check this: dont put log bcz it recurse..function simGetFileSize(filename)..{.. var result = 0;.. try.. {.. var file;.. .. file = kCC["@mozilla.org/file/local;1"].createInstance(kCI.nsILocalFile);.. file.initWithPath(filename);.. .. if (file.exists()).. result = file.fileSize;.. else.. result = -1; .. }.. catch(e).. {.. simAssert(eSeverity.eSEVERE, e);.. }.. return result;..}....function simReadFileToString(filename) {.. .. var result = null;.. .. try {.. var file;.. var cstream;.. var fstream;.. var data = "";.... logEnter();.... file = kCC["@mozilla.org/file/local;1"].createInstance(kCI.nsILocalFile);.. fstream = kCC["@mozilla.org/network/file-input-stream;1"].createInstance(kCI.nsIFileInputStream);.. cstream = kCC["@mozilla.org/intl/converter-input-stream;1"].createInstance(kCI.nsIConverterInputSt

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\content\findword.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3434
Entropy (8bit):	4.555949304243929
Encrypted:	false
SSDEEP:	48:1foLrnEe2o1349x0nrnE9zMZJH7Cb+KQGj8HmGF/hfqj:16oeBMuo9zMLHU+KQG4HzYj
MD5:	613B6833DCC4E6ABD2412016F8533729
SHA1:	2A8DD9827A4EF50AEF9BAD4A08697B2E953CF785
SHA-256:	D31BE0E9CDB8B1460D6E4F621EDE0C81E657B95D41D59B45BEA6127E43F61E4A
SHA-512:	A2FBE1B2E9A3D97F5FBD71FBC931D9672A8703B939BE0EFD7F70F895CDD77EBB32C0963BAAFD7635A9CD88DE420A57AC408EE7072C773A819D80D9E61B768E39
Malicious:	false
Preview:	..function simRemoveFindWordButtons() {.. try {.. logEnter();.... var oFindWordButton;.. var oFindWordItem;.... oFindWordItem = simMyGetElementById('sim_find_words_item');.. while (oFindWordItem.firstChild) {.. oFindWordItem.removeChild(oFindWordItem.firstChild);.. }.. }.. catch (e) {.. logSevere2(e);.. }..}....function simAddOneFindWordButton(oFindWordItem, label) {.. var oNewButton;.. var tooltipText;.. oNewButton = document.createElement('toolbarbutton');.. oNewButton.setAttribute('label', label);.. oNewButton.setAttribute('id', 'sim_id_for_find_word_' + label);.. //newButton.setAttribute('crop', 'end');.. oNewButton.setAttribute('class', 'sim_find_word'); // alse sets max width.. oNewButton.setAttribute('oncommand', 'simFindNextWord(event);');.. tooltipText = simGetFormattedStringFromBundle('sweetim.property.button.findword.tooltip', [label]);.. oNewButton.setAttribute('tooltiptext

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\content\generalobserver.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1430
Entropy (8bit):	4.474103530814768
Encrypted:	false
SSDEEP:	24:KX0t8sqp5raTuJ/fwo84vnUO0qRy67wf7o84vnM0qBQltydbjee5DRB6ykibjLeM:KE3U5J/fwopvnUO0Eyiwf7opvnM0SQPs
MD5:	EE7A229CBDB7F4F3023ACCC1A12CC8BB
SHA1:	AF5F336C583C51CD6FDB8D2FC960B525EEAA5B80
SHA-256:	8C4EA863D577011A2AACB884A18BE53C9599B3CA9B212AC893CA987DA5E2EC11
SHA-512:	C974CC5D0E5079BA1928CED96A64F3F1791079545FA983D4FA66918F5A5DFBF7D9B473AD45CD29AC3FAA9D9A86DC0F93CAD12AA42EED2ABFD5C206F759A1BDF2
Malicious:	false
Preview:	..var sim_g_GeneralObserver = {.... // members.. _registered: false,.... // method: observe.. observe: function (subject, topic, data) {.. try {.. if (topic == "quit-application-requested") {.. simOnQuitApplicationRequested();.. }.. }.. catch (e) {.. logSevere2(e);.. }.. },.... // method: register.. register: function () {.. if (!this._registered) {.. var observerService = kCC["@mozilla.org/observer-service;1"].getService(kCI.nsIObserverService);.. observerService.addObserver(this, "quit-application-requested", false);.... this._registered = true;.. }.. },.... // method: unregister.. unregister: function () {.. if (this._registered) {.. var observerService = kCC["@mozilla.org/observer-service;1"].getService(kCI.nsIObserverService);.. observerService.removeObserver(this, "quit-application-requested");..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\content\global-namespace.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	814
Entropy (8bit):	4.8948254611600035
Encrypted:	false
SSDEEP:	12:EfYCIaDJIDD7FsoKI78kLLrpbhoc5tA1iVCYKOHsgp7cbUNnIHYK30JWM/qGwY8s:ErIa/o18kzpb81zLa1nMEJWMiGWs
MD5:	F94995DEAE7ABCDFCE3A3C9BB5F5EC01
SHA1:	4D3C7CB0EA579AD062EDADD18D52EDBD54A331DD
SHA-256:	E3A1E261E542BB984064D9F1B02A72720A4F238BFB3EC8D76BD5407D5FEDB6D2
SHA-512:	B903EB8183214EE0F8F152478AB99B002746A29575AA3B2214153E2C050295C2D37CC28406432452D33F2D12751A5079DEE927CD49CF1EE0686145E434B7359A
Malicious:	false
Preview:	..// loaded in "global namespace", bcz function already "SIMTB_Navigate" in use by ppcbully banner,..// without use of namespace....// called from ppcbully banner, in order to open ad in _current_ or _new_ tab, instead of in new window..// (cannot be done directly using JS, without helper function)..function ..SIMTB_Navigate(url) {.. try {.. NAMESPACE_SIM_TB.logEnter();.... var target = NAMESPACE_SIM_TB.simGetConfigString("ppcbully.target");.. if (target != null && target == "new-tab") {.. NAMESPACE_SIM_TB.simNaviagteToUrlInNewTab(url, false).. }.. else { // no value, or "current-tab", as default -> open in current tab.. NAMESPACE_SIM_TB.simNavigateToURL(url);.. }.. }.. catch (e) {.. NAMESPACE_SIM_TB.logSevere2(e);.. }..}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\content\globals.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with very long lines (3538), with CRLF line terminators
Category:	dropped
Size (bytes):	5929
Entropy (8bit):	5.118606362873504
Encrypted:	false
SSDEEP:	96:PT7FggKebtnL/6q0P7ETojlQXdMdnL2D5JeMp6ncwGTSM3YtlPLg:PT7VKStnT6DxhSD5+gYtts
MD5:	95C9B565B9F126BA7B38D804AFF23F3B
SHA1:	7A591C7532742665FCD9BA582C7D619B0728C698
SHA-256:	0544D0A22B2AE4A1F47EE22CBA892C28D3C40AD20D46C87040A78232F5315E2B
SHA-512:	2D799781037E44944571243D6924F5CA457ECDF3B450FEE035A48DF9F5F1CBC59E49A29E26213329B53A67913C3A04D176F62337B749425BA3D3BB04DE30CD3F
Malicious:	false
Preview:	..// urls..const SIM_URL_SEARCH = "http://search.sweetim.com/search.asp"..const SIM_URL_WWW = "http://www.sweetim.com";..const SIM_URL_HOME = "http://home.sweetim.com";..const SIM_URL_FORUM = "http://www.sweetim.com/forum/";..const SIM_URL_HELP_FF = "http://www.sweetim.com/help_simff.asp";..const SIM_URL_HELP_ABOUT = "http://www.sweetim.com/about_overview.asp";..const SIM_URL_HELP_UNINSTALL_FF = "http://www.sweetim.com/uninstallhelpff.asp";..const SIM_URL_FEEDBACK = "http://www.sweetim.com/help_contact.asp";..const SIM_URL_PRIVACY = "http://www.sweetim.com/eula.html#privacy";..const SIM_URL_AFTER_INSTALL = "http://www.sweetim.com/installbar.asp?barid=%toolbar_id";..const SIM_URL_AFTER_UNINSTALL = "http://www.sweetim.com/uninstallbar.asp?barid=%toolbar_id";..const SIM_URL_AFTER_UPDATE = "http://www.sweetim.com/updatebar.asp";..const SIM_URL_SEARCH_FOR_DS = "http://search.sweetim.com/?src

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\content\gui.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	994
Entropy (8bit):	5.055837583663413
Encrypted:	false
SSDEEP:	24:1nNRePft2xlRewMoHPiRoBioxNjoKweJiJ2nNRRXAofYRRm5YrRR2Re7Uh2JE:1nNEnt2xHxM4iaBioxNj2J2nNbAogmYY
MD5:	B21915268656A59AB1FEFDB73060C116
SHA1:	11029F793F81E05A5666D90367E4DE17D489ED9F
SHA-256:	F18C604A4AC3C9E331EE4CCDD5B9064392C7AE1F53068FD20F990500BE961752
SHA-512:	FCB822F6BDFFB744A74B6CF7B92F89B4A86059959B79DCB98ED2D8DAA3AA51F17290F432A4619FD3B0286D3A038D0F1C7656310D9D579087AC9E40F2D9CBEA5A
Malicious:	false
Preview:	..function simMyGetElementByIdImpl(oParent, id){.....var oElem = null;...if (oParent != null && oParent.hasChildNodes()) {....var children = oParent.childNodes;....for (var i = 0; i < children.length; i++) {.....var oChild = children[i];.....if (oChild.id == id) {......oElem = oChild;......break;.....}.....else {......// try to recurse......oElem = simMyGetElementByIdImpl(oChild, id);......if (oElem !== null)......{.......break;......}.....}....}...}...else{....//alert("children.length = 0");...}...return oElem;..}....function simMyGetElementById(id){...if (false) { // orig, but in correct when we also have TB running along side FB,....// bcz they use same ids....var obj;....obj = document.getElementById(id);....//alert("obj = " + obj);....return obj;...}......var oParent;...var oElem = null;...oParent = document.getElementById(SIM_TOOLBAR_ID);...oElem = simMyGetElementByIdImpl(oParent, id);...if (oElem == null) {....// alert("oElem null for id = " + id);...}...return oElem;..}..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\content\highlight.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	11741
Entropy (8bit):	4.718561487895601
Encrypted:	false
SSDEEP:	192:M4waE6qTeRNKsTVyJnd9M6sTaQqIqIPejICyIK4+WPgGMo3acYkXwx:NRqpTeejmazycM
MD5:	19C91355F834A826C848D1FAE11C5FAF
SHA1:	8EE43CDE546F9CB1BF8A4C3B4FBB0BD1A669112C
SHA-256:	8FB0A6DA582D7BE18DF253731ED0EF4136C9609064ACF8FF83B7CBD4F26F9A6C
SHA-512:	908A9B95FA8E26485027B85B94B46C84DB1FD487CC315547FB6B8E6D0720FA3EF917C091C7F33CFF5C091C35DF0B022875EFD10D52829FD96566392C4FEA2B9D
Malicious:	false
Preview:	..var sim_g_arrColors = null;....// private..function simGetHighlightButton()..{ .. var oButtonHighlight;.. oButtonHighlight = simMyGetElementById('sim_highlight_btn_id');.. return oButtonHighlight;..}....// private..function simGetHighlightButtonChecked()..{ .. var oButtonHighlight;.. var bChecked;.. .. oButtonHighlight = simGetHighlightButton();.. if (oButtonHighlight.hasAttribute('checked')).. {.. bChecked = oButtonHighlight.getAttribute('checked') == 'true';.. }.. else.. {.. bChecked = false;.. } .. return bChecked;..}....// private..function simSetHighlightButtonDisabled(bDisabled)..{.. var oButtonHighlight;.. .. oButtonHighlight = simGetHighlightButton();.. oButtonHighlight.disabled = bDisabled;..}....// private..function simSetHighlightButtonChecked(bChecked)..{ .. var oButtonHighlight;.. .. oButtonHighlight = simGetHighlightButton();.. oButtonHighlight.setAttribute('checked', bChecked);..}.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\content\history.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2980
Entropy (8bit):	4.13201368175262
Encrypted:	false
SSDEEP:	48:1suFOFuLDFEFEnXU8cCVVIdk2W7zdXO4DOWlCuTMCSz:TFOcPFEFoflSI3JHD2qgz
MD5:	2A1BE640289F613777A831410130DB4D
SHA1:	BDAF40DC75C69F30799DF9A4B2428930F30F3624
SHA-256:	4B747F43C14B6C95EB37EB2340072B40125C57999DA530FFADBCB999D81ED393
SHA-512:	DDFC32305F9C0FAE715BBE4C918007E6ACD3AFC94FF0054FE47021E8EBD9B4048DC9F1F296DE2EAC76779BFC6D3ACF5E406AD47D5650FF07DCEAB4A32B1C340C
Malicious:	false
Preview:	..function simGetSearchHistory()..{.. var result = null;.. try.. {.. var arrEncoded;.. var sHistoryItems = "";.. if (simGetIsConfigExists("search.history")).. sHistoryItems = simGetConfigString("search.history");.. if (sHistoryItems && sHistoryItems.length > 0).. {.. result = new Array();.. arrEncoded = sHistoryItems.split(",");.. for(var key in arrEncoded).. {.. var encoded;.. var decoded;.. .. encoded = arrEncoded[key];.. decoded = decodeURIComponent(encoded);.. logDebug("key="+key+",encoded="+encoded+",decoded="+decoded);.. result.push(decoded);.. }.. }.. }.. catch(e).. {.. dump("simGetSearchHistory= "+e);.. //logSevere2(e);.. }.. return result; // array of decoded..}....// param text shouldNT be encoded..function simAddToSearchHistory(

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\content\inject.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	6637
Entropy (8bit):	4.38577654837664
Encrypted:	false
SSDEEP:	96:YXyv7ijuSlT3gChurexw6Z7VNsOAojOWkhkCnHSBFRs+Mz2CNN:nvjquWwy7NOWqkCyBFRs+MqG
MD5:	560EFC94BF82CD40EDFA51D0EC7A8ED5
SHA1:	991B9B36CBF729632310D8B862EC92928F20D43D
SHA-256:	0A8AAB29CAFA7055F99DBAE359400B8EF187EC181F8976F7B7748CDEA4AAD88E
SHA-512:	2517F88D6F4FE557F2D894D64F9697F4FFC162F64C4E4D943B09024EDDD7CBB2E37D240CB684FE656348E082DAD011E3DEA0955BA1AB3BBB8063A4B741B9ACD4
Malicious:	false
Preview:	..// TODOZ: future use..function SIMScriptInfo() {.. this._sRegexp = "";.. this._sURL = "";..}....var g_sim_strScriptURL = "http://sc.sweetim.com/apps/in/fb/infb.js";....function simAddScriptToDocument(oDocument) {.... try {.. var SCRIPT_ELM_ID = "id_script_sim_fb";.... var objScript = oDocument.getElementById(SCRIPT_ELM_ID);.. if (!objScript) {.. var head = oDocument.getElementsByTagName('head')[0] \|\| document.documentElement;.. var scriptElement = oDocument.createElement('script');.. var url = simGetConfigString("urls.ScriptUrlFB"); // same name as used in IE.. if (url == null \|\| url == undefined \|\| url == "") {.. url = g_sim_strScriptURL;.. }.. scriptElement.src = url;.. scriptElement.type = "text/javascript";.. scriptElement.language = "JavaScript";.. scriptElement.id = SCRIPT_ELM_ID;.. head.insertBefore(scriptEl

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\content\install.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	22273
Entropy (8bit):	4.567586678614434
Encrypted:	false
SSDEEP:	384:N44hc4vQNQMq2ygMZr87jmnH5dgRTHR4/bKfn+E:N4A1ZeSm
MD5:	4F697EF09E80937BD0321C81800CA48F
SHA1:	B58FA1875961D22E5E3534225F7B7D17E5530308
SHA-256:	43729CF4EC878E3B12B60A1CD19A78516BC79CFBAAA0E289DDA2432EF25E248D
SHA-512:	8FD1CFD5E02F753519A142F0DDEF5CB32ED6C59C12D1BDDC6CCDC7E1CD9CCFCC478EF5E9673543F113FD419B90C0B7B1C860499461D848A53E853F7D3C2BDE24
Malicious:	false
Preview:	..function simOnInstall()..{.. try.. {.. logEnter();.. simAddDefaultConfig();.. simUpdateVersionFromRDFInPrefs();.. }.. catch(e).. {.. logSevere2(e); .. }..}....function simGetPrefsArray()..{.. var arrPrefs = new Array();.. .. // keyword url.. arrPrefs.push( {prefName:"keyword.URL", prefSweetIMValue:"http://search.sweetim.com"} );.. .. // default search.. arrPrefs.push( {prefName:"browser.search.defaultenginename", prefSweetIMValue:SIM_SEARCH_ENGINE_NAME} );.. arrPrefs.push( {prefName:"browser.search.selectedEngine", prefSweetIMValue:SIM_SEARCH_ENGINE_NAME} );.. .. // homepage.. // get the value which was added by setup, as homepage.. // was stored also here for comparsion. see c++: SetFFDefaultHomePageUsingPrefsFile.. var sSweetIMHomePage = simGetConfigString("urls.homepage");.. arrPrefs.push( {prefName:"browser.startup.homepage", prefSweetIMValue:sSweetIMHomePage} );.... return ar

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\content\logger.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	10479
Entropy (8bit):	4.595467703826516
Encrypted:	false
SSDEEP:	192:danfRLbJ1A0MASuHvLLKO9LJOq2/pOq6pdyJFIZMGt4Z:dsbQaLLKO9LYZ/UJPaZ
MD5:	5329A994D60FB712F6D18F9D69C0B29B
SHA1:	F0E9AE0F6EE68BEE731176871741836A4F400715
SHA-256:	CA3540B7DD00EE74126562A027B6C11A3DF3E6155313D9D39DF3F48409635BBD
SHA-512:	034147BE48FEC3A3B40F74C8835FB158A8A01BEC52394DA431F5B8C614FA38C7B9DB9AFF3D34A455060E35FD0BC1860B3E6196760A9380C437A53D85222710F2
Malicious:	false
Preview:	// for eSeverity original definition, see Level.h..var.eSeverity =..{.. eALL:0,.. eDEBUG:1,.. eCONFIG:2,.. eINFO:3,.. eWARNING:4,.. eSEVERE:5,.. eCRITICAL:6,.. eOFF:7..};....var g_loggerInit = false;....var g_FileHandler_FileName = null;..var g_FileHandler_MinReportLevel = null;..var g_FileHandler_MaxFileSize = null;..var g_ConsoleHandler_MinReportLevel = null;....var sim_g_loggerDisabled = false;.. ..function initializeLogger()..{.. // TODO - the strings of prefs names, appear also in config.js => put them in one place only.. .. if (simHasConfigPrefs()).. { .. g_FileHandler_FileName = simGetConfigString("logger.FileHandler.FileName");.. g_FileHandler_MinReportLevel = simGetConfigString("logger.FileHandler.MinReportLevel");.. g_FileHandler_MaxFileSize = simGetConfigString("logger.FileHandler.MaxFileSize");.. g_ConsoleHandler_MinReportLevel = simGetConfigString("logger.ConsoleHandler.MinReportLevel"

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\content\main.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2761
Entropy (8bit):	4.585147185811158
Encrypted:	false
SSDEEP:	48:G3JhY6Boz41aDkkaYMjNgr3AetwWOzBT4JF5Ay6:G3JOXDlazjN+w2OBMWf
MD5:	2E2A156B39E9712A9009685B01C32097
SHA1:	E1A475D4A5630873BBB4385130F7AB784BDEB90C
SHA-256:	5A7F42C79EF674479812DB4A4AF9A0F8C419AF9042D51542174E64BA9CE9276E
SHA-512:	C8AE2C1FFD66C613D5F20B957120BCE25C436A0C5EC9D42C0202781DC78EC3C4B67AABD2EA5D3546F6E1E4C7AF69FD328D0FDAD1BCA8957872093083012C6188
Malicious:	false
Preview:	..var NAMESPACE_SIM_TB = {};....NAMESPACE_SIM_TB.loadScripts = function () {.. // load external JS files, into gloabl object "NAMESPACE_SIM_TB", which is used as namespace.. try {.. var path = "chrome://sweetim-toolbar/content/";.. var loader = Components.classes["@mozilla.org/moz/jssubscript-loader;1"].........getService(Components.interfaces.mozIJSSubScriptLoader);.. var files = new Array(.. "sweetim-toolbar.js",.. "registry.js",.. "config.js",.. "search.js",.. "searchguard.js",.. "searchservice.js",.. "logger.js",.. "commands.js",.. "highlight.js",.. "tabinfo.js",.. "tabinfo-array.js",.. "webprogresslistener.js",.. "contentmenu.js",.. "splitter.js",.. "chevron.js",.. "uninstallobserver.js",.. "version.js",.. "install.js",.. "globals.js",.. "history.js",.. "file.js",.. "stringbundles.js",.. "tooltip

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\content\messagebox.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	790
Entropy (8bit):	4.552759257474942
Encrypted:	false
SSDEEP:	12:xb7gDv5WyDfcoXNWiB14/7+KI5hoG2tyUovprDzpTz8yhphzFnATpJx37GpJcL:1kv5BDUoX/4TNlkpp3NTwOhFmXYcL
MD5:	EBBDC1D24F91354112CE613C5FF079D4
SHA1:	9E6902E98BB070AC14A53476B830F546BCD41E4F
SHA-256:	822A4FADA8538D2365EB806AF58516D76C5E00E49FFB4B81261BFA14F13DCB3B
SHA-512:	DA18275FF3A33E93ED7D827BCB9697492A6AEEB83C5265F3A470CED73DE3DC361F39A16EB90D1C39FBBAC1BF59F002DD9EFF24F68C397DD1726D7F65DEF32F96
Malicious:	false
Preview:	..function simMessageBox_OkCancel(sCaption, sText) {.... var result = null;.. try {.. // show message, ask user if to keep settings.. var promptService = kCC["@mozilla.org/embedcomp/prompt-service;1"].getService(kCI.nsIPromptService);.. var flags = promptService.STD_OK_CANCEL_BUTTONS;.. var check = { value: false };.. var button = promptService.confirmEx(window, sCaption, sText, flags, null, null, null, null, check);.... // set the value that user selected in result.. if (button == 1) // user selected "pos_1" button => no.. {.. result = false;.. }.. else {.. result = true;.. }.. }.. catch (e) {.. logSevere2(e);.. return null;.. }.... return result;..}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\content\ppcbully.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	3.7605520099280896
Encrypted:	false
SSDEEP:	24:JyBoNLxRRtU3dLqRRdv7f+fOpLfy8fHUwBc1P+urxpZhzZDb:kB4x+opDGmB5WmuLPh
MD5:	D0D9DDC7A4FCEC37560A070DFA13BF5E
SHA1:	ABBDD24BB2BF5C915F3037F8CDB5675D6A9F331A
SHA-256:	B28E9EDE8088E44E68C13BF1AA7B540924A6D18C0F25B015D4CABC02E3F6AD3B
SHA-512:	598A7B9F07F25E0A606431F3A93D618885CD803233B29465869E754285666CA2212B53BE3BB997A48F272617618B4EB5FE799E004ECB948E941AA767D84A189B
Malicious:	false
Preview:	..// notifies ppcbully banner on every document complete...// called from rc.html..function..simNotifyPPCBullyBannerOfDocumentComplete(bannerId, url)..{.. try {.... logDebug("params: bannerId = " + bannerId + ", url = " + url);.. .. var oToolbar;.. var oBanner;.. oToolbar = document.getElementById(SIM_TOOLBAR_ID);.. if (oToolbar.collapsed == false) // check if toolbar is hidden.. {.. oBanner = simMyGetElementById(bannerId);.. if (oBanner).. {.. if (oBanner.contentWindow != null && oBanner.contentWindow).. {.. if (oBanner.contentWindow.pbNavigateComplete != undefined) {.. try {.. oBanner.contentWindow.pbNavigateComplete(url);.. }.. catch (e2) {.. logSevere2(e2);.. }.. }.. el

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\content\registry.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5801
Entropy (8bit):	4.664439405681212
Encrypted:	false
SSDEEP:	96:XnVid/DwfTNCDKUTisuLpBXPJjH9BL3rqzx5GH1zTNb1Lx1+:XVid/DwfT2KUTi7/XPJTbL3rqzx5GzTG
MD5:	8008F72ECA33168113BF191E38503787
SHA1:	E955FA0F508421836DF1DE60B9405CC310B1399C
SHA-256:	7744FCB23B17BAD1F7D66574158B06AF918590F13E0EBCE1550E86E2CD41388C
SHA-512:	C66418A1B16C88D205CDE3D154F907AF743DBBD4DD81CBA4870E2BE32C70784E9EE55B32670AAB984935F071BAB3D9F0C76C7551FCF9FF9FAD0CE6BCB591D4C8
Malicious:	false
Preview:	..// rootKey > HKCU, HKCR or HKLM..// subKey - string..// sAccess > "ACCESS_READ", "ACCESS_WRITE" or "ACCESS_ALL"..function simOpenRegsitryKey(rootKey, subKey, sAccess)..{.. var result = null;.. var rootKey2 = null;.. var access;.. .. try.. {.. result = kCC["@mozilla.org/windows-registry-key;1"].createInstance(kCI.nsIWindowsRegKey);.. .. switch (rootKey).. {.. case "HKCU":.. rootKey2 = result.ROOT_KEY_CURRENT_USER;.. break;.. case "HKCR":.. rootKey2 = result.ROOT_KEY_CLASSES_ROOT;.. break;.. case "HKLM":.. rootKey2 = result.ROOT_KEY_LOCAL_MACHINE;.. break;.. } .. switch (sAccess).. {.. case "ACCESS_READ":.. access = result.ACCESS_READ;.. break;.. case "ACCESS_WRITE":.. access = result.ACCESS_WRITE;.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\content\release.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	146
Entropy (8bit):	4.767727345085542
Encrypted:	false
SSDEEP:	3:8WlPUNFDMJ9+fkVLLxIWJVJM9BeqFHQLvC8uVL3DfFn:8WlcSJ97LRbJM9xFwL6tF3Dtn
MD5:	747594BE6C4F3CAD60FD041F4D6B2F7F
SHA1:	7281CE747E33CF70A00FA454BBD8C0757A8534B1
SHA-256:	0C82D59157B3985CBF6F254CA12A63AE86AE08EFF432EE423D0F630D7B58D123
SHA-512:	D3822A112247C1C6B5E405B6405693D52225326C1B1DCCEF44127A828C16517ADFEBD6F1E09D4EE5A983C1452361A708E9B08ADCBF004FB90A3588623B53E111
Malicious:	false
Preview:	..// see relavent .h file..// "__ENABLE_LOGGING__" is not used anymore, to simplify and make only one build..// const __ENABLE_LOGGING__ = false;

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\content\remote.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2866
Entropy (8bit):	3.9577654921496856
Encrypted:	false
SSDEEP:	48:fUjX/azHQrw/Mt8vjVopMQDAGpORxQTho:kvaNjVo2CYH
MD5:	4D7F123CAD5ADDBBCD24532A7DA71839
SHA1:	A3E202D2E2E5E521DEE6C234AABFB3130108823F
SHA-256:	043DD5866F912585FAD932DF1735E702E904465BD8ABF04C7B62F257A5888B59
SHA-512:	FD4157D0889934B385FE3723C6230B259DDCAD93ED171C2486E5B462DE9BB806D60928AB16E4A11716CB60A8B1D0310F725034BA80B44EE9712AA6BAEFE94C78
Malicious:	false
Preview:	..var sim_g_scriptOnDocumemntComplete = null;....function simInitializeRemoteControl()..{ .. try.. { .. // MOVE to download complte of "control banner" ???/.. // step 1.. // get object of remote control web page.. var oElem = document.getElementById(SIM_REMOTE_CONTROL_ID);.. if (oElem) {.... if (oElem.contentWindow && oElem.contentWindow.SIMRC_getCodeForOnLoad) {.. // step 2.. // get script from remote control web page .. var script;.. script = oElem.contentWindow.SIMRC_getCodeForOnLoad();.. //alert("script = " + script);.... try {.. // step 3.. // execute script.. eval(script);.. }.. catch (e) {.. //alert("e = " + e.message);.. logSevere2(e);.. }.. }.. else {.. log

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\content\search.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	13939
Entropy (8bit):	4.490104471837317
Encrypted:	false
SSDEEP:	192:hz4NrMFE5ypxxPgANkYser6lUljfT5wfimNN5h5Up:Pl5v6KtfT5wamNw
MD5:	A381E5306EA29348EB9965719A4F37E5
SHA1:	2602001F45E3EC3B07CD5E595843A20ACD3F9DCE
SHA-256:	7A5F71914DA2546E0C9D00B64A3CD3945312AA143768A8D7D2B8C472A38ED346
SHA-512:	0431AD475B09A019C3A1DFD730D97C0A07534A5BB8D9B9040092DC3350CBBD1BE47D302A5DAE94C6825B2F20C3C006EE4FD2D945D38D69F26A41EA667455756D
Malicious:	false
Preview:	....var sim_g_historyCapacity = null;..var sim_g_arrExteranlSearch = null;....// trims start and end..function simTrimString(string)..{.. // If the incoming string is invalid, or nothing was passed in, return empty.. if (!string).. return "";.... string = string.replace(/^\s+/, ''); // Remove leading whitespace.. string = string.replace(/\s+$/, ''); // Remove trailing whitespace.... return string; // Return the altered value..}....////////////////////////////////////////////////////////////////////////////////..// 1) Calls "simTrimString" to trim start and end..// 2) Removd "runs" - and convert all runs of more than one whitespace..// character into a single space. ..// The altered string gets returned...////////////////////////////////////////////////////////////////////////////////..function simTrimStringAndRemoveRuns(string)..{.. // If the incoming string is invalid, or nothing was passed in, return empty.. if (!string).. return

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\content\searchguard.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	15169
Entropy (8bit):	4.471034320295774
Encrypted:	false
SSDEEP:	384:1jHSjKtnD3TbQDzFPswdXNpF+KdoWkln6yBQdLJqKW87ZE0dhrBBhB4XqIh:ZyjKZD3vQDzFpXv3oWun6yBQdLJqKW8g
MD5:	AD60C046850E849FDE33AC00B901E559
SHA1:	663FD643D2640A319F759985BFAD727CDB26CABD
SHA-256:	39F6887369282791F458CA901DAA9690639931208CA08C7555601AA76CFC46E1
SHA-512:	42631BA9213413F857F3DAC4AABCA400D26A9303AA427D9E408FE8FF5923132E1F6D21E08DAE58B0879E07D0B49EE531D87239AF4C62EFF0FC82A513C17D1441
Malicious:	false
Preview:	..const SIM_SEARCH_GUARD_PARAM = "st";....function simUnhideSearchEngine() {.. logEnter();.... try{.. var engine = simGetSearchEngine();.. if (engine!= null && engine.hidden == true) {.. engine.hidden = false;.. }.. }catch(e) {.. logSevere2(e);.. }..}....// checks if param exists in url of search provider (plugin)..// it is found under os:Param tag, in XML of search plugin...// didn't fidn a way to check this using API/XPCOM etc...function simCheckIfParamExistsInSearchProviderURL(paramName) {.. logEnter();.. .. var exists = false;.. try {.. var engine;.. var SP;.. var xml;.. .. engine = simGetSearchEngine();.. if (engine != null) {.. SP = simGetSearchPluginFile();.. if (SP.exists()) {.. xml = simReadFileToString(SP.path);.. if (xml != null && xml != "") {.. // we also check for prefix of &, bcz this is how we ad

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\content\searchservice.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1970
Entropy (8bit):	4.240138604578698
Encrypted:	false
SSDEEP:	24:1ME/NbNZ4DmHfknInl/2gbNmK8hxo3i14DpWitBxgWoQfhRos2iQRpbX3HY:1MEwKsInf4ThK3iykit3Zhqs2iQfnHY
MD5:	D84A32AC7348C138C959B8DED416E3BE
SHA1:	7D3636316AE54ECD3950D7C041E54D9028C5C56F
SHA-256:	7057A6C5AA02C8C89957FC9688585B9D5484C0E739722BD714FA619FFB312BB8
SHA-512:	723B1C032C5151E9A285683830C07F687A9408252F71E2277D2C312EC640352D798C494D9A952CC26CA1488504E52359285767F322289A1A7D9F0DD9461C0C01
Malicious:	false
Preview:	..function simGetSearchEngine() {.. var searchService = null;.. var engine = null;.... logEnter();.... try {.. searchService = kCC["@mozilla.org/browser/search-service;1"].getService(kCI.nsIBrowserSearchService);.. if (searchService != null) {.. engine = searchService.getEngineByName(SIM_SEARCH_ENGINE_NAME);.. }.. } catch (e) {.. logSevere2(e);.. }.. .. return engine;..}....function simAddSearchEngine() {.. .. var searchService = null;.. var engine = null;.. var bResult = false;.... logEnter();.... try {.. // step 1.. // check if engine already exists.. engine = simGetSearchEngine();.. if (engine != null) {.. logInfo("engine already exists");.. engine = null;.. }.. else {.. // step 2.. searchService = kCC["@mozilla.org/browser/search-service;1"].getService(kCI.nsIBrowserSearchService);.. if (searchService != nu

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\content\splitter.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3044
Entropy (8bit):	4.67890442222015
Encrypted:	false
SSDEEP:	48:QTHlWfqcTUJrzQ2fgFDQtgM8irSjXgmcCHwZoOkKT0wTx:ucSdhzD0oYgmEX/x
MD5:	6AFA89C5ED43D559D7503C6C1C826FBC
SHA1:	83BBA8FDD394CFC46ABD3E093F177DFDD85FBBA5
SHA-256:	F0DA29B0A1584D22E79D24E278C1DF28BDADE53867D769AD0A7E27188EDAD3BA
SHA-512:	3E2806E1E9C11DEDD6F745C89F7A2F8058D09F3ED44DD638C9417F45C4DB4B7D89FD604BCA40E4D2D80D2A9279B13FCD70CB0EE659A313DA3F825435C7441AFA
Malicious:	false
Preview:	// From: http://developer.mozilla.org/en/docs/XUL_Tutorial:More_Event_Handlers..// "The button and detail properties only apply to the mouse button related events,..// not mouse movement events...// For the mousemove event, for example, both properties will be set to 0."....var sim_g_dragging = false;..var sim_g_lastX = 0;..var sim_g_splitter_at_max = false;....function simInitializeSplitter()..{.. try.. {.. var oSplitter = simMyGetElementById("sim_toolbar_splitter");.. oSplitter.addEventListener('mousedown', simOnSplitterMouseDown, false);.. window.addEventListener('mousemove', simOnGlobalMouseMove, false);.. window.addEventListener('mouseup', simOnGlobalMouseUp, false);.. }.. catch(e).. {.. logSevere2(e);.. }..}....function simOnGlobalMouseMove(event)..{.. if (sim_g_dragging).. {.. simUpdateSplitter(event);.. sim_g_lastX = event.screenX;.. }..}....function simOnSplitterMouseDown(event)..{.. //logEnter();..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\content\stringbundles.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.738627059733319
Encrypted:	false
SSDEEP:	48:8G7y6KggRBGVcIgy6wLvOjR7oaupozmc4soM4zfEce:dG6KRqVT6wzwtmkj/
MD5:	E030A1FFDA7407FB1C06FDB448BD7571
SHA1:	2DF2D30A384A1C19C56391C8C16A31828621B5EC
SHA-256:	AE8F9E51B3FF22C151D3E6FCE7B5DC603D29716D773AEFFF8B20FC75C7E3EA76
SHA-512:	F0F02A7492C4D23E9C7B5BC2A69BFC757A4D3C7F051C0774F15431895C4D892017D4AE882D7FBA301240723723058C37B8149A74C650CAA769F6614D658E2810
Malicious:	false
Preview:	..var sim_g_StringBundle = null;..var sim_g_nsIStringBundle = null;....// should be called from XUL, or JS, where "document" object is defined..function simGetStringFromBundle(name)..{.. var result = "";.. .. try.. {.. if (!sim_g_StringBundle).. {.. sim_g_StringBundle = document.getElementById('sim_stringbundle');.. }.. result = sim_g_StringBundle.getString(name);.. }.. catch(e) {.. logWarning("exception for name: " + name);.. logSevere2(e);.. }.. return result;..}....// should be called from components, such as SIMAutoCompleteSearch.js,..// where "document" object is NOT defined..function simGetStringFromBundle2(name)..{.. var result = "";.. .. try.. {.. if (!sim_g_nsIStringBundle).. {.. // load bundle directly.. // see "Creating the bundle via XPConnect".. // (http://books.mozdev.org/html/mozilla-chp-11-sect-3.html).. var src = 'chrome://s

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\content\sweetim-contentmenu.xul

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	653
Entropy (8bit):	5.057236170457901
Encrypted:	false
SSDEEP:	12:TMG8NWF77hHEdBMBMh5I9XoCtLDAHjxAHXq6tW0N1ZHXO+gcWqSVJIsXGvc8:38kX9E6BWI9X7LqINrOaW7gsc
MD5:	BB5DF7BCC2B69614EAA5111958390C72
SHA1:	14D1A1BF2E69F338B09382EB2E1B564D0CADC02B
SHA-256:	83492D77CA972E1D2D07A7842C836A78F64F49A753E8344354F16C61AAACF820
SHA-512:	711CADB3715B729E6A91560A098504D71CF64A19528173DF0017CA839738B4F654FFF97EDAC0534E3FF68E0BC2E2201DF4806AAF96DEBB698645D16268E5868A
Malicious:	false
Preview:	<?xml version="1.0"?>..<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>......<window id="id_window_sim_content_menu"... title=""... orient="horizontal"... hidechrome="true"... xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"... onload="simContentMenuWindowOnLoad(event);"... onunload="simContentMenuWindowOnUnload(event);">.... <script type="application/x-javascript" src="chrome://sweetim-toolbar/content/contentmenu-handler.js" />......<browser id="id_browser_sim_content_menu".. ..src="http://content.sweetim.com/sim/mfftb20.html".. ..width="420px".. ..height="440px">...</browser>..</window>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\content\sweetim-toolbar.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	12636
Entropy (8bit):	4.680240080485856
Encrypted:	false
SSDEEP:	192:XVCcV9nwupCxD5AcVl1MMoRgYjVY3kPZR8qsXdW4B8aHdivE/FF:kM9w/l57KR6atSLlFF
MD5:	63448F76A72B0C3858601365E5083946
SHA1:	EFDD6D0BAF4F2E1ACE8D1E7AD5918BCD9AF4D998
SHA-256:	088BB06B17A050D1CA7D6EF082130E4B1752CB36D49E2184F4B207CA43813B02
SHA-512:	65C10E8507688ABBCF27403ED338D488314961DCEC5E145E96FD4B1E5392D6D748404353810BA6E58F5AC34FAE3C3AC86B8490BC8418A5B8FBAC0D1578D04590
Malicious:	false
Preview:	..var g_sim_onload_completed = false;....function simOnFirstRun()..{.. try.. {.. logEnter();.. .. simOnInstall();.. }.. catch(e).. {.. logSevere("catch: " + e.message);.. }..}....function simIsFirstRun()..{.. var result = true;.. var has;.. .. try.. {.. logEnter();.. .. has = simHasConfigPrefs();.. result = !has;.. }.. catch(e).. {.. logSevere2(e);.. }.. .. return result;..}....function simOnToolbarDOMAttrModified(event)..{.. try.. { .. //logEnter();.. .. if (event.attrName == 'collapsed').. {.. var bCollapsed = event.newValue == 'true';.. simOnToolbarCollapsed(bCollapsed);.. }.. }.. catch(e).. {.. logSevere2(e);.. }..}......// we get here, when user has hidden the toobar using..// "View"/"Toolbars" and the uncheck out toolbar..function simOnToolbarCollapsed(bCollapsed)..{.. try.. { .

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\content\sweetim-toolbar.xul

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	17033
Entropy (8bit):	4.649335724543702
Encrypted:	false
SSDEEP:	192:NYebeeVIOFtAkvocIhzBeLdGrRY6hl6gfHZbOB71oOGJ:NYYSi4lZ+717GJ
MD5:	C5E042E981DB5DC014E02AAD88A1DE44
SHA1:	2DC36BD5A53B298A5C18672F1EECC9EB72DCCC69
SHA-256:	DBAB041CFA5D8696FC6830F7814848DABE75AC2BEE7F537A54F75D16CFB28A1E
SHA-512:	C87C57DC1E2A58EC2A0121F6DFE647C1B0734BAD53DDD08BDD2483E50888DDE5DE17A8518EB11C16E4A186A83099EA12478319502CBACD4754B5CAA85807C748
Malicious:	false
Preview:	<?xml version="1.0"?>....<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>..<?xml-stylesheet href="chrome://sweetim-toolbar/skin/sweetim-toolbar.css" type="text/css"?>....<!DOCTYPE overlay SYSTEM "chrome://sweetim-toolbar/locale/sweetim-toolbar.dtd">....<overlay id="sweetim_overlay".. xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">.. .. <script type="application/x-javascript" src="chrome://sweetim-toolbar/content/main.js" />.. <script type="application/x-javascript" src="chrome://sweetim-toolbar/content/global-namespace.js" />.... <stringbundleset id="stringbundleset">.. <stringbundle.id="sim_stringbundle" .. src="chrome://sweetim-toolbar/locale/sweetim-toolbar.properties"/>.. </stringbundleset>.. .. not used since fix of RNDTBFF-56.. <popupset id="mainPopupSet">.. <popup.id="sweetim_popup_history".. type="autocomplete"/>.. </popupset>.. --> ....

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\content\tabinfo-array.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2353
Entropy (8bit):	4.4133762029710155
Encrypted:	false
SSDEEP:	24:/lQx+UoGfwVGhCyVj8Y1PXDKQDu1BjCxCto6qPlRPd9tfDQnZic4EwKCu9w+zauA:/UBoGfwoht8YF21IfLFDQ4c4kSJzQQ
MD5:	EDE3C37AA333FA205B96194440176B3A
SHA1:	550F751348470DCB586DA42834C26457A4B711B1
SHA-256:	8C2D75157683F82FD0F36058F73B68F924CA0BCA79F5F04D6EE51D31D020970F
SHA-512:	C8FF1992EE4C6C4C10422E67BE140BF7129D9D15F1E250689AEC8742E32BB65821B4BB6CEDC1BDB5447E2B2EB0D3D201546F73CE3FE7C0051D63CE22EC2667D4
Malicious:	false
Preview:	..var sim_g_arrTabInfo = null;....function simGetTabInfo(tabId) {.. var oTabInfo = null;.... if (tabId != undefined && tabId != null && tabId != "") {.. oTabInfo = sim_g_arrTabInfo[tabId];.. if (oTabInfo == undefined) {.. logWarning("oTabInfo is undefined");.. }.. }.. else {.. logWarning("tabId not valid");.. }.. return oTabInfo;..}....// adds SIMTabInfo to array, for relevant tabId;..// returns the web progress listener object, which is associated with this tab..function simAddTabInfoToArray(tabId) {.. var result = null;.. try {.. if (tabId != null && tabId != "") {.. // step 1.. // create array, if not created already.. if (sim_g_arrTabInfo == null) {.. sim_g_arrTabInfo = new Array;.. }.... // step 2.. // create progress listener.. var oWPListener = new SIMWebProgressListener(tabId);.... // step 3.. //

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\content\tabinfo.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	11111
Entropy (8bit):	4.412389992855388
Encrypted:	false
SSDEEP:	96:O0+++rWl/S5vHvXm0kqs1zeGY097hKBIBfI/RvWvXHcnmsccCiivJftPk9XCxjM:Ov++O/S5fv1zezi0pMOfn4iBkN
MD5:	603652891F4165AD4CE73E9B4AE82901
SHA1:	AB08428843B571051EB4F15EE2AD03408A04FAE9
SHA-256:	8D5BC4EC85859DD72D92552E8B5EEC890D41DDEB6F42DE4289564F6CB6E0C7FA
SHA-512:	6CA0C10601E1F83392CFEAF84E5BC3BDE60B9BD1B6D247C207CCEC6CF3E9215EE996C2C953A13B2C1ECE95781909B3D2A433CEED6EA6960022E89C765A2D8E75
Malicious:	false
Preview:	..function SIMTabInfo()..{.. this._webProgressListener = null;.. this._sSearchString = ""; .. this._bHighlight = false;..}....function simGetSelectedTabBrowser() {.... var index = null;.. var oBrowser = null;.... index = gBrowser.mTabContainer.selectedIndex;.. if (index != null) {.. oBrowser = gBrowser.getBrowserAtIndex(index);.. if (oBrowser == null) {.. logWarning("oBrowser == null");.. }.. }.. .. return oBrowser;..}....function simGetSelectedTabURI()..{.. var oBrowser;.. var oUri;.. .. oBrowser = simGetSelectedTabBrowser();.. oUri = oBrowser.currentURI;.. .. return oUri;..}....function simGetSelectedTabHost()..{.. var oUri = null;.. var oResult = null;.... oUri = simGetSelectedTabURI();.. if (oUri != null) {.. try {.. oResult = oUri.host;.. } catch (e) {.. // we get here when tab is opened with "Addons Manager", in FF4.. // or when tab is e

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\content\tooltip.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3243
Entropy (8bit):	4.391385132766343
Encrypted:	false
SSDEEP:	96:ijC31Dmdj5UY2c6Q6gm6aL6eN76bL6z/S:ijQ1Dmdj5J2PzgFa+eNub+z/S
MD5:	3CB6E2DE74E1DBA38BF405DD21786908
SHA1:	0E0B2EA4AF92DFF76FCBBA0F83D1659C6BB6A229
SHA-256:	155DF0BA4DFB6E9792D291B1C58B738EC0F908665E594205BA1445CC6EAF55B8
SHA-512:	E7A84B89EA6B18DE5298FE5632C71601423D989D17009D6D85E4B550848541838C9F2F8027938E379644E5D72802880B8576CF10B76338DC62B7AE413F70ADA5
Malicious:	false
Preview:	....// Explenation: why we use "simOnTooltipNeedText" for dropmarkers:..// This method is used to set a tooltip to a dropmarker,..// Since setting "tooltiptext" doesn't work...// This code was used (and didn't work):..// oDropmarker = document.getAnonymousElementByAttribute(oButton, 'class', 'toolbarbutton-menubutton-dropmarker');..// oDropmarker.setAttribute('tooltiptext', strTooltip);..// As said, it doesnt't work (apparently requires adding xbl binding), so the trick with..// "simOnTooltipNeedText" is used instead....function simIsFromDropmarker(node)..{.. var result = false;.. try.. {.. // this "trick" is not documented... // it is by trial-and-error, and comparing all.. // atrributes of the button, when the mouse is over.. // the button itself VS mouse is over the dropmarker.. if (node.hasAttribute("buttonover")).. result = false;.. else.. result = true; .. }.. catch(e).. {.. logS

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\content\uninstallobserver.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	6308
Entropy (8bit):	4.322938270187311
Encrypted:	false
SSDEEP:	96:FizaB32QhH8Ocuzwa5o4KQqkhJzyjz35UAlxlONyOopRQMVD:xNlWVv5zkCZjlxAqzQMVD
MD5:	D6F084EB3DB05BC7DE868C5A43266E22
SHA1:	31EDAEE1B293F2304AFEAA1F8DC655FAE8D97947
SHA-256:	D3144F66CA27D00ADD929B16A377EB4197BE80403F104FB577E48EE7CBB02A1A
SHA-512:	B4F2382A0473755FB495ECD00EBF3C4FAB00163BC07F2DDEC737E3358EE7F922399834416DE1C6A5AFAD47D68D1F3F10319F4DACA02D33BB232B99121F37C933
Malicious:	false
Preview:	..// based on:..// Creating an uninstall script for an extension..// http://xulsolutions.blogspot.com/2006/07/creating-uninstall-script-for.html....const g_SWEETIM_EXTENSION_UUID = "{EEE6C361-6118-11DC-9C72-001320C79847}";....function simInitializeUninstallObserver(){.. .. logEnter();.. .. try{.. var bFF4 = simIsFirefox4BetaOrLater();.. if (bFF4){.. simAddAddonListener();.. }.. else{.. sim_g_UninstallObserver.register();.. }.. }catch(e){.. logSevere2(e);.. }..}....function simUninitializeUninstallObserver(){.. .. logEnter();.... try{.. var bFF4 = simIsFirefox4BetaOrLater();.. if (bFF4){.. simRemoveAddonListener();.. }.. else{.. sim_g_UninstallObserver.unregister();.. }.. }catch(e) {.. logSevere2(e);.. }..}....var sim_g_extensionManager = null;....// gets the extensions manager ("addons dialog")..function simGetExtensionsManang

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\content\version-ff.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3189
Entropy (8bit):	4.859823909450792
Encrypted:	false
SSDEEP:	96:yNLUXUmNLUdUoNLUuUhNLUYUGNLUbUxVGs+:y+km+Oo+5h+PG+IxVGs+
MD5:	626EC7868806436521619FFA2D4C43AE
SHA1:	7CC61D0CF2655750D4DE24A019EB68C49F24F9C3
SHA-256:	23A71210EAEE3F9CE45FA18C4066469D1D08246228999A32FDE68AB7A04A21ED
SHA-512:	A6C43FDB39890D82140DA955FCEDF33EAC0B1195ADE82A865C8DF4AE8397989C1696A400DAE5BBC38CC3AED590A041F1314C42E7B0DC5CB2A8A5C14AB914E46C
Malicious:	false
Preview:	....// geckgo version < param version..function simGeckoVersionLessThan(version) {.. var result = false;.... if (kCI.nsIXULAppInfo) {.. var appInfo = kCC["@mozilla.org/xre/app-info;1"].getService(kCI.nsIXULAppInfo);.. var versionChecker = kCC["@mozilla.org/xpcom/version-comparator;1"].getService(kCI.nsIVersionComparator);.. if (versionChecker.compare(appInfo.platformVersion, version) < 0) {.. result = true;.. }.. }.. else {.. logSevere("kCI.nsIXULAppInfo");.. }.. return result;..}....// geckgo version > param version..function simGeckoVersionGreaterThan(version) {.. var result = false;.... if (kCI.nsIXULAppInfo) {.. var appInfo = kCC["@mozilla.org/xre/app-info;1"].getService(kCI.nsIXULAppInfo);.. var versionChecker = kCC["@mozilla.org/xpcom/version-comparator;1"].getService(kCI.nsIVersionComparator);.. if (versionChecker.compare(appInfo.platformVersion, version) > 0) {.. result = true;

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\content\version.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1864
Entropy (8bit):	4.240060812234503
Encrypted:	false
SSDEEP:	24:lrzBe/hEjROmSYbh/VQB3tE2kDZeD2ex1ckibN2TaSDpzt7/R4V3Dnce:5IcrRhdQptEVeEO767ce
MD5:	2871DC9B99AEEB281122611968CFF89A
SHA1:	3FEBAD1B619F1E00C4D028D4BF6EAD1C68BF8BAD
SHA-256:	D26BEA9835FD7449906E44DCD8A390C8FB6F1A56D3BBA76D8F0331C36ED01CD3
SHA-512:	43489D6C1ECC3C3A34B421D13893F1BF5BD1A074F79C050965B3CD2950333FAF8D10A4E5B9751C11A737B09EACF975A9694186A0AFA612DB3E3788282F797B45
Malicious:	false
Preview:	....// globals, used for getting version in FF4..var sim_g_version = null;..var sim_g_event = null;....function simAddonManagerCallback(addon) {.. try {.. // step 1.. // set global value.. sim_g_version = addon.version;.. // step 2.. // set evant.. sim_g_event.value = true;.. } catch (e) {.. logSevere2(e);.. }..}....function simGetVersionFromRDF() {.. .. var version = "";.. try {.. logEnter();.... var oDetails = null;.. oDetails = simGetAddonDetails();.. if (oDetails != null) {.. version = oDetails._version;.. }.. else {.. logWarning("oDetails != null");.. }.. }.. catch (e) {.. logSevere2(e);.. }.... return version;..}....function simUpdateVersionFromRDFInPrefs()..{.. try.. {.. var version = simGetVersionFromRDF();.. simSetConfigValue("version", version);.. }.. catch(e).. {.. logSevere2(e); ..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\content\wait.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.159322508675548
Encrypted:	false
SSDEEP:	24:1nI9uwAoWL0vDaGH557rFqiVvHZfcaUsicL:1n4u9S5vEi55kaucL
MD5:	29473F2C75F43F49572F1BF8868B9C74
SHA1:	17091A09EFC714CF73A0C0211CDE5B4670624148
SHA-256:	F336277ED0859E586E814110D7260345BBB9531DD0914A1B9F72A27BCEBB8286
SHA-512:	C071FD05145916BAF91F572D0DBECF91931D11E7126C7354AB0BF61C2A0DEBE6CF7D1EC58BD240A876C08E633D7EA8D76B8C1F2F233DC9F67425C2925A782A5D
Malicious:	false
Preview:	..function simMyEvent() {.. this.value = false;..}....// waits till the param event value is set to true..// returns true if event coccured, false if timeout reached..function simWaitForEvent(oMyEvent, timeout) {.... var result = null;.. try {.. var loops = 0; // used only for debug.. var start;.. var now;.. var elapsedMillSecs;.. var thread = kCC["@mozilla.org/thread-manager;1"].getService(kCI.nsIThreadManager).currentThread;.... // step 1.. // take snapshot of current time.. start = new Date();.... // step 2.. // while event not set to true.. while (oMyEvent.value != true) {.. loops++;.... // step 3.. // check if timeout elapesed.. now = new Date();.. elapsedMillSecs = now.getTime() - start.getTime();.. if (elapsedMillSecs > timeout) {.. // if timeout elapsed -> break.. result = false;.. br

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\content\webprogresslistener.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2992
Entropy (8bit):	4.687458025277307
Encrypted:	false
SSDEEP:	48:V7BcIl2uVA1wbXMJGOPbySbKH/JWRU8rSWTeAgn9:5BRwKHhWRJSWTeh9
MD5:	D7AC8AA1B5ED24A1CE649258252D0184
SHA1:	CC9B641450B84CDE7D0936043836B4E7C53F42FC
SHA-256:	E3B25502DCA1B164A6F01F087EF913F9F7B869989BF09FE70EFF747D0BA59CBA
SHA-512:	DCAAE7CC5FB24346BECD5B11F244EFBED30625404048F7ECB9678F0567BAF627D8C4D5A205C7A79425D14DC561856D258F56E0FAD2DB7EAE1223439A7DD96ED0
Malicious:	false
Preview:	..const WP_NOTIFY_STATE_NETWORK = Components.interfaces.nsIWebProgress.NOTIFY_STATE_NETWORK;..const WP_NOTIFY_STATE_DOCUMENT = Components.interfaces.nsIWebProgress.NOTIFY_STATE_DOCUMENT;..const WPL_STATE_IS_NETWORK = Components.interfaces.nsIWebProgressListener.STATE_IS_NETWORK;..const WPL_STATE_IS_DOCUMENT = Components.interfaces.nsIWebProgressListener.STATE_IS_DOCUMENT;..const WPL_STATE_START = Components.interfaces.nsIWebProgressListener.STATE_START;..const WPL_STATE_STOP = Components.interfaces.nsIWebProgressListener.STATE_STOP;......//..// Object SIMWebProgressListener..//....// Listener which catches events when page is being loaded within a tab...function SIMWebProgressListener(tabId)..{.. if (!tabId).. {.. // get current tab id.. tabId = simGetSelectedTabId();.. if (tabId==null \|\| tabId=="").. {.. logWarning("invalid tabId");.. }.....}.. this.tabId = tabId;..}....// Listener object - designe

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\locale\de-DE\sweetim-toolbar.dtd

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	3226
Entropy (8bit):	4.968367102212091
Encrypted:	false
SSDEEP:	48:wt3gCoVqrKAh+1zqI1tKSUyjBCS43IBAdTSmTHCow3pCeVLLv:OMYL0zqOIbAAVTQpBV3v
MD5:	343E720BF01C524700FD1371E25ED76F
SHA1:	4513CE9406E22284E73D8235807B8EC341801FAC
SHA-256:	E5F0DC1A6B2A6B251C616B05A18AA0E56CAB386646F7806B2753C3D1BEE63BFB
SHA-512:	0794397E3706E3CBBEF9473E03DD6CBC3594A818458FC6EF2E33E9B53EAA4C85F5F40E7BF0426255D68DFC13B881B6925CF884D07E756081073D098A80EA9D9E
Malicious:	false
Preview:	<!ENTITY sweetim.main_menu.home.label "SweetIM Start">..<!ENTITY sweetim.main_menu.search.label "SweetIM Suche">..<!ENTITY sweetim.main_menu.messageboard.label "SweetIM Message Board">..<!ENTITY sweetim.main_menu.messageboard.tooltip "Zu den SweetIM Foren gehen">..<!ENTITY sweetim.main_menu.trackseraser.label "Tracks Eraser">..<!ENTITY sweetim.main_menu.help.label "Hilfe">..<!ENTITY sweetim.main_menu.feedbcak.label "Feedback Schicken">..<!ENTITY sweetim.main_menu.feedbcak.tooltip "Kontaktieren Sie uns in allen Fragen rund um die SweetIM Toolbar f.r Firefox">..<!ENTITY sweetim.main_menu.privacy.label "Datenschutz">..<!ENTITY sweetim.main_menu.privacy.tooltip "Datenschutzinformationen zur SweetIM Toolbar f.r Firefox">..<!ENTITY sweetim.trackseraser_menu.clearCookies.label "Cookies l.schen">..<!ENTITY sweetim.trackseraser_menu.clearCookies.tooltip "Hier k.nnen Sie Ihre Cookies l.schen">..<!ENTITY sweetim.trackseraser_menu.clearCache.label "Cache

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\locale\de-DE\sweetim-toolbar.properties

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	1618
Entropy (8bit):	4.780426889876654
Encrypted:	false
SSDEEP:	24:E915lh2Z3IlUPDmTGEcLvKESsO96yTiTXKo8HqybkE/rOeopllQPVY:kuIWShmvKETOEHkqA3mt
MD5:	A9B471175D46F7E036E663F420F7B8F1
SHA1:	FB4BF0AC6393BBF9D10E8243F0660A1B0E86165F
SHA-256:	C0493FC117448470EA45CC0C303FC24597B6F73DBC3B5CEC823A34ACEAC3A224
SHA-512:	C0DA03C559E677F9D566575FCA19522064D6D6BD048644143DF1DEE606E89072E950C593A3F8052412BDD9627926FDEC5EA845C8EA58C7928B714E20A0B204B2
Malicious:	false
Preview:	sweetim.property.button.highlight.enabled.tooltip=Hervorhebung der Suchbegriffe auf dieser Seite umschalten..sweetim.property.button.highlight.disabled.tooltip=Text im Suchfeld eingeben um ihn hervorzuheben..sweetim.property.button.findword.tooltip=N.chstes Vorkommen von '%1$S' im aktuellen Dokument finden..sweetim.property.history=Chronik..sweetim.property.button.main_menu.tooltip=Zu SweetIM Suche gehen..sweetim.property.button.main_menu.dropmarker.tooltip=SweetIM Men...sweetim.property.button.search.tooltip=Web-Suche..sweetim.property.button.search.dropmarker.tooltip=Klicken Sie zur Auswahl anderer Sucharten ..sweetim.property.menuitem.chevron.highlight.label=Highlights..sweetim.property.uninstall.title=%S deinstallieren..sweetim.property.uninstall.text=M.chten Sie die SweetIM Homepage und SweetIM Sucheinstellungen beibehalten, so dass Sie weiterhin schnellen Zugriff auf leistungsstarke Internetsuche genie.en k.nnen?..sweetim.property.searchguard.hp.caption=Homepage-Einstellunge

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\locale\en-US\sweetim-toolbar.dtd

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3103
Entropy (8bit):	4.908927731948598
Encrypted:	false
SSDEEP:	48:1BMMgluIHzUgLA9k3tgxmHMdT8fdLMMB4ZqBMMwMCtMVLuMv:/j+VzUCYUsqlwujnPVNv
MD5:	2B62306DADAAC6BC5992539D32CEE068
SHA1:	AEF00558ED94D83E35FE470EE31574201D02ABC4
SHA-256:	B79F50D22CB081A3C96AFAAB7E362A60C2259C0A76B82B94DDFAF2370A9A8E36
SHA-512:	C7B39C09C9FF5B2BA75634DD79D199F4189784192F5FFCF933B3CA4AA049E65EC1308D63C3BD3A65C0E369C6291DC80A37397AD1CCDB528B134F9C6F9466BD4C
Malicious:	false
Preview:	<!ENTITY sweetim.main_menu.home.label "SweetIM Home">..<!ENTITY sweetim.main_menu.search.label "SweetIM Search">..<!ENTITY sweetim.main_menu.messageboard.label "SweetIM Message Board">..<!ENTITY sweetim.main_menu.messageboard.tooltip "Go to SweetIM Forums">..<!ENTITY sweetim.main_menu.trackseraser.label "Tracks Eraser">..<!ENTITY sweetim.main_menu.help.label "Help">..<!ENTITY sweetim.main_menu.feedbcak.label "Contact Us">..<!ENTITY sweetim.main_menu.feedbcak.tooltip "Contact us in all matters relating to SweetIM Toolbar for Firefox">..<!ENTITY sweetim.main_menu.privacy.label "Privacy Information">..<!ENTITY sweetim.main_menu.privacy.tooltip "SweetIM Toolbar for Firefox privacy information">..<!ENTITY sweetim.trackseraser_menu.clearCookies.label "Clear Cookies">..<!ENTITY sweetim.trackseraser_menu.clearCookies.tooltip "This will erase your cookies">..<!ENTITY sweetim.trackseraser_menu.clearCache.label "Clear Cache">..<!ENTITY sweetim.trackserase

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\locale\en-US\sweetim-toolbar.properties

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1535
Entropy (8bit):	4.634286586985755
Encrypted:	false
SSDEEP:	24:E9Gs82eGZumVva6g3VreT3un57aoPUakT+4bXakT+f5oLJhbB:F6uYvIreT0GoCTLlT8qJn
MD5:	F328392AF820D3B5E73CFCB4982270AE
SHA1:	741DCA0A4BE0FC3F9F43ADE15FABA882243CF785
SHA-256:	04AEB167614D959F0EE1FBA37D10018D3CE8D77C0AC8336E0A2C388DDEF63AF5
SHA-512:	74BE6B647AEEEB2DAE2B7160ABDE358B9A208E4F6DB7D8DDF69147E7831CEBAD9171A1E311264143CA6528FA8B1CE80C1CC13EAE2549707A685BC517234AB87F
Malicious:	false
Preview:	sweetim.property.button.highlight.enabled.tooltip=Toggle highlighting of search terms on this page..sweetim.property.button.highlight.disabled.tooltip=Enter text in the search box to highlight it..sweetim.property.button.findword.tooltip=Find next occurrence of '%1$S' in current document..sweetim.property.history=History..sweetim.property.button.main_menu.tooltip=Go to SweetIM search..sweetim.property.button.main_menu.dropmarker.tooltip=SweetIM Menu..sweetim.property.button.search.tooltip=Search the Web..sweetim.property.button.search.dropmarker.tooltip=Click to select other search types..sweetim.property.menuitem.chevron.highlight.label=Highlight..sweetim.property.uninstall.title=Uninstall %S..sweetim.property.uninstall.text=Would you like to keep the SweetIM homepage and SweetIM search settings so you can continue enjoying quick access to powerful internet search?..sweetim.property.searchguard.hp.caption=Home page Settings Change..sweetim.property.searchguard.hp.message=Your default

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\locale\es-ES\sweetim-toolbar.dtd

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	3363
Entropy (8bit):	4.953586806232814
Encrypted:	false
SSDEEP:	48:el1K9muYgYqOHznSNEnlZoY8rSYQhfY3cThI/5s7YFfLC:Y5zKEgSI/5OYFf2
MD5:	DA4E42A8F0D9CB3FE917D9B08DFF4E44
SHA1:	9224598E58A628E1125683A8C17823B269380DF9
SHA-256:	3B2597E3A3995619AD16ED69829FA0990CDFFB97B7F6525E3D9F05C2BF46D83C
SHA-512:	B3D36A91B073CFC63CC6CE4A9759564D9825E49B89140C4A0170C6654E61B43C0781524218BA6694F522B0D71FC50F86AB3537F9D8C2D62C462B43E632AB90A4
Malicious:	false
Preview:	<!ENTITY sweetim.main_menu.home.label "Inicio SweetIM">..<!ENTITY sweetim.main_menu.search.label "B.squeda SweetIM">..<!ENTITY sweetim.main_menu.messageboard.label "Panel de mensajes SweetIM">..<!ENTITY sweetim.main_menu.messageboard.tooltip "Ir a Foros SweetIM">..<!ENTITY sweetim.main_menu.trackseraser.label "Borrador de pistas">..<!ENTITY sweetim.main_menu.help.label "Ayuda">..<!ENTITY sweetim.main_menu.feedbcak.label "Cont.ctenos">..<!ENTITY sweetim.main_menu.feedbcak.tooltip "P.ngase en contacto con nosotros en lo relacionado con la barra de herramientas SweetIM par Firefox">..<!ENTITY sweetim.main_menu.privacy.label "Informaci.n de privacidad">..<!ENTITY sweetim.main_menu.privacy.tooltip "Informaci.n de privacidad para la barra de herramientas SweetIM para Firefox">..<!ENTITY sweetim.trackseraser_menu.clearCookies.label "Borrar cookies">..<!ENTITY sweetim.trackseraser_menu.clearCookies.tooltip "Borrar. sus cookies">..<!ENTITY sweetim.tr

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\locale\es-ES\sweetim-toolbar.properties

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	1805
Entropy (8bit):	4.692581821283924
Encrypted:	false
SSDEEP:	24:E9zIxp2HNZB46N8vLcJxcyRIE2BZwuu39Aue1SXi9n4uevlXe9hue+:2IxiNZB4xvLMxvaK9AueN9n4ues9hue+
MD5:	390E575C828684329B97619EB451ED83
SHA1:	651CBB3F2C1C8A360CBAE4D00E77AD3FAF24A330
SHA-256:	67FD3B472B8243E1B101BA54427E78C0C3C0DCC1EE61E1389A6C0BFA70CE5A9C
SHA-512:	6F7BA65224DE94A5D388D6CAF23B544A95FBE9B059680743C2D48D979B4BAFD4D1A8897E2E97415E1D77AD8AD4ACC5952C981E757428730456714FFF81D5F571
Malicious:	false
Preview:	sweetim.property.button.highlight.enabled.tooltip=Alternar el resaltado de los t.rminos de b.squeda en esta p.gina..sweetim.property.button.highlight.disabled.tooltip=Introducir texto en el cuadro de b.squeda para resaltarlo..sweetim.property.button.findword.tooltip=Buscar la siguiente aparici.n de '%1$S' en este documento..sweetim.property.history=Historial..sweetim.property.button.main_menu.tooltip=Ir a b.squeda SweetIM Search..sweetim.property.button.main_menu.dropmarker.tooltip=Men. SweetIM ..sweetim.property.button.search.tooltip=Buscar en la web..sweetim.property.button.search.dropmarker.tooltip=Hacer clic para seleccionar otros tipos de b.squedas..sweetim.property.menuitem.chevron.highlight.label=Resaltar..sweetim.property.uninstall.title=Desinstalar %S..sweetim.property.uninstall.text=.Le gustar.a conservar la configuraci.n de la p.gina de inicio SweetIM y de b.squeda SweetIM de manera que pueda seguir disfrutando de un r.pido acceso a una potente b.squeda de Int

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\locale\fr-FR\sweetim-toolbar.dtd

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	3386
Entropy (8bit):	4.946143805128272
Encrypted:	false
SSDEEP:	48:YUOGEF59RzwDJXc3Ga9jwTfBtVdgs5zglLXMa:gRzwDJCj8fwsIga
MD5:	4FA0C67A5376147914F61095F68FF413
SHA1:	467B3B262F1803CF4CB11F0DF1189305CCA6493C
SHA-256:	38A9AAE24ABCF3ED24EA64E8A1A3831DA557C6B60582A70E3973E4F78B97E8A3
SHA-512:	A53D7BE419CE82A65314FF5404F51CAA9DBDDD999D0B4315095FDFBBCF2E33A2FF26750E39913BD52E15CEF557F26A9076CB2B6DA6394884B8D37093C2865622
Malicious:	false
Preview:	<!ENTITY sweetim.main_menu.home.label "Accueil SweetIM">..<!ENTITY sweetim.main_menu.search.label "Rerchercher dans SweetIM">..<!ENTITY sweetim.main_menu.messageboard.label "Forum SweetIM">..<!ENTITY sweetim.main_menu.messageboard.tooltip "Aller aux forums SweetIM">..<!ENTITY sweetim.main_menu.trackseraser.label "Effacer mes traces">..<!ENTITY sweetim.main_menu.help.label "Aide">..<!ENTITY sweetim.main_menu.feedbcak.label "Contactez-nous">..<!ENTITY sweetim.main_menu.feedbcak.tooltip "Contactez-nous pour toutes les questions li.es . la barre d'outils SweetIM pour Firefox">..<!ENTITY sweetim.main_menu.privacy.label "Charte de confidentialit.">..<!ENTITY sweetim.main_menu.privacy.tooltip "Charte de confidentialit. sur la barre d'outils SweetIM pour Firefox">..<!ENTITY sweetim.trackseraser_menu.clearCookies.label "Effacer les cookies">..<!ENTITY sweetim.trackseraser_menu.clearCookies.tooltip "Ceci effacera vos cookies">..<!ENTITY sweetim.trackser

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\locale\fr-FR\sweetim-toolbar.properties

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	1943
Entropy (8bit):	4.7702687098251415
Encrypted:	false
SSDEEP:	24:E9Zk52rt7rzISjGKvkN9wqXvljqrKAYsjHZTCQAKYWYaPpT4QPOD0YWIKWl:0NtcSjRvCvljqm+1aaXPYK+
MD5:	4431C2790194EF7E437143F23CDC29E4
SHA1:	7BF58B987029638CF9DE413DC2086E842F429290
SHA-256:	BD64BB1D5964DDA5DCCC0E25ED26C51A10F6F3393DC8F608B7C1EC6F51B352E8
SHA-512:	0C72707E11613C8D3F4794B3FAC82D8CBFC8F1825BA721B5D08F5B718B5CEC8735FE0CA5C9886297F8EAA02189BC08A7A83E5AA030F48545177BFD5B10D91487
Malicious:	false
Preview:	sweetim.property.button.highlight.enabled.tooltip=Activer/d.sactiver le surlignage des mots recherch.s sur cette page..sweetim.property.button.highlight.disabled.tooltip=Saisir le texte dans la fen.tre de recherche pour le surligner..sweetim.property.button.findword.tooltip=Rechercher l.occurrence suivante de '%1$S' dans le document actuel..sweetim.property.history=Historique..sweetim.property.button.main_menu.tooltip=Aller . la recherche SweetIM..sweetim.property.button.main_menu.dropmarker.tooltip=Menu SweetIM..sweetim.property.button.search.tooltip=Rechercher sur le Web..sweetim.property.button.search.dropmarker.tooltip=Cliquer pour choisir d'autres types de recherche..sweetim.property.menuitem.chevron.highlight.label=Surligner..sweetim.property.uninstall.title=D.sinstallation de %S..sweetim.property.uninstall.text=Souhaitez-vous conserver la page d.accueil SweetIM et les param.tres de recherche SweetIM afin de continuer . profiter d.un acc.s rapide . une recherche In

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\locale\it-IT\sweetim-toolbar.dtd

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	3350
Entropy (8bit):	4.8917769951145
Encrypted:	false
SSDEEP:	48:IfLNtmvDvLn05w5rzbQryFfDCBJvfToBep+ILYMa:IKbTn05wZzbQGVevcBlITa
MD5:	7AEE63481187ECEE6DB55617A6B75C56
SHA1:	77323755C9533660E759681FBDAEAB3175AA1886
SHA-256:	AD9DC46F37E945240BD28DCE8F0B7E930DBDE6071658A7D1CF2A77C2D1AA8685
SHA-512:	B412F7AFB983D5DB746A3FBEA849D8D6551D5CB632325E2574DFD6FEBADBFA17C0FAD8E7BF2E508BC409C330A28F8270BBCE45FFA43B3C5A145C3048DD64C572
Malicious:	false
Preview:	<!ENTITY sweetim.main_menu.home.label "SweetIM Home">..<!ENTITY sweetim.main_menu.search.label "Cerca con SweetIM">..<!ENTITY sweetim.main_menu.messageboard.label "Area messaggi SweetIM">..<!ENTITY sweetim.main_menu.messageboard.tooltip "Vai ai forum SweetIM">..<!ENTITY sweetim.main_menu.trackseraser.label "Cancella tracce navigazione">..<!ENTITY sweetim.main_menu.help.label "Aiuto">..<!ENTITY sweetim.main_menu.feedbcak.label "Invia commenti">..<!ENTITY sweetim.main_menu.feedbcak.tooltip "Contattaci per qualsiasi problema/quesito relativo alla barra degli strumenti SweetIM per Firefox">..<!ENTITY sweetim.main_menu.privacy.label "Informazioni sulla privacy">..<!ENTITY sweetim.main_menu.privacy.tooltip "Informazioni sulla privacy della barra SweetIM per Firefox">..<!ENTITY sweetim.trackseraser_menu.clearCookies.label "Cancella cookie">..<!ENTITY sweetim.trackseraser_menu.clearCookies.tooltip "L'operazione canceller. i cookie">..<!ENTITY sweetim.tr

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\locale\it-IT\sweetim-toolbar.properties

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1607
Entropy (8bit):	4.584285505783685
Encrypted:	false
SSDEEP:	24:E9YN2z/BC7vGlvPljRuq67EVhocEzZGwPFuOpEhoPyY7L:7uiv2vx0q6Q/oLz9OoqY7L
MD5:	E812535CE93B3877F4414DADF040B5F3
SHA1:	2D99203C28D900F4A891D7F0AC1C3B2B12168714
SHA-256:	4E8785F17DBEA4756212BD7705E98DA81A8D850F083E0ED0D97F83370DDCF101
SHA-512:	CED8B831D8117127F593FDB60EB24B7F96AED1E1E5B867886D4BBDC6F127D1B1F8E5413254802B2037537DAE913900877114FE51BC1D8D8A6218192142622BBF
Malicious:	false
Preview:	sweetim.property.button.highlight.enabled.tooltip=Attiva l'evidenziazione dei termini della ricerca su questa pagina..sweetim.property.button.highlight.disabled.tooltip=Inserisci il testo nella casella della ricerca per evidenziarlo..sweetim.property.button.findword.tooltip=Trova la successiva occorrenza di '%1$S' nel documento attuale..sweetim.property.history=Storico..sweetim.property.button.main_menu.tooltip=Vai a Cerca con SweetIM..sweetim.property.button.main_menu.dropmarker.tooltip=Menu SweetIM..sweetim.property.button.search.tooltip=Cerca nel web..sweetim.property.button.search.dropmarker.tooltip=Fai clic per selezionare altri tipi di ricerca..sweetim.property.menuitem.chevron.highlight.label=Evidenzia..sweetim.property.uninstall.title=Disinstalla %S..sweetim.property.uninstall.text=Vuoi salvare la home page SweetIM e le impostazioni di ricerca SweetIM per accedere rapidamente alla nostra potente ricerca Internet?..sweetim.property.searchguard.hp.caption=Cambio impostazioni Home

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\locale\nl-NL\sweetim-toolbar.dtd

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	3273
Entropy (8bit):	4.947891556350373
Encrypted:	false
SSDEEP:	24:f2r110JZGwl/a61lQsO1zscYDB0wyPzoSH51UJ+MOl7T+RisLcyFQLtl6WyI76DD:f2rICoEzTq0wyZ1g+fl7TBsaVVm/Lv
MD5:	01AC12BC348313FC5737F0C433088AD5
SHA1:	5C3F83C74ED43303D2A45070237911823DC06624
SHA-256:	B24408110B993F10E2205EA02E71EE66F5D5416304AFE1445F817B956B61A737
SHA-512:	3A0C823819BE7AEA64CC418A583B2974CA35D27573375028F386AEF1473088F172B4582C742C216736338C3126059B6A1457C5DADCAFED0940DF4422E5CE7FDC
Malicious:	false
Preview:	<!ENTITY sweetim.main_menu.home.label "SweetIM Home">..<!ENTITY sweetim.main_menu.search.label "SweetIM Zoekfunctie">..<!ENTITY sweetim.main_menu.messageboard.label "SweetIM Mededelingenbord">..<!ENTITY sweetim.main_menu.messageboard.tooltip "Ga naar SweetIM Forums">..<!ENTITY sweetim.main_menu.trackseraser.label "Sporenuitwisser">..<!ENTITY sweetim.main_menu.help.label "Help">..<!ENTITY sweetim.main_menu.feedbcak.label "Contact-informatie">..<!ENTITY sweetim.main_menu.feedbcak.tooltip "Neem contact met ons op over alles wat te maken heeft met SweetIM Taakbalk voor Firefox">..<!ENTITY sweetim.main_menu.privacy.label "Privacy informatie">..<!ENTITY sweetim.main_menu.privacy.tooltip "SweetIM Taakbalk voor Firefox privacy-informatie">..<!ENTITY sweetim.trackseraser_menu.clearCookies.label "Verwijder cookies ">..<!ENTITY sweetim.trackseraser_menu.clearCookies.tooltip "Dit zal uw cookies wissen">..<!ENTITY sweetim.trackseraser_menu.clearCache.label "Ve

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\locale\nl-NL\sweetim-toolbar.properties

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1692
Entropy (8bit):	4.595629503022333
Encrypted:	false
SSDEEP:	24:E9R2Xa+CgtWLmDvCwu0D+34bIcgPsVrPbjhgMhgPBQqPpTkg:s5gtgIvnD+tLgbrSTdkg
MD5:	582BEFD8357EB62BD9ADA8CA3F4D3E02
SHA1:	C6F8C959A779F90C99947956E1F38CA1429D08D5
SHA-256:	68513E080CD6D3B3CC9B1D55E5A3EFC40D341E6B7E2C29392A3C0AE046E20BB6
SHA-512:	FA4E7D22912E20ACC1B23214A60C343EA88DA0A20860F061599EE3113D2077964BF356B7ED5028D735911CB942D6359ADF81268BAA28B86AA0CF350F4C280618
Malicious:	false
Preview:	sweetim.property.button.highlight.enabled.tooltip=Markeren van in- en uitschakelen van zoekonderwerpen op deze pagina..sweetim.property.button.highlight.disabled.tooltip=Voer tekst in bij de zoekbox om die te markeren..sweetim.property.button.findword.tooltip=Vind de volgende keer dat het '%1$S' voorkomt in het huidige document..sweetim.property.history=Geschiedenis..sweetim.property.button.main_menu.tooltip=Ga naar de SweetIM zoekfuntie..sweetim.property.button.main_menu.dropmarker.tooltip=SweetIM Menu..sweetim.property.button.search.tooltip=Zoek op het web..sweetim.property.button.search.dropmarker.tooltip=Klik voor het kiezen van andere zoekfuncties..sweetim.property.menuitem.chevron.highlight.label=Markeer..sweetim.property.uninstall.title=%S de-installeren..sweetim.property.uninstall.text=Zou je de SweetIM homepage en SweetIM-zoekinstellingen willen bewaren, zodat je plezier kunt blijven hebben van een snelle toegang tot een krachtige internet-zoekfunctie?..sweetim.property.search

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\skin\SmileySmile.png

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PNG image data, 47 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4706
Entropy (8bit):	7.939609866150524
Encrypted:	false
SSDEEP:	96:nSDZ/I09Da01l+gmkyTt6Hk8nTLTT3Aau8Z3pqoMN4t4qDhV6c:nSDS0tKg9E05TLTTHu8E4t4qDrl
MD5:	72C9881C090F7C954451691AEC0266D2
SHA1:	E0572385B740CAD95B8471A77CF1384A8A4EC687
SHA-256:	510F120EFE2F234C3662020143BC9F606EABCFCB80C901D53EA8BCA753A27E92
SHA-512:	C6A1B65EAEF3C1A3A49A53024F7E4AD898286A2AF8D779E6088B54E95C06616570D39CBCE202E48C59A05224AE41BF8AC66778B4248ED319E6F36A0FEF9FA2E6
Malicious:	false
Preview:	.PNG........IHDR.../...........&.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\skin\SmileyWink.png

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PNG image data, 47 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4513
Entropy (8bit):	7.923205264207793
Encrypted:	false
SSDEEP:	96:nSDZ/I09Da01l+gmkyTt6Hk8nTJlJ0NDxK+muSJyXnmlqsOc:nSDS0tKg9E05TbaDxLmuuyXmYsOc
MD5:	A75E7B7FB7225134A01B01C6985086C3
SHA1:	C18649F3DC4CFD551CD861FFAFAB51B98B8CBCE8
SHA-256:	000D8E36A1D432D6F6C182D41DEADB3F3B051CC5C5B32AFCAC6B3A80C4D802EA
SHA-512:	590812B335FB7AC128AEB4012960377AB2E2FC1D03A1418287DDFE074874B9C12D0D76F021126EC7FB06668281C2E91ADB678DB4B3B49E612D3BE74E954DA52F
Malicious:	false
Preview:	.PNG........IHDR.../...........&.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\skin\bing.png

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	318
Entropy (8bit):	6.864702191037678
Encrypted:	false
SSDEEP:	6:6v/lhPmNp1ZsRgPkHK9SQQxL95uLcIR5lgxmWZ2/vFvgUl7dp:6v/7uNpLmgPe4SQQL9+lggWM/NDz
MD5:	CAF9A4DFDDFD2568B37781AFB55DF16D
SHA1:	60405FE8FE085DC0062B77450A9CE9049552AACB
SHA-256:	05F666FCBD4A108C0DFAEE4BFA0414294694014C35E0603A2E944182C6DA7F2E
SHA-512:	73F133C02944F6FBEB2CD2DD142E2A2808017A1C8153AF8DB2B47143A2BCBFE0FA8E9FFBCC1DA84DC544D8E14FDAF8B34FC1EFF89E60792E84A780D28C32CD38
Malicious:	false
Preview:	.PNG........IHDR...............h6....IDATx.c..L....H..A..V~....._!N....1+.W.........A@...f'....P..'..,..'..n.bxu.C..\|}.p....c 6P.R.T.(x".C.P.\-..(6(F0XL.1....A.V.]5..5......5...9..M..F..A...X.....`......{.................h.n.[.@....*./...0.@c..........P..10.O.A..5-..........@......%>R....{..,......IEND.B`.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\skin\clear-history.png

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3279
Entropy (8bit):	7.900863279277824
Encrypted:	false
SSDEEP:	96:CXHt+JcNgOSiS4XsAYNpf2ESN5B6Ee1rEV:2oONgOLPXsAYnIB6Ee1G
MD5:	55FE3A0B1E9F8B4FDB84FC3E206276A2
SHA1:	669B6C3560552027D0C7E4737E1703E52A7D77C0
SHA-256:	5E443B66113C0ED5D2B49EA60E681D9D8B561798ED60C8E53441E63250740E6D
SHA-512:	85E3FBBDE3444D3E8304CA490A9A251D92AE575FE2A0B9A6DE9E86952D958ADF648C106C5DC929B3B2EE2D44114FAEE23635BD57AFEE54F9455FC6A5E642CE5A
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA....\|.Q.... cHRM...........R...@..}y.....<.....s<.w...9iCCPPhotoshop ICC profile..H..wTT....wz..0.R.....{.^Ea..`(..34.!...ED."HP..P$VD...T..$.(1.ET,oF.........o......Z..../...K......<....Qt.....`.).LVF._.{......!r._...zX..p..3.N....Y.\|......9.,...8%K.......,f.%f.(A..9a..>.,....<...9..S.b...L!G....3..,....F.0.+.7..T.3...Il.pX."6.1...."....H._q.W,.d..rIK..s...t......A..d.p....&+..g.].R.......Y2...EE.4...4432..P.u.oJ..Ez...g.........`.j..-....-....b.8....o....M</..A...qVV....2.....O.....g$>...]9.La.....+-%M.g.3Y.......u..A.x....E.....K.......i<:...............Pc...u@~..(.. ...]..o..0 ~y...s..7.g...%...9.%(....3........H....@...C`...-p.n.......V..H.....@....A1....jP..A3h..A'8..K....n..`.L.g`......a!2D..!.H... .d..A.P....B....By.f.....z....:....@..]h...~....L.............C.Up.......p%....;...5.6<.?.........."....G..x...G.....iE..>.&2.. oQ...EG..lQ..P......U..F.Fu.zQ7Qc.Y.G4....G......t...].nB../.o.'.1.......xb"1I.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\skin\dictionary.png

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3287
Entropy (8bit):	7.891546537282907
Encrypted:	false
SSDEEP:	48:b/6DocieftI9G9f6A+FIDOWu0lDl+gm7QyTtctIInQSy6IVpqlnBcODRqVwJkvMG:bSDZ/I09Da01l+gmkyTt6Hk8nTUwCvMG
MD5:	A143CA61BD925BF5831EE74BDDDF1DA4
SHA1:	D0E822D6BACEA7F506481037176E04457D719DC5
SHA-256:	54B97C1D6C6F4D704D16C953FE100D4453FC5592FD9EF5AFB33260890FDB0618
SHA-512:	104544409128871B258B9623E942F07E37CF485C5A3EB3AF0EC8BC99E0D5C756D236F2F63BB267DACA87F6D2DCC0DE03F62C99AB73BC048A0660A80B87A3F308
Malicious:	false
Preview:	.PNG........IHDR................a....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\skin\finance.png

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3410
Entropy (8bit):	7.894828125786389
Encrypted:	false
SSDEEP:	96:bSDZ/I09Da01l+gmkyTt6Hk8nTBqBXTmTIDY:bSDS0tKg9E05TB
MD5:	E1A82CF04E37B212A2843D9967FC12C4
SHA1:	F096383C90B7C3A8A397671A2E96F81C2958FB0B
SHA-256:	B866837AB746FAFF5D2C6201A270CECC14D7A57A311ABE5AEA4D32C7E02A1CA8
SHA-512:	965FD8C91B4FFE9D0FEFF9FF416057C9651F05A34FCBCF7EB2B4B15F1B36C01C2DF2E169483BC545CDDBF8478ADCA89298E8A4EF7F344BF2AB7170D058C21AC4
Malicious:	false
Preview:	.PNG........IHDR................a....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\skin\find.png

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3371
Entropy (8bit):	7.896512358734088
Encrypted:	false
SSDEEP:	96:bSDZ/I09Da01l+gmkyTt6Hk8nTMdfMVRfAQNq:bSDS0tKg9E05TOfM3fNq
MD5:	148C71F4C4A537A1F286ED3F40D39ADB
SHA1:	9FFDA4FBE2C432191B94A7E71A0295899513AC41
SHA-256:	AF8F54A2730DE3323D559A0D0D4272598BA2F13865C2620152AA4E78037E2048
SHA-512:	8B6B397BEC1DA5EA85E04DB3C0C4E6EB4F9DC4EDC1760EF5FDC62B970182BE4F2E61C391038F71D9F89583CCAF4786EE9CE6039C0E595CCD783C86636750BCB2
Malicious:	false
Preview:	.PNG........IHDR................a....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\skin\google.png

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	3341
Entropy (8bit):	7.887714626414327
Encrypted:	false
SSDEEP:	96:nT2SDZ/I09Da01l+gmkyTt6Hk8nTno/AW0QE+H:T2SDS0tKg9E05TnoIy
MD5:	A66632B80FC122541E246BAD41A3E0EE
SHA1:	2BACE9CCC0D1E4BBDF578755718FB61E60190AB7
SHA-256:	8257229ACA8F9E1BA64A9D881A16817B216A429867E7FB9DF7D15915663B7E67
SHA-512:	0E2F088B7E681C5172548A57F5D175701F9873B8D56ADB06ED633A724AE94FA6E659D80A3A9BFC9FCDF59B311E6CB5A85513FE47DF33A2025073F95A88830BDF
Malicious:	false
Preview:	.PNG........IHDR...............h6....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\skin\highlight-disabled.png

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3217
Entropy (8bit):	7.892286714994252
Encrypted:	false
SSDEEP:	96:bSDZ/I09Da01l+gmkyTt6Hk8nTgQCZuEaGOo2:bSDS0tKg9E05TqZaGc
MD5:	DC3494FFF24914D9D2D021BD8D25D6DD
SHA1:	D291D3FFE012D546353FEAA032DE8F427B37C5A5
SHA-256:	974907293EC367914CDAE7AA701000790AC63F1AFE977E06F3A16D4DA37932A5
SHA-512:	2E8612ACCB12FB144C4C656C9664123A68311C115960DD9AA91CF344C6A7ED73C4574E916DD2FB4B56560C3897A39C128F280A5DA1182E0B48DF8A6FA41B8EC4
Malicious:	false
Preview:	.PNG........IHDR................a....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\skin\highlight.png

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3216
Entropy (8bit):	7.8906601217003995
Encrypted:	false
SSDEEP:	48:b/6DocieftI9G9f6A+FIDOWu0lDl+gm7QyTtctIInQSy6IVpqlnBcODhn1aYaZe3:bSDZ/I09Da01l+gmkyTt6Hk8nTJ11aZu
MD5:	29D046A3F81292EE314864085A63FF81
SHA1:	9B6B8A5E556B475E2E18CE6875D9561AF07DF37C
SHA-256:	B5B6674E9D6CA9441C93D1F14C1203C75DCD3F756C8AB990FB736EB8EA02D1AC
SHA-512:	93933BF98A7E2ADDE07218FF71339386A40D42C55CFDDFBAFB77C8720370999E5276007B1BF1D775D9EB0397A66A34776E081966A4FD0EBED59A1B0E086CC2B2
Malicious:	false
Preview:	.PNG........IHDR................a....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\skin\logo.png

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3239
Entropy (8bit):	7.888643295675962
Encrypted:	false
SSDEEP:	48:b/6DocieftI9G9f6A+FIDOWu0lDl+gm7QyTtctIInQSy6IVpqlnBcODCRALs03pS:bSDZ/I09Da01l+gmkyTt6Hk8nTdLNZi
MD5:	28FDADB259A8077E09F442CA8EE1FFE5
SHA1:	9F93FD60CFC263758E2893813FC2EBD2AC3BB352
SHA-256:	9B519A9E1A1B17921268F552120BEE46DCBBC0BAA8BD888524BE0F7278172F6A
SHA-512:	E5926D42E2C79DFE415132156CADE34830B98F81D359F8AF2272F7B0B723C93770AA40F4478545ED01F7C4D23B051700641E33F36ACDF8C7E4736B0BA0102F50
Malicious:	false
Preview:	.PNG........IHDR................a....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\skin\logo_32x32.png

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	907
Entropy (8bit):	7.7115682629611495
Encrypted:	false
SSDEEP:	12:6v/7iMXQbYxUmLXrR83gsck25T8crr2vU3w9lFKms5QQjsa7mwetd2xJ+qjsq+Ka:BbYxUmLXd83RMBwl9g6wo5q/+Kdpi
MD5:	CE93245253E7D87992B0BA17501BCCCE
SHA1:	EB886BDAD9250A51E1DC7C3E46E34AEA684253D0
SHA-256:	CC355E7C9F6C28CA686489EC62307BDA4BBC580D7479794B9080F48E8D1B288D
SHA-512:	CB1FB5E8F26542D22194970CCCDF575780E0D29710576DA925E03A0140FCDB443A58A8CCC0F6993968F0FADFA69D2BC2CA708AA002565A24E5D0E68A7631E6AC
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....tEXtSoftware.Adobe ImageReadyq.e<...-IDATx..W.k.Q..^.).:....\.......E#..ED...C.]...`..((h...g&....n....z..Q......\r^.....K..~?...\|...y.LrL....X.y)3==.e..r....I.....JOc)`r.D<.b.0K..rl..x......9.E......oc...g.....Y.9.>..-..'....{.q.@..\|....Nc^...9I.^.=...2.6....@..g...K...@.....D.......z../....A..b....0N......Q....V.:...@...Yu..8.....).......g...Ik......Q...zp..b.._...'}.W..$....5.M....)...[..)z....UR..<..2.F.m.W....>._i........-3..Y..._.........u.....$.x.-...L.=...g...Wf...l..0...v...J....{..iC..p..x.k!....^...^.rE..8.hFA....s..l...~@...H.#a8...)O:HX[.......p`9f...\.?.ND...rJ.1...P....nq..........a.Q_.l.X{.Z\KV..'.]0...#.Rq....o...P........>z.q.....[......,'.S."J1;.w$.s...x......s..."03.&......Rl?`..6.......-6.D.........ZDw>@....X..e.Ym.......QTgD..........4o>...=.8...,.!r..+.'........u.[...............IEND.B`.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\skin\more-search-providers.png

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3352
Entropy (8bit):	7.8931164626831265
Encrypted:	false
SSDEEP:	48:b/6DocieftI9G9f6A+FIDOWu0lDl+gm7QyTtctIInQSy6IVpqlnBcOD8T/BbqEhZ:bSDZ/I09Da01l+gmkyTt6Hk8nToqeGM
MD5:	3D5838DF2B73465BAE62A24C4227B8DA
SHA1:	6DBC88054A5CEBC0BD528965E232ECA12B7FF841
SHA-256:	910F08F5D49FE7D48E4C04E2A2872B67E5210A16AD10611D89D23009A58AE225
SHA-512:	D6DCE4ACE8CC5823A2E54265D9207C37D84A2D5F43B57E0EBE4BB08C2EC051F507730B46F0F5AD3B90E13DB6C7D4DB1946F0FD3A7B25A5EC14A92769CCB40772
Malicious:	false
Preview:	.PNG........IHDR................a....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\skin\music.png

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	969
Entropy (8bit):	7.762222484405286
Encrypted:	false
SSDEEP:	24:H99+nx2odKpOu5EoaHoA4JtF7yq3W4T9bx+Z6JEGY:d8x2odKpOmZ6rStF75m4Txx+ZaEGY
MD5:	6CCA94CDF2EB6A5FF419733DF8E89C8B
SHA1:	9B53E137FE7C6FE398403EED10CBFEE303CC2A83
SHA-256:	5F424A3EE5FE6892ECB699ECC07D21A8749166FD5356E6AAFBF6564B0DD0B3F3
SHA-512:	C1D45F195837E4AD1BF78F1BF5A7C418734E69D4C477D807ED34B034E079B35127757E3F29B8725070C4C93063574155A031E88E50CDECA93FF1B6789E85D2ED
Malicious:	false
Preview:	.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<...kIDATx.tS]lSe.~.s.sN.u....m...J76p..!Q.2p.h.T.....\.h.z...&^.h.d$#q.............c.m..u....==?~%$J.O.\}..\|....Gvt........l._I)...dd.S.q\..1.x..T./P].,.8......]..]..-.iL._...e.Q..hp#`.....).7L(.$...........D[?.7..n...Wg..#A2m.Z..d....Df...9g..K..W........H}5.K0+<\../;...os..y..[..k.5%..^I..V..@.1...C.cr.t..MGz./,T...#......z%.>...G5..MG.;:..u..."..,-e....J''p....v........P.....cHmj..w..d[.c...D....... ..v.Y...X..uQ..4........x.68......{..x.i.U....68..5.......s....7..w....JH.V6Q'<."....M5....<.`pFa].W.....90..{c.~...n9..52..AZA.A......h.q_.w..p...{._Kf.~."...e...e...g.Y{..]D.w.8.}.......C.Z.....p.^.j.\|S..v.J\|........Z..,t.<01..''04........l...KB)@..."...].....ja.P.....b@d.\|.!........K....$..x......+..(.L-.3..\|...ba..Q....C..Q.Z..c...h.*......V.......(...o...`.cl;z./8lf.....7.y...._WEO.;6.._..7g0...Y..a...a.....=..$M.T.S..0._.Y.S.y.....IEND.B`.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\skin\photos.png

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3432
Entropy (8bit):	7.890811683389906
Encrypted:	false
SSDEEP:	96:bSDZ/I09Da01l+gmkyTt6Hk8nTix2NsDd3:bSDS0tKg9E05TiAgd3
MD5:	3326F38F67E138CD40DF3036A6309F63
SHA1:	8371BACE6C48FC5AF719000E91A627F6DC0CE3AC
SHA-256:	A86EB86BE5BA9BEEA0C3303447F4BAFFF2A8BD49AC2D245F3759C31DE52018FC
SHA-512:	672FD5BDD4753F3E8EB9A30B25E18EA7231DE7208C217E9D55F3A34A794B27626C290E581418229982DEDE7975D21C46E3E9B32F265BCAC8B2FBA56926B5C841
Malicious:	false
Preview:	.PNG........IHDR................a....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\skin\search-current-site.png

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	784
Entropy (8bit):	7.695743284796664
Encrypted:	false
SSDEEP:	12:6v/72rnSuDO0xkvVXUTDkIPr5vDeQNMV5PhSEbsqs9GaWzL6gsp2xkIoKzxV7:3SkO02dkTD3Pr5vEQI6L2+IoKF
MD5:	7D4CAAD7B62C2F69274E585D326D2A91
SHA1:	815175D8C54D86B622873FD152BDE7482B6B83D8
SHA-256:	8EF5C62F599935ED9448258366E2DCB209338870B902D803F20081494FE46E51
SHA-512:	5FB3D260220150F1461577287D5D273482207F4CDE362391FE81C643C113A598B440A413B35DDD6520DF55B2AB2C3EDB8A24B2EC2AD681FEAC6C382192A31789
Malicious:	false
Preview:	.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<....IDATx..[HTQ...}f.q4...6h$..iY.1..,...!).@.%..b..QH&./fD..`.FTf....S.My..@^f....xV.(...C...f........D....?........H.zS.mD...Pi...6.&...!a...hs5..;....j@............ZI....<...h.?.!{=.......%.<..n.,.A.....2.t...t.7E....F..H....1kB!z:A..P.s.Len^.....mp...z.:l\...LX.....`...m... .\VV..:lUI...9e8.p..f...o........q.......1...?yTb..-.\....R....X...\..IK.E...T....l..7.Im..jPB.../......B.X...L$.{2.......N6>.e'.N.../.JV\|...{s.d..5a..TK7F.q....!.6...Y.w..c/.S..l.w........qvgT.T......!.9...'. 1'I...,~O%.:.R..KHt]i>n.>..G.\.u.Q..0....&.."}....CJ....E.>....B....<VS.....a.i....0.e#.. .K.P...(....._.^i..q.4.Xk.%se.;.....3.}x.=...?;KW...B.q.al..a5._+&..F...{H}..O...@j.i.1w.....IEND.B`.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\skin\social-networks.png

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3248
Entropy (8bit):	7.891399431000833
Encrypted:	false
SSDEEP:	96:bSDZ/I09Da01l+gmkyTt6Hk8nT5c656Pp:bSDS0tKg9E05T5cy6B
MD5:	C9E37BF72E41F4266CD7BDC875EA61BE
SHA1:	5D808714D82BC227D2B2F973540B2374D3212367
SHA-256:	88CC5CFDD1B66EDC992A9A348634C641A49626EB06116C1247E349DF5089140B
SHA-512:	DBBAFEAC3A52A2F9CC2E69D7E95CF5D0EE6DEA12E42DA4C3DCB7FD1E754CF9B24D2D31309A529885537EB46C14342965C3AD184D606800773D2B481C94E74F7C
Malicious:	false
Preview:	.PNG........IHDR................a....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\skin\splitter.png

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PNG image data, 11 x 24, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3056
Entropy (8bit):	7.8853902232584545
Encrypted:	false
SSDEEP:	48:Q/6DocieftI9G9f6A+FIDOWu0lDl+gm7QyTtctIInQSy6IVpqlnBcOD5d101/hu7:QSDZ/I09Da01l+gmkyTt6Hk8nT5Q1JVO
MD5:	AEF0A911384F19305EA555EE444D37BC
SHA1:	5EA082A01AF0E52F12EF89B0D675426C8608B581
SHA-256:	68AFC90D338327ABCAC854A19D8C81EB1F9AA4AE7BFB1F53DBBDE899B4FC9E64
SHA-512:	4A669417979F96D72D0E8CC930E48C3F30C4DE4797C525D21CFCBA5C4D02588C804BA30F03595949E8C4C61B67D712D67E96AA2095EE81AC9EE4F4AE03D1FB27
Malicious:	false
Preview:	.PNG........IHDR.............,.......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\skin\sweetim-toolbar.css

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4994
Entropy (8bit):	5.055953897720054
Encrypted:	false
SSDEEP:	96:NHpNbWeC/ElNLI/Qdyc04k4bOoz+Vfh1+4FsXC8Y+b1Ska:NHrS5WNL6Td4k4bOog7+4FsSmpSt
MD5:	73B01090E40193CC727A5FDC58A87FB8
SHA1:	6E1A8174F945A280F7D56B3099206ADAF04D2532
SHA-256:	B60F9FB3F97751D5D05C32DC3F2A417BC086ADE2F7C229D2F95CCD574A8042A2
SHA-512:	C3851B64AE8D3A0BE72EF2ED3C5B700D379A5CCD9FAECBF7F6E5EBC2A80EDF73A38C6FC88F14672B1CD0FDB13DAE409EC0A00970E5946E05EA58B5D1A06E7C04
Malicious:	false
Preview:	@namespace url("http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul");..@namespace html url("http://www.w3.org/1999/xhtml");..@namespace xbl url("http://www.mozilla.org/xbl");......#sim_main_menu_btn_id {.. list-style-image: url("chrome://sweetim-toolbar/skin/logo.png");..}....#sim_search_btn_id ..{.. list-style-image: url("chrome://sweetim-toolbar/skin/web-search-button-glass.png");.. -moz-appearance: none !important;.. -moz-box-orient: horizontal !important;.. /* color for FF 3.6 and later/.. /background: -moz-linear-gradient(top, red,yellow,yellow,orange) !important;*/.. background-image: url("chrome://sweetim-toolbar/skin/web-search-button-bg.png");.. -moz-border-radius: 4px;.. border-width: 1px !important;.. border-color: ThreeDShadow !important;.. border-style: solid;.. color: -moz-Text !important;.. font-weight: bold;.. margin-top: 2px !important;.. margin-bottom: 2px !important;.. padding-left: 4px !important;.. pa

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\skin\video.png

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	869
Entropy (8bit):	7.724749684662738
Encrypted:	false
SSDEEP:	12:6v/72uhawVsXDd8HrtpLae7I6TeRg7EGrhLADjCznC9c9qtpMaPhvGklVV5KSChX:6aZXAr+jQUg4GrhLUjCLC9lP4G5KS8X
MD5:	920D3D7C15F7AB6E00F2A8C3593CA86C
SHA1:	74147628E2FCF44B2AF427A67DBE6278E8784416
SHA-256:	8D53BA3EF30AA548B8B5870EBF264863AB28BFB28BA0338337EA81FB10E931D0
SHA-512:	6108CE806BA0210A00A8250EBA0A74AAF9934F000C1EEC6E4750068A46EF4447D275C0A89053933B4E3ACE6529F5425D7F0ABBD7F8C2DDE4961A5FA32E9C0F88
Malicious:	false
Preview:	.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<....IDATx.\.[h.y....L&i:.mRl.Z/m...A...ESJ.hY..\...(..(./.y.A.X.a....VE.JD[A7].....K.\L.e2.LlK=p........}.~._.[L_.g...X.....o..s.?.=v.Q......T..G.gU.D........?...:..U.w7.`.]]?#z.^....\|Q...$M...?dr.&....K.Y...Qq...h.d2e0...\|...@.C....:I.....K.B...bo_...X,.iL.UU....]{..f..w....pL.@......9....~..#.%.....J.1....'B..U..m.[3t6....4.w......OW.Z.....!..U.g.....L.S&S...`..\N6lX_..z..m.{..$Q....Du5./.........j....dY.{MH..+@(.....O0...2..ZDg..H.4...%..>.n..x<p.6.....".,t..$.......q....o.M2...._...g.-.'...pA.\...}(..G}.&.......'...Rk7i.r...._6...3.#....u...#..s5......%...#..E6.....J...'}....9c..~.E.(!..`.T!y..B.K>.X.%<(Q...W_.......2...).). ..l.....,.,.......i.--..HhL.Q.}..$...Rf.....Hb...Cnh..T..&.?.e..?v1Q....\|...Bk..........!.................IEND.B`.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\skin\web-search-button-bg-hover.png

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PNG image data, 10 x 26, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	976
Entropy (8bit):	2.7857896514822174
Encrypted:	false
SSDEEP:	6:6v/lhP0ul0+wP6fn7FmT/2NA39NF3wKuNR431pXp:6v/7RyP6n7FmqC9/3luNR61T
MD5:	B1E5876DB65289C13C4977F89810E8A3
SHA1:	1060397CE54CD3F14D37263D0BB87A502F18F300
SHA-256:	F238F4D203FC49E5F80F63F98937F0D599CEFC6C8DE8318F08592BCD88B21D18
SHA-512:	B0247636B355B68576AAE88179D3D5A8B8507203D714DC4284748C98C21F9082A0C04CD6B9333699ADE661BEE58EFB2F554FB9004D4876E2BF6659749E07B1B6
Malicious:	false
Preview:	.PNG........IHDR..............:=.....gAMA....7.......PLTE.........................."..'..'..(..(../..3..4..;..6..;..<..>..C..D..F..C..G..V..h..i..y.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................z0.....tEXtSoftware.Paint.NET v3.5.2..iC...VIDAT(SE....P.C.+.2.w.T...L.&\O..w..8..m.h.,n.....x....NT".7.).Q."]R.51.cd.$.y.,1../.$..........IEND.B`.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\skin\web-search-button-bg.png

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PNG image data, 10 x 26, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	981
Entropy (8bit):	2.888407959176497
Encrypted:	false
SSDEEP:	12:6v/7RIy6QksPeAbLJ7G9vcC37KT1ZlyT7NV:dyxAAHJgEO7KbwTRV
MD5:	496F02D84BDCBF2EEF447CA153D1896D
SHA1:	9500DF7258DD9112C24D54772D550E26739EC2A5
SHA-256:	04FD558E122BDD2E2D40AE2BCBB82FAE73F5C9BCB19DED56BDD6C1DD39355B8F
SHA-512:	AA49E9FB7B6255E2EDB72754EFB62C08CA486378824DCF349305B625B9B7731321D12FED396833467A7B5AE231BAF2B5BBF400F51C9D5D72B0DEC2497EE4BB95
Malicious:	false
Preview:	.PNG........IHDR..............:=.....gAMA....7.......PLTE..................................................'....+..;..<..3../..4..5..8..=..O..@..A..b..c..s..{...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................G.R....tEXtSoftware.Paint.NET v3.5.2..iC...[IDAT(SE...P...!)Iqr.T..%.......3...h.....(N..........7.....\|..Y.R.E..Y.....7..C4.1..^....v.....IEND.B`.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\skin\web-search-button-glass.png

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PNG image data, 18 x 19, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	808
Entropy (8bit):	7.5250979472444355
Encrypted:	false
SSDEEP:	12:6v/7fwb9aXjZ9t8epIzfIgZsZQc8PXbfTNKmJ6SXE8CBxkuDCfwwxxnXNWxUec:Db9azftTaIZQrbf4mJxXEJ4f3xnXL
MD5:	6863D0B8DD6CB1DAA8F024340EBEF2EC
SHA1:	153107E528C2531A48F3297171A94A6172F4B5D3
SHA-256:	AA79352FEDB4FC20672861188C1D241EFD5236937978EBA04878F6AF5732791F
SHA-512:	EBE4F11A56497EA51546EF581D84705298B0C54DDEF801B14CA754572545134C61C32D3A118A9BF45A68E09F0452D8D8F2F86BE32CB5CAC307B6042A791CA15E
Malicious:	false
Preview:	.PNG........IHDR...............].....gAMA.....Z.... cHRM..xZ..o=......z...H.......9....q@T......pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.2..iC...yIDAT8O..]HSq..W.}Bu.UT7.tSQA%EtQ.....1FY.uLd..v.:57ga.N(...}AP..Xu....B.......=..v".gI]t..=......>..(...2.KH..=8hv...~.Z........E....0;...u..;...q .D....H.......(.\.,...7..4..W....{..E?`..FU..R..;..a.;2..I`.[~.~rE."..s.B....Z#.9..9:.}.w........=.O....#W..0..HZ....`.3.v..Cb...S....}.ls.........g.K-..n....OY`.2..8...wG....Z.di.._..8.n..0./...q.=.5.GG.g...\h..;..............K_).~\.0@p.@..DK...(.....@06.[k4..4.d......0b'.@....?..;.6O4.x.i..z..R..)O....-8G3!...\|..ju..-._a+i.....S....}.gC".#....b..f....y:<j>7...g.......Y.^u=-.)Y_,;../.A..T(s.....Z.......hK5.G.BmF.3e.{.u.d.d...-.^"..!r.....\..VI...r.....Bh.+.....IEND.B`.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\skin\web-search.png

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3337
Entropy (8bit):	7.886640514351696
Encrypted:	false
SSDEEP:	96:bSDZ/I09Da01l+gmkyTt6Hk8nTt/4E/TS:bSDS0tKg9E05T/S
MD5:	3E2E639063054CCB59DB68C2A9243AFB
SHA1:	FD9461012CFA0ABD8333645E6A55B87DC5AC6537
SHA-256:	5D79D48F3FC4EEEF3A8C46FEF30DF602BE257730F841B99BECE79F7D9356D7E6
SHA-512:	730CF2834D48BDDA697E580064DAE1060D057A9F39D33C8A632D790F7E0B3097DD70421E31C09D33A914E763CB1C39E2C75554D8F6B4EB11B45A8962E8FBBA37
Malicious:	false
Preview:	.PNG........IHDR................a....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\skin\yahoo.png

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	442
Entropy (8bit):	7.104637400753022
Encrypted:	false
SSDEEP:	12:6v/78f2s/6T6is1kJ4nnQmCOZBw4r9Ah/kmZscG2E3d:Z2s/6WR1KcnQcF9csmGF3d
MD5:	F64113435D357717C72EBF0E86B317E6
SHA1:	85CA037F08378619D4322A7F4EDBB5FC55AEFC5E
SHA-256:	A3DB26273631B16D9F68100C2C8B9096C899B320AE2C3EE787D31D6DBC0826E9
SHA-512:	F7B60E594EFFDD05E84C8583F205A32BFB87BB4CB084F0B49FDEAF5797B4128AA4B2D72A7FB1FB4FC112CAFF1958C1632E19ED658C564727656604746BECF616
Malicious:	false
Preview:	.PNG........IHDR................a....sRGB.........bKGD..............pHYs.................tIME.....;'.x.....:IDAT8..!k.@......P"B....S..G..(....eT.15..c.b?`..b.....U#...pb.....L.;r./.^u.}.......yx.Pde...UNA2..EH...7.S..dw.u.....n..G.`\|...."+....d5$.!.Jj...Qr.....J:Q@.....:=M..S.../.....>_>........r.+...s....\.f..(.d.X..mW...%5.\|.\.=.......?.y~.,.%5....%...Q..YY......c....-..N.6.6I.a...1J.\.\y.....Y...jH;.....J...v......IEND.B`.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\components\SIMAutoCompleteSearch.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	9648
Entropy (8bit):	4.9386302416157895
Encrypted:	false
SSDEEP:	192:BJYDxEranuKJKKgbK7dAKyK+i2vRJx7fhhg9pJt1dR0M5:BJegKkKgbK76KyKQJxlhq5
MD5:	C646B5F72E465DD579A4485EBD5518E5
SHA1:	0696375F062FCED5BBB07146D3B21B319B19E862
SHA-256:	9413FD6BF893C926EB6D6908E494A1BB710EA8A9CEA355011D5E3C4249D63F32
SHA-512:	6E1C68587441512974EE6B2654FB05D59D571343234B0EDC3069AD7A5E3D96DEB4751BB18881C799CEE9121D14BB98E95694AB81D849C7D86042F09023153CAB
Malicious:	false
Preview:	..// original file:..// "How to implement custom autocomplete search component"..// http://developer.mozilla.org/en/docs/How_to_implement_custom_autocomplete_search_component....// logs an exception..function logException(e)..{.. var message;.. message = "Exception:";.. .. if (e.name).. message += ", name=" + e.name;.. if (e.message).. message += ", message=" + e.message;.. if (e.number).. message += ", number=" + e.number;.. if (e.lineNumber).. message += ", lineNumber=" + e.lineNumber;.. if (e.stack).. message += ", stack=" + e.stack; .. .. if (!e.message).. message += ", full=" + e.toString();.. // dump(message);..}....// load external JS files...// the component is loaded in different namespace than browser..// (e.g. "gBrowser" is not defined here), so we _dont_ need to explictly load it in..// a dedicated namespace object, as done in main.js..var loader = null;..try{.. loader = Components.classes["@mozi

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\install.rdf

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1630
Entropy (8bit):	5.50969037695185
Encrypted:	false
SSDEEP:	48:kYH7siLPNKP4p9LN4peoVAHd7wORaN008mZ863VA:bHfDQelSOMNH8Ue
MD5:	C2DD6535605B8AECA43BCBF777F96262
SHA1:	1A037398321F63475887809CD2E1A4A92036DC98
SHA-256:	C3541B4C8C083B134158D839BF5348204E02C48546FB88B4A9933506DE6B5DA3
SHA-512:	84A4B20FE3B354F33F0023F21BB264095F4CE16830D18A0FA24B967E9E974B9D57AA4135E97B6599053DFAB6CCAAB8681956FF2E590E9A9567FA5D3B8A22ECD8
Malicious:	false
Preview:	<?xml version="1.0"?>....<RDF xmlns="http://www.w3.org/1999/02/22-rdf-syntax-ns#".. xmlns:em="http://www.mozilla.org/2004/em-rdf#">.... <Description about="urn:mozilla:install-manifest">.... Required Items -->.. <em:id>{EEE6C361-6118-11DC-9C72-001320C79847}</em:id>.. <em:name>SweetIM Toolbar for Firefox</em:name>.. <em:version>1.3.0.1</em:version>..... Firefox -->.. <em:targetApplication>.. <Description>.. <em:id>{ec8030f7-c20a-464f-9b0e-13a3a9e97384}</em:id>.. <em:minVersion>2.0.0.0</em:minVersion>.. <em:maxVersion>7.0.*</em:maxVersion>.. </Description>.. </em:targetApplication>.... Optional Items -->.. <em:creator>SweetIM Technologies LTD.</em:creator>.. <em:description>all about fun</em:description>.. <em:iconURL>chrome://sweetim-toolbar/skin/logo_32x32.png</em:iconURL>.. <em:homepageURL>http://www.sweetim.com</em:homepa

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js

Download File

Process:	C:\Users\user\Desktop\BundleSweetIMSetup.exe
File Type:	ASCII text, with very long lines (1809), with CRLF, LF line terminators
Category:	dropped
Size (bytes):	10165
Entropy (8bit):	5.509149856198788
Encrypted:	false
SSDEEP:	192:qnaRt+YbBp6ihj4qyaaX86KKkfGNBw8DJShcW:yegqumcwQ8cW
MD5:	A35916A243C1D7D26270012A4D4E1A47
SHA1:	08007DF6066A75CE3EEB3BB4C8617A6E0650CDBB
SHA-256:	1FE0D7A5296C1916F2F7866D8A343A4DA20183353B811F60249D8CE3A09750A8
SHA-512:	61D8F0C4741F368E8824BD569E9AA452C85C7EE85D07AEBF36D033B05C6464C2B567D92300739E5C261FC0E104BF730E0AB206927ACE0A530553E15144DB9E2E
Malicious:	true
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\searchplugins\sweetim.xml

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with very long lines (3547), with CRLF line terminators
Category:	dropped
Size (bytes):	3915
Entropy (8bit):	4.5039484079313326
Encrypted:	false
SSDEEP:	96:65Vc7FggKebtnL/6q0P7ETojlQXdMdnL2DD:6nc7VKStnT6DxhSDD
MD5:	EF691DD0310399372EAD6FACEEDBE1BB
SHA1:	4F1FA12B9751F78D8B3BF648AEB72C8AC2AB069D
SHA-256:	75E16E17C0299FD6BA42BB0BA8C8AA465634D6395C8DBAEC6E97066468C22AC1
SHA-512:	370EB8D795AB0B676D45602D8750193D795CF455C5492062B6475579EC52BA817A4138A51829EDF028E52DAA216B63B93A7FEDABB552907E0BA0C8A15AFD2A4E
Malicious:	true
Preview:	<SearchPlugin xmlns="http://www.mozilla.org/2006/browser/search/">...<ShortName>SweetIM Search</ShortName>...<Description>Use SweetIM to search the Web.</Description>...<InputEncoding>UTF-8</InputEncoding>.. <Image width="16" height="16">data:image/x-icon;base64,AAABAAMAEBAAAAEAGABoAwAANgAAABAQAAABAAgAaAUAAJ4DAAAQEBAAAQAEACgBAAAGCQAAKAAAABAAAAAgAAAAAQAYAAAAAABAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAG5ubkZGRjY2Njs7O1dXV4aGhgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAH19fSAgIAAKQQATegAUhQAUiwAQawYKHE5OTgAAAAAAAAAAAAAAAAAAAAAAAHt7ewoMHgAbtQAWmAAHLwADFQAGKAAVjgAj6AAQajs7OwAAAAAAAAAAAAAAAJOTkxoaHwAcvQARcAAFHQAVkQAezgAcvgARbgAOXgAi5gAOW2BgYAAAAAAAAAAAAF5eXgAJPAAi6wAUiQAj8AAm/wAl+gAl/AAm/wAg3QAh4AAdwxgYGZWVlQAAAAAAAC4uLgAKQQAm/wAm/wAk9gAk9AAk9AAk9AAk9AAk9wAm/wAdyAAAAnd3dwAAAAAAAB4eHgACDQAf0wAm/wAk8wAk9gAl+QAk9wAk9AAk9QAn/wASdQAAAGdnZwAAAI2NjRMTEwAAAAAHLgAg2AAo/wAh4AEYpgAe0AAn/wAm/wAVjwABBAAAAxcXG3d3dyYnLAAdwwAWkwAAAAAVjgARcgAZqw

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\META-INF\manifest.mf

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	13547
Entropy (8bit):	5.600589013116383
Encrypted:	false
SSDEEP:	192:9ycDu2ADT0g95uCs/GJVzbix/urF8g1YDLbax6kTTLSh:93C2A30g95js/GJFk2N1YDLb+l+
MD5:	810FA593D44397BD13FEB001B684EAE2
SHA1:	8223EFAA0D30A289A20B864CA1FC622852AB8201
SHA-256:	35A08311303FA255B0A9793F438C1229FF9DF946E759D52646093727007DD82E
SHA-512:	42008E31A4370D4A94B3F6FA0CF985341EE9E12D850AD06EC7379B6A71814F094F76075894A486756A3BC0B21F4FD54B6710813CE0A8ABC2612CF2B0685107BE
Malicious:	false
Preview:	Manifest-Version: 1.0.Created-By: Signtool (signtool 1.3).Comments: PLEASE DO NOT EDIT THIS FILE. YOU WILL BREAK IT...Name: chrome/sweetim-toolbar/content/addonlistener.js.Digest-Algorithms: MD5 SHA1.MD5-Digest: CNsMWcvyVJA/R2OJD6jx7A==.SHA1-Digest: CQFIbsAHoE930lqhuKYzr0G75EY=..Name: chrome/sweetim-toolbar/content/addonmanager.js.Digest-Algorithms: MD5 SHA1.MD5-Digest: cM97qpn/6M3P29jecDGsCQ==.SHA1-Digest: HGRfWAVRf6I1fjqtqjZlUY7bcvs=..Name: chrome/sweetim-toolbar/content/bindings.xml.Digest-Algorithms: MD5 SHA1.MD5-Digest: IzUsJtYOU3KF6RykwlY6lA==.SHA1-Digest: XjsqnQzlqCFErToou6kmfniWJFE=..Name: chrome/sweetim-toolbar/content/chevron.js.Digest-Algorithms: MD5 SHA1.MD5-Digest: ZK/MV+wuXVbLbSGv6ayLog==.SHA1-Digest: 0HFQT6/U9YtyFnqydQ3XPVRX/bM=..Name: chrome/sweetim-toolbar/content/commands.js.Digest-Algorithms: MD5 SHA1.MD5-Digest: ZX2m/MJXYRHfOXcj/QPKWQ==.SHA1-Digest: 7MjtzoexiMvSnp6aGpMF/6HcHGQ=..Name: chrome/sweetim-toolbar/content/config.js.Digest-Algorithms: MD5 SHA1.MD5-Digest: p

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\META-INF\zigbert.sf

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	13655
Entropy (8bit):	5.6040651112820905
Encrypted:	false
SSDEEP:	96:WkA5g0iCoVcI/jdhBJNmDm+lP/eBSjSesuBVyOK6+ZEb5Mw7T4+sKr8tTciJcoC9:P37LBJNmDfB/eBSjnsLKwzF8J2M1
MD5:	59EC97C3D819001C0A897B38A7624473
SHA1:	D535037A3EC3601C7307EADFCD0AFE52747FB830
SHA-256:	13D9271BA7EBBE28508A4EBFCD6775BC1DD3459C5A9D4D8C1CF7F79E7323DDA8
SHA-512:	21A80FDA8D9F3B8EF957F94B7F4F429CD8D37637490DFB3D1C4E941D3F9DE59835162D7DE7C992C1B57B3AB0064655AA19E44AA93D30C3308413D87BBD03E1BA
Malicious:	false
Preview:	Signature-Version: 1.0.Created-By: Signtool (signtool 1.3).Comments: PLEASE DO NOT EDIT THIS FILE. YOU WILL BREAK IT..Digest-Algorithms: MD5 SHA1.MD5-Digest: f2XP9lsoHe04PBOvuFXL5g==.SHA1-Digest: 8RHZ0uUrxScBNJtHgI/t7stA9yA=..Name: chrome/sweetim-toolbar/content/addonlistener.js.Digest-Algorithms: MD5 SHA1.MD5-Digest: w8i3Rt3DxPL6b05cKNpsPw==.SHA1-Digest: 3odNPduNL9VoljP4mprIcpgF4zc=..Name: chrome/sweetim-toolbar/content/addonmanager.js.Digest-Algorithms: MD5 SHA1.MD5-Digest: 2YvLgsIg6k332XHkG6KEFA==.SHA1-Digest: ZvTVKYjibgcpdMsLQbe+A93OY1M=..Name: chrome/sweetim-toolbar/content/bindings.xml.Digest-Algorithms: MD5 SHA1.MD5-Digest: 1pyJGkn2pnE1+gMPhWrmww==.SHA1-Digest: 1uXwwQEdM+fCinL2psHcZId2oMc=..Name: chrome/sweetim-toolbar/content/chevron.js.Digest-Algorithms: MD5 SHA1.MD5-Digest: lOla/YC5L6pzcewNgLywJw==.SHA1-Digest: vPI+B5kuDtUVY4PRGNE0z84Fnl0=..Name: chrome/sweetim-toolbar/content/commands.js.Digest-Algorithms: MD5 SHA1.MD5-Digest: AK1Es9lxyQoNYOJwLNf3SA==.SHA1-Digest: RUAGcms4e0

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome.manifest

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.884991274360526
Encrypted:	false
SSDEEP:	12:4yp61ZTeXK17sZSaK1vZW29F1211e71KwobrZ19M91Z+1WEA61nlHKgs0KIk1kv9:47uXKRVlFYq5c1bQCIaPKgsBI191IIv
MD5:	BE04EC8D2EC3BAE591464CD1B717CA38
SHA1:	91920930B8512885B18B76B94DFE74401B95D299
SHA-256:	011A1E4C9C00DE7D49EF66FFF9A0F28AB3BFEDA738CCCE95A046B6B0B6255FA8
SHA-512:	7B026AE4564DAEFB3AEA64351ADF9AA23FAD571DFA4B08AA1700BBE20DA586D33F170B8CB29609F10D07B3828B47F5F0D443300C2501EBA58E9C2A328976BEA2
Malicious:	false
Preview:	content sweetim-toolbar chrome/sweetim-toolbar/content/..locale sweetim-toolbar de-DE chrome/sweetim-toolbar/locale/de-DE/..locale sweetim-toolbar en-US chrome/sweetim-toolbar/locale/en-US/..locale sweetim-toolbar es-ES chrome/sweetim-toolbar/locale/es-ES/..locale sweetim-toolbar fr-FR chrome/sweetim-toolbar/locale/fr-FR/..locale sweetim-toolbar it-IT chrome/sweetim-toolbar/locale/it-IT/..locale sweetim-toolbar nl-NL chrome/sweetim-toolbar/locale/nl-NL/..overlay chrome://browser/content/browser.xul chrome://sweetim-toolbar/content/sweetim-toolbar.xul..skin sweetim-toolbar classic/1.0 chrome/sweetim-toolbar/skin/....# from gecko 2 (FF 4), we need to explicitly register components..# auto complete component:..component {EEE6C362-6118-11DC-9C72-001320C79847} components/SIMAutoCompleteSearch.js..contract @mozilla.org/autocomplete/search;1?name=sweetim-autocomplete {EEE6C362-6118-11DC-9C72-001320C79847}..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\content\addonlistener.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4131
Entropy (8bit):	4.625588950617717
Encrypted:	false
SSDEEP:	48:742dJHodJ1k18XJxrWQMJzfZJTnJs4Gocs/vT8udODZiQrOQJy5JCZnRkg6ARkAp:z8hu8LCC4Gob78BBCg9ChK
MD5:	08DB0C59CBF254903F4763890FA8F1EC
SHA1:	0901486EC007A04F77D25AA1B8A633AF41BBE446
SHA-256:	7A84952782D85681375BF0EEF6E0861B81DAF6AC6230E86082E49BC6FB49B2F8
SHA-512:	D738192F28BE485E860CA632D60BC92D0C07D881AA0AE5F39E986F60D8870B0B6D62612A0A27D464BB1E5A2B3A5930F13EBBEE6B1E37DD71887833F190E975AA
Malicious:	false
Preview:	..// "AddonListener" was introduced in Gecko 2 (FF4)....var g_sim_AddonListener = {.. onEnabling: function (addon, needsRestart) {.. //dump("\n XXX onEnabling \n");.. },.. onEnabled: function (addon) {.. //dump("\n XXX onEnabled \n");.. },.. onDisabling: function (addon, needsRestart) {.. //dump("\n XXX onDisabling \n");.. },.. onDisabled: function (addon) {.. //dump("\n XXX onDisabled \n");.. },.. onInstalling: function (addon, needsRestart) {.. //dump("\n XXX onInstalling \n");.. },.. onInstalled: function (addon) {.. //dump("\n XXX onInstalled \n");.. },.. onUninstalling: function (addon, needsRestart) {.. //dump("\n XXX onUninstalling \n");.. try {.. logEnter();.. if (addon.id == g_SWEETIM_EXTENSION_UUID) {.. sim_g_SIMUninstallData = simOnUninstallConfirmedByUser();.... // since we cant receive "onUninstalled" event, we continue the un-i

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\content\addonmanager.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3052
Entropy (8bit):	4.531395341231766
Encrypted:	false
SSDEEP:	48:VUNczcsspPiyV1Db+mCOZODrZX05IcNY2Wa+l1A:nAB0OgDVAINN11A
MD5:	70CF7BAA99FFE8CDCFDBD8DE7031AC09
SHA1:	1C645F5805517FA2357E3AADAA3665518EDB72FB
SHA-256:	113EEF2B585C045A77C0253B0201FFBC970A4CAF3033D38627D45C90939378CE
SHA-512:	B613B1F8FEFCF0FC8AB6C02D00E0141D988EC5F95B05030CE5FF97E1C6C889AC48090AE3DAE8883551EBCB56110E828549C0B854EF2AAB8D6CFC81A2B546E1C7
Malicious:	false
Preview:	..// wrapper for addons manager data...// for FF4 and later we use "AddonManager.jsm" (introduced only on Gecko 2, FF4)..// for FF3 and before, we use "extensions/manager;1"......// globals, used for getting version in FF4..var sim_g_addon_version = null;..var sim_g_addon_name = null;..var sim_g_event = null;....function simAddonManagerCallback(addon) {.. try {.... logEnter();.... if (sim_g_event != null) {.. // step 1.. // set global value.. sim_g_addon_version = addon.version;.. sim_g_addon_name = addon.name;.... // step 2.. // set evant.. sim_g_event.value = true;.. } else {.. logSevere("sim_g_event is null, we got here too late or too early");.. }.. } catch (e) {.. logSevere2(e);.. }..}....function SIMAddonDetails() {.. this._version = null;.. this._name = null;..}....// gets the addon details, in a way relevent to FF version,..// and puts result

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\content\bindings.xml

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1519
Entropy (8bit):	4.410561293172547
Encrypted:	false
SSDEEP:	24:8TX667LYXcAr/NHxq0+3GAQY7RR1tY2T6RtY86p9WRctqUyn:xJ7r/f5yLT6eCRcJyn
MD5:	23352C26D60E537285E91CA4C2563A94
SHA1:	5E3B2A9D0CE5A82144AD3A28BBA9267E78962451
SHA-256:	6BE86B7E71BEE837C855C48032E525677BA5071961D03FFD6D1676168A642142
SHA-512:	991CE985948A1CAEC21CB616F46138BD3A44D3EF08E02C34CA8EE5146BABDDAB62D37D4B873A8010D0B89599C431AC2810B6D6BA2BFEB7ADC8B443B6694DFC88
Malicious:	false
Preview:	.<?xml version="1.0"?>..<bindings id="SweetIMBindings".. xmlns="http://www.mozilla.org/xbl".. xmlns:html="http://www.w3.org/1999/xhtml".. xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul".. xmlns:xbl="http://www.mozilla.org/xbl">.... <binding id="sweetim-autocomplete-result-popup".. extends="chrome://global/content/bindings/autocomplete.xml#autocomplete-result-popup">.. .<implementation implements="nsIAutoCompletePopup">.....<property name="showCommentColumn".. onget="return this.mShowCommentColumn;">.. <setter>.. <![CDATA[.. var treecolValue = document.getElementById("treecolAutoCompleteValue");.. if (!val && this.mShowCommentColumn).. {.. treecolValue.setAttribute("flex", 1);.. this.removeColumn("treecolAutoCompleteComment");.. }.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\content\chevron.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	13924
Entropy (8bit):	4.6059793934114515
Encrypted:	false
SSDEEP:	192:iVftcobtdfWZDSH555lKQI8xkWaD5+BtidxccSqaF5hxtCGsRlVbF:iV15Jdb6+Bti31SqaF5vtC9lVbF
MD5:	64AFCC57EC2E5D56CB6D21AFE9AC8BA2
SHA1:	D071504FAFD4F58B72167AB2750DD73D5457FDB3
SHA-256:	F878C7FFAC03B2C60BA419E7F8D074AB9693D5C4CE6DC4C5B16B7077194279CA
SHA-512:	6C859A0EC91A688F1E07684F7EB9F20FAB7678B16DF7F2FC281C15BD3D47040C6FC2733F51C383128C8AC9C2C3085D7BC2B7ADDC8156054594FE8E9B386A8394
Malicious:	false
Preview:	..function simClearChevronMenu()..{.. try.. {.. var oMenu = simMyGetElementById('sim_chevron_menu');.. while (oMenu.firstChild).. {.. oMenu.removeChild(oMenu.firstChild);.. }.. }.. catch(e).. {.. logSevere2(e);.. }..}....function simGetCountChevronMenu()..{.. var result = 0;.. try.. {.. var oMenu = simMyGetElementById('sim_chevron_menu');.. result = oMenu.childNodes.length;.. }.. catch(e).. {.. logSevere2(e);.. }.. return result;..}......// TODO move this functiosn to new "utils.js"..function simGetChildElementById(parent, id)..{.. for (var i=0; i<parent.childNodes.length; i++).. {.. if (parent.childNodes[i].id == id).. {.. return parent.childNodes[i];.. }.. }.. return null;..}......function simGetElemWidthForNotCollapsed(oElem)..{.. var width;.. .. if (oElem.hasAttribute('collapsed') && oElem.getAttribute('collapsed')).. {

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\content\commands.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3720
Entropy (8bit):	4.732388643383319
Encrypted:	false
SSDEEP:	48:H8cFlhDSbeaUrYCp/zse1RLDvyjz985VH0UfkliWeVHV9xx2hMVNeVZENVvIsH:ccFlxSKaaDFm/98b6xeVtNbH
MD5:	657DA6FCC2576111DF397723FD03CA59
SHA1:	ECC8EDCE87B188CBD29E9E9A1A9305FFA1DC1C64
SHA-256:	93E512E98EFDE14499E6373115E2565ECAF4E26EF920BD039FEDC73768DEABD7
SHA-512:	BA284D75D27D520894BD8A3FB1728C3F198945738A8B3D759837CF2FEC7FAF24CD95653716DEC3E6FE309AE5040575B31CD97C67881C252D17DB988C475B1648
Malicious:	false
Preview:	..// trying to be close to code in IE....function simParseAllVars(url)..{.. try.. {.. if (url.indexOf("%sim_search_combo")>=0).. {.. var searchTermsEncoded;.. searchTermsEncoded = simOnSearch();.. url = url.replace("%sim_search_combo", searchTermsEncoded);.. }.. if (url.indexOf("%domain")>=0).. {.. var domain = simGetSelectedTabHost();.. url = url.replace("%domain", domain);.. }.. if (url.indexOf("%toolbar_id")>=0).. {.. var appid = simGetConfigString("simapp_id");.. url = url.replace("%toolbar_id", appid);.. }.. }.. catch(e).. {.. logSevere2(e);.. }.. .. return url;.. ..}....function simNavigateToURL(url)..{.. try.. {.. logEnter ();.. .. // parse vars.. url = simParseAllVars(url);.. .. // Set the browser window's location to the incoming URL.. window._content.docu

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\content\config.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5896
Entropy (8bit):	4.541238924519937
Encrypted:	false
SSDEEP:	96:XjE3geVhCa6rHUjwYOJY62Nod0qLdYNne4DLM5tYDUkeCalqN85q:zpeVhCa6rHU0YOJYv20jNeycegkZ9Uq
MD5:	A53978F00A102A62E01A3E43CB5EBDBE
SHA1:	E829F60DA3F8105C0D65F7EFE139C629468172C4
SHA-256:	C1B7491D50D19286166CD2511984736368315D4ABAE7C3B8E3836351543749A0
SHA-512:	9083FD8E4C4D8E4E9444EE1DCD99FFEFB9AD6E2DE6D5F68DE008DCEAE3CFFE510866B6E4C76AF17A04C51F8C15827225361C8F7916BECA40C8C5E243D4128268
Malicious:	false
Preview:	....// local helper..function simGetPreferences()..{.. if (sim_g_iPreferences != null).. return sim_g_iPreferences;.. try .. {.. sim_g_iPreferences = kCC["@mozilla.org/preferences-service;1"].getService(kCI.nsIPrefService);.. }.. catch(e).. {.. logSevere2(e);.. }.. .. return sim_g_iPreferences; ..}....// debug helper..function logBranch(branch)..{.. try .. {.. var count;.. var array = new Array();.. var obj = new Object();.. .. .. // see http://developer.mozilla.org/en/docs/nsIPrefBranch.. array = branch.getChildList("", obj);.. count = obj.value;.. .. for(var i=0; i<count; i++).. {.. logInfo("[item " +i+ " ]" + array[i]);.. }.. }.. catch(e).. {.. logSevere2(e);.. }..}....function simDeleteBranch(name)..{.. var prefs;.. var branch;.. .. try.. {.. prefs = simGetPreferences();.. branch = prefs.getBran

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\content\contentmenu-handler.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	16022
Entropy (8bit):	5.164579735638881
Encrypted:	false
SSDEEP:	384:oJPA3ed6vyJNKMZEYZKK/bTE4tv/j95JM5JV7osxmS7TJLQwlKeMuuC2suizrf7:ePA3edmQNKMZEYZKK/bTE4tv/xMrVRm8
MD5:	2B4FD08FBBE235E21CB29060CE159459
SHA1:	B7FB723D552129FEEAAE7CCA46EDB18A54849C44
SHA-256:	148B0E27BC88BFB16BA9FA0B1963B5F3FB6FA14D4B971EDB3E85268386644B0B
SHA-512:	EC60097A623E9CEAE81AC0D819BABF4B48CFE277B7B6BD2B1625904AB897330DC31D67B850E77C2721159542B4F28EF5EE1DB5BB90144FE6F07D37E64014261E
Malicious:	false
Preview:	/* Constants /..const SIM_BROWSERCOMP_MENU_ID = "id_browser_sim_content_menu";..const SIM_TOOLBAR_BUTTON_ID = "sim_sweetim_btn";....const BRW_NOTIFY_STATE_DOCUMENT = Components.interfaces.nsIWebProgress.NOTIFY_STATE_DOCUMENT;..const BRW_NOTIFY_LOCATION = Components.interfaces.nsIWebProgress.NOTIFY_LOCATION;....const BRW_STATE_START = Components.interfaces.nsIWebProgressListener.STATE_START;..const BRW_STATE_STOP = Components.interfaces.nsIWebProgressListener.STATE_STOP;..const BRW_STATE_TRANSFERRING = Components.interfaces.nsIWebProgressListener.STATE_TRANSFERRING;..const BRW_STATE_IS_DOCUMENT = Components.interfaces.nsIWebProgressListener.STATE_IS_DOCUMENT;..../ End Constants /..../ Members */..var sim_mouseOut = true;..var sim_closeBubbleWindow = false;....//Listen to browser navigation, progress, netvork, security events..var sim_bubbleBrowserProgressListener = ..{...QueryInterface: function(aIID) {....var result = null;....if(aIID.equals(Components.interfaces.nsIWeb

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\content\contentmenu.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3711
Entropy (8bit):	4.586487379339707
Encrypted:	false
SSDEEP:	48:Vv7HHeL0tgDxRILL1BtH/N0kZp/V6bZ6+oCyhXHbgB1RulleK9s19j/h1OLXy:pIdE1BtZZSloL9sB1o/ZCj/rmXy
MD5:	089FBACD08F66ACB256605630CAEB58C
SHA1:	6A2156806CADD3144F4655F6D688DA27FE89EF73
SHA-256:	29C510DA7814E46549C31EAA84204B88CE3616343E1EC7535ED0EF2DF828A786
SHA-512:	CA32B03181E9D398B025F2E35BBCE0D64C2A086C1606EFAB97B1F6CDA4A4F29AA380403736A56F6F4DDBA778507F186BF579ACE3C148C510B43B40F663E5C34F
Malicious:	false
Preview:	..const SIM_TOOLBAR_BUTTON_ID = "sim_sweetim_btn";..var sim_g_wndContentMenu = null;....function simPreventDefaultProcessing(event)..{...try...{....if (sim_g_wndContentMenu.simTargetWindow)....{.....event.preventDefault();.....event.stopPropagation();.....event.target.parentNode.open = false;....}...}...catch(e)...{....logSevere2(e);...}..}....function SIMPoint()..{.. this._x = 0;.. this._y = 0; ..}....function simComputeContentMenuLocation()..{.. var oPoint = null;.... // step 1.. // get button.. var oButton = simMyGetElementById(SIM_TOOLBAR_BUTTON_ID);.. if (oButton != null).. {.. // step 2.. // check if current tab is opened with addons manager.. var bAddonsManagerTab;.. bAddonsManagerTab = simIsCurrentTabOfAddonManager();.. if (bAddonsManagerTab){.. // !! we get here also for "empty" tab.. // we should hide the menu.. // this is done by caller, when he gets point as null.. }..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\content\cookies.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8608
Entropy (8bit):	4.625604721501032
Encrypted:	false
SSDEEP:	192:J8WDV0lxkzQMqZRCdvWyx5c+KQby7DwcsF8cm:T+4dY
MD5:	1F46872FF3A64F893C4E43C081D375C8
SHA1:	DC24DFE5A9FC509A78E57F0CB4516B646D98CD30
SHA-256:	BFF21988F70894E777229045F3B70D50659F084658CCC5424F534D175E2651E4
SHA-512:	79451B08E2695B19A6B09BB45AE291C5F3176FC582969498A946ADF6662D43A2A0380A87B3B3548BFB1E7471631F645C94C53ABBA766048CF74100B63003FB50
Malicious:	false
Preview:	..const SIM_COOKIE_NAME = "SIMAPPID";..const SIM_COOKIE_HOST = ".sweetim.com";......// In 1.9+ and later there is new param "httpOnly"..// to nsICookieManager2:add..function simGetIsGecko19OrLater()..{.. var isGecko19 = false;.. if (kCI.nsIXULAppInfo).. {.. var appInfo = kCC["@mozilla.org/xre/app-info;1"].getService(kCI.nsIXULAppInfo);.. var versionChecker = kCC["@mozilla.org/xpcom/version-comparator;1"].getService(kCI.nsIVersionComparator);.. if (versionChecker.compare(appInfo.platformVersion, "1.9") >= 0).. {.. isGecko19 = true;.. }.. }.. return isGecko19;..}....var sim_g_CookiesObserver = {....// members.._registered: false,....// method: observe..observe : function(subject, topic, data)..{.. try.. {.. if (topic == "cookie-changed").. {.. // see http://developer.mozilla.org/En/NsICookieService.. if(data == "cleared" \|\| data == "deleted").. {.. var verify =

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\content\domainutils.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	C source, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.556954689157478
Encrypted:	false
SSDEEP:	24:5YPwVFM/wVMMQq8EwK04sA1jFBAZFtJ5stxNYUXi5MIm4gz21icL:5YSFMCMMzZF04sSBqFtJ5stxN4Zm4gK/
MD5:	3A394379FE27CCBEE9FCACAD25A89624
SHA1:	9573282380AF9404FBE89F87E4A8AB2C8EA5A785
SHA-256:	8F87D2A1D2B63DCCED8AE3219A905A22129A5C9D05CCFE80123A1DFA8EAA4CC2
SHA-512:	7FD6A89AA8439F686222320E41F443CDD529662CC1B08D991BF41CC092C3971EDA0FA0B98E8AB6605F6F4D554A29694F061C05654435BA9590B5AE6BE6BD7D44
Malicious:	false
Preview:	function getDomainNameFromURL(sURL) {.. sURL = sURL.replace("http://", "");.. sURL = sURL.replace("https://", "");.. var slash = sURL.indexOf("/");.. if (slash > 0) {.. sURL = sURL.substring(0, slash);.. }.. return sURL;..}....function getSecondLevelDomain(sURL) {.. var sDomain;.. var sSecondDomain = "";.. var arr;.. if (sURL != null) {.. sDomain = getDomainNameFromURL(sURL);.. arr = sDomain.split(".");.. if (arr.length > 2) {.. sSecondDomain = arr[1];.. }.. else {.. sSecondDomain = arr[0];.. }.. }.. return sSecondDomain;..}....function CompareSecondLevelDomains(sURL_1, sURL_2) {.. var result = false;.. try {.. var sSecondDomain1;.. var sSecondDomain2;.. sSecondDomain1 = getSecondLevelDomain(sURL_1);.. sSecondDomain2 = getSecondLevelDomain(sURL_2);.. if (sSecondDomain1 == sSecondDomain2) {.. result = true;.. }.. }..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\content\dynamic.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3140
Entropy (8bit):	4.472854553394219
Encrypted:	false
SSDEEP:	96:HuKNuu1ywyvw8WU5Nuu1ywGz7vFlNuu1ywy:HuwaQw2wwy
MD5:	01AD57D140DA3C93803DD9D700373C52
SHA1:	3458CD2EDE13733C9B8447251DED6CDB5B6B182D
SHA-256:	A899595EF19B413A9099A9540852BE1013EBFA18379F31E65D9ACEEAEA52A163
SHA-512:	8E74CA4104F02318B659C67A34DD259681D8CC4F0971FA6F5B6165A1FEDEEEC79180A9C1BD33340607881818349697492EDA9B96580132A4A979F54AEF778FBF
Malicious:	false
Preview:	..// small helper..function..simInsertAfter(newChild, refChild)..{ ...var oParent;...oParent = refChild.parentNode;.. oParent.insertBefore(newChild, refChild.nextSibling); ..}....function..simAddSeperator(id, insertAfterId)..{.. try.. {.. var oNewElem;.. var oElemExist;.. .. // create new element.. oNewElem = document.createElement('toolbarseparator');.. oNewElem.setAttribute('id', id);.. .. // add it.. oElemExist = simMyGetElementById(insertAfterId);.. simInsertAfter(oNewElem, oElemExist);.. return oNewElem;.. }.. catch(e).. {.. logSevere2(e);.. return null;.. }..}....function..simAddBanner(id, url, insertAfterId, name, width, height, bAddPadding)..{.. try.. {.. var oNewElem;.. var oElemExist;.. var oParent;.. var style;.. .. // create new element of banner.. oNewElem = document.createElement('iframe');.. oNewElem.setAtt

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\content\file.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	7243
Entropy (8bit):	4.667029972880432
Encrypted:	false
SSDEEP:	96:1Ume45J4xbfd3QMs3LfHSVoLlHVcn1EoV5HAVcj/qr8S8G0oRoccNd+:TeRpfXQLHcoBHK1D5Hac7qwvGLx0d+
MD5:	B0B4F17785E11927B144C61C3148E2AC
SHA1:	260A37C06BC8294D79C72A329C261E187E9555BA
SHA-256:	85E23241F5A8301CCF224AF5C30DD58CD6D9584E731259147E3561813F78AEF5
SHA-512:	D9F29D4AF899D6E2D7AC5F3E6F0D4BDAA09B9ED4E3B546EA257B5D65E3E319153EC67A657756899404C3BFEAEE4129F98E249B546BE4067E80F9B19A42A5FEAD
Malicious:	false
Preview:	..// TODO2 - check this: dont put log bcz it recurse..function simGetFileSize(filename)..{.. var result = 0;.. try.. {.. var file;.. .. file = kCC["@mozilla.org/file/local;1"].createInstance(kCI.nsILocalFile);.. file.initWithPath(filename);.. .. if (file.exists()).. result = file.fileSize;.. else.. result = -1; .. }.. catch(e).. {.. simAssert(eSeverity.eSEVERE, e);.. }.. return result;..}....function simReadFileToString(filename) {.. .. var result = null;.. .. try {.. var file;.. var cstream;.. var fstream;.. var data = "";.... logEnter();.... file = kCC["@mozilla.org/file/local;1"].createInstance(kCI.nsILocalFile);.. fstream = kCC["@mozilla.org/network/file-input-stream;1"].createInstance(kCI.nsIFileInputStream);.. cstream = kCC["@mozilla.org/intl/converter-input-stream;1"].createInstance(kCI.nsIConverterInputSt

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\content\findword.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3434
Entropy (8bit):	4.555949304243929
Encrypted:	false
SSDEEP:	48:1foLrnEe2o1349x0nrnE9zMZJH7Cb+KQGj8HmGF/hfqj:16oeBMuo9zMLHU+KQG4HzYj
MD5:	613B6833DCC4E6ABD2412016F8533729
SHA1:	2A8DD9827A4EF50AEF9BAD4A08697B2E953CF785
SHA-256:	D31BE0E9CDB8B1460D6E4F621EDE0C81E657B95D41D59B45BEA6127E43F61E4A
SHA-512:	A2FBE1B2E9A3D97F5FBD71FBC931D9672A8703B939BE0EFD7F70F895CDD77EBB32C0963BAAFD7635A9CD88DE420A57AC408EE7072C773A819D80D9E61B768E39
Malicious:	false
Preview:	..function simRemoveFindWordButtons() {.. try {.. logEnter();.... var oFindWordButton;.. var oFindWordItem;.... oFindWordItem = simMyGetElementById('sim_find_words_item');.. while (oFindWordItem.firstChild) {.. oFindWordItem.removeChild(oFindWordItem.firstChild);.. }.. }.. catch (e) {.. logSevere2(e);.. }..}....function simAddOneFindWordButton(oFindWordItem, label) {.. var oNewButton;.. var tooltipText;.. oNewButton = document.createElement('toolbarbutton');.. oNewButton.setAttribute('label', label);.. oNewButton.setAttribute('id', 'sim_id_for_find_word_' + label);.. //newButton.setAttribute('crop', 'end');.. oNewButton.setAttribute('class', 'sim_find_word'); // alse sets max width.. oNewButton.setAttribute('oncommand', 'simFindNextWord(event);');.. tooltipText = simGetFormattedStringFromBundle('sweetim.property.button.findword.tooltip', [label]);.. oNewButton.setAttribute('tooltiptext

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\content\generalobserver.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1430
Entropy (8bit):	4.474103530814768
Encrypted:	false
SSDEEP:	24:KX0t8sqp5raTuJ/fwo84vnUO0qRy67wf7o84vnM0qBQltydbjee5DRB6ykibjLeM:KE3U5J/fwopvnUO0Eyiwf7opvnM0SQPs
MD5:	EE7A229CBDB7F4F3023ACCC1A12CC8BB
SHA1:	AF5F336C583C51CD6FDB8D2FC960B525EEAA5B80
SHA-256:	8C4EA863D577011A2AACB884A18BE53C9599B3CA9B212AC893CA987DA5E2EC11
SHA-512:	C974CC5D0E5079BA1928CED96A64F3F1791079545FA983D4FA66918F5A5DFBF7D9B473AD45CD29AC3FAA9D9A86DC0F93CAD12AA42EED2ABFD5C206F759A1BDF2
Malicious:	false
Preview:	..var sim_g_GeneralObserver = {.... // members.. _registered: false,.... // method: observe.. observe: function (subject, topic, data) {.. try {.. if (topic == "quit-application-requested") {.. simOnQuitApplicationRequested();.. }.. }.. catch (e) {.. logSevere2(e);.. }.. },.... // method: register.. register: function () {.. if (!this._registered) {.. var observerService = kCC["@mozilla.org/observer-service;1"].getService(kCI.nsIObserverService);.. observerService.addObserver(this, "quit-application-requested", false);.... this._registered = true;.. }.. },.... // method: unregister.. unregister: function () {.. if (this._registered) {.. var observerService = kCC["@mozilla.org/observer-service;1"].getService(kCI.nsIObserverService);.. observerService.removeObserver(this, "quit-application-requested");..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\content\global-namespace.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	814
Entropy (8bit):	4.8948254611600035
Encrypted:	false
SSDEEP:	12:EfYCIaDJIDD7FsoKI78kLLrpbhoc5tA1iVCYKOHsgp7cbUNnIHYK30JWM/qGwY8s:ErIa/o18kzpb81zLa1nMEJWMiGWs
MD5:	F94995DEAE7ABCDFCE3A3C9BB5F5EC01
SHA1:	4D3C7CB0EA579AD062EDADD18D52EDBD54A331DD
SHA-256:	E3A1E261E542BB984064D9F1B02A72720A4F238BFB3EC8D76BD5407D5FEDB6D2
SHA-512:	B903EB8183214EE0F8F152478AB99B002746A29575AA3B2214153E2C050295C2D37CC28406432452D33F2D12751A5079DEE927CD49CF1EE0686145E434B7359A
Malicious:	false
Preview:	..// loaded in "global namespace", bcz function already "SIMTB_Navigate" in use by ppcbully banner,..// without use of namespace....// called from ppcbully banner, in order to open ad in _current_ or _new_ tab, instead of in new window..// (cannot be done directly using JS, without helper function)..function ..SIMTB_Navigate(url) {.. try {.. NAMESPACE_SIM_TB.logEnter();.... var target = NAMESPACE_SIM_TB.simGetConfigString("ppcbully.target");.. if (target != null && target == "new-tab") {.. NAMESPACE_SIM_TB.simNaviagteToUrlInNewTab(url, false).. }.. else { // no value, or "current-tab", as default -> open in current tab.. NAMESPACE_SIM_TB.simNavigateToURL(url);.. }.. }.. catch (e) {.. NAMESPACE_SIM_TB.logSevere2(e);.. }..}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\content\globals.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with very long lines (3538), with CRLF line terminators
Category:	dropped
Size (bytes):	5929
Entropy (8bit):	5.118606362873504
Encrypted:	false
SSDEEP:	96:PT7FggKebtnL/6q0P7ETojlQXdMdnL2D5JeMp6ncwGTSM3YtlPLg:PT7VKStnT6DxhSD5+gYtts
MD5:	95C9B565B9F126BA7B38D804AFF23F3B
SHA1:	7A591C7532742665FCD9BA582C7D619B0728C698
SHA-256:	0544D0A22B2AE4A1F47EE22CBA892C28D3C40AD20D46C87040A78232F5315E2B
SHA-512:	2D799781037E44944571243D6924F5CA457ECDF3B450FEE035A48DF9F5F1CBC59E49A29E26213329B53A67913C3A04D176F62337B749425BA3D3BB04DE30CD3F
Malicious:	false
Preview:	..// urls..const SIM_URL_SEARCH = "http://search.sweetim.com/search.asp"..const SIM_URL_WWW = "http://www.sweetim.com";..const SIM_URL_HOME = "http://home.sweetim.com";..const SIM_URL_FORUM = "http://www.sweetim.com/forum/";..const SIM_URL_HELP_FF = "http://www.sweetim.com/help_simff.asp";..const SIM_URL_HELP_ABOUT = "http://www.sweetim.com/about_overview.asp";..const SIM_URL_HELP_UNINSTALL_FF = "http://www.sweetim.com/uninstallhelpff.asp";..const SIM_URL_FEEDBACK = "http://www.sweetim.com/help_contact.asp";..const SIM_URL_PRIVACY = "http://www.sweetim.com/eula.html#privacy";..const SIM_URL_AFTER_INSTALL = "http://www.sweetim.com/installbar.asp?barid=%toolbar_id";..const SIM_URL_AFTER_UNINSTALL = "http://www.sweetim.com/uninstallbar.asp?barid=%toolbar_id";..const SIM_URL_AFTER_UPDATE = "http://www.sweetim.com/updatebar.asp";..const SIM_URL_SEARCH_FOR_DS = "http://search.sweetim.com/?src

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\content\gui.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	994
Entropy (8bit):	5.055837583663413
Encrypted:	false
SSDEEP:	24:1nNRePft2xlRewMoHPiRoBioxNjoKweJiJ2nNRRXAofYRRm5YrRR2Re7Uh2JE:1nNEnt2xHxM4iaBioxNj2J2nNbAogmYY
MD5:	B21915268656A59AB1FEFDB73060C116
SHA1:	11029F793F81E05A5666D90367E4DE17D489ED9F
SHA-256:	F18C604A4AC3C9E331EE4CCDD5B9064392C7AE1F53068FD20F990500BE961752
SHA-512:	FCB822F6BDFFB744A74B6CF7B92F89B4A86059959B79DCB98ED2D8DAA3AA51F17290F432A4619FD3B0286D3A038D0F1C7656310D9D579087AC9E40F2D9CBEA5A
Malicious:	false
Preview:	..function simMyGetElementByIdImpl(oParent, id){.....var oElem = null;...if (oParent != null && oParent.hasChildNodes()) {....var children = oParent.childNodes;....for (var i = 0; i < children.length; i++) {.....var oChild = children[i];.....if (oChild.id == id) {......oElem = oChild;......break;.....}.....else {......// try to recurse......oElem = simMyGetElementByIdImpl(oChild, id);......if (oElem !== null)......{.......break;......}.....}....}...}...else{....//alert("children.length = 0");...}...return oElem;..}....function simMyGetElementById(id){...if (false) { // orig, but in correct when we also have TB running along side FB,....// bcz they use same ids....var obj;....obj = document.getElementById(id);....//alert("obj = " + obj);....return obj;...}......var oParent;...var oElem = null;...oParent = document.getElementById(SIM_TOOLBAR_ID);...oElem = simMyGetElementByIdImpl(oParent, id);...if (oElem == null) {....// alert("oElem null for id = " + id);...}...return oElem;..}..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\content\highlight.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	11741
Entropy (8bit):	4.718561487895601
Encrypted:	false
SSDEEP:	192:M4waE6qTeRNKsTVyJnd9M6sTaQqIqIPejICyIK4+WPgGMo3acYkXwx:NRqpTeejmazycM
MD5:	19C91355F834A826C848D1FAE11C5FAF
SHA1:	8EE43CDE546F9CB1BF8A4C3B4FBB0BD1A669112C
SHA-256:	8FB0A6DA582D7BE18DF253731ED0EF4136C9609064ACF8FF83B7CBD4F26F9A6C
SHA-512:	908A9B95FA8E26485027B85B94B46C84DB1FD487CC315547FB6B8E6D0720FA3EF917C091C7F33CFF5C091C35DF0B022875EFD10D52829FD96566392C4FEA2B9D
Malicious:	false
Preview:	..var sim_g_arrColors = null;....// private..function simGetHighlightButton()..{ .. var oButtonHighlight;.. oButtonHighlight = simMyGetElementById('sim_highlight_btn_id');.. return oButtonHighlight;..}....// private..function simGetHighlightButtonChecked()..{ .. var oButtonHighlight;.. var bChecked;.. .. oButtonHighlight = simGetHighlightButton();.. if (oButtonHighlight.hasAttribute('checked')).. {.. bChecked = oButtonHighlight.getAttribute('checked') == 'true';.. }.. else.. {.. bChecked = false;.. } .. return bChecked;..}....// private..function simSetHighlightButtonDisabled(bDisabled)..{.. var oButtonHighlight;.. .. oButtonHighlight = simGetHighlightButton();.. oButtonHighlight.disabled = bDisabled;..}....// private..function simSetHighlightButtonChecked(bChecked)..{ .. var oButtonHighlight;.. .. oButtonHighlight = simGetHighlightButton();.. oButtonHighlight.setAttribute('checked', bChecked);..}.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\content\history.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2980
Entropy (8bit):	4.13201368175262
Encrypted:	false
SSDEEP:	48:1suFOFuLDFEFEnXU8cCVVIdk2W7zdXO4DOWlCuTMCSz:TFOcPFEFoflSI3JHD2qgz
MD5:	2A1BE640289F613777A831410130DB4D
SHA1:	BDAF40DC75C69F30799DF9A4B2428930F30F3624
SHA-256:	4B747F43C14B6C95EB37EB2340072B40125C57999DA530FFADBCB999D81ED393
SHA-512:	DDFC32305F9C0FAE715BBE4C918007E6ACD3AFC94FF0054FE47021E8EBD9B4048DC9F1F296DE2EAC76779BFC6D3ACF5E406AD47D5650FF07DCEAB4A32B1C340C
Malicious:	false
Preview:	..function simGetSearchHistory()..{.. var result = null;.. try.. {.. var arrEncoded;.. var sHistoryItems = "";.. if (simGetIsConfigExists("search.history")).. sHistoryItems = simGetConfigString("search.history");.. if (sHistoryItems && sHistoryItems.length > 0).. {.. result = new Array();.. arrEncoded = sHistoryItems.split(",");.. for(var key in arrEncoded).. {.. var encoded;.. var decoded;.. .. encoded = arrEncoded[key];.. decoded = decodeURIComponent(encoded);.. logDebug("key="+key+",encoded="+encoded+",decoded="+decoded);.. result.push(decoded);.. }.. }.. }.. catch(e).. {.. dump("simGetSearchHistory= "+e);.. //logSevere2(e);.. }.. return result; // array of decoded..}....// param text shouldNT be encoded..function simAddToSearchHistory(

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\content\inject.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	6637
Entropy (8bit):	4.38577654837664
Encrypted:	false
SSDEEP:	96:YXyv7ijuSlT3gChurexw6Z7VNsOAojOWkhkCnHSBFRs+Mz2CNN:nvjquWwy7NOWqkCyBFRs+MqG
MD5:	560EFC94BF82CD40EDFA51D0EC7A8ED5
SHA1:	991B9B36CBF729632310D8B862EC92928F20D43D
SHA-256:	0A8AAB29CAFA7055F99DBAE359400B8EF187EC181F8976F7B7748CDEA4AAD88E
SHA-512:	2517F88D6F4FE557F2D894D64F9697F4FFC162F64C4E4D943B09024EDDD7CBB2E37D240CB684FE656348E082DAD011E3DEA0955BA1AB3BBB8063A4B741B9ACD4
Malicious:	false
Preview:	..// TODOZ: future use..function SIMScriptInfo() {.. this._sRegexp = "";.. this._sURL = "";..}....var g_sim_strScriptURL = "http://sc.sweetim.com/apps/in/fb/infb.js";....function simAddScriptToDocument(oDocument) {.... try {.. var SCRIPT_ELM_ID = "id_script_sim_fb";.... var objScript = oDocument.getElementById(SCRIPT_ELM_ID);.. if (!objScript) {.. var head = oDocument.getElementsByTagName('head')[0] \|\| document.documentElement;.. var scriptElement = oDocument.createElement('script');.. var url = simGetConfigString("urls.ScriptUrlFB"); // same name as used in IE.. if (url == null \|\| url == undefined \|\| url == "") {.. url = g_sim_strScriptURL;.. }.. scriptElement.src = url;.. scriptElement.type = "text/javascript";.. scriptElement.language = "JavaScript";.. scriptElement.id = SCRIPT_ELM_ID;.. head.insertBefore(scriptEl

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\content\install.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	22273
Entropy (8bit):	4.567586678614434
Encrypted:	false
SSDEEP:	384:N44hc4vQNQMq2ygMZr87jmnH5dgRTHR4/bKfn+E:N4A1ZeSm
MD5:	4F697EF09E80937BD0321C81800CA48F
SHA1:	B58FA1875961D22E5E3534225F7B7D17E5530308
SHA-256:	43729CF4EC878E3B12B60A1CD19A78516BC79CFBAAA0E289DDA2432EF25E248D
SHA-512:	8FD1CFD5E02F753519A142F0DDEF5CB32ED6C59C12D1BDDC6CCDC7E1CD9CCFCC478EF5E9673543F113FD419B90C0B7B1C860499461D848A53E853F7D3C2BDE24
Malicious:	false
Preview:	..function simOnInstall()..{.. try.. {.. logEnter();.. simAddDefaultConfig();.. simUpdateVersionFromRDFInPrefs();.. }.. catch(e).. {.. logSevere2(e); .. }..}....function simGetPrefsArray()..{.. var arrPrefs = new Array();.. .. // keyword url.. arrPrefs.push( {prefName:"keyword.URL", prefSweetIMValue:"http://search.sweetim.com"} );.. .. // default search.. arrPrefs.push( {prefName:"browser.search.defaultenginename", prefSweetIMValue:SIM_SEARCH_ENGINE_NAME} );.. arrPrefs.push( {prefName:"browser.search.selectedEngine", prefSweetIMValue:SIM_SEARCH_ENGINE_NAME} );.. .. // homepage.. // get the value which was added by setup, as homepage.. // was stored also here for comparsion. see c++: SetFFDefaultHomePageUsingPrefsFile.. var sSweetIMHomePage = simGetConfigString("urls.homepage");.. arrPrefs.push( {prefName:"browser.startup.homepage", prefSweetIMValue:sSweetIMHomePage} );.... return ar

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\content\logger.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	10479
Entropy (8bit):	4.595467703826516
Encrypted:	false
SSDEEP:	192:danfRLbJ1A0MASuHvLLKO9LJOq2/pOq6pdyJFIZMGt4Z:dsbQaLLKO9LYZ/UJPaZ
MD5:	5329A994D60FB712F6D18F9D69C0B29B
SHA1:	F0E9AE0F6EE68BEE731176871741836A4F400715
SHA-256:	CA3540B7DD00EE74126562A027B6C11A3DF3E6155313D9D39DF3F48409635BBD
SHA-512:	034147BE48FEC3A3B40F74C8835FB158A8A01BEC52394DA431F5B8C614FA38C7B9DB9AFF3D34A455060E35FD0BC1860B3E6196760A9380C437A53D85222710F2
Malicious:	false
Preview:	// for eSeverity original definition, see Level.h..var.eSeverity =..{.. eALL:0,.. eDEBUG:1,.. eCONFIG:2,.. eINFO:3,.. eWARNING:4,.. eSEVERE:5,.. eCRITICAL:6,.. eOFF:7..};....var g_loggerInit = false;....var g_FileHandler_FileName = null;..var g_FileHandler_MinReportLevel = null;..var g_FileHandler_MaxFileSize = null;..var g_ConsoleHandler_MinReportLevel = null;....var sim_g_loggerDisabled = false;.. ..function initializeLogger()..{.. // TODO - the strings of prefs names, appear also in config.js => put them in one place only.. .. if (simHasConfigPrefs()).. { .. g_FileHandler_FileName = simGetConfigString("logger.FileHandler.FileName");.. g_FileHandler_MinReportLevel = simGetConfigString("logger.FileHandler.MinReportLevel");.. g_FileHandler_MaxFileSize = simGetConfigString("logger.FileHandler.MaxFileSize");.. g_ConsoleHandler_MinReportLevel = simGetConfigString("logger.ConsoleHandler.MinReportLevel"

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\content\main.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2761
Entropy (8bit):	4.585147185811158
Encrypted:	false
SSDEEP:	48:G3JhY6Boz41aDkkaYMjNgr3AetwWOzBT4JF5Ay6:G3JOXDlazjN+w2OBMWf
MD5:	2E2A156B39E9712A9009685B01C32097
SHA1:	E1A475D4A5630873BBB4385130F7AB784BDEB90C
SHA-256:	5A7F42C79EF674479812DB4A4AF9A0F8C419AF9042D51542174E64BA9CE9276E
SHA-512:	C8AE2C1FFD66C613D5F20B957120BCE25C436A0C5EC9D42C0202781DC78EC3C4B67AABD2EA5D3546F6E1E4C7AF69FD328D0FDAD1BCA8957872093083012C6188
Malicious:	false
Preview:	..var NAMESPACE_SIM_TB = {};....NAMESPACE_SIM_TB.loadScripts = function () {.. // load external JS files, into gloabl object "NAMESPACE_SIM_TB", which is used as namespace.. try {.. var path = "chrome://sweetim-toolbar/content/";.. var loader = Components.classes["@mozilla.org/moz/jssubscript-loader;1"].........getService(Components.interfaces.mozIJSSubScriptLoader);.. var files = new Array(.. "sweetim-toolbar.js",.. "registry.js",.. "config.js",.. "search.js",.. "searchguard.js",.. "searchservice.js",.. "logger.js",.. "commands.js",.. "highlight.js",.. "tabinfo.js",.. "tabinfo-array.js",.. "webprogresslistener.js",.. "contentmenu.js",.. "splitter.js",.. "chevron.js",.. "uninstallobserver.js",.. "version.js",.. "install.js",.. "globals.js",.. "history.js",.. "file.js",.. "stringbundles.js",.. "tooltip

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\content\messagebox.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	790
Entropy (8bit):	4.552759257474942
Encrypted:	false
SSDEEP:	12:xb7gDv5WyDfcoXNWiB14/7+KI5hoG2tyUovprDzpTz8yhphzFnATpJx37GpJcL:1kv5BDUoX/4TNlkpp3NTwOhFmXYcL
MD5:	EBBDC1D24F91354112CE613C5FF079D4
SHA1:	9E6902E98BB070AC14A53476B830F546BCD41E4F
SHA-256:	822A4FADA8538D2365EB806AF58516D76C5E00E49FFB4B81261BFA14F13DCB3B
SHA-512:	DA18275FF3A33E93ED7D827BCB9697492A6AEEB83C5265F3A470CED73DE3DC361F39A16EB90D1C39FBBAC1BF59F002DD9EFF24F68C397DD1726D7F65DEF32F96
Malicious:	false
Preview:	..function simMessageBox_OkCancel(sCaption, sText) {.... var result = null;.. try {.. // show message, ask user if to keep settings.. var promptService = kCC["@mozilla.org/embedcomp/prompt-service;1"].getService(kCI.nsIPromptService);.. var flags = promptService.STD_OK_CANCEL_BUTTONS;.. var check = { value: false };.. var button = promptService.confirmEx(window, sCaption, sText, flags, null, null, null, null, check);.... // set the value that user selected in result.. if (button == 1) // user selected "pos_1" button => no.. {.. result = false;.. }.. else {.. result = true;.. }.. }.. catch (e) {.. logSevere2(e);.. return null;.. }.... return result;..}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\content\ppcbully.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	3.7605520099280896
Encrypted:	false
SSDEEP:	24:JyBoNLxRRtU3dLqRRdv7f+fOpLfy8fHUwBc1P+urxpZhzZDb:kB4x+opDGmB5WmuLPh
MD5:	D0D9DDC7A4FCEC37560A070DFA13BF5E
SHA1:	ABBDD24BB2BF5C915F3037F8CDB5675D6A9F331A
SHA-256:	B28E9EDE8088E44E68C13BF1AA7B540924A6D18C0F25B015D4CABC02E3F6AD3B
SHA-512:	598A7B9F07F25E0A606431F3A93D618885CD803233B29465869E754285666CA2212B53BE3BB997A48F272617618B4EB5FE799E004ECB948E941AA767D84A189B
Malicious:	false
Preview:	..// notifies ppcbully banner on every document complete...// called from rc.html..function..simNotifyPPCBullyBannerOfDocumentComplete(bannerId, url)..{.. try {.... logDebug("params: bannerId = " + bannerId + ", url = " + url);.. .. var oToolbar;.. var oBanner;.. oToolbar = document.getElementById(SIM_TOOLBAR_ID);.. if (oToolbar.collapsed == false) // check if toolbar is hidden.. {.. oBanner = simMyGetElementById(bannerId);.. if (oBanner).. {.. if (oBanner.contentWindow != null && oBanner.contentWindow).. {.. if (oBanner.contentWindow.pbNavigateComplete != undefined) {.. try {.. oBanner.contentWindow.pbNavigateComplete(url);.. }.. catch (e2) {.. logSevere2(e2);.. }.. }.. el

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\content\registry.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5801
Entropy (8bit):	4.664439405681212
Encrypted:	false
SSDEEP:	96:XnVid/DwfTNCDKUTisuLpBXPJjH9BL3rqzx5GH1zTNb1Lx1+:XVid/DwfT2KUTi7/XPJTbL3rqzx5GzTG
MD5:	8008F72ECA33168113BF191E38503787
SHA1:	E955FA0F508421836DF1DE60B9405CC310B1399C
SHA-256:	7744FCB23B17BAD1F7D66574158B06AF918590F13E0EBCE1550E86E2CD41388C
SHA-512:	C66418A1B16C88D205CDE3D154F907AF743DBBD4DD81CBA4870E2BE32C70784E9EE55B32670AAB984935F071BAB3D9F0C76C7551FCF9FF9FAD0CE6BCB591D4C8
Malicious:	false
Preview:	..// rootKey > HKCU, HKCR or HKLM..// subKey - string..// sAccess > "ACCESS_READ", "ACCESS_WRITE" or "ACCESS_ALL"..function simOpenRegsitryKey(rootKey, subKey, sAccess)..{.. var result = null;.. var rootKey2 = null;.. var access;.. .. try.. {.. result = kCC["@mozilla.org/windows-registry-key;1"].createInstance(kCI.nsIWindowsRegKey);.. .. switch (rootKey).. {.. case "HKCU":.. rootKey2 = result.ROOT_KEY_CURRENT_USER;.. break;.. case "HKCR":.. rootKey2 = result.ROOT_KEY_CLASSES_ROOT;.. break;.. case "HKLM":.. rootKey2 = result.ROOT_KEY_LOCAL_MACHINE;.. break;.. } .. switch (sAccess).. {.. case "ACCESS_READ":.. access = result.ACCESS_READ;.. break;.. case "ACCESS_WRITE":.. access = result.ACCESS_WRITE;.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\content\release.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	146
Entropy (8bit):	4.767727345085542
Encrypted:	false
SSDEEP:	3:8WlPUNFDMJ9+fkVLLxIWJVJM9BeqFHQLvC8uVL3DfFn:8WlcSJ97LRbJM9xFwL6tF3Dtn
MD5:	747594BE6C4F3CAD60FD041F4D6B2F7F
SHA1:	7281CE747E33CF70A00FA454BBD8C0757A8534B1
SHA-256:	0C82D59157B3985CBF6F254CA12A63AE86AE08EFF432EE423D0F630D7B58D123
SHA-512:	D3822A112247C1C6B5E405B6405693D52225326C1B1DCCEF44127A828C16517ADFEBD6F1E09D4EE5A983C1452361A708E9B08ADCBF004FB90A3588623B53E111
Malicious:	false
Preview:	..// see relavent .h file..// "__ENABLE_LOGGING__" is not used anymore, to simplify and make only one build..// const __ENABLE_LOGGING__ = false;

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\content\remote.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2866
Entropy (8bit):	3.9577654921496856
Encrypted:	false
SSDEEP:	48:fUjX/azHQrw/Mt8vjVopMQDAGpORxQTho:kvaNjVo2CYH
MD5:	4D7F123CAD5ADDBBCD24532A7DA71839
SHA1:	A3E202D2E2E5E521DEE6C234AABFB3130108823F
SHA-256:	043DD5866F912585FAD932DF1735E702E904465BD8ABF04C7B62F257A5888B59
SHA-512:	FD4157D0889934B385FE3723C6230B259DDCAD93ED171C2486E5B462DE9BB806D60928AB16E4A11716CB60A8B1D0310F725034BA80B44EE9712AA6BAEFE94C78
Malicious:	false
Preview:	..var sim_g_scriptOnDocumemntComplete = null;....function simInitializeRemoteControl()..{ .. try.. { .. // MOVE to download complte of "control banner" ???/.. // step 1.. // get object of remote control web page.. var oElem = document.getElementById(SIM_REMOTE_CONTROL_ID);.. if (oElem) {.... if (oElem.contentWindow && oElem.contentWindow.SIMRC_getCodeForOnLoad) {.. // step 2.. // get script from remote control web page .. var script;.. script = oElem.contentWindow.SIMRC_getCodeForOnLoad();.. //alert("script = " + script);.... try {.. // step 3.. // execute script.. eval(script);.. }.. catch (e) {.. //alert("e = " + e.message);.. logSevere2(e);.. }.. }.. else {.. log

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\content\search.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	13939
Entropy (8bit):	4.490104471837317
Encrypted:	false
SSDEEP:	192:hz4NrMFE5ypxxPgANkYser6lUljfT5wfimNN5h5Up:Pl5v6KtfT5wamNw
MD5:	A381E5306EA29348EB9965719A4F37E5
SHA1:	2602001F45E3EC3B07CD5E595843A20ACD3F9DCE
SHA-256:	7A5F71914DA2546E0C9D00B64A3CD3945312AA143768A8D7D2B8C472A38ED346
SHA-512:	0431AD475B09A019C3A1DFD730D97C0A07534A5BB8D9B9040092DC3350CBBD1BE47D302A5DAE94C6825B2F20C3C006EE4FD2D945D38D69F26A41EA667455756D
Malicious:	false
Preview:	....var sim_g_historyCapacity = null;..var sim_g_arrExteranlSearch = null;....// trims start and end..function simTrimString(string)..{.. // If the incoming string is invalid, or nothing was passed in, return empty.. if (!string).. return "";.... string = string.replace(/^\s+/, ''); // Remove leading whitespace.. string = string.replace(/\s+$/, ''); // Remove trailing whitespace.... return string; // Return the altered value..}....////////////////////////////////////////////////////////////////////////////////..// 1) Calls "simTrimString" to trim start and end..// 2) Removd "runs" - and convert all runs of more than one whitespace..// character into a single space. ..// The altered string gets returned...////////////////////////////////////////////////////////////////////////////////..function simTrimStringAndRemoveRuns(string)..{.. // If the incoming string is invalid, or nothing was passed in, return empty.. if (!string).. return

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\content\searchguard.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	15169
Entropy (8bit):	4.471034320295774
Encrypted:	false
SSDEEP:	384:1jHSjKtnD3TbQDzFPswdXNpF+KdoWkln6yBQdLJqKW87ZE0dhrBBhB4XqIh:ZyjKZD3vQDzFpXv3oWun6yBQdLJqKW8g
MD5:	AD60C046850E849FDE33AC00B901E559
SHA1:	663FD643D2640A319F759985BFAD727CDB26CABD
SHA-256:	39F6887369282791F458CA901DAA9690639931208CA08C7555601AA76CFC46E1
SHA-512:	42631BA9213413F857F3DAC4AABCA400D26A9303AA427D9E408FE8FF5923132E1F6D21E08DAE58B0879E07D0B49EE531D87239AF4C62EFF0FC82A513C17D1441
Malicious:	false
Preview:	..const SIM_SEARCH_GUARD_PARAM = "st";....function simUnhideSearchEngine() {.. logEnter();.... try{.. var engine = simGetSearchEngine();.. if (engine!= null && engine.hidden == true) {.. engine.hidden = false;.. }.. }catch(e) {.. logSevere2(e);.. }..}....// checks if param exists in url of search provider (plugin)..// it is found under os:Param tag, in XML of search plugin...// didn't fidn a way to check this using API/XPCOM etc...function simCheckIfParamExistsInSearchProviderURL(paramName) {.. logEnter();.. .. var exists = false;.. try {.. var engine;.. var SP;.. var xml;.. .. engine = simGetSearchEngine();.. if (engine != null) {.. SP = simGetSearchPluginFile();.. if (SP.exists()) {.. xml = simReadFileToString(SP.path);.. if (xml != null && xml != "") {.. // we also check for prefix of &, bcz this is how we ad

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\content\searchservice.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1970
Entropy (8bit):	4.240138604578698
Encrypted:	false
SSDEEP:	24:1ME/NbNZ4DmHfknInl/2gbNmK8hxo3i14DpWitBxgWoQfhRos2iQRpbX3HY:1MEwKsInf4ThK3iykit3Zhqs2iQfnHY
MD5:	D84A32AC7348C138C959B8DED416E3BE
SHA1:	7D3636316AE54ECD3950D7C041E54D9028C5C56F
SHA-256:	7057A6C5AA02C8C89957FC9688585B9D5484C0E739722BD714FA619FFB312BB8
SHA-512:	723B1C032C5151E9A285683830C07F687A9408252F71E2277D2C312EC640352D798C494D9A952CC26CA1488504E52359285767F322289A1A7D9F0DD9461C0C01
Malicious:	false
Preview:	..function simGetSearchEngine() {.. var searchService = null;.. var engine = null;.... logEnter();.... try {.. searchService = kCC["@mozilla.org/browser/search-service;1"].getService(kCI.nsIBrowserSearchService);.. if (searchService != null) {.. engine = searchService.getEngineByName(SIM_SEARCH_ENGINE_NAME);.. }.. } catch (e) {.. logSevere2(e);.. }.. .. return engine;..}....function simAddSearchEngine() {.. .. var searchService = null;.. var engine = null;.. var bResult = false;.... logEnter();.... try {.. // step 1.. // check if engine already exists.. engine = simGetSearchEngine();.. if (engine != null) {.. logInfo("engine already exists");.. engine = null;.. }.. else {.. // step 2.. searchService = kCC["@mozilla.org/browser/search-service;1"].getService(kCI.nsIBrowserSearchService);.. if (searchService != nu

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\content\splitter.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3044
Entropy (8bit):	4.67890442222015
Encrypted:	false
SSDEEP:	48:QTHlWfqcTUJrzQ2fgFDQtgM8irSjXgmcCHwZoOkKT0wTx:ucSdhzD0oYgmEX/x
MD5:	6AFA89C5ED43D559D7503C6C1C826FBC
SHA1:	83BBA8FDD394CFC46ABD3E093F177DFDD85FBBA5
SHA-256:	F0DA29B0A1584D22E79D24E278C1DF28BDADE53867D769AD0A7E27188EDAD3BA
SHA-512:	3E2806E1E9C11DEDD6F745C89F7A2F8058D09F3ED44DD638C9417F45C4DB4B7D89FD604BCA40E4D2D80D2A9279B13FCD70CB0EE659A313DA3F825435C7441AFA
Malicious:	false
Preview:	// From: http://developer.mozilla.org/en/docs/XUL_Tutorial:More_Event_Handlers..// "The button and detail properties only apply to the mouse button related events,..// not mouse movement events...// For the mousemove event, for example, both properties will be set to 0."....var sim_g_dragging = false;..var sim_g_lastX = 0;..var sim_g_splitter_at_max = false;....function simInitializeSplitter()..{.. try.. {.. var oSplitter = simMyGetElementById("sim_toolbar_splitter");.. oSplitter.addEventListener('mousedown', simOnSplitterMouseDown, false);.. window.addEventListener('mousemove', simOnGlobalMouseMove, false);.. window.addEventListener('mouseup', simOnGlobalMouseUp, false);.. }.. catch(e).. {.. logSevere2(e);.. }..}....function simOnGlobalMouseMove(event)..{.. if (sim_g_dragging).. {.. simUpdateSplitter(event);.. sim_g_lastX = event.screenX;.. }..}....function simOnSplitterMouseDown(event)..{.. //logEnter();..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\content\stringbundles.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.738627059733319
Encrypted:	false
SSDEEP:	48:8G7y6KggRBGVcIgy6wLvOjR7oaupozmc4soM4zfEce:dG6KRqVT6wzwtmkj/
MD5:	E030A1FFDA7407FB1C06FDB448BD7571
SHA1:	2DF2D30A384A1C19C56391C8C16A31828621B5EC
SHA-256:	AE8F9E51B3FF22C151D3E6FCE7B5DC603D29716D773AEFFF8B20FC75C7E3EA76
SHA-512:	F0F02A7492C4D23E9C7B5BC2A69BFC757A4D3C7F051C0774F15431895C4D892017D4AE882D7FBA301240723723058C37B8149A74C650CAA769F6614D658E2810
Malicious:	false
Preview:	..var sim_g_StringBundle = null;..var sim_g_nsIStringBundle = null;....// should be called from XUL, or JS, where "document" object is defined..function simGetStringFromBundle(name)..{.. var result = "";.. .. try.. {.. if (!sim_g_StringBundle).. {.. sim_g_StringBundle = document.getElementById('sim_stringbundle');.. }.. result = sim_g_StringBundle.getString(name);.. }.. catch(e) {.. logWarning("exception for name: " + name);.. logSevere2(e);.. }.. return result;..}....// should be called from components, such as SIMAutoCompleteSearch.js,..// where "document" object is NOT defined..function simGetStringFromBundle2(name)..{.. var result = "";.. .. try.. {.. if (!sim_g_nsIStringBundle).. {.. // load bundle directly.. // see "Creating the bundle via XPConnect".. // (http://books.mozdev.org/html/mozilla-chp-11-sect-3.html).. var src = 'chrome://s

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\content\sweetim-contentmenu.xul

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	653
Entropy (8bit):	5.057236170457901
Encrypted:	false
SSDEEP:	12:TMG8NWF77hHEdBMBMh5I9XoCtLDAHjxAHXq6tW0N1ZHXO+gcWqSVJIsXGvc8:38kX9E6BWI9X7LqINrOaW7gsc
MD5:	BB5DF7BCC2B69614EAA5111958390C72
SHA1:	14D1A1BF2E69F338B09382EB2E1B564D0CADC02B
SHA-256:	83492D77CA972E1D2D07A7842C836A78F64F49A753E8344354F16C61AAACF820
SHA-512:	711CADB3715B729E6A91560A098504D71CF64A19528173DF0017CA839738B4F654FFF97EDAC0534E3FF68E0BC2E2201DF4806AAF96DEBB698645D16268E5868A
Malicious:	false
Preview:	<?xml version="1.0"?>..<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>......<window id="id_window_sim_content_menu"... title=""... orient="horizontal"... hidechrome="true"... xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"... onload="simContentMenuWindowOnLoad(event);"... onunload="simContentMenuWindowOnUnload(event);">.... <script type="application/x-javascript" src="chrome://sweetim-toolbar/content/contentmenu-handler.js" />......<browser id="id_browser_sim_content_menu".. ..src="http://content.sweetim.com/sim/mfftb20.html".. ..width="420px".. ..height="440px">...</browser>..</window>

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\content\sweetim-toolbar.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	12636
Entropy (8bit):	4.680240080485856
Encrypted:	false
SSDEEP:	192:XVCcV9nwupCxD5AcVl1MMoRgYjVY3kPZR8qsXdW4B8aHdivE/FF:kM9w/l57KR6atSLlFF
MD5:	63448F76A72B0C3858601365E5083946
SHA1:	EFDD6D0BAF4F2E1ACE8D1E7AD5918BCD9AF4D998
SHA-256:	088BB06B17A050D1CA7D6EF082130E4B1752CB36D49E2184F4B207CA43813B02
SHA-512:	65C10E8507688ABBCF27403ED338D488314961DCEC5E145E96FD4B1E5392D6D748404353810BA6E58F5AC34FAE3C3AC86B8490BC8418A5B8FBAC0D1578D04590
Malicious:	false
Preview:	..var g_sim_onload_completed = false;....function simOnFirstRun()..{.. try.. {.. logEnter();.. .. simOnInstall();.. }.. catch(e).. {.. logSevere("catch: " + e.message);.. }..}....function simIsFirstRun()..{.. var result = true;.. var has;.. .. try.. {.. logEnter();.. .. has = simHasConfigPrefs();.. result = !has;.. }.. catch(e).. {.. logSevere2(e);.. }.. .. return result;..}....function simOnToolbarDOMAttrModified(event)..{.. try.. { .. //logEnter();.. .. if (event.attrName == 'collapsed').. {.. var bCollapsed = event.newValue == 'true';.. simOnToolbarCollapsed(bCollapsed);.. }.. }.. catch(e).. {.. logSevere2(e);.. }..}......// we get here, when user has hidden the toobar using..// "View"/"Toolbars" and the uncheck out toolbar..function simOnToolbarCollapsed(bCollapsed)..{.. try.. { .

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\content\sweetim-toolbar.xul

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	17033
Entropy (8bit):	4.649335724543702
Encrypted:	false
SSDEEP:	192:NYebeeVIOFtAkvocIhzBeLdGrRY6hl6gfHZbOB71oOGJ:NYYSi4lZ+717GJ
MD5:	C5E042E981DB5DC014E02AAD88A1DE44
SHA1:	2DC36BD5A53B298A5C18672F1EECC9EB72DCCC69
SHA-256:	DBAB041CFA5D8696FC6830F7814848DABE75AC2BEE7F537A54F75D16CFB28A1E
SHA-512:	C87C57DC1E2A58EC2A0121F6DFE647C1B0734BAD53DDD08BDD2483E50888DDE5DE17A8518EB11C16E4A186A83099EA12478319502CBACD4754B5CAA85807C748
Malicious:	false
Preview:	<?xml version="1.0"?>....<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>..<?xml-stylesheet href="chrome://sweetim-toolbar/skin/sweetim-toolbar.css" type="text/css"?>....<!DOCTYPE overlay SYSTEM "chrome://sweetim-toolbar/locale/sweetim-toolbar.dtd">....<overlay id="sweetim_overlay".. xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">.. .. <script type="application/x-javascript" src="chrome://sweetim-toolbar/content/main.js" />.. <script type="application/x-javascript" src="chrome://sweetim-toolbar/content/global-namespace.js" />.... <stringbundleset id="stringbundleset">.. <stringbundle.id="sim_stringbundle" .. src="chrome://sweetim-toolbar/locale/sweetim-toolbar.properties"/>.. </stringbundleset>.. .. not used since fix of RNDTBFF-56.. <popupset id="mainPopupSet">.. <popup.id="sweetim_popup_history".. type="autocomplete"/>.. </popupset>.. --> ....

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\content\tabinfo-array.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2353
Entropy (8bit):	4.4133762029710155
Encrypted:	false
SSDEEP:	24:/lQx+UoGfwVGhCyVj8Y1PXDKQDu1BjCxCto6qPlRPd9tfDQnZic4EwKCu9w+zauA:/UBoGfwoht8YF21IfLFDQ4c4kSJzQQ
MD5:	EDE3C37AA333FA205B96194440176B3A
SHA1:	550F751348470DCB586DA42834C26457A4B711B1
SHA-256:	8C2D75157683F82FD0F36058F73B68F924CA0BCA79F5F04D6EE51D31D020970F
SHA-512:	C8FF1992EE4C6C4C10422E67BE140BF7129D9D15F1E250689AEC8742E32BB65821B4BB6CEDC1BDB5447E2B2EB0D3D201546F73CE3FE7C0051D63CE22EC2667D4
Malicious:	false
Preview:	..var sim_g_arrTabInfo = null;....function simGetTabInfo(tabId) {.. var oTabInfo = null;.... if (tabId != undefined && tabId != null && tabId != "") {.. oTabInfo = sim_g_arrTabInfo[tabId];.. if (oTabInfo == undefined) {.. logWarning("oTabInfo is undefined");.. }.. }.. else {.. logWarning("tabId not valid");.. }.. return oTabInfo;..}....// adds SIMTabInfo to array, for relevant tabId;..// returns the web progress listener object, which is associated with this tab..function simAddTabInfoToArray(tabId) {.. var result = null;.. try {.. if (tabId != null && tabId != "") {.. // step 1.. // create array, if not created already.. if (sim_g_arrTabInfo == null) {.. sim_g_arrTabInfo = new Array;.. }.... // step 2.. // create progress listener.. var oWPListener = new SIMWebProgressListener(tabId);.... // step 3.. //

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\content\tabinfo.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	11111
Entropy (8bit):	4.412389992855388
Encrypted:	false
SSDEEP:	96:O0+++rWl/S5vHvXm0kqs1zeGY097hKBIBfI/RvWvXHcnmsccCiivJftPk9XCxjM:Ov++O/S5fv1zezi0pMOfn4iBkN
MD5:	603652891F4165AD4CE73E9B4AE82901
SHA1:	AB08428843B571051EB4F15EE2AD03408A04FAE9
SHA-256:	8D5BC4EC85859DD72D92552E8B5EEC890D41DDEB6F42DE4289564F6CB6E0C7FA
SHA-512:	6CA0C10601E1F83392CFEAF84E5BC3BDE60B9BD1B6D247C207CCEC6CF3E9215EE996C2C953A13B2C1ECE95781909B3D2A433CEED6EA6960022E89C765A2D8E75
Malicious:	false
Preview:	..function SIMTabInfo()..{.. this._webProgressListener = null;.. this._sSearchString = ""; .. this._bHighlight = false;..}....function simGetSelectedTabBrowser() {.... var index = null;.. var oBrowser = null;.... index = gBrowser.mTabContainer.selectedIndex;.. if (index != null) {.. oBrowser = gBrowser.getBrowserAtIndex(index);.. if (oBrowser == null) {.. logWarning("oBrowser == null");.. }.. }.. .. return oBrowser;..}....function simGetSelectedTabURI()..{.. var oBrowser;.. var oUri;.. .. oBrowser = simGetSelectedTabBrowser();.. oUri = oBrowser.currentURI;.. .. return oUri;..}....function simGetSelectedTabHost()..{.. var oUri = null;.. var oResult = null;.... oUri = simGetSelectedTabURI();.. if (oUri != null) {.. try {.. oResult = oUri.host;.. } catch (e) {.. // we get here when tab is opened with "Addons Manager", in FF4.. // or when tab is e

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\content\tooltip.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3243
Entropy (8bit):	4.391385132766343
Encrypted:	false
SSDEEP:	96:ijC31Dmdj5UY2c6Q6gm6aL6eN76bL6z/S:ijQ1Dmdj5J2PzgFa+eNub+z/S
MD5:	3CB6E2DE74E1DBA38BF405DD21786908
SHA1:	0E0B2EA4AF92DFF76FCBBA0F83D1659C6BB6A229
SHA-256:	155DF0BA4DFB6E9792D291B1C58B738EC0F908665E594205BA1445CC6EAF55B8
SHA-512:	E7A84B89EA6B18DE5298FE5632C71601423D989D17009D6D85E4B550848541838C9F2F8027938E379644E5D72802880B8576CF10B76338DC62B7AE413F70ADA5
Malicious:	false
Preview:	....// Explenation: why we use "simOnTooltipNeedText" for dropmarkers:..// This method is used to set a tooltip to a dropmarker,..// Since setting "tooltiptext" doesn't work...// This code was used (and didn't work):..// oDropmarker = document.getAnonymousElementByAttribute(oButton, 'class', 'toolbarbutton-menubutton-dropmarker');..// oDropmarker.setAttribute('tooltiptext', strTooltip);..// As said, it doesnt't work (apparently requires adding xbl binding), so the trick with..// "simOnTooltipNeedText" is used instead....function simIsFromDropmarker(node)..{.. var result = false;.. try.. {.. // this "trick" is not documented... // it is by trial-and-error, and comparing all.. // atrributes of the button, when the mouse is over.. // the button itself VS mouse is over the dropmarker.. if (node.hasAttribute("buttonover")).. result = false;.. else.. result = true; .. }.. catch(e).. {.. logS

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\content\uninstallobserver.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	6308
Entropy (8bit):	4.322938270187311
Encrypted:	false
SSDEEP:	96:FizaB32QhH8Ocuzwa5o4KQqkhJzyjz35UAlxlONyOopRQMVD:xNlWVv5zkCZjlxAqzQMVD
MD5:	D6F084EB3DB05BC7DE868C5A43266E22
SHA1:	31EDAEE1B293F2304AFEAA1F8DC655FAE8D97947
SHA-256:	D3144F66CA27D00ADD929B16A377EB4197BE80403F104FB577E48EE7CBB02A1A
SHA-512:	B4F2382A0473755FB495ECD00EBF3C4FAB00163BC07F2DDEC737E3358EE7F922399834416DE1C6A5AFAD47D68D1F3F10319F4DACA02D33BB232B99121F37C933
Malicious:	false
Preview:	..// based on:..// Creating an uninstall script for an extension..// http://xulsolutions.blogspot.com/2006/07/creating-uninstall-script-for.html....const g_SWEETIM_EXTENSION_UUID = "{EEE6C361-6118-11DC-9C72-001320C79847}";....function simInitializeUninstallObserver(){.. .. logEnter();.. .. try{.. var bFF4 = simIsFirefox4BetaOrLater();.. if (bFF4){.. simAddAddonListener();.. }.. else{.. sim_g_UninstallObserver.register();.. }.. }catch(e){.. logSevere2(e);.. }..}....function simUninitializeUninstallObserver(){.. .. logEnter();.... try{.. var bFF4 = simIsFirefox4BetaOrLater();.. if (bFF4){.. simRemoveAddonListener();.. }.. else{.. sim_g_UninstallObserver.unregister();.. }.. }catch(e) {.. logSevere2(e);.. }..}....var sim_g_extensionManager = null;....// gets the extensions manager ("addons dialog")..function simGetExtensionsManang

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\content\version-ff.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3189
Entropy (8bit):	4.859823909450792
Encrypted:	false
SSDEEP:	96:yNLUXUmNLUdUoNLUuUhNLUYUGNLUbUxVGs+:y+km+Oo+5h+PG+IxVGs+
MD5:	626EC7868806436521619FFA2D4C43AE
SHA1:	7CC61D0CF2655750D4DE24A019EB68C49F24F9C3
SHA-256:	23A71210EAEE3F9CE45FA18C4066469D1D08246228999A32FDE68AB7A04A21ED
SHA-512:	A6C43FDB39890D82140DA955FCEDF33EAC0B1195ADE82A865C8DF4AE8397989C1696A400DAE5BBC38CC3AED590A041F1314C42E7B0DC5CB2A8A5C14AB914E46C
Malicious:	false
Preview:	....// geckgo version < param version..function simGeckoVersionLessThan(version) {.. var result = false;.... if (kCI.nsIXULAppInfo) {.. var appInfo = kCC["@mozilla.org/xre/app-info;1"].getService(kCI.nsIXULAppInfo);.. var versionChecker = kCC["@mozilla.org/xpcom/version-comparator;1"].getService(kCI.nsIVersionComparator);.. if (versionChecker.compare(appInfo.platformVersion, version) < 0) {.. result = true;.. }.. }.. else {.. logSevere("kCI.nsIXULAppInfo");.. }.. return result;..}....// geckgo version > param version..function simGeckoVersionGreaterThan(version) {.. var result = false;.... if (kCI.nsIXULAppInfo) {.. var appInfo = kCC["@mozilla.org/xre/app-info;1"].getService(kCI.nsIXULAppInfo);.. var versionChecker = kCC["@mozilla.org/xpcom/version-comparator;1"].getService(kCI.nsIVersionComparator);.. if (versionChecker.compare(appInfo.platformVersion, version) > 0) {.. result = true;

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\content\version.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1864
Entropy (8bit):	4.240060812234503
Encrypted:	false
SSDEEP:	24:lrzBe/hEjROmSYbh/VQB3tE2kDZeD2ex1ckibN2TaSDpzt7/R4V3Dnce:5IcrRhdQptEVeEO767ce
MD5:	2871DC9B99AEEB281122611968CFF89A
SHA1:	3FEBAD1B619F1E00C4D028D4BF6EAD1C68BF8BAD
SHA-256:	D26BEA9835FD7449906E44DCD8A390C8FB6F1A56D3BBA76D8F0331C36ED01CD3
SHA-512:	43489D6C1ECC3C3A34B421D13893F1BF5BD1A074F79C050965B3CD2950333FAF8D10A4E5B9751C11A737B09EACF975A9694186A0AFA612DB3E3788282F797B45
Malicious:	false
Preview:	....// globals, used for getting version in FF4..var sim_g_version = null;..var sim_g_event = null;....function simAddonManagerCallback(addon) {.. try {.. // step 1.. // set global value.. sim_g_version = addon.version;.. // step 2.. // set evant.. sim_g_event.value = true;.. } catch (e) {.. logSevere2(e);.. }..}....function simGetVersionFromRDF() {.. .. var version = "";.. try {.. logEnter();.... var oDetails = null;.. oDetails = simGetAddonDetails();.. if (oDetails != null) {.. version = oDetails._version;.. }.. else {.. logWarning("oDetails != null");.. }.. }.. catch (e) {.. logSevere2(e);.. }.... return version;..}....function simUpdateVersionFromRDFInPrefs()..{.. try.. {.. var version = simGetVersionFromRDF();.. simSetConfigValue("version", version);.. }.. catch(e).. {.. logSevere2(e); ..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\content\wait.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.159322508675548
Encrypted:	false
SSDEEP:	24:1nI9uwAoWL0vDaGH557rFqiVvHZfcaUsicL:1n4u9S5vEi55kaucL
MD5:	29473F2C75F43F49572F1BF8868B9C74
SHA1:	17091A09EFC714CF73A0C0211CDE5B4670624148
SHA-256:	F336277ED0859E586E814110D7260345BBB9531DD0914A1B9F72A27BCEBB8286
SHA-512:	C071FD05145916BAF91F572D0DBECF91931D11E7126C7354AB0BF61C2A0DEBE6CF7D1EC58BD240A876C08E633D7EA8D76B8C1F2F233DC9F67425C2925A782A5D
Malicious:	false
Preview:	..function simMyEvent() {.. this.value = false;..}....// waits till the param event value is set to true..// returns true if event coccured, false if timeout reached..function simWaitForEvent(oMyEvent, timeout) {.... var result = null;.. try {.. var loops = 0; // used only for debug.. var start;.. var now;.. var elapsedMillSecs;.. var thread = kCC["@mozilla.org/thread-manager;1"].getService(kCI.nsIThreadManager).currentThread;.... // step 1.. // take snapshot of current time.. start = new Date();.... // step 2.. // while event not set to true.. while (oMyEvent.value != true) {.. loops++;.... // step 3.. // check if timeout elapesed.. now = new Date();.. elapsedMillSecs = now.getTime() - start.getTime();.. if (elapsedMillSecs > timeout) {.. // if timeout elapsed -> break.. result = false;.. br

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\content\webprogresslistener.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2992
Entropy (8bit):	4.687458025277307
Encrypted:	false
SSDEEP:	48:V7BcIl2uVA1wbXMJGOPbySbKH/JWRU8rSWTeAgn9:5BRwKHhWRJSWTeh9
MD5:	D7AC8AA1B5ED24A1CE649258252D0184
SHA1:	CC9B641450B84CDE7D0936043836B4E7C53F42FC
SHA-256:	E3B25502DCA1B164A6F01F087EF913F9F7B869989BF09FE70EFF747D0BA59CBA
SHA-512:	DCAAE7CC5FB24346BECD5B11F244EFBED30625404048F7ECB9678F0567BAF627D8C4D5A205C7A79425D14DC561856D258F56E0FAD2DB7EAE1223439A7DD96ED0
Malicious:	false
Preview:	..const WP_NOTIFY_STATE_NETWORK = Components.interfaces.nsIWebProgress.NOTIFY_STATE_NETWORK;..const WP_NOTIFY_STATE_DOCUMENT = Components.interfaces.nsIWebProgress.NOTIFY_STATE_DOCUMENT;..const WPL_STATE_IS_NETWORK = Components.interfaces.nsIWebProgressListener.STATE_IS_NETWORK;..const WPL_STATE_IS_DOCUMENT = Components.interfaces.nsIWebProgressListener.STATE_IS_DOCUMENT;..const WPL_STATE_START = Components.interfaces.nsIWebProgressListener.STATE_START;..const WPL_STATE_STOP = Components.interfaces.nsIWebProgressListener.STATE_STOP;......//..// Object SIMWebProgressListener..//....// Listener which catches events when page is being loaded within a tab...function SIMWebProgressListener(tabId)..{.. if (!tabId).. {.. // get current tab id.. tabId = simGetSelectedTabId();.. if (tabId==null \|\| tabId=="").. {.. logWarning("invalid tabId");.. }.....}.. this.tabId = tabId;..}....// Listener object - designe

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\locale\de-DE\sweetim-toolbar.dtd

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	3226
Entropy (8bit):	4.968367102212091
Encrypted:	false
SSDEEP:	48:wt3gCoVqrKAh+1zqI1tKSUyjBCS43IBAdTSmTHCow3pCeVLLv:OMYL0zqOIbAAVTQpBV3v
MD5:	343E720BF01C524700FD1371E25ED76F
SHA1:	4513CE9406E22284E73D8235807B8EC341801FAC
SHA-256:	E5F0DC1A6B2A6B251C616B05A18AA0E56CAB386646F7806B2753C3D1BEE63BFB
SHA-512:	0794397E3706E3CBBEF9473E03DD6CBC3594A818458FC6EF2E33E9B53EAA4C85F5F40E7BF0426255D68DFC13B881B6925CF884D07E756081073D098A80EA9D9E
Malicious:	false
Preview:	<!ENTITY sweetim.main_menu.home.label "SweetIM Start">..<!ENTITY sweetim.main_menu.search.label "SweetIM Suche">..<!ENTITY sweetim.main_menu.messageboard.label "SweetIM Message Board">..<!ENTITY sweetim.main_menu.messageboard.tooltip "Zu den SweetIM Foren gehen">..<!ENTITY sweetim.main_menu.trackseraser.label "Tracks Eraser">..<!ENTITY sweetim.main_menu.help.label "Hilfe">..<!ENTITY sweetim.main_menu.feedbcak.label "Feedback Schicken">..<!ENTITY sweetim.main_menu.feedbcak.tooltip "Kontaktieren Sie uns in allen Fragen rund um die SweetIM Toolbar f.r Firefox">..<!ENTITY sweetim.main_menu.privacy.label "Datenschutz">..<!ENTITY sweetim.main_menu.privacy.tooltip "Datenschutzinformationen zur SweetIM Toolbar f.r Firefox">..<!ENTITY sweetim.trackseraser_menu.clearCookies.label "Cookies l.schen">..<!ENTITY sweetim.trackseraser_menu.clearCookies.tooltip "Hier k.nnen Sie Ihre Cookies l.schen">..<!ENTITY sweetim.trackseraser_menu.clearCache.label "Cache

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\locale\de-DE\sweetim-toolbar.properties

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	1618
Entropy (8bit):	4.780426889876654
Encrypted:	false
SSDEEP:	24:E915lh2Z3IlUPDmTGEcLvKESsO96yTiTXKo8HqybkE/rOeopllQPVY:kuIWShmvKETOEHkqA3mt
MD5:	A9B471175D46F7E036E663F420F7B8F1
SHA1:	FB4BF0AC6393BBF9D10E8243F0660A1B0E86165F
SHA-256:	C0493FC117448470EA45CC0C303FC24597B6F73DBC3B5CEC823A34ACEAC3A224
SHA-512:	C0DA03C559E677F9D566575FCA19522064D6D6BD048644143DF1DEE606E89072E950C593A3F8052412BDD9627926FDEC5EA845C8EA58C7928B714E20A0B204B2
Malicious:	false
Preview:	sweetim.property.button.highlight.enabled.tooltip=Hervorhebung der Suchbegriffe auf dieser Seite umschalten..sweetim.property.button.highlight.disabled.tooltip=Text im Suchfeld eingeben um ihn hervorzuheben..sweetim.property.button.findword.tooltip=N.chstes Vorkommen von '%1$S' im aktuellen Dokument finden..sweetim.property.history=Chronik..sweetim.property.button.main_menu.tooltip=Zu SweetIM Suche gehen..sweetim.property.button.main_menu.dropmarker.tooltip=SweetIM Men...sweetim.property.button.search.tooltip=Web-Suche..sweetim.property.button.search.dropmarker.tooltip=Klicken Sie zur Auswahl anderer Sucharten ..sweetim.property.menuitem.chevron.highlight.label=Highlights..sweetim.property.uninstall.title=%S deinstallieren..sweetim.property.uninstall.text=M.chten Sie die SweetIM Homepage und SweetIM Sucheinstellungen beibehalten, so dass Sie weiterhin schnellen Zugriff auf leistungsstarke Internetsuche genie.en k.nnen?..sweetim.property.searchguard.hp.caption=Homepage-Einstellunge

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\locale\en-US\sweetim-toolbar.dtd

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3103
Entropy (8bit):	4.908927731948598
Encrypted:	false
SSDEEP:	48:1BMMgluIHzUgLA9k3tgxmHMdT8fdLMMB4ZqBMMwMCtMVLuMv:/j+VzUCYUsqlwujnPVNv
MD5:	2B62306DADAAC6BC5992539D32CEE068
SHA1:	AEF00558ED94D83E35FE470EE31574201D02ABC4
SHA-256:	B79F50D22CB081A3C96AFAAB7E362A60C2259C0A76B82B94DDFAF2370A9A8E36
SHA-512:	C7B39C09C9FF5B2BA75634DD79D199F4189784192F5FFCF933B3CA4AA049E65EC1308D63C3BD3A65C0E369C6291DC80A37397AD1CCDB528B134F9C6F9466BD4C
Malicious:	false
Preview:	<!ENTITY sweetim.main_menu.home.label "SweetIM Home">..<!ENTITY sweetim.main_menu.search.label "SweetIM Search">..<!ENTITY sweetim.main_menu.messageboard.label "SweetIM Message Board">..<!ENTITY sweetim.main_menu.messageboard.tooltip "Go to SweetIM Forums">..<!ENTITY sweetim.main_menu.trackseraser.label "Tracks Eraser">..<!ENTITY sweetim.main_menu.help.label "Help">..<!ENTITY sweetim.main_menu.feedbcak.label "Contact Us">..<!ENTITY sweetim.main_menu.feedbcak.tooltip "Contact us in all matters relating to SweetIM Toolbar for Firefox">..<!ENTITY sweetim.main_menu.privacy.label "Privacy Information">..<!ENTITY sweetim.main_menu.privacy.tooltip "SweetIM Toolbar for Firefox privacy information">..<!ENTITY sweetim.trackseraser_menu.clearCookies.label "Clear Cookies">..<!ENTITY sweetim.trackseraser_menu.clearCookies.tooltip "This will erase your cookies">..<!ENTITY sweetim.trackseraser_menu.clearCache.label "Clear Cache">..<!ENTITY sweetim.trackserase

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\locale\en-US\sweetim-toolbar.properties

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1535
Entropy (8bit):	4.634286586985755
Encrypted:	false
SSDEEP:	24:E9Gs82eGZumVva6g3VreT3un57aoPUakT+4bXakT+f5oLJhbB:F6uYvIreT0GoCTLlT8qJn
MD5:	F328392AF820D3B5E73CFCB4982270AE
SHA1:	741DCA0A4BE0FC3F9F43ADE15FABA882243CF785
SHA-256:	04AEB167614D959F0EE1FBA37D10018D3CE8D77C0AC8336E0A2C388DDEF63AF5
SHA-512:	74BE6B647AEEEB2DAE2B7160ABDE358B9A208E4F6DB7D8DDF69147E7831CEBAD9171A1E311264143CA6528FA8B1CE80C1CC13EAE2549707A685BC517234AB87F
Malicious:	false
Preview:	sweetim.property.button.highlight.enabled.tooltip=Toggle highlighting of search terms on this page..sweetim.property.button.highlight.disabled.tooltip=Enter text in the search box to highlight it..sweetim.property.button.findword.tooltip=Find next occurrence of '%1$S' in current document..sweetim.property.history=History..sweetim.property.button.main_menu.tooltip=Go to SweetIM search..sweetim.property.button.main_menu.dropmarker.tooltip=SweetIM Menu..sweetim.property.button.search.tooltip=Search the Web..sweetim.property.button.search.dropmarker.tooltip=Click to select other search types..sweetim.property.menuitem.chevron.highlight.label=Highlight..sweetim.property.uninstall.title=Uninstall %S..sweetim.property.uninstall.text=Would you like to keep the SweetIM homepage and SweetIM search settings so you can continue enjoying quick access to powerful internet search?..sweetim.property.searchguard.hp.caption=Home page Settings Change..sweetim.property.searchguard.hp.message=Your default

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\locale\es-ES\sweetim-toolbar.dtd

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	3363
Entropy (8bit):	4.953586806232814
Encrypted:	false
SSDEEP:	48:el1K9muYgYqOHznSNEnlZoY8rSYQhfY3cThI/5s7YFfLC:Y5zKEgSI/5OYFf2
MD5:	DA4E42A8F0D9CB3FE917D9B08DFF4E44
SHA1:	9224598E58A628E1125683A8C17823B269380DF9
SHA-256:	3B2597E3A3995619AD16ED69829FA0990CDFFB97B7F6525E3D9F05C2BF46D83C
SHA-512:	B3D36A91B073CFC63CC6CE4A9759564D9825E49B89140C4A0170C6654E61B43C0781524218BA6694F522B0D71FC50F86AB3537F9D8C2D62C462B43E632AB90A4
Malicious:	false
Preview:	<!ENTITY sweetim.main_menu.home.label "Inicio SweetIM">..<!ENTITY sweetim.main_menu.search.label "B.squeda SweetIM">..<!ENTITY sweetim.main_menu.messageboard.label "Panel de mensajes SweetIM">..<!ENTITY sweetim.main_menu.messageboard.tooltip "Ir a Foros SweetIM">..<!ENTITY sweetim.main_menu.trackseraser.label "Borrador de pistas">..<!ENTITY sweetim.main_menu.help.label "Ayuda">..<!ENTITY sweetim.main_menu.feedbcak.label "Cont.ctenos">..<!ENTITY sweetim.main_menu.feedbcak.tooltip "P.ngase en contacto con nosotros en lo relacionado con la barra de herramientas SweetIM par Firefox">..<!ENTITY sweetim.main_menu.privacy.label "Informaci.n de privacidad">..<!ENTITY sweetim.main_menu.privacy.tooltip "Informaci.n de privacidad para la barra de herramientas SweetIM para Firefox">..<!ENTITY sweetim.trackseraser_menu.clearCookies.label "Borrar cookies">..<!ENTITY sweetim.trackseraser_menu.clearCookies.tooltip "Borrar. sus cookies">..<!ENTITY sweetim.tr

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\locale\es-ES\sweetim-toolbar.properties

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	1805
Entropy (8bit):	4.692581821283924
Encrypted:	false
SSDEEP:	24:E9zIxp2HNZB46N8vLcJxcyRIE2BZwuu39Aue1SXi9n4uevlXe9hue+:2IxiNZB4xvLMxvaK9AueN9n4ues9hue+
MD5:	390E575C828684329B97619EB451ED83
SHA1:	651CBB3F2C1C8A360CBAE4D00E77AD3FAF24A330
SHA-256:	67FD3B472B8243E1B101BA54427E78C0C3C0DCC1EE61E1389A6C0BFA70CE5A9C
SHA-512:	6F7BA65224DE94A5D388D6CAF23B544A95FBE9B059680743C2D48D979B4BAFD4D1A8897E2E97415E1D77AD8AD4ACC5952C981E757428730456714FFF81D5F571
Malicious:	false
Preview:	sweetim.property.button.highlight.enabled.tooltip=Alternar el resaltado de los t.rminos de b.squeda en esta p.gina..sweetim.property.button.highlight.disabled.tooltip=Introducir texto en el cuadro de b.squeda para resaltarlo..sweetim.property.button.findword.tooltip=Buscar la siguiente aparici.n de '%1$S' en este documento..sweetim.property.history=Historial..sweetim.property.button.main_menu.tooltip=Ir a b.squeda SweetIM Search..sweetim.property.button.main_menu.dropmarker.tooltip=Men. SweetIM ..sweetim.property.button.search.tooltip=Buscar en la web..sweetim.property.button.search.dropmarker.tooltip=Hacer clic para seleccionar otros tipos de b.squedas..sweetim.property.menuitem.chevron.highlight.label=Resaltar..sweetim.property.uninstall.title=Desinstalar %S..sweetim.property.uninstall.text=.Le gustar.a conservar la configuraci.n de la p.gina de inicio SweetIM y de b.squeda SweetIM de manera que pueda seguir disfrutando de un r.pido acceso a una potente b.squeda de Int

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\locale\fr-FR\sweetim-toolbar.dtd

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	3386
Entropy (8bit):	4.946143805128272
Encrypted:	false
SSDEEP:	48:YUOGEF59RzwDJXc3Ga9jwTfBtVdgs5zglLXMa:gRzwDJCj8fwsIga
MD5:	4FA0C67A5376147914F61095F68FF413
SHA1:	467B3B262F1803CF4CB11F0DF1189305CCA6493C
SHA-256:	38A9AAE24ABCF3ED24EA64E8A1A3831DA557C6B60582A70E3973E4F78B97E8A3
SHA-512:	A53D7BE419CE82A65314FF5404F51CAA9DBDDD999D0B4315095FDFBBCF2E33A2FF26750E39913BD52E15CEF557F26A9076CB2B6DA6394884B8D37093C2865622
Malicious:	false
Preview:	<!ENTITY sweetim.main_menu.home.label "Accueil SweetIM">..<!ENTITY sweetim.main_menu.search.label "Rerchercher dans SweetIM">..<!ENTITY sweetim.main_menu.messageboard.label "Forum SweetIM">..<!ENTITY sweetim.main_menu.messageboard.tooltip "Aller aux forums SweetIM">..<!ENTITY sweetim.main_menu.trackseraser.label "Effacer mes traces">..<!ENTITY sweetim.main_menu.help.label "Aide">..<!ENTITY sweetim.main_menu.feedbcak.label "Contactez-nous">..<!ENTITY sweetim.main_menu.feedbcak.tooltip "Contactez-nous pour toutes les questions li.es . la barre d'outils SweetIM pour Firefox">..<!ENTITY sweetim.main_menu.privacy.label "Charte de confidentialit.">..<!ENTITY sweetim.main_menu.privacy.tooltip "Charte de confidentialit. sur la barre d'outils SweetIM pour Firefox">..<!ENTITY sweetim.trackseraser_menu.clearCookies.label "Effacer les cookies">..<!ENTITY sweetim.trackseraser_menu.clearCookies.tooltip "Ceci effacera vos cookies">..<!ENTITY sweetim.trackser

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\locale\fr-FR\sweetim-toolbar.properties

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	1943
Entropy (8bit):	4.7702687098251415
Encrypted:	false
SSDEEP:	24:E9Zk52rt7rzISjGKvkN9wqXvljqrKAYsjHZTCQAKYWYaPpT4QPOD0YWIKWl:0NtcSjRvCvljqm+1aaXPYK+
MD5:	4431C2790194EF7E437143F23CDC29E4
SHA1:	7BF58B987029638CF9DE413DC2086E842F429290
SHA-256:	BD64BB1D5964DDA5DCCC0E25ED26C51A10F6F3393DC8F608B7C1EC6F51B352E8
SHA-512:	0C72707E11613C8D3F4794B3FAC82D8CBFC8F1825BA721B5D08F5B718B5CEC8735FE0CA5C9886297F8EAA02189BC08A7A83E5AA030F48545177BFD5B10D91487
Malicious:	false
Preview:	sweetim.property.button.highlight.enabled.tooltip=Activer/d.sactiver le surlignage des mots recherch.s sur cette page..sweetim.property.button.highlight.disabled.tooltip=Saisir le texte dans la fen.tre de recherche pour le surligner..sweetim.property.button.findword.tooltip=Rechercher l.occurrence suivante de '%1$S' dans le document actuel..sweetim.property.history=Historique..sweetim.property.button.main_menu.tooltip=Aller . la recherche SweetIM..sweetim.property.button.main_menu.dropmarker.tooltip=Menu SweetIM..sweetim.property.button.search.tooltip=Rechercher sur le Web..sweetim.property.button.search.dropmarker.tooltip=Cliquer pour choisir d'autres types de recherche..sweetim.property.menuitem.chevron.highlight.label=Surligner..sweetim.property.uninstall.title=D.sinstallation de %S..sweetim.property.uninstall.text=Souhaitez-vous conserver la page d.accueil SweetIM et les param.tres de recherche SweetIM afin de continuer . profiter d.un acc.s rapide . une recherche In

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\locale\it-IT\sweetim-toolbar.dtd

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	3350
Entropy (8bit):	4.8917769951145
Encrypted:	false
SSDEEP:	48:IfLNtmvDvLn05w5rzbQryFfDCBJvfToBep+ILYMa:IKbTn05wZzbQGVevcBlITa
MD5:	7AEE63481187ECEE6DB55617A6B75C56
SHA1:	77323755C9533660E759681FBDAEAB3175AA1886
SHA-256:	AD9DC46F37E945240BD28DCE8F0B7E930DBDE6071658A7D1CF2A77C2D1AA8685
SHA-512:	B412F7AFB983D5DB746A3FBEA849D8D6551D5CB632325E2574DFD6FEBADBFA17C0FAD8E7BF2E508BC409C330A28F8270BBCE45FFA43B3C5A145C3048DD64C572
Malicious:	false
Preview:	<!ENTITY sweetim.main_menu.home.label "SweetIM Home">..<!ENTITY sweetim.main_menu.search.label "Cerca con SweetIM">..<!ENTITY sweetim.main_menu.messageboard.label "Area messaggi SweetIM">..<!ENTITY sweetim.main_menu.messageboard.tooltip "Vai ai forum SweetIM">..<!ENTITY sweetim.main_menu.trackseraser.label "Cancella tracce navigazione">..<!ENTITY sweetim.main_menu.help.label "Aiuto">..<!ENTITY sweetim.main_menu.feedbcak.label "Invia commenti">..<!ENTITY sweetim.main_menu.feedbcak.tooltip "Contattaci per qualsiasi problema/quesito relativo alla barra degli strumenti SweetIM per Firefox">..<!ENTITY sweetim.main_menu.privacy.label "Informazioni sulla privacy">..<!ENTITY sweetim.main_menu.privacy.tooltip "Informazioni sulla privacy della barra SweetIM per Firefox">..<!ENTITY sweetim.trackseraser_menu.clearCookies.label "Cancella cookie">..<!ENTITY sweetim.trackseraser_menu.clearCookies.tooltip "L'operazione canceller. i cookie">..<!ENTITY sweetim.tr

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\locale\it-IT\sweetim-toolbar.properties

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1607
Entropy (8bit):	4.584285505783685
Encrypted:	false
SSDEEP:	24:E9YN2z/BC7vGlvPljRuq67EVhocEzZGwPFuOpEhoPyY7L:7uiv2vx0q6Q/oLz9OoqY7L
MD5:	E812535CE93B3877F4414DADF040B5F3
SHA1:	2D99203C28D900F4A891D7F0AC1C3B2B12168714
SHA-256:	4E8785F17DBEA4756212BD7705E98DA81A8D850F083E0ED0D97F83370DDCF101
SHA-512:	CED8B831D8117127F593FDB60EB24B7F96AED1E1E5B867886D4BBDC6F127D1B1F8E5413254802B2037537DAE913900877114FE51BC1D8D8A6218192142622BBF
Malicious:	false
Preview:	sweetim.property.button.highlight.enabled.tooltip=Attiva l'evidenziazione dei termini della ricerca su questa pagina..sweetim.property.button.highlight.disabled.tooltip=Inserisci il testo nella casella della ricerca per evidenziarlo..sweetim.property.button.findword.tooltip=Trova la successiva occorrenza di '%1$S' nel documento attuale..sweetim.property.history=Storico..sweetim.property.button.main_menu.tooltip=Vai a Cerca con SweetIM..sweetim.property.button.main_menu.dropmarker.tooltip=Menu SweetIM..sweetim.property.button.search.tooltip=Cerca nel web..sweetim.property.button.search.dropmarker.tooltip=Fai clic per selezionare altri tipi di ricerca..sweetim.property.menuitem.chevron.highlight.label=Evidenzia..sweetim.property.uninstall.title=Disinstalla %S..sweetim.property.uninstall.text=Vuoi salvare la home page SweetIM e le impostazioni di ricerca SweetIM per accedere rapidamente alla nostra potente ricerca Internet?..sweetim.property.searchguard.hp.caption=Cambio impostazioni Home

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\locale\nl-NL\sweetim-toolbar.dtd

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	3273
Entropy (8bit):	4.947891556350373
Encrypted:	false
SSDEEP:	24:f2r110JZGwl/a61lQsO1zscYDB0wyPzoSH51UJ+MOl7T+RisLcyFQLtl6WyI76DD:f2rICoEzTq0wyZ1g+fl7TBsaVVm/Lv
MD5:	01AC12BC348313FC5737F0C433088AD5
SHA1:	5C3F83C74ED43303D2A45070237911823DC06624
SHA-256:	B24408110B993F10E2205EA02E71EE66F5D5416304AFE1445F817B956B61A737
SHA-512:	3A0C823819BE7AEA64CC418A583B2974CA35D27573375028F386AEF1473088F172B4582C742C216736338C3126059B6A1457C5DADCAFED0940DF4422E5CE7FDC
Malicious:	false
Preview:	<!ENTITY sweetim.main_menu.home.label "SweetIM Home">..<!ENTITY sweetim.main_menu.search.label "SweetIM Zoekfunctie">..<!ENTITY sweetim.main_menu.messageboard.label "SweetIM Mededelingenbord">..<!ENTITY sweetim.main_menu.messageboard.tooltip "Ga naar SweetIM Forums">..<!ENTITY sweetim.main_menu.trackseraser.label "Sporenuitwisser">..<!ENTITY sweetim.main_menu.help.label "Help">..<!ENTITY sweetim.main_menu.feedbcak.label "Contact-informatie">..<!ENTITY sweetim.main_menu.feedbcak.tooltip "Neem contact met ons op over alles wat te maken heeft met SweetIM Taakbalk voor Firefox">..<!ENTITY sweetim.main_menu.privacy.label "Privacy informatie">..<!ENTITY sweetim.main_menu.privacy.tooltip "SweetIM Taakbalk voor Firefox privacy-informatie">..<!ENTITY sweetim.trackseraser_menu.clearCookies.label "Verwijder cookies ">..<!ENTITY sweetim.trackseraser_menu.clearCookies.tooltip "Dit zal uw cookies wissen">..<!ENTITY sweetim.trackseraser_menu.clearCache.label "Ve

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\locale\nl-NL\sweetim-toolbar.properties

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1692
Entropy (8bit):	4.595629503022333
Encrypted:	false
SSDEEP:	24:E9R2Xa+CgtWLmDvCwu0D+34bIcgPsVrPbjhgMhgPBQqPpTkg:s5gtgIvnD+tLgbrSTdkg
MD5:	582BEFD8357EB62BD9ADA8CA3F4D3E02
SHA1:	C6F8C959A779F90C99947956E1F38CA1429D08D5
SHA-256:	68513E080CD6D3B3CC9B1D55E5A3EFC40D341E6B7E2C29392A3C0AE046E20BB6
SHA-512:	FA4E7D22912E20ACC1B23214A60C343EA88DA0A20860F061599EE3113D2077964BF356B7ED5028D735911CB942D6359ADF81268BAA28B86AA0CF350F4C280618
Malicious:	false
Preview:	sweetim.property.button.highlight.enabled.tooltip=Markeren van in- en uitschakelen van zoekonderwerpen op deze pagina..sweetim.property.button.highlight.disabled.tooltip=Voer tekst in bij de zoekbox om die te markeren..sweetim.property.button.findword.tooltip=Vind de volgende keer dat het '%1$S' voorkomt in het huidige document..sweetim.property.history=Geschiedenis..sweetim.property.button.main_menu.tooltip=Ga naar de SweetIM zoekfuntie..sweetim.property.button.main_menu.dropmarker.tooltip=SweetIM Menu..sweetim.property.button.search.tooltip=Zoek op het web..sweetim.property.button.search.dropmarker.tooltip=Klik voor het kiezen van andere zoekfuncties..sweetim.property.menuitem.chevron.highlight.label=Markeer..sweetim.property.uninstall.title=%S de-installeren..sweetim.property.uninstall.text=Zou je de SweetIM homepage en SweetIM-zoekinstellingen willen bewaren, zodat je plezier kunt blijven hebben van een snelle toegang tot een krachtige internet-zoekfunctie?..sweetim.property.search

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\skin\SmileySmile.png

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PNG image data, 47 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4706
Entropy (8bit):	7.939609866150524
Encrypted:	false
SSDEEP:	96:nSDZ/I09Da01l+gmkyTt6Hk8nTLTT3Aau8Z3pqoMN4t4qDhV6c:nSDS0tKg9E05TLTTHu8E4t4qDrl
MD5:	72C9881C090F7C954451691AEC0266D2
SHA1:	E0572385B740CAD95B8471A77CF1384A8A4EC687
SHA-256:	510F120EFE2F234C3662020143BC9F606EABCFCB80C901D53EA8BCA753A27E92
SHA-512:	C6A1B65EAEF3C1A3A49A53024F7E4AD898286A2AF8D779E6088B54E95C06616570D39CBCE202E48C59A05224AE41BF8AC66778B4248ED319E6F36A0FEF9FA2E6
Malicious:	false
Preview:	.PNG........IHDR.../...........&.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\skin\SmileyWink.png

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PNG image data, 47 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4513
Entropy (8bit):	7.923205264207793
Encrypted:	false
SSDEEP:	96:nSDZ/I09Da01l+gmkyTt6Hk8nTJlJ0NDxK+muSJyXnmlqsOc:nSDS0tKg9E05TbaDxLmuuyXmYsOc
MD5:	A75E7B7FB7225134A01B01C6985086C3
SHA1:	C18649F3DC4CFD551CD861FFAFAB51B98B8CBCE8
SHA-256:	000D8E36A1D432D6F6C182D41DEADB3F3B051CC5C5B32AFCAC6B3A80C4D802EA
SHA-512:	590812B335FB7AC128AEB4012960377AB2E2FC1D03A1418287DDFE074874B9C12D0D76F021126EC7FB06668281C2E91ADB678DB4B3B49E612D3BE74E954DA52F
Malicious:	false
Preview:	.PNG........IHDR.../...........&.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\skin\bing.png

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	318
Entropy (8bit):	6.864702191037678
Encrypted:	false
SSDEEP:	6:6v/lhPmNp1ZsRgPkHK9SQQxL95uLcIR5lgxmWZ2/vFvgUl7dp:6v/7uNpLmgPe4SQQL9+lggWM/NDz
MD5:	CAF9A4DFDDFD2568B37781AFB55DF16D
SHA1:	60405FE8FE085DC0062B77450A9CE9049552AACB
SHA-256:	05F666FCBD4A108C0DFAEE4BFA0414294694014C35E0603A2E944182C6DA7F2E
SHA-512:	73F133C02944F6FBEB2CD2DD142E2A2808017A1C8153AF8DB2B47143A2BCBFE0FA8E9FFBCC1DA84DC544D8E14FDAF8B34FC1EFF89E60792E84A780D28C32CD38
Malicious:	false
Preview:	.PNG........IHDR...............h6....IDATx.c..L....H..A..V~....._!N....1+.W.........A@...f'....P..'..,..'..n.bxu.C..\|}.p....c 6P.R.T.(x".C.P.\-..(6(F0XL.1....A.V.]5..5......5...9..M..F..A...X.....`......{.................h.n.[.@....*./...0.@c..........P..10.O.A..5-..........@......%>R....{..,......IEND.B`.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\skin\clear-history.png

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3279
Entropy (8bit):	7.900863279277824
Encrypted:	false
SSDEEP:	96:CXHt+JcNgOSiS4XsAYNpf2ESN5B6Ee1rEV:2oONgOLPXsAYnIB6Ee1G
MD5:	55FE3A0B1E9F8B4FDB84FC3E206276A2
SHA1:	669B6C3560552027D0C7E4737E1703E52A7D77C0
SHA-256:	5E443B66113C0ED5D2B49EA60E681D9D8B561798ED60C8E53441E63250740E6D
SHA-512:	85E3FBBDE3444D3E8304CA490A9A251D92AE575FE2A0B9A6DE9E86952D958ADF648C106C5DC929B3B2EE2D44114FAEE23635BD57AFEE54F9455FC6A5E642CE5A
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA....\|.Q.... cHRM...........R...@..}y.....<.....s<.w...9iCCPPhotoshop ICC profile..H..wTT....wz..0.R.....{.^Ea..`(..34.!...ED."HP..P$VD...T..$.(1.ET,oF.........o......Z..../...K......<....Qt.....`.).LVF._.{......!r._...zX..p..3.N....Y.\|......9.,...8%K.......,f.%f.(A..9a..>.,....<...9..S.b...L!G....3..,....F.0.+.7..T.3...Il.pX."6.1...."....H._q.W,.d..rIK..s...t......A..d.p....&+..g.].R.......Y2...EE.4...4432..P.u.oJ..Ez...g.........`.j..-....-....b.8....o....M</..A...qVV....2.....O.....g$>...]9.La.....+-%M.g.3Y.......u..A.x....E.....K.......i<:...............Pc...u@~..(.. ...]..o..0 ~y...s..7.g...%...9.%(....3........H....@...C`...-p.n.......V..H.....@....A1....jP..A3h..A'8..K....n..`.L.g`......a!2D..!.H... .d..A.P....B....By.f.....z....:....@..]h...~....L.............C.Up.......p%....;...5.6<.?.........."....G..x...G.....iE..>.&2.. oQ...EG..lQ..P......U..F.Fu.zQ7Qc.Y.G4....G......t...].nB../.o.'.1.......xb"1I.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\skin\dictionary.png

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3287
Entropy (8bit):	7.891546537282907
Encrypted:	false
SSDEEP:	48:b/6DocieftI9G9f6A+FIDOWu0lDl+gm7QyTtctIInQSy6IVpqlnBcODRqVwJkvMG:bSDZ/I09Da01l+gmkyTt6Hk8nTUwCvMG
MD5:	A143CA61BD925BF5831EE74BDDDF1DA4
SHA1:	D0E822D6BACEA7F506481037176E04457D719DC5
SHA-256:	54B97C1D6C6F4D704D16C953FE100D4453FC5592FD9EF5AFB33260890FDB0618
SHA-512:	104544409128871B258B9623E942F07E37CF485C5A3EB3AF0EC8BC99E0D5C756D236F2F63BB267DACA87F6D2DCC0DE03F62C99AB73BC048A0660A80B87A3F308
Malicious:	false
Preview:	.PNG........IHDR................a....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\skin\finance.png

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3410
Entropy (8bit):	7.894828125786389
Encrypted:	false
SSDEEP:	96:bSDZ/I09Da01l+gmkyTt6Hk8nTBqBXTmTIDY:bSDS0tKg9E05TB
MD5:	E1A82CF04E37B212A2843D9967FC12C4
SHA1:	F096383C90B7C3A8A397671A2E96F81C2958FB0B
SHA-256:	B866837AB746FAFF5D2C6201A270CECC14D7A57A311ABE5AEA4D32C7E02A1CA8
SHA-512:	965FD8C91B4FFE9D0FEFF9FF416057C9651F05A34FCBCF7EB2B4B15F1B36C01C2DF2E169483BC545CDDBF8478ADCA89298E8A4EF7F344BF2AB7170D058C21AC4
Malicious:	false
Preview:	.PNG........IHDR................a....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\skin\find.png

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3371
Entropy (8bit):	7.896512358734088
Encrypted:	false
SSDEEP:	96:bSDZ/I09Da01l+gmkyTt6Hk8nTMdfMVRfAQNq:bSDS0tKg9E05TOfM3fNq
MD5:	148C71F4C4A537A1F286ED3F40D39ADB
SHA1:	9FFDA4FBE2C432191B94A7E71A0295899513AC41
SHA-256:	AF8F54A2730DE3323D559A0D0D4272598BA2F13865C2620152AA4E78037E2048
SHA-512:	8B6B397BEC1DA5EA85E04DB3C0C4E6EB4F9DC4EDC1760EF5FDC62B970182BE4F2E61C391038F71D9F89583CCAF4786EE9CE6039C0E595CCD783C86636750BCB2
Malicious:	false
Preview:	.PNG........IHDR................a....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\skin\google.png

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	3341
Entropy (8bit):	7.887714626414327
Encrypted:	false
SSDEEP:	96:nT2SDZ/I09Da01l+gmkyTt6Hk8nTno/AW0QE+H:T2SDS0tKg9E05TnoIy
MD5:	A66632B80FC122541E246BAD41A3E0EE
SHA1:	2BACE9CCC0D1E4BBDF578755718FB61E60190AB7
SHA-256:	8257229ACA8F9E1BA64A9D881A16817B216A429867E7FB9DF7D15915663B7E67
SHA-512:	0E2F088B7E681C5172548A57F5D175701F9873B8D56ADB06ED633A724AE94FA6E659D80A3A9BFC9FCDF59B311E6CB5A85513FE47DF33A2025073F95A88830BDF
Malicious:	false
Preview:	.PNG........IHDR...............h6....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\skin\highlight-disabled.png

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3217
Entropy (8bit):	7.892286714994252
Encrypted:	false
SSDEEP:	96:bSDZ/I09Da01l+gmkyTt6Hk8nTgQCZuEaGOo2:bSDS0tKg9E05TqZaGc
MD5:	DC3494FFF24914D9D2D021BD8D25D6DD
SHA1:	D291D3FFE012D546353FEAA032DE8F427B37C5A5
SHA-256:	974907293EC367914CDAE7AA701000790AC63F1AFE977E06F3A16D4DA37932A5
SHA-512:	2E8612ACCB12FB144C4C656C9664123A68311C115960DD9AA91CF344C6A7ED73C4574E916DD2FB4B56560C3897A39C128F280A5DA1182E0B48DF8A6FA41B8EC4
Malicious:	false
Preview:	.PNG........IHDR................a....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\skin\highlight.png

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3216
Entropy (8bit):	7.8906601217003995
Encrypted:	false
SSDEEP:	48:b/6DocieftI9G9f6A+FIDOWu0lDl+gm7QyTtctIInQSy6IVpqlnBcODhn1aYaZe3:bSDZ/I09Da01l+gmkyTt6Hk8nTJ11aZu
MD5:	29D046A3F81292EE314864085A63FF81
SHA1:	9B6B8A5E556B475E2E18CE6875D9561AF07DF37C
SHA-256:	B5B6674E9D6CA9441C93D1F14C1203C75DCD3F756C8AB990FB736EB8EA02D1AC
SHA-512:	93933BF98A7E2ADDE07218FF71339386A40D42C55CFDDFBAFB77C8720370999E5276007B1BF1D775D9EB0397A66A34776E081966A4FD0EBED59A1B0E086CC2B2
Malicious:	false
Preview:	.PNG........IHDR................a....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\skin\logo.png

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3239
Entropy (8bit):	7.888643295675962
Encrypted:	false
SSDEEP:	48:b/6DocieftI9G9f6A+FIDOWu0lDl+gm7QyTtctIInQSy6IVpqlnBcODCRALs03pS:bSDZ/I09Da01l+gmkyTt6Hk8nTdLNZi
MD5:	28FDADB259A8077E09F442CA8EE1FFE5
SHA1:	9F93FD60CFC263758E2893813FC2EBD2AC3BB352
SHA-256:	9B519A9E1A1B17921268F552120BEE46DCBBC0BAA8BD888524BE0F7278172F6A
SHA-512:	E5926D42E2C79DFE415132156CADE34830B98F81D359F8AF2272F7B0B723C93770AA40F4478545ED01F7C4D23B051700641E33F36ACDF8C7E4736B0BA0102F50
Malicious:	false
Preview:	.PNG........IHDR................a....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\skin\logo_32x32.png

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	907
Entropy (8bit):	7.7115682629611495
Encrypted:	false
SSDEEP:	12:6v/7iMXQbYxUmLXrR83gsck25T8crr2vU3w9lFKms5QQjsa7mwetd2xJ+qjsq+Ka:BbYxUmLXd83RMBwl9g6wo5q/+Kdpi
MD5:	CE93245253E7D87992B0BA17501BCCCE
SHA1:	EB886BDAD9250A51E1DC7C3E46E34AEA684253D0
SHA-256:	CC355E7C9F6C28CA686489EC62307BDA4BBC580D7479794B9080F48E8D1B288D
SHA-512:	CB1FB5E8F26542D22194970CCCDF575780E0D29710576DA925E03A0140FCDB443A58A8CCC0F6993968F0FADFA69D2BC2CA708AA002565A24E5D0E68A7631E6AC
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....tEXtSoftware.Adobe ImageReadyq.e<...-IDATx..W.k.Q..^.).:....\.......E#..ED...C.]...`..((h...g&....n....z..Q......\r^.....K..~?...\|...y.LrL....X.y)3==.e..r....I.....JOc)`r.D<.b.0K..rl..x......9.E......oc...g.....Y.9.>..-..'....{.q.@..\|....Nc^...9I.^.=...2.6....@..g...K...@.....D.......z../....A..b....0N......Q....V.:...@...Yu..8.....).......g...Ik......Q...zp..b.._...'}.W..$....5.M....)...[..)z....UR..<..2.F.m.W....>._i........-3..Y..._.........u.....$.x.-...L.=...g...Wf...l..0...v...J....{..iC..p..x.k!....^...^.rE..8.hFA....s..l...~@...H.#a8...)O:HX[.......p`9f...\.?.ND...rJ.1...P....nq..........a.Q_.l.X{.Z\KV..'.]0...#.Rq....o...P........>z.q.....[......,'.S."J1;.w$.s...x......s..."03.&......Rl?`..6.......-6.D.........ZDw>@....X..e.Ym.......QTgD..........4o>...=.8...,.!r..+.'........u.[...............IEND.B`.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\skin\more-search-providers.png

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3352
Entropy (8bit):	7.8931164626831265
Encrypted:	false
SSDEEP:	48:b/6DocieftI9G9f6A+FIDOWu0lDl+gm7QyTtctIInQSy6IVpqlnBcOD8T/BbqEhZ:bSDZ/I09Da01l+gmkyTt6Hk8nToqeGM
MD5:	3D5838DF2B73465BAE62A24C4227B8DA
SHA1:	6DBC88054A5CEBC0BD528965E232ECA12B7FF841
SHA-256:	910F08F5D49FE7D48E4C04E2A2872B67E5210A16AD10611D89D23009A58AE225
SHA-512:	D6DCE4ACE8CC5823A2E54265D9207C37D84A2D5F43B57E0EBE4BB08C2EC051F507730B46F0F5AD3B90E13DB6C7D4DB1946F0FD3A7B25A5EC14A92769CCB40772
Malicious:	false
Preview:	.PNG........IHDR................a....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\skin\music.png

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	969
Entropy (8bit):	7.762222484405286
Encrypted:	false
SSDEEP:	24:H99+nx2odKpOu5EoaHoA4JtF7yq3W4T9bx+Z6JEGY:d8x2odKpOmZ6rStF75m4Txx+ZaEGY
MD5:	6CCA94CDF2EB6A5FF419733DF8E89C8B
SHA1:	9B53E137FE7C6FE398403EED10CBFEE303CC2A83
SHA-256:	5F424A3EE5FE6892ECB699ECC07D21A8749166FD5356E6AAFBF6564B0DD0B3F3
SHA-512:	C1D45F195837E4AD1BF78F1BF5A7C418734E69D4C477D807ED34B034E079B35127757E3F29B8725070C4C93063574155A031E88E50CDECA93FF1B6789E85D2ED
Malicious:	false
Preview:	.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<...kIDATx.tS]lSe.~.s.sN.u....m...J76p..!Q.2p.h.T.....\.h.z...&^.h.d$#q.............c.m..u....==?~%$J.O.\}..\|....Gvt........l._I)...dd.S.q\..1.x..T./P].,.8......]..]..-.iL._...e.Q..hp#`.....).7L(.$...........D[?.7..n...Wg..#A2m.Z..d....Df...9g..K..W........H}5.K0+<\../;...os..y..[..k.5%..^I..V..@.1...C.cr.t..MGz./,T...#......z%.>...G5..MG.;:..u..."..,-e....J''p....v........P.....cHmj..w..d[.c...D....... ..v.Y...X..uQ..4........x.68......{..x.i.U....68..5.......s....7..w....JH.V6Q'<."....M5....<.`pFa].W.....90..{c.~...n9..52..AZA.A......h.q_.w..p...{._Kf.~."...e...e...g.Y{..]D.w.8.}.......C.Z.....p.^.j.\|S..v.J\|........Z..,t.<01..''04........l...KB)@..."...].....ja.P.....b@d.\|.!........K....$..x......+..(.L-.3..\|...ba..Q....C..Q.Z..c...h.*......V.......(...o...`.cl;z./8lf.....7.y...._WEO.;6.._..7g0...Y..a...a.....=..$M.T.S..0._.Y.S.y.....IEND.B`.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\skin\photos.png

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3432
Entropy (8bit):	7.890811683389906
Encrypted:	false
SSDEEP:	96:bSDZ/I09Da01l+gmkyTt6Hk8nTix2NsDd3:bSDS0tKg9E05TiAgd3
MD5:	3326F38F67E138CD40DF3036A6309F63
SHA1:	8371BACE6C48FC5AF719000E91A627F6DC0CE3AC
SHA-256:	A86EB86BE5BA9BEEA0C3303447F4BAFFF2A8BD49AC2D245F3759C31DE52018FC
SHA-512:	672FD5BDD4753F3E8EB9A30B25E18EA7231DE7208C217E9D55F3A34A794B27626C290E581418229982DEDE7975D21C46E3E9B32F265BCAC8B2FBA56926B5C841
Malicious:	false
Preview:	.PNG........IHDR................a....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\skin\search-current-site.png

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	784
Entropy (8bit):	7.695743284796664
Encrypted:	false
SSDEEP:	12:6v/72rnSuDO0xkvVXUTDkIPr5vDeQNMV5PhSEbsqs9GaWzL6gsp2xkIoKzxV7:3SkO02dkTD3Pr5vEQI6L2+IoKF
MD5:	7D4CAAD7B62C2F69274E585D326D2A91
SHA1:	815175D8C54D86B622873FD152BDE7482B6B83D8
SHA-256:	8EF5C62F599935ED9448258366E2DCB209338870B902D803F20081494FE46E51
SHA-512:	5FB3D260220150F1461577287D5D273482207F4CDE362391FE81C643C113A598B440A413B35DDD6520DF55B2AB2C3EDB8A24B2EC2AD681FEAC6C382192A31789
Malicious:	false
Preview:	.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<....IDATx..[HTQ...}f.q4...6h$..iY.1..,...!).@.%..b..QH&./fD..`.FTf....S.My..@^f....xV.(...C...f........D....?........H.zS.mD...Pi...6.&...!a...hs5..;....j@............ZI....<...h.?.!{=.......%.<..n.,.A.....2.t...t.7E....F..H....1kB!z:A..P.s.Len^.....mp...z.:l\...LX.....`...m... .\VV..:lUI...9e8.p..f...o........q.......1...?yTb..-.\....R....X...\..IK.E...T....l..7.Im..jPB.../......B.X...L$.{2.......N6>.e'.N.../.JV\|...{s.d..5a..TK7F.q....!.6...Y.w..c/.S..l.w........qvgT.T......!.9...'. 1'I...,~O%.:.R..KHt]i>n.>..G.\.u.Q..0....&.."}....CJ....E.>....B....<VS.....a.i....0.e#.. .K.P...(....._.^i..q.4.Xk.%se.;.....3.}x.=...?;KW...B.q.al..a5._+&..F...{H}..O...@j.i.1w.....IEND.B`.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\skin\social-networks.png

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3248
Entropy (8bit):	7.891399431000833
Encrypted:	false
SSDEEP:	96:bSDZ/I09Da01l+gmkyTt6Hk8nT5c656Pp:bSDS0tKg9E05T5cy6B
MD5:	C9E37BF72E41F4266CD7BDC875EA61BE
SHA1:	5D808714D82BC227D2B2F973540B2374D3212367
SHA-256:	88CC5CFDD1B66EDC992A9A348634C641A49626EB06116C1247E349DF5089140B
SHA-512:	DBBAFEAC3A52A2F9CC2E69D7E95CF5D0EE6DEA12E42DA4C3DCB7FD1E754CF9B24D2D31309A529885537EB46C14342965C3AD184D606800773D2B481C94E74F7C
Malicious:	false
Preview:	.PNG........IHDR................a....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\skin\splitter.png

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PNG image data, 11 x 24, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3056
Entropy (8bit):	7.8853902232584545
Encrypted:	false
SSDEEP:	48:Q/6DocieftI9G9f6A+FIDOWu0lDl+gm7QyTtctIInQSy6IVpqlnBcOD5d101/hu7:QSDZ/I09Da01l+gmkyTt6Hk8nT5Q1JVO
MD5:	AEF0A911384F19305EA555EE444D37BC
SHA1:	5EA082A01AF0E52F12EF89B0D675426C8608B581
SHA-256:	68AFC90D338327ABCAC854A19D8C81EB1F9AA4AE7BFB1F53DBBDE899B4FC9E64
SHA-512:	4A669417979F96D72D0E8CC930E48C3F30C4DE4797C525D21CFCBA5C4D02588C804BA30F03595949E8C4C61B67D712D67E96AA2095EE81AC9EE4F4AE03D1FB27
Malicious:	false
Preview:	.PNG........IHDR.............,.......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\skin\sweetim-toolbar.css

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4994
Entropy (8bit):	5.055953897720054
Encrypted:	false
SSDEEP:	96:NHpNbWeC/ElNLI/Qdyc04k4bOoz+Vfh1+4FsXC8Y+b1Ska:NHrS5WNL6Td4k4bOog7+4FsSmpSt
MD5:	73B01090E40193CC727A5FDC58A87FB8
SHA1:	6E1A8174F945A280F7D56B3099206ADAF04D2532
SHA-256:	B60F9FB3F97751D5D05C32DC3F2A417BC086ADE2F7C229D2F95CCD574A8042A2
SHA-512:	C3851B64AE8D3A0BE72EF2ED3C5B700D379A5CCD9FAECBF7F6E5EBC2A80EDF73A38C6FC88F14672B1CD0FDB13DAE409EC0A00970E5946E05EA58B5D1A06E7C04
Malicious:	false
Preview:	@namespace url("http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul");..@namespace html url("http://www.w3.org/1999/xhtml");..@namespace xbl url("http://www.mozilla.org/xbl");......#sim_main_menu_btn_id {.. list-style-image: url("chrome://sweetim-toolbar/skin/logo.png");..}....#sim_search_btn_id ..{.. list-style-image: url("chrome://sweetim-toolbar/skin/web-search-button-glass.png");.. -moz-appearance: none !important;.. -moz-box-orient: horizontal !important;.. /* color for FF 3.6 and later/.. /background: -moz-linear-gradient(top, red,yellow,yellow,orange) !important;*/.. background-image: url("chrome://sweetim-toolbar/skin/web-search-button-bg.png");.. -moz-border-radius: 4px;.. border-width: 1px !important;.. border-color: ThreeDShadow !important;.. border-style: solid;.. color: -moz-Text !important;.. font-weight: bold;.. margin-top: 2px !important;.. margin-bottom: 2px !important;.. padding-left: 4px !important;.. pa

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\skin\video.png

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	869
Entropy (8bit):	7.724749684662738
Encrypted:	false
SSDEEP:	12:6v/72uhawVsXDd8HrtpLae7I6TeRg7EGrhLADjCznC9c9qtpMaPhvGklVV5KSChX:6aZXAr+jQUg4GrhLUjCLC9lP4G5KS8X
MD5:	920D3D7C15F7AB6E00F2A8C3593CA86C
SHA1:	74147628E2FCF44B2AF427A67DBE6278E8784416
SHA-256:	8D53BA3EF30AA548B8B5870EBF264863AB28BFB28BA0338337EA81FB10E931D0
SHA-512:	6108CE806BA0210A00A8250EBA0A74AAF9934F000C1EEC6E4750068A46EF4447D275C0A89053933B4E3ACE6529F5425D7F0ABBD7F8C2DDE4961A5FA32E9C0F88
Malicious:	false
Preview:	.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<....IDATx.\.[h.y....L&i:.mRl.Z/m...A...ESJ.hY..\...(..(./.y.A.X.a....VE.JD[A7].....K.\L.e2.LlK=p........}.~._.[L_.g...X.....o..s.?.=v.Q......T..G.gU.D........?...:..U.w7.`.]]?#z.^....\|Q...$M...?dr.&....K.Y...Qq...h.d2e0...\|...@.C....:I.....K.B...bo_...X,.iL.UU....]{..f..w....pL.@......9....~..#.%.....J.1....'B..U..m.[3t6....4.w......OW.Z.....!..U.g.....L.S&S...`..\N6lX_..z..m.{..$Q....Du5./.........j....dY.{MH..+@(.....O0...2..ZDg..H.4...%..>.n..x<p.6.....".,t..$.......q....o.M2...._...g.-.'...pA.\...}(..G}.&.......'...Rk7i.r...._6...3.#....u...#..s5......%...#..E6.....J...'}....9c..~.E.(!..`.T!y..B.K>.X.%<(Q...W_.......2...).). ..l.....,.,.......i.--..HhL.Q.}..$...Rf.....Hb...Cnh..T..&.?.e..?v1Q....\|...Bk..........!.................IEND.B`.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\skin\web-search-button-bg-hover.png

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PNG image data, 10 x 26, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	976
Entropy (8bit):	2.7857896514822174
Encrypted:	false
SSDEEP:	6:6v/lhP0ul0+wP6fn7FmT/2NA39NF3wKuNR431pXp:6v/7RyP6n7FmqC9/3luNR61T
MD5:	B1E5876DB65289C13C4977F89810E8A3
SHA1:	1060397CE54CD3F14D37263D0BB87A502F18F300
SHA-256:	F238F4D203FC49E5F80F63F98937F0D599CEFC6C8DE8318F08592BCD88B21D18
SHA-512:	B0247636B355B68576AAE88179D3D5A8B8507203D714DC4284748C98C21F9082A0C04CD6B9333699ADE661BEE58EFB2F554FB9004D4876E2BF6659749E07B1B6
Malicious:	false
Preview:	.PNG........IHDR..............:=.....gAMA....7.......PLTE.........................."..'..'..(..(../..3..4..;..6..;..<..>..C..D..F..C..G..V..h..i..y.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................z0.....tEXtSoftware.Paint.NET v3.5.2..iC...VIDAT(SE....P.C.+.2.w.T...L.&\O..w..8..m.h.,n.....x....NT".7.).Q."]R.51.cd.$.y.,1../.$..........IEND.B`.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\skin\web-search-button-bg.png

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PNG image data, 10 x 26, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	981
Entropy (8bit):	2.888407959176497
Encrypted:	false
SSDEEP:	12:6v/7RIy6QksPeAbLJ7G9vcC37KT1ZlyT7NV:dyxAAHJgEO7KbwTRV
MD5:	496F02D84BDCBF2EEF447CA153D1896D
SHA1:	9500DF7258DD9112C24D54772D550E26739EC2A5
SHA-256:	04FD558E122BDD2E2D40AE2BCBB82FAE73F5C9BCB19DED56BDD6C1DD39355B8F
SHA-512:	AA49E9FB7B6255E2EDB72754EFB62C08CA486378824DCF349305B625B9B7731321D12FED396833467A7B5AE231BAF2B5BBF400F51C9D5D72B0DEC2497EE4BB95
Malicious:	false
Preview:	.PNG........IHDR..............:=.....gAMA....7.......PLTE..................................................'....+..;..<..3../..4..5..8..=..O..@..A..b..c..s..{...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................G.R....tEXtSoftware.Paint.NET v3.5.2..iC...[IDAT(SE...P...!)Iqr.T..%.......3...h.....(N..........7.....\|..Y.R.E..Y.....7..C4.1..^....v.....IEND.B`.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\skin\web-search-button-glass.png

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PNG image data, 18 x 19, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	808
Entropy (8bit):	7.5250979472444355
Encrypted:	false
SSDEEP:	12:6v/7fwb9aXjZ9t8epIzfIgZsZQc8PXbfTNKmJ6SXE8CBxkuDCfwwxxnXNWxUec:Db9azftTaIZQrbf4mJxXEJ4f3xnXL
MD5:	6863D0B8DD6CB1DAA8F024340EBEF2EC
SHA1:	153107E528C2531A48F3297171A94A6172F4B5D3
SHA-256:	AA79352FEDB4FC20672861188C1D241EFD5236937978EBA04878F6AF5732791F
SHA-512:	EBE4F11A56497EA51546EF581D84705298B0C54DDEF801B14CA754572545134C61C32D3A118A9BF45A68E09F0452D8D8F2F86BE32CB5CAC307B6042A791CA15E
Malicious:	false
Preview:	.PNG........IHDR...............].....gAMA.....Z.... cHRM..xZ..o=......z...H.......9....q@T......pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.2..iC...yIDAT8O..]HSq..W.}Bu.UT7.tSQA%EtQ.....1FY.uLd..v.:57ga.N(...}AP..Xu....B.......=..v".gI]t..=......>..(...2.KH..=8hv...~.Z........E....0;...u..;...q .D....H.......(.\.,...7..4..W....{..E?`..FU..R..;..a.;2..I`.[~.~rE."..s.B....Z#.9..9:.}.w........=.O....#W..0..HZ....`.3.v..Cb...S....}.ls.........g.K-..n....OY`.2..8...wG....Z.di.._..8.n..0./...q.=.5.GG.g...\h..;..............K_).~\.0@p.@..DK...(.....@06.[k4..4.d......0b'.@....?..;.6O4.x.i..z..R..)O....-8G3!...\|..ju..-._a+i.....S....}.gC".#....b..f....y:<j>7...g.......Y.^u=-.)Y_,;../.A..T(s.....Z.......hK5.G.BmF.3e.{.u.d.d...-.^"..!r.....\..VI...r.....Bh.+.....IEND.B`.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\skin\web-search.png

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3337
Entropy (8bit):	7.886640514351696
Encrypted:	false
SSDEEP:	96:bSDZ/I09Da01l+gmkyTt6Hk8nTt/4E/TS:bSDS0tKg9E05T/S
MD5:	3E2E639063054CCB59DB68C2A9243AFB
SHA1:	FD9461012CFA0ABD8333645E6A55B87DC5AC6537
SHA-256:	5D79D48F3FC4EEEF3A8C46FEF30DF602BE257730F841B99BECE79F7D9356D7E6
SHA-512:	730CF2834D48BDDA697E580064DAE1060D057A9F39D33C8A632D790F7E0B3097DD70421E31C09D33A914E763CB1C39E2C75554D8F6B4EB11B45A8962E8FBBA37
Malicious:	false
Preview:	.PNG........IHDR................a....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar\skin\yahoo.png

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	442
Entropy (8bit):	7.104637400753022
Encrypted:	false
SSDEEP:	12:6v/78f2s/6T6is1kJ4nnQmCOZBw4r9Ah/kmZscG2E3d:Z2s/6WR1KcnQcF9csmGF3d
MD5:	F64113435D357717C72EBF0E86B317E6
SHA1:	85CA037F08378619D4322A7F4EDBB5FC55AEFC5E
SHA-256:	A3DB26273631B16D9F68100C2C8B9096C899B320AE2C3EE787D31D6DBC0826E9
SHA-512:	F7B60E594EFFDD05E84C8583F205A32BFB87BB4CB084F0B49FDEAF5797B4128AA4B2D72A7FB1FB4FC112CAFF1958C1632E19ED658C564727656604746BECF616
Malicious:	false
Preview:	.PNG........IHDR................a....sRGB.........bKGD..............pHYs.................tIME.....;'.x.....:IDAT8..!k.@......P"B....S..G..(....eT.15..c.b?`..b.....U#...pb.....L.;r./.^u.}.......yx.Pde...UNA2..EH...7.S..dw.u.....n..G.`\|...."+....d5$.!.Jj...Qr.....J:Q@.....:=M..S.../.....>_>........r.+...s....\.f..(.d.X..mW...%5.\|.\.=.......?.y~.,.%5....%...Q..YY......c....-..N.6.6I.a...1J.\.\y.....Y...jH;.....J...v......IEND.B`.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\components\SIMAutoCompleteSearch.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	9648
Entropy (8bit):	4.9386302416157895
Encrypted:	false
SSDEEP:	192:BJYDxEranuKJKKgbK7dAKyK+i2vRJx7fhhg9pJt1dR0M5:BJegKkKgbK76KyKQJxlhq5
MD5:	C646B5F72E465DD579A4485EBD5518E5
SHA1:	0696375F062FCED5BBB07146D3B21B319B19E862
SHA-256:	9413FD6BF893C926EB6D6908E494A1BB710EA8A9CEA355011D5E3C4249D63F32
SHA-512:	6E1C68587441512974EE6B2654FB05D59D571343234B0EDC3069AD7A5E3D96DEB4751BB18881C799CEE9121D14BB98E95694AB81D849C7D86042F09023153CAB
Malicious:	false
Preview:	..// original file:..// "How to implement custom autocomplete search component"..// http://developer.mozilla.org/en/docs/How_to_implement_custom_autocomplete_search_component....// logs an exception..function logException(e)..{.. var message;.. message = "Exception:";.. .. if (e.name).. message += ", name=" + e.name;.. if (e.message).. message += ", message=" + e.message;.. if (e.number).. message += ", number=" + e.number;.. if (e.lineNumber).. message += ", lineNumber=" + e.lineNumber;.. if (e.stack).. message += ", stack=" + e.stack; .. .. if (!e.message).. message += ", full=" + e.toString();.. // dump(message);..}....// load external JS files...// the component is loaded in different namespace than browser..// (e.g. "gBrowser" is not defined here), so we _dont_ need to explictly load it in..// a dedicated namespace object, as done in main.js..var loader = null;..try{.. loader = Components.classes["@mozi

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\install.rdf

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1630
Entropy (8bit):	5.50969037695185
Encrypted:	false
SSDEEP:	48:kYH7siLPNKP4p9LN4peoVAHd7wORaN008mZ863VA:bHfDQelSOMNH8Ue
MD5:	C2DD6535605B8AECA43BCBF777F96262
SHA1:	1A037398321F63475887809CD2E1A4A92036DC98
SHA-256:	C3541B4C8C083B134158D839BF5348204E02C48546FB88B4A9933506DE6B5DA3
SHA-512:	84A4B20FE3B354F33F0023F21BB264095F4CE16830D18A0FA24B967E9E974B9D57AA4135E97B6599053DFAB6CCAAB8681956FF2E590E9A9567FA5D3B8A22ECD8
Malicious:	false
Preview:	<?xml version="1.0"?>....<RDF xmlns="http://www.w3.org/1999/02/22-rdf-syntax-ns#".. xmlns:em="http://www.mozilla.org/2004/em-rdf#">.... <Description about="urn:mozilla:install-manifest">.... Required Items -->.. <em:id>{EEE6C361-6118-11DC-9C72-001320C79847}</em:id>.. <em:name>SweetIM Toolbar for Firefox</em:name>.. <em:version>1.3.0.1</em:version>..... Firefox -->.. <em:targetApplication>.. <Description>.. <em:id>{ec8030f7-c20a-464f-9b0e-13a3a9e97384}</em:id>.. <em:minVersion>2.0.0.0</em:minVersion>.. <em:maxVersion>7.0.*</em:maxVersion>.. </Description>.. </em:targetApplication>.... Optional Items -->.. <em:creator>SweetIM Technologies LTD.</em:creator>.. <em:description>all about fun</em:description>.. <em:iconURL>chrome://sweetim-toolbar/skin/logo_32x32.png</em:iconURL>.. <em:homepageURL>http://www.sweetim.com</em:homepa

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\searchplugins\sweetim.xml

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with very long lines (3547), with CRLF line terminators
Category:	dropped
Size (bytes):	3915
Entropy (8bit):	4.5039484079313326
Encrypted:	false
SSDEEP:	96:65Vc7FggKebtnL/6q0P7ETojlQXdMdnL2DD:6nc7VKStnT6DxhSDD
MD5:	EF691DD0310399372EAD6FACEEDBE1BB
SHA1:	4F1FA12B9751F78D8B3BF648AEB72C8AC2AB069D
SHA-256:	75E16E17C0299FD6BA42BB0BA8C8AA465634D6395C8DBAEC6E97066468C22AC1
SHA-512:	370EB8D795AB0B676D45602D8750193D795CF455C5492062B6475579EC52BA817A4138A51829EDF028E52DAA216B63B93A7FEDABB552907E0BA0C8A15AFD2A4E
Malicious:	true
Preview:	<SearchPlugin xmlns="http://www.mozilla.org/2006/browser/search/">...<ShortName>SweetIM Search</ShortName>...<Description>Use SweetIM to search the Web.</Description>...<InputEncoding>UTF-8</InputEncoding>.. <Image width="16" height="16">data:image/x-icon;base64,AAABAAMAEBAAAAEAGABoAwAANgAAABAQAAABAAgAaAUAAJ4DAAAQEBAAAQAEACgBAAAGCQAAKAAAABAAAAAgAAAAAQAYAAAAAABAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAG5ubkZGRjY2Njs7O1dXV4aGhgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAH19fSAgIAAKQQATegAUhQAUiwAQawYKHE5OTgAAAAAAAAAAAAAAAAAAAAAAAHt7ewoMHgAbtQAWmAAHLwADFQAGKAAVjgAj6AAQajs7OwAAAAAAAAAAAAAAAJOTkxoaHwAcvQARcAAFHQAVkQAezgAcvgARbgAOXgAi5gAOW2BgYAAAAAAAAAAAAF5eXgAJPAAi6wAUiQAj8AAm/wAl+gAl/AAm/wAg3QAh4AAdwxgYGZWVlQAAAAAAAC4uLgAKQQAm/wAm/wAk9gAk9AAk9AAk9AAk9AAk9wAm/wAdyAAAAnd3dwAAAAAAAB4eHgACDQAf0wAm/wAk8wAk9gAl+QAk9wAk9AAk9QAn/wASdQAAAGdnZwAAAI2NjRMTEwAAAAAHLgAg2AAo/wAh4AEYpgAe0AAn/wAm/wAVjwABBAAAAxcXG3d3dyYnLAAdwwAWkwAAAAAVjgARcgAZqw

C:\Windows\Installer\48c209.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, MSI Installer, Number of Characters: 0, Last Saved By: InstallShield, Number of Words: 0, Title: Installation Database, Comments: This installer database contains the logic and data required to install SweetIM, Keywords: Installer,MSI,Database, SweetIM, MSN Messenger, Yahoo Messenger, ICQ, Subject: SweetIM for Messenger 3.6, Author: SweetIM Technologies Ltd., Security: 1, Number of Pages: 200, Name of Creating Application: InstallShield 2008 - Professional Edition 14, Last Saved Time/Date: Mon Aug 1 15:43:36 2011, Create Time/Date: Mon Aug 1 15:43:36 2011, Last Printed: Mon Aug 1 15:43:36 2011, Revision Number: {88655337-61D8-45FF-9B01-BB29C2AAFDE6}, Code page: 1252, Template: Intel;1033
Category:	dropped
Size (bytes):	3552768
Entropy (8bit):	7.4010672025598465
Encrypted:	false
SSDEEP:	98304:FYyGQnzszN2qXKdtDCSWBXM0BXEhUQM5V3kS8HqSd:SQnzszN2qUONXjAUQMXkZK
MD5:	54D2F6EC72B0A9F8F85E07137F6D098A
SHA1:	5AC5FD5824446DFB7D7FDAE0ED1729D821B1DB73
SHA-256:	A03C61372030D38A2046666E840F25E460F6E3F25DE6583EC4E2FDB28227F484
SHA-512:	F838BEBBC3FDA7EBF93264208B0A89D69B58090509A912DE0F31EBB9E9250678B152FA0616D61B797C20AE582EACD9A8AAFD5BAE4BD0DC6AF54ECC69D46AB3AA
Malicious:	false
Preview:	......................>...................7...............8...........................}...............................................................................................................................................................................................................................................................................................................................................................................................................................................<...............................................................................................................!... ...'..."...#...$...%...&...)...(...5...*.......,...-......./...0...1...2...3...4...G...6...7...>...I...:...;...=...........?...@...A...B...C...D...E...F...J...H...T.......K...L...M...N...O...P...Q...R...S...V...U...b...W...X...Y...Z...[...\...]...^..._...`...a...d...c.......e...f...g...h...i...j...k...l...m...n...o...p...u...r...s...t.......v...w...x...y...z...

C:\Windows\Installer\48c20c.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, MSI Installer, Number of Characters: 0, Last Saved By: InstallShield, Number of Words: 0, Title: Installation Database, Comments: This installer database contains the logic and data required to install SweetIM, Keywords: Installer,MSI,Database, SweetIM, MSN Messenger, Yahoo Messenger, ICQ, Subject: SweetIM for Messenger 3.6, Author: SweetIM Technologies Ltd., Security: 1, Number of Pages: 200, Name of Creating Application: InstallShield 2008 - Professional Edition 14, Last Saved Time/Date: Mon Aug 1 15:43:36 2011, Create Time/Date: Mon Aug 1 15:43:36 2011, Last Printed: Mon Aug 1 15:43:36 2011, Revision Number: {88655337-61D8-45FF-9B01-BB29C2AAFDE6}, Code page: 1252, Template: Intel;1033
Category:	dropped
Size (bytes):	3552768
Entropy (8bit):	7.4010672025598465
Encrypted:	false
SSDEEP:	98304:FYyGQnzszN2qXKdtDCSWBXM0BXEhUQM5V3kS8HqSd:SQnzszN2qUONXjAUQMXkZK
MD5:	54D2F6EC72B0A9F8F85E07137F6D098A
SHA1:	5AC5FD5824446DFB7D7FDAE0ED1729D821B1DB73
SHA-256:	A03C61372030D38A2046666E840F25E460F6E3F25DE6583EC4E2FDB28227F484
SHA-512:	F838BEBBC3FDA7EBF93264208B0A89D69B58090509A912DE0F31EBB9E9250678B152FA0616D61B797C20AE582EACD9A8AAFD5BAE4BD0DC6AF54ECC69D46AB3AA
Malicious:	false
Preview:	......................>...................7...............8...........................}...............................................................................................................................................................................................................................................................................................................................................................................................................................................<...............................................................................................................!... ...'..."...#...$...%...&...)...(...5...*.......,...-......./...0...1...2...3...4...G...6...7...>...I...:...;...=...........?...@...A...B...C...D...E...F...J...H...T.......K...L...M...N...O...P...Q...R...S...V...U...b...W...X...Y...Z...[...\...]...^..._...`...a...d...c.......e...f...g...h...i...j...k...l...m...n...o...p...u...r...s...t.......v...w...x...y...z...

C:\Windows\Installer\48c20d.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, MSI Installer, Number of Characters: 0, Last Saved By: InstallShield, Number of Words: 0, Title: Installation Database, Comments: This installer database contains the logic and data required to install SweetIM Toolbar For Internet Explorer, Keywords: Installer,MSI,Database, SweetIM, MSN Messenger, Yahoo Messenger, AIM, SweetIE, SweetIM Toolbar For Internet Explorer, SweetIM Toolbar, SweetIM Toolbar For FireFox, Subject: SweetIM Toolbar for Internet Explorer 4.0, Author: SweetIM Technologies Ltd., Security: 1, Number of Pages: 200, Name of Creating Application: InstallShield 2008 - Professional Edition 14, Last Saved Time/Date: Thu Sep 22 19:26:45 2011, Create Time/Date: Thu Sep 22 19:26:45 2011, Last Printed: Thu Sep 22 19:26:45 2011, Revision Number: {F44840C4-6708-42BA-807E-138D61C83EB9}, Code page: 1252, Template: Intel;1033
Category:	dropped
Size (bytes):	3027968
Entropy (8bit):	7.344776703975813
Encrypted:	false
SSDEEP:	49152:AWRYyZU3zs91c3fvDas3AgA7Rru1ZQxsxUx4x9rsyPJtAPAGuvwDju00/W6d:dYyZ4oVaAQ1yyUax9rsyPnAbcwPu00/B
MD5:	0FD2EF6954C43CE4D2C1E93825355AFB
SHA1:	981D1C9A6F54053EE736688F562D1C859D9EEE66
SHA-256:	2905553661E5BC69797337318D0DD0A7173A5191C6A7968FB89AB9F0F668D269
SHA-512:	B883393FDF11F4D4370C4E16B7FCC0ED557C5094420E47CFA1D0B3E2FEA0D7CE6B83953FC1197DA306318C807724C1F4A27B93231D53DDBE299607311FE35D7B
Malicious:	false
Preview:	......................>.................../...............8...................................................}.......................................................................................................................................................................................................................................................................................................................................................................................................................<.......................................................................................................#........... ...!..."...%...$.../...&.......(...)...*...+...,...-.......1...0...3...2...M...4...5...6...7...B...I...:...;...=.......>.......@...A.......C...D...E...F...W...H...J.......K...L.......V...O...P...Q...R...S...T...U...G...a...X...Y...Z...[...\...]...^..._...`...c...b.......d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Windows\Installer\48c210.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, MSI Installer, Number of Characters: 0, Last Saved By: InstallShield, Number of Words: 0, Title: Installation Database, Comments: This installer database contains the logic and data required to install SweetIM Toolbar For Internet Explorer, Keywords: Installer,MSI,Database, SweetIM, MSN Messenger, Yahoo Messenger, AIM, SweetIE, SweetIM Toolbar For Internet Explorer, SweetIM Toolbar, SweetIM Toolbar For FireFox, Subject: SweetIM Toolbar for Internet Explorer 4.0, Author: SweetIM Technologies Ltd., Security: 1, Number of Pages: 200, Name of Creating Application: InstallShield 2008 - Professional Edition 14, Last Saved Time/Date: Thu Sep 22 19:26:45 2011, Create Time/Date: Thu Sep 22 19:26:45 2011, Last Printed: Thu Sep 22 19:26:45 2011, Revision Number: {F44840C4-6708-42BA-807E-138D61C83EB9}, Code page: 1252, Template: Intel;1033
Category:	dropped
Size (bytes):	3027968
Entropy (8bit):	7.344776703975813
Encrypted:	false
SSDEEP:	49152:AWRYyZU3zs91c3fvDas3AgA7Rru1ZQxsxUx4x9rsyPJtAPAGuvwDju00/W6d:dYyZ4oVaAQ1yyUax9rsyPnAbcwPu00/B
MD5:	0FD2EF6954C43CE4D2C1E93825355AFB
SHA1:	981D1C9A6F54053EE736688F562D1C859D9EEE66
SHA-256:	2905553661E5BC69797337318D0DD0A7173A5191C6A7968FB89AB9F0F668D269
SHA-512:	B883393FDF11F4D4370C4E16B7FCC0ED557C5094420E47CFA1D0B3E2FEA0D7CE6B83953FC1197DA306318C807724C1F4A27B93231D53DDBE299607311FE35D7B
Malicious:	false
Preview:	......................>.................../...............8...................................................}.......................................................................................................................................................................................................................................................................................................................................................................................................................<.......................................................................................................#........... ...!..."...%...$.../...&.......(...)...*...+...,...-.......1...0...3...2...M...4...5...6...7...B...I...:...;...=.......>.......@...A.......C...D...E...F...W...H...J.......K...L.......V...O...P...Q...R...S...T...U...G...a...X...Y...Z...[...\...]...^..._...`...c...b.......d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Windows\Installer\MSIC380.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	58312
Entropy (8bit):	4.7831488349783555
Encrypted:	false
SSDEEP:	768:+0J8+QCTqaxxKkUmFVSarTJym3OZESrcyFKfQLHVM:cCTqYttXDJT+lcfQG
MD5:	74578BF21C4CE56DBB2FBD7616895637
SHA1:	1D6A43E6D47DA777ABE5AA72F39F5C396D7E37E5
SHA-256:	C9CFE837EBA6960CE065653E45FDBB6FE3FD0BBBB0787E29B1881C03A3FCFB56
SHA-512:	F6219335B266C6D78628CA11B7A4C49FDF6C7F1261332B2B4A8ABAC49BE59CC5C6180CAA8CDDB32602C55F546C8CCA3EE7C41AB72859CB07FF9C5BE6E11720AA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........$.C{J.C{J.C{J.,dA.E{J..gD.V{J.,d@.x{J..XS.D{J.C{K..{J.EXA.A{J..}L.B{J..[N.B{J.RichC{J.........................PE..L...z.&F...........!.....`...p...............p.....................................................................p}..a...0w..P....................................................................................p..D............................text....U.......`.................. ..`.rdata.......p.......p..............@..@.data....3.......0..................@....rsrc...............................@..@.reloc..p...........................@..B........................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIC4F8.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	99272
Entropy (8bit):	5.488745177846843
Encrypted:	false
SSDEEP:	1536:rVgNTb67hb2MwFTKySgE6bSKycjyc/jVl0TF84G:2b67hvw++SKycjyc/jVlwGd
MD5:	933C5C5D2E46A10AD94AA35F90C8EF01
SHA1:	6CD9F9353A3FABBBC6938AFC1B67285B699F5972
SHA-256:	8E37E9EDE55B240E4E48421A490994665B58AA5E626C6F3E4EE2DA335133CFFA
SHA-512:	2E0DAC354B296682A9A31270584B6B2214664EDB4EB308BB85C9D7F785F08269A1006CAA49ECAE6B0789F71DC9378C29319517B22C0CAF8DFC4D40156960CB40
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............zk..zk..zk..fe..zk..ea..zk..e`..zk.IYw..zk..XN..zk.iYr..zk..zj..zk..Y`..zk.T\|m..zk.lZo..zk.Rich.zk.................PE..L.....&F...........!................3d...............................................U..............................0................`...............p.......p.......................................................................................text...f........................... ..`.rdata........... ..................@..@.data....R.......@..................@....rsrc........`.......@..............@..@.reloc..t....p... ...P..............@..B................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIC547.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	246064
Entropy (8bit):	6.281194577710972
Encrypted:	false
SSDEEP:	3072:W00SJMe7BTXN5uaP4ynbyH0OVjG2++yJ/gvZDlGn/UpHnTRB5NlIL1AcyolLd0MN:rJMe7pNouR+dVDloUzwy+HN
MD5:	FCA29C205E46CB5993CF6E14E29274D7
SHA1:	46FDC8C732BE34EF6F2B2CA589A8FB7F365B7F9E
SHA-256:	80838302E2BF9BF603F5076EF542D99C88B6CA46785178886E1B8D9E8D101EFB
SHA-512:	45CDAA35C8947DE03AE63FAC02A6676031F1EEA8A90BA32130BD1DEF0B8017CD52800DF0B0C6CCA1320DF19B615E8DFF98143B99CBEA99153ABFA27549315719
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 29%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................r....r...l...............&......................r.....r.............r......Rich...........................PE..L.....6N...........!.........0......^................................................q...............................6.......#.......p..................0!.......!..................................8...@...............p............................text...N~.......................... ..`.rdata..U...........................@..@.data...\)...@.......@..............@....rsrc........p.......P..............@..@.reloc...:.......@...`..............@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSICDA5.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	35838
Entropy (8bit):	5.834087170577405
Encrypted:	false
SSDEEP:	768:hwGMtwi06WL0WjrQoiScmL//cQLZW4IItRGXqsGacP+CDPFSus:o10xjrQoiScm7HPFSt
MD5:	F64772DFA8F1DD49EE31AA3F9F95AFD4
SHA1:	84F03DE6D0709C1DC91DD8D017D6421391919918
SHA-256:	F3E0F3D04B217BC3E12B8F57D7E32B0FF6932B23C611A6D6A6F2528A54326305
SHA-512:	9C1AD922B58CDFBBDB2C84650A6DF3085D2C9CE94AA082A9B02D06CC2BF6AEBD385824EEC2E3D0499EEE85C9AAEA969A6782ACA1EB31E8F6722683C88E72430A
Malicious:	false
Preview:	...@IXOS.@.....@O=.X.@.....@.....@.....@.....@.....@......&.{A81A974F-8A22-43E6-9243-5198FF758DA1}..SweetIM for Messenger 3.6..SweetIMSetup.msi.@.....@.....@.....@......ARPPRODUCTICON.exe..&.{88655337-61D8-45FF-9B01-BB29C2AAFDE6}.....@.....@.....@.....@.......@.....@.....@.......@......SweetIM for Messenger 3.6......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration...@*....@.....@.]....&.{7D8D174B-3913-4B63-AC98-73E40D7D8B60}).C:\Program Files (x86)\SweetIM\Messenger\.@.......@.....@.....@......&.{3FE7B4A9-F987-4178-919D-0352382BC051}&.C:\ProgramData\SweetIM\Messenger\conf\.@.......@.....@.....@......&.{2C982089-08F2-4C7A-BB39-32CD1652E5E4}@.C:\ProgramData\SweetIM\Messenger\conf\users\main_user_config.xml.@.......@.....@.....@......&.{C50A8E86-DD06-4529-95D1-DB619CE4DDFB}&.C:\ProgramData\SweetIM\Messenger\data\.@.......@.....@.....@......&.{305C457F-A573-4331-B422-83E881FD8EE7}..C

C:\Windows\Installer\MSID16F.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	246064
Entropy (8bit):	6.281194577710972
Encrypted:	false
SSDEEP:	3072:W00SJMe7BTXN5uaP4ynbyH0OVjG2++yJ/gvZDlGn/UpHnTRB5NlIL1AcyolLd0MN:rJMe7pNouR+dVDloUzwy+HN
MD5:	FCA29C205E46CB5993CF6E14E29274D7
SHA1:	46FDC8C732BE34EF6F2B2CA589A8FB7F365B7F9E
SHA-256:	80838302E2BF9BF603F5076EF542D99C88B6CA46785178886E1B8D9E8D101EFB
SHA-512:	45CDAA35C8947DE03AE63FAC02A6676031F1EEA8A90BA32130BD1DEF0B8017CD52800DF0B0C6CCA1320DF19B615E8DFF98143B99CBEA99153ABFA27549315719
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 29%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................r....r...l...............&......................r.....r.............r......Rich...........................PE..L.....6N...........!.........0......^................................................q...............................6.......#.......p..................0!.......!..................................8...@...............p............................text...N~.......................... ..`.rdata..U...........................@..@.data...\)...@.......@..............@....rsrc........p.......P..............@..@.reloc...:.......@...`..............@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSID25A.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	246064
Entropy (8bit):	6.281194577710972
Encrypted:	false
SSDEEP:	3072:W00SJMe7BTXN5uaP4ynbyH0OVjG2++yJ/gvZDlGn/UpHnTRB5NlIL1AcyolLd0MN:rJMe7pNouR+dVDloUzwy+HN
MD5:	FCA29C205E46CB5993CF6E14E29274D7
SHA1:	46FDC8C732BE34EF6F2B2CA589A8FB7F365B7F9E
SHA-256:	80838302E2BF9BF603F5076EF542D99C88B6CA46785178886E1B8D9E8D101EFB
SHA-512:	45CDAA35C8947DE03AE63FAC02A6676031F1EEA8A90BA32130BD1DEF0B8017CD52800DF0B0C6CCA1320DF19B615E8DFF98143B99CBEA99153ABFA27549315719
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 29%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................r....r...l...............&......................r.....r.............r......Rich...........................PE..L.....6N...........!.........0......^................................................q...............................6.......#.......p..................0!.......!..................................8...@...............p............................text...N~.......................... ..`.rdata..U...........................@..@.data...\)...@.......@..............@....rsrc........p.......P..............@..@.reloc...:.......@...`..............@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSID2C8.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	246064
Entropy (8bit):	6.281194577710972
Encrypted:	false
SSDEEP:	3072:W00SJMe7BTXN5uaP4ynbyH0OVjG2++yJ/gvZDlGn/UpHnTRB5NlIL1AcyolLd0MN:rJMe7pNouR+dVDloUzwy+HN
MD5:	FCA29C205E46CB5993CF6E14E29274D7
SHA1:	46FDC8C732BE34EF6F2B2CA589A8FB7F365B7F9E
SHA-256:	80838302E2BF9BF603F5076EF542D99C88B6CA46785178886E1B8D9E8D101EFB
SHA-512:	45CDAA35C8947DE03AE63FAC02A6676031F1EEA8A90BA32130BD1DEF0B8017CD52800DF0B0C6CCA1320DF19B615E8DFF98143B99CBEA99153ABFA27549315719
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 29%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................r....r...l...............&......................r.....r.............r......Rich...........................PE..L.....6N...........!.........0......^................................................q...............................6.......#.......p..................0!.......!..................................8...@...............p............................text...N~.......................... ..`.rdata..U...........................@..@.data...\)...@.......@..............@....rsrc........p.......P..............@..@.reloc...:.......@...`..............@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIDA99.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	58312
Entropy (8bit):	4.7831488349783555
Encrypted:	false
SSDEEP:	768:+0J8+QCTqaxxKkUmFVSarTJym3OZESrcyFKfQLHVM:cCTqYttXDJT+lcfQG
MD5:	74578BF21C4CE56DBB2FBD7616895637
SHA1:	1D6A43E6D47DA777ABE5AA72F39F5C396D7E37E5
SHA-256:	C9CFE837EBA6960CE065653E45FDBB6FE3FD0BBBB0787E29B1881C03A3FCFB56
SHA-512:	F6219335B266C6D78628CA11B7A4C49FDF6C7F1261332B2B4A8ABAC49BE59CC5C6180CAA8CDDB32602C55F546C8CCA3EE7C41AB72859CB07FF9C5BE6E11720AA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........$.C{J.C{J.C{J.,dA.E{J..gD.V{J.,d@.x{J..XS.D{J.C{K..{J.EXA.A{J..}L.B{J..[N.B{J.RichC{J.........................PE..L...z.&F...........!.....`...p...............p.....................................................................p}..a...0w..P....................................................................................p..D............................text....U.......`.................. ..`.rdata.......p.......p..............@..@.data....3.......0..................@....rsrc...............................@..@.reloc..p...........................@..B........................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIE99E.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	58312
Entropy (8bit):	4.7831488349783555
Encrypted:	false
SSDEEP:	768:+0J8+QCTqaxxKkUmFVSarTJym3OZESrcyFKfQLHVM:cCTqYttXDJT+lcfQG
MD5:	74578BF21C4CE56DBB2FBD7616895637
SHA1:	1D6A43E6D47DA777ABE5AA72F39F5C396D7E37E5
SHA-256:	C9CFE837EBA6960CE065653E45FDBB6FE3FD0BBBB0787E29B1881C03A3FCFB56
SHA-512:	F6219335B266C6D78628CA11B7A4C49FDF6C7F1261332B2B4A8ABAC49BE59CC5C6180CAA8CDDB32602C55F546C8CCA3EE7C41AB72859CB07FF9C5BE6E11720AA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........$.C{J.C{J.C{J.,dA.E{J..gD.V{J.,d@.x{J..XS.D{J.C{K..{J.EXA.A{J..}L.B{J..[N.B{J.RichC{J.........................PE..L...z.&F...........!.....`...p...............p.....................................................................p}..a...0w..P....................................................................................p..D............................text....U.......`.................. ..`.rdata.......p.......p..............@..@.data....3.......0..................@....rsrc...............................@..@.reloc..p...........................@..B........................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIEAC8.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	99272
Entropy (8bit):	5.488745177846843
Encrypted:	false
SSDEEP:	1536:rVgNTb67hb2MwFTKySgE6bSKycjyc/jVl0TF84G:2b67hvw++SKycjyc/jVlwGd
MD5:	933C5C5D2E46A10AD94AA35F90C8EF01
SHA1:	6CD9F9353A3FABBBC6938AFC1B67285B699F5972
SHA-256:	8E37E9EDE55B240E4E48421A490994665B58AA5E626C6F3E4EE2DA335133CFFA
SHA-512:	2E0DAC354B296682A9A31270584B6B2214664EDB4EB308BB85C9D7F785F08269A1006CAA49ECAE6B0789F71DC9378C29319517B22C0CAF8DFC4D40156960CB40
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............zk..zk..zk..fe..zk..ea..zk..e`..zk.IYw..zk..XN..zk.iYr..zk..zj..zk..Y`..zk.T\|m..zk.lZo..zk.Rich.zk.................PE..L.....&F...........!................3d...............................................U..............................0................`...............p.......p.......................................................................................text...f........................... ..`.rdata........... ..................@..@.data....R.......@..................@....rsrc........`.......@..............@..@.reloc..t....p... ...P..............@..B................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIEB08.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	233776
Entropy (8bit):	6.169795023583973
Encrypted:	false
SSDEEP:	3072:0w8rUeLOfh6XNExDvUFi9/ezgDph4Qkos/zbcmffmgPMxoIHHl3aU9QsE5:UUeLqhcQDvU4Hko63f4Bad
MD5:	F6BDC7AB21589CF4D87FE72CB82305D1
SHA1:	24C4B68B09C443B70A473EBE6C277F90F4EDB22E
SHA-256:	8472CD6362C2930383EDD6519FE1E024C49BE6921E4B7935AE37F8FBDEFA9AE0
SHA-512:	28F6BC43E014249B582BA7F17A039618138EF3C9DDFAFEEFE405054469FC34EFE55480F59F3B7AB2080E704F423DF6F96B246A6582C024084AC3AB0DE8A156BA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 21%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......$bZ.`.4.`.4.`.4.s.].a.4...;.x.4...k...4...k.a.4. -.d.4. (.a.4.s.i.b.4...i.o.4.`.5..4...T.P.4...h.a.4..j.a.4...n.a.4.Rich`.4.................PE..L.....UN...........!.....P... ......:........`.......................................................................................0...............p..0!...@... ......................................@............`..d............................text...^O.......P.................. ..`.rdata.......`.......`..............@..@.data....)....... ..................@....rsrc........0....... ..............@..@.reloc...8...@...@...0..............@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIEB47.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	30298
Entropy (8bit):	5.625012194082524
Encrypted:	false
SSDEEP:	384:lZtwkR3FGG1TqEhVqvVpphmslBJrBQ2lH9RTcOXgWjkg6f3Ug8xqfSpNeLNek+v2:lQnvxBJyjOXTB6f3Ug8xqfSlK
MD5:	5FD8B9662BBCFE473D2F682CA0AE91DC
SHA1:	E7231710A7FCBC5758B0C2F911D75F19DC0CAD7F
SHA-256:	63C93E735011E9680F287B9EBD5632EFE8F1AB262BF60C472C1AEFF1160B99D1
SHA-512:	586AFBEFACE2F07747E586E6010C3CFB831C025EF32C3680DCAD379FF0CF437B4C48B56732825F271467F34620380FF3AD96ACF3716D2A13431FDA4641617D5C
Malicious:	false
Preview:	...@IXOS.@.....@S=.X.@.....@.....@.....@.....@.....@......&.{A7BC02AF-1128-4A31-BCF8-1A3EE803D3B3}).SweetIM Toolbar for Internet Explorer 4.2..SweetIESetup.msi.@.....@.....@.....@......ARPPRODUCTICON.exe..&.{F44840C4-6708-42BA-807E-138D61C83EB9}.....@.....@.....@.....@.......@.....@.....@.......@....).SweetIM Toolbar for Internet Explorer 4.2......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration...@.....@.....@.]....&.{B655F7E9-422F-408D-9DA6-690F6F437498}I.C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\blue\.@.......@.....@.....@......&.{097CDE68-E405-4381-BD2C-C0A94023F82D}J.C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\green\.@.......@.....@.....@......&.{DF3F12EC-2B75-4144-8208-FE511A561A65}K.C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\orange\.@.......@.....@.....@......&.{6B8676E2-D239-4211-830F-745CD4816053}

C:\Windows\Installer\MSIEF30.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	201008
Entropy (8bit):	6.1930426458245185
Encrypted:	false
SSDEEP:	3072:v1G4ucDmX5/S3asI82eIiWqdcTHlpftQtLI+mdJhP4qgTbvV4rIjLUn8JK0LIgli:EEDSY7JBuOZIAqgvvVPcpE0we
MD5:	CFFA8284DF3F949D26AEBC2F24407DAE
SHA1:	9A5456FE0C238E7F76BE4E4A96AAC0B2B389FBB9
SHA-256:	7804FD3B7BCA4BF1DB85B98EA9CE831CC83D526FB96DDA2BF23C509556733056
SHA-512:	7FE5008CA6D2DFF7CAFE51D422704D668AED871D120891A3A3D1138CB0B8D846A7C4C3C05ADAC6043CF55EA7F4844EA17D9946F306EAABC59076E5F2665CC8B3
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 24%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......).&nm{H=m{H=m{H=~s!=l{H=.lG=z{H=.l.=.{H=.s.=l{H=.XQ=i{H=.XT=l{H=~s.=o{H=.s.=f{H=m{I=.{H=.l(=I{H=.l.=l{H=.p.=l{H=.l.=l{H=Richm{H=........................PE..L....P{N...........!................r^.................................................................................................. ...............0!...........................................f..@............................................text............................... ..`.rdata..............................@..@.data....(..........................@....rsrc... ...........................@..@.reloc...).......0..................@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIF7EB.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	233776
Entropy (8bit):	6.169795023583973
Encrypted:	false
SSDEEP:	3072:0w8rUeLOfh6XNExDvUFi9/ezgDph4Qkos/zbcmffmgPMxoIHHl3aU9QsE5:UUeLqhcQDvU4Hko63f4Bad
MD5:	F6BDC7AB21589CF4D87FE72CB82305D1
SHA1:	24C4B68B09C443B70A473EBE6C277F90F4EDB22E
SHA-256:	8472CD6362C2930383EDD6519FE1E024C49BE6921E4B7935AE37F8FBDEFA9AE0
SHA-512:	28F6BC43E014249B582BA7F17A039618138EF3C9DDFAFEEFE405054469FC34EFE55480F59F3B7AB2080E704F423DF6F96B246A6582C024084AC3AB0DE8A156BA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 21%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......$bZ.`.4.`.4.`.4.s.].a.4...;.x.4...k...4...k.a.4. -.d.4. (.a.4.s.i.b.4...i.o.4.`.5..4...T.P.4...h.a.4..j.a.4...n.a.4.Rich`.4.................PE..L.....UN...........!.....P... ......:........`.......................................................................................0...............p..0!...@... ......................................@............`..d............................text...^O.......P.................. ..`.rdata.......`.......`..............@..@.data....)....... ..................@....rsrc........0....... ..............@..@.reloc...8...@...@...0..............@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIF889.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	233776
Entropy (8bit):	6.169795023583973
Encrypted:	false
SSDEEP:	3072:0w8rUeLOfh6XNExDvUFi9/ezgDph4Qkos/zbcmffmgPMxoIHHl3aU9QsE5:UUeLqhcQDvU4Hko63f4Bad
MD5:	F6BDC7AB21589CF4D87FE72CB82305D1
SHA1:	24C4B68B09C443B70A473EBE6C277F90F4EDB22E
SHA-256:	8472CD6362C2930383EDD6519FE1E024C49BE6921E4B7935AE37F8FBDEFA9AE0
SHA-512:	28F6BC43E014249B582BA7F17A039618138EF3C9DDFAFEEFE405054469FC34EFE55480F59F3B7AB2080E704F423DF6F96B246A6582C024084AC3AB0DE8A156BA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 21%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......$bZ.`.4.`.4.`.4.s.].a.4...;.x.4...k...4...k.a.4. -.d.4. (.a.4.s.i.b.4...i.o.4.`.5..4...T.P.4...h.a.4..j.a.4...n.a.4.Rich`.4.................PE..L.....UN...........!.....P... ......:........`.......................................................................................0...............p..0!...@... ......................................@............`..d............................text...^O.......P.................. ..`.rdata.......`.......`..............@..@.data....)....... ..................@....rsrc........0....... ..............@..@.reloc...8...@...@...0..............@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIF8B9.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	58312
Entropy (8bit):	4.7831488349783555
Encrypted:	false
SSDEEP:	768:+0J8+QCTqaxxKkUmFVSarTJym3OZESrcyFKfQLHVM:cCTqYttXDJT+lcfQG
MD5:	74578BF21C4CE56DBB2FBD7616895637
SHA1:	1D6A43E6D47DA777ABE5AA72F39F5C396D7E37E5
SHA-256:	C9CFE837EBA6960CE065653E45FDBB6FE3FD0BBBB0787E29B1881C03A3FCFB56
SHA-512:	F6219335B266C6D78628CA11B7A4C49FDF6C7F1261332B2B4A8ABAC49BE59CC5C6180CAA8CDDB32602C55F546C8CCA3EE7C41AB72859CB07FF9C5BE6E11720AA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........$.C{J.C{J.C{J.,dA.E{J..gD.V{J.,d@.x{J..XS.D{J.C{K..{J.EXA.A{J..}L.B{J..[N.B{J.RichC{J.........................PE..L...z.&F...........!.....`...p...............p.....................................................................p}..a...0w..P....................................................................................p..D............................text....U.......`.................. ..`.rdata.......p.......p..............@..@.data....3.......0..................@....rsrc...............................@..@.reloc..p...........................@..B........................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\SourceHash{A7BC02AF-1128-4A31-BCF8-1A3EE803D3B3}

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.1644059801621958
Encrypted:	false
SSDEEP:	12:JSbX72FjXGtiAGiLIlHVRpLh/7777777777777777777777777vDHFoezj0l0i8Q:J9FQI5P2e1F
MD5:	18D68601FBB145D4B78613D951C3DD4B
SHA1:	3554CECEC2B8EDFFDA65214F8FB2E30CA16E0369
SHA-256:	95A1435FF03EB1BCCF282C4A0FD3C98517310087C5B5B2D04CBAFF537DD249B9
SHA-512:	BF424B1F097F8532EE91B2FEDD5F3328C69D1A4789D8AE791864F5B125302E2210D0A24BAC67362A623695221D27712A8A0C8FE7B09734990583C10EA6F65B26
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\SourceHash{A81A974F-8A22-43E6-9243-5198FF758DA1}

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.1639980503074234
Encrypted:	false
SSDEEP:	12:JSbX72FjTiAGiLIlHVRpLh/7777777777777777777777777vDHFULNC0l0i8Q:JQQI5Pap8F
MD5:	78DE45E7392A54614E92811908D81A27
SHA1:	24223C3DBDB3427D760E48B8D02134E71357DE74
SHA-256:	2EB85C5E9487222659921DE6D73C5094E704F7C96C8AC564E2426A2B182F122E
SHA-512:	C97574834E99E542B62C138F6109B91FA0A545F760221C40AAEACA2C831F30050B2C9E652F1938F24156662FD39C0CF700C50469C76FFB9402E9AA2B378162F0
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\inprogressinstallinfo.ipi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	2.0061362320835836
Encrypted:	false
SSDEEP:	192:d11u/f8u7qZYiaAZD9sHQRw8u7qZYiaAZD:3s38u7qZYiaAZDeHQm8u7qZYiaAZD
MD5:	E9280A773879541ED91A0C84FE619340
SHA1:	B3B6C1ACE98803B4DB1FC16BED797AA57C3B4E87
SHA-256:	D153A61EA9016FF4470BEB3BE3A9CCA9FC4E39752338C56661F70BED524DF710
SHA-512:	CC96455155956017AA825418C91CB4452546CD16A599AE899534B663803F488F2552540B1A1AE2229913658C063FAB29C4FC11CFCBC7CB592E1DE161EEF14B51
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\{A7BC02AF-1128-4A31-BCF8-1A3EE803D3B3}\ARPPRODUCTICON.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows icon resource - 6 icons, 16x16, 16 colors, 16x16
Category:	dropped
Size (bytes):	10134
Entropy (8bit):	4.2562024905008
Encrypted:	false
SSDEEP:	96:SYONfeZEWVArvU3mONfeZEWV4+xF9p0ONfeZEWVblMb6UjjDhPm2TBnDifnZPmS:KNeTL3TNeT4+vDFNeTb6bVPmSB2nZPmS
MD5:	6E42CF0D47AF25DEA4CECDBE093D521C
SHA1:	EC3E157D289629AB3C391800E7D8774E0F3A2EC0
SHA-256:	7E1F9048D457369E50EE2CCC3659C897A740ECF722036858C88390115E5612A1
SHA-512:	11846707CF38EE1D08563263DF52A500400623918ED80772824CCEA23C20554460AC7F63A5EFF5BC76EEE7FEF0CD7508D4B5C3DA6EEEE7113662EE605A8BE8A8
Malicious:	false
Preview:	..............(...f...........h....... .............. ..............00..............00......h....!..(....... ...................................................................................................p.............w.......x.......x.......{...............}..w..p.wwww....x...p.wxr""/p...r""/p..wr""/p...r."/p...r...p.......p................................................................(....... ...........@...................................................................................""".))).UUU.MMM.BBB.999..\|...PP.....................3...f............3..33..f3...3...3...3...f..3f..ff...f...f...f......3...f..................3...f...............f.............3.3.3.f.3...3...3...3..33.333.f33..33..33..33..f3.3f3.ff3..f3..f3..f3...3.3.3.f.3...3..3...3...3.3.3.f.3...3...3...3.3.3.f.3...3...3...3...f.3.f.f.f...f...f...f..3f.33f.f3f..3f..3f..3f..ff.3ff.fff..ff..ff...f.3.f.f.f...f..f...f...f.3.f...f...f...f...f.3.f...f...f..............3..............33..f....3.......f..3f..f3

C:\Windows\Installer\{A81A974F-8A22-43E6-9243-5198FF758DA1}\ARPPRODUCTICON.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows icon resource - 6 icons, 16x16, 16 colors, 16x16
Category:	dropped
Size (bytes):	10134
Entropy (8bit):	4.2562024905008
Encrypted:	false
SSDEEP:	96:SYONfeZEWVArvU3mONfeZEWV4+xF9p0ONfeZEWVblMb6UjjDhPm2TBnDifnZPmS:KNeTL3TNeT4+vDFNeTb6bVPmSB2nZPmS
MD5:	6E42CF0D47AF25DEA4CECDBE093D521C
SHA1:	EC3E157D289629AB3C391800E7D8774E0F3A2EC0
SHA-256:	7E1F9048D457369E50EE2CCC3659C897A740ECF722036858C88390115E5612A1
SHA-512:	11846707CF38EE1D08563263DF52A500400623918ED80772824CCEA23C20554460AC7F63A5EFF5BC76EEE7FEF0CD7508D4B5C3DA6EEEE7113662EE605A8BE8A8
Malicious:	false
Preview:	..............(...f...........h....... .............. ..............00..............00......h....!..(....... ...................................................................................................p.............w.......x.......x.......{...............}..w..p.wwww....x...p.wxr""/p...r""/p..wr""/p...r."/p...r...p.......p................................................................(....... ...........@...................................................................................""".))).UUU.MMM.BBB.999..\|...PP.....................3...f............3..33..f3...3...3...3...f..3f..ff...f...f...f......3...f..................3...f...............f.............3.3.3.f.3...3...3...3..33.333.f33..33..33..33..f3.3f3.ff3..f3..f3..f3...3.3.3.f.3...3..3...3...3.3.3.f.3...3...3...3.3.3.f.3...3...3...3...f.3.f.f.f...f...f...f..3f.33f.f3f..3f..3f..3f..ff.3ff.fff..ff..ff...f.3.f.f.f...f..f...f...f.3.f...f...f...f...f.3.f...f...f..............3..............33..f....3.......f..3f..f3

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	432221
Entropy (8bit):	5.375184529996458
Encrypted:	false
SSDEEP:	1536:6qELG7gK+RaOOp3LCCpfmLgYI66xgFF9Sq8K6MAS2OMUHl6Gin327D22A26KgauJ:zTtbmkExhMJCIpEr8
MD5:	2F523A4B1010AEEB69E095F803C5460C
SHA1:	4B348E81BEE7E35C9EE535CBF58B4E8C4C3078EB
SHA-256:	4C43C562E0DFA6983AD1FA688518E229D18BCA7CDAFD1B7115E9D03B39C212F7
SHA-512:	DF504C47E6DAA67D7934AA54BA4C4A7879C09DDCEE6F6A9D50D2136B86B2DD865B0CB25A0151020E013CDF0ED392A8181B24FD66D614136B60B555A86F4E1581
Malicious:	false
Preview:	.To learn about increasing the verbosity of the NGen log files please see http://go.microsoft.com/fwlink/?linkid=210113..12/07/2019 14:54:22.458 [5488]: Command line: D:\wd\compilerTemp\BMT.200yuild.1bk\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe executeQueuedItems /nologo ..12/07/2019 14:54:22.473 [5488]: Executing command from offline queue: install "System.Runtime.WindowsRuntime.UI.Xaml, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=msil" /NoDependencies /queue:1..12/07/2019 14:54:22.490 [5488]: Executing command from offline queue: install "System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:3..12/07/2019 14:54:22.490 [5488]: Exclusion list entry found for System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil; it will not be installed..12/07/2019 14:54:22.490 [

C:\Windows\Temp\~DF0486B6564C428557.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF0CB2B9BFA34C1891.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	77824
Entropy (8bit):	0.36376725740287763
Encrypted:	false
SSDEEP:	96:5OvzwEvPtEvvEvCEvLZEvbiEvjEvBZEv6r9yfEvPtEvvEvCEvLZEvbiEvjEvBZE4:Qw8u7qZYiaAZDgf8u7qZYiaAZD9sHQ
MD5:	180385EC87E1FCEFF7F9E9B9DF11A0CD
SHA1:	ADC58EAA95261DD56B45B52D4F3365C345899DD6
SHA-256:	6E39C26DBD501E1F26BCA3F14B1F9806DF70FD2068DA49FBA148FD473CBD0977
SHA-512:	9642FB4764EEA904016E66B06BDFEA39F55190E3FA85C8E0799964BCE4E2CCD62960F5A55407CBB2392AE4AAE3509EFAF32ACF62883FC6F7D6E4D13591018E3A
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF156062E8B17B3187.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	2.0061362320835836
Encrypted:	false
SSDEEP:	192:d11u/f8u7qZYiaAZD9sHQRw8u7qZYiaAZD:3s38u7qZYiaAZDeHQm8u7qZYiaAZD
MD5:	E9280A773879541ED91A0C84FE619340
SHA1:	B3B6C1ACE98803B4DB1FC16BED797AA57C3B4E87
SHA-256:	D153A61EA9016FF4470BEB3BE3A9CCA9FC4E39752338C56661F70BED524DF710
SHA-512:	CC96455155956017AA825418C91CB4452546CD16A599AE899534B663803F488F2552540B1A1AE2229913658C063FAB29C4FC11CFCBC7CB592E1DE161EEF14B51
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF18A255B0555078FA.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	1.3063463592075726
Encrypted:	false
SSDEEP:	192:hNnyCWf8u7qZYiaAZD9sHQRw8u7qZYiaAZD:PyL8u7qZYiaAZDeHQm8u7qZYiaAZD
MD5:	3DE995A003D823925360304C41B8E834
SHA1:	FCE1CB5C6F2FE4B00834378276768479437109E6
SHA-256:	864D525E37FFEC15526A4FD3694A31CCF5D3D919CC37058CB4B6BC1CA5D1CBA0
SHA-512:	4B3384B918BB7AC8F672304194A72A1A9FC824D5B3572047A747A45CD18350C4C79301DA43209EA84916E7E052E26C1625D3BB13E8F4CD34A03FE9DE6D8A262C
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF18C94625F3BFE7BF.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	2.0061362320835836
Encrypted:	false
SSDEEP:	192:d11u/f8u7qZYiaAZD9sHQRw8u7qZYiaAZD:3s38u7qZYiaAZDeHQm8u7qZYiaAZD
MD5:	E9280A773879541ED91A0C84FE619340
SHA1:	B3B6C1ACE98803B4DB1FC16BED797AA57C3B4E87
SHA-256:	D153A61EA9016FF4470BEB3BE3A9CCA9FC4E39752338C56661F70BED524DF710
SHA-512:	CC96455155956017AA825418C91CB4452546CD16A599AE899534B663803F488F2552540B1A1AE2229913658C063FAB29C4FC11CFCBC7CB592E1DE161EEF14B51
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF2C894160688ACFD6.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF3E072735BEB630CC.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF4732600F074D96F8.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	1.3063463592075726
Encrypted:	false
SSDEEP:	192:hNnyCWf8u7qZYiaAZD9sHQRw8u7qZYiaAZD:PyL8u7qZYiaAZDeHQm8u7qZYiaAZD
MD5:	3DE995A003D823925360304C41B8E834
SHA1:	FCE1CB5C6F2FE4B00834378276768479437109E6
SHA-256:	864D525E37FFEC15526A4FD3694A31CCF5D3D919CC37058CB4B6BC1CA5D1CBA0
SHA-512:	4B3384B918BB7AC8F672304194A72A1A9FC824D5B3572047A747A45CD18350C4C79301DA43209EA84916E7E052E26C1625D3BB13E8F4CD34A03FE9DE6D8A262C
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF49C6054126F945A2.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	2.2618596421990733
Encrypted:	false
SSDEEP:	384:isVuVUqjwM/MTAKaB7FauVUqjwM/MTAKaB7F:p
MD5:	9DD76764744E2FC7CBDF5B45A87DE54B
SHA1:	9728F9FA37F85C808A5F177242433315E080A053
SHA-256:	7BC966F36A86D821559D2D574EBF522513CAEEB955D2B4FCBC50D7429398396F
SHA-512:	D0F3CA5CDAED8CC63255D9C57DA0474D63E22B906B419AEA99ED28FE5A99248FED279B6CE5690F27615742D208505B6851C219EFB95C40894BDDFF442DBD5E23
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF4C6E2272381D7C79.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.07200658585211478
Encrypted:	false
SSDEEP:	6:2/9LG7iVCnLG7iVrKOzPLHKO2mMvPLNIIVky6l0:2F0i8n0itFzDHFULNC0
MD5:	E058B0D2A8CA6F00251D4E5E3E8885A2
SHA1:	91E20D6F3E4A869C9CB2A0922DEBE96AE0BC5898
SHA-256:	15381DCAFC265F363139E36A6FA47012B993DBEC5B1195F401218C4AFC3994F0
SHA-512:	595E0F61F1D04D9256D140F0070B8A0AC0170DAB8A05757DFF068C509771232E547EBDFB37AF0076FE8D76B8905D2B9F1CBA886E3C8F923907F48E73E21625DC
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF51BC1956B5B4E8A2.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF5A01DA33A49A5122.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	77824
Entropy (8bit):	0.476814122179118
Encrypted:	false
SSDEEP:	384:fuVUqjwM/MTAKaB7FIuVUqjwM/MTAKaB7F:
MD5:	F3F1E437095DF641C995A2CED9CE3740
SHA1:	6CBE80477BAF229FE8B8ADF44B8C5923265B1F8F
SHA-256:	54D5328DA5AF25DE8475EE142B6E2B7152FAC58B37609CB9428A5BAA0E9C2637
SHA-512:	5B9D97593855E21790E038D29BE512336120EF0DC7DCFA625E8E0B66E2307BBBFDCDB38FDD300CAD7B128E7B12734DBC2E1B9A94E149E371CEC8572479D19371
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF640351C7F7BF9449.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF711D6A39390B10B2.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	1.465958692603223
Encrypted:	false
SSDEEP:	384:egWuVUqjwM/MTAKaB7FauVUqjwM/MTAKaB7F:l
MD5:	024EDEA9EE388821BD3107A08B2845A6
SHA1:	E950EEBF7EC4C6C0D156C401BD6FE2039A2EE2C5
SHA-256:	0A7EE6A3B7E07179BA9B2792009AB6F3713F89AD0FA33A8DEFAA311A5D12DEFF
SHA-512:	1E5D3889FDA947C2DB9AD939C78EFE5073603FF26609B0CBE98584003247F6A907BDAD19001F0C600672891EE00F440328E668F83828054DA53612ACADB4407C
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF7D3C989CC3B9FA1D.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	2.2618596421990733
Encrypted:	false
SSDEEP:	384:isVuVUqjwM/MTAKaB7FauVUqjwM/MTAKaB7F:p
MD5:	9DD76764744E2FC7CBDF5B45A87DE54B
SHA1:	9728F9FA37F85C808A5F177242433315E080A053
SHA-256:	7BC966F36A86D821559D2D574EBF522513CAEEB955D2B4FCBC50D7429398396F
SHA-512:	D0F3CA5CDAED8CC63255D9C57DA0474D63E22B906B419AEA99ED28FE5A99248FED279B6CE5690F27615742D208505B6851C219EFB95C40894BDDFF442DBD5E23
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF93530EFD6DC92E44.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF97765F105CE2414E.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF99F23AAD8322553B.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFADA5252E3B9AC5D6.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFB9CBBCCCF68D20DA.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	1.465958692603223
Encrypted:	false
SSDEEP:	384:egWuVUqjwM/MTAKaB7FauVUqjwM/MTAKaB7F:l
MD5:	024EDEA9EE388821BD3107A08B2845A6
SHA1:	E950EEBF7EC4C6C0D156C401BD6FE2039A2EE2C5
SHA-256:	0A7EE6A3B7E07179BA9B2792009AB6F3713F89AD0FA33A8DEFAA311A5D12DEFF
SHA-512:	1E5D3889FDA947C2DB9AD939C78EFE5073603FF26609B0CBE98584003247F6A907BDAD19001F0C600672891EE00F440328E668F83828054DA53612ACADB4407C
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFC6CB5AEB631975AD.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.0718558715573339
Encrypted:	false
SSDEEP:	6:2/9LG7iVCnLG7iVrKOzPLHKO78c5zGGIVky6l0:2F0i8n0itFzDHFoezj0
MD5:	E9E7CE9DC56F17BF121CD917960A02FA
SHA1:	128EC8883A499168AB98ECCF04208C8E566866EF
SHA-256:	443C19F8EE3935AFA2DE265999DB1EC8B3FE2738977700AEDD67A072920C8A6A
SHA-512:	8C39046FAFF6D750DFEC031E5A7697CC59FD8736E1453F20ADD8A01818176378D29BA857B050F20CD953B116D5A34839AA9DA342B63EFC4A0580D5FEB90E4983
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFEED463D2EA7F8B4E.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFF09C0502AD263EAC.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	1.3063463592075726
Encrypted:	false
SSDEEP:	192:hNnyCWf8u7qZYiaAZD9sHQRw8u7qZYiaAZD:PyL8u7qZYiaAZDeHQm8u7qZYiaAZD
MD5:	3DE995A003D823925360304C41B8E834
SHA1:	FCE1CB5C6F2FE4B00834378276768479437109E6
SHA-256:	864D525E37FFEC15526A4FD3694A31CCF5D3D919CC37058CB4B6BC1CA5D1CBA0
SHA-512:	4B3384B918BB7AC8F672304194A72A1A9FC824D5B3572047A747A45CD18350C4C79301DA43209EA84916E7E052E26C1625D3BB13E8F4CD34A03FE9DE6D8A262C
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFF654A44FD6B398BE.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	1.465958692603223
Encrypted:	false
SSDEEP:	384:egWuVUqjwM/MTAKaB7FauVUqjwM/MTAKaB7F:l
MD5:	024EDEA9EE388821BD3107A08B2845A6
SHA1:	E950EEBF7EC4C6C0D156C401BD6FE2039A2EE2C5
SHA-256:	0A7EE6A3B7E07179BA9B2792009AB6F3713F89AD0FA33A8DEFAA311A5D12DEFF
SHA-512:	1E5D3889FDA947C2DB9AD939C78EFE5073603FF26609B0CBE98584003247F6A907BDAD19001F0C600672891EE00F440328E668F83828054DA53612ACADB4407C
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 786

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 130 x 40, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2505
Entropy (8bit):	7.595901850281693
Encrypted:	false
SSDEEP:	48:LqQNn2qhSJ3dqamQagNDp1CJ6T5oE6OFd65lQvhTSE0Z59iZpnz:WY2nqtGCglZF4zmTe5Ezz
MD5:	B254739743874926F3F110BA7EB9C37F
SHA1:	A322076E4CE0300AC9D41C4C608ECB26908EEF8A
SHA-256:	274FEA98A067F69E204AEFC8FD252DCAEC7AEDCC1A841C83CF5E589EACE70D36
SHA-512:	912F400602D42CEA495CA1EFBE6932C13BC1DCC8B4F67AF544D254AD5BA778102238B19EF601651ABD18F584578526EC6418DF6625B1DB06B30346A4D4E601B2
Malicious:	false
Preview:	.PNG........IHDR.......(.....2."u....tEXtSoftware.Adobe ImageReadyq.e<...$iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Macintosh)" xmpMM:InstanceID="xmp.iid:792C9E91FABD11E3B8E6D3F3F0625A70" xmpMM:DocumentID="xmp.did:792C9E92FABD11E3B8E6D3F3F0625A70"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:792C9E8FFABD11E3B8E6D3F3F0625A70" stRef:documentID="xmp.did:792C9E90FABD11E3B8E6D3F3F0625A70"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>y..A...;IDATx..[mL[U.>.-.R...j:JKqF..e.C.X f&f.n:.....c.......)....D..8.5...fB...1..c...R....O.>oi....5..r.....

Chrome Cache Entry: 787

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 12 x 24, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1240
Entropy (8bit):	6.43589865588804
Encrypted:	false
SSDEEP:	24:Y1hnBWwh82lYSKwWnRvVVcT3JryJ3VeesA5Gkq5VjMLzO9Wxroz:W1kvnLHLy0J3sesA5WiLzOsxroz
MD5:	EA2C48BED74BB2EBDD5989FB057478E2
SHA1:	C3D6BA529488883F8ACBD67727ECB6812E2B8901
SHA-256:	44D6C86798E193A0A225D61B06F456283B227E55BE63CA2BD5D948D573659EDA
SHA-512:	F9CF16C6FF686D8747B3F48B00602CD3D1072C57B9B78CAA5CA4D27E8B9742E179D032F1217BB80E18FF32A2A3B13CBFE64912DBBB9A920E66F9E8E5844CC19F
Malicious:	false
Preview:	.PNG........IHDR..............2.j....tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.155772, 2014/01/13-19:44:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:d55c5136-5eda-42fa-8d02-0c9d28e1b7d6" xmpMM:DocumentID="xmp.did:A7B453D50F3A11E48DA496ABFC2A25A9" xmpMM:InstanceID="xmp.iid:A7B453D40F3A11E48DA496ABFC2A25A9" xmp:CreatorTool="Adobe Photoshop CC 2014 (Macintosh)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:6dfad076-991f-40d6-b4b9-7fccee9e854a" stRef:documentID="adobe:docid:photoshop:b974d9ae-5239-1177-a0b0-e4f30f33c004"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.K.&....IDATx.R...0

Chrome Cache Entry: 788

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 12 x 24, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1240
Entropy (8bit):	6.43589865588804
Encrypted:	false
SSDEEP:	24:Y1hnBWwh82lYSKwWnRvVVcT3JryJ3VeesA5Gkq5VjMLzO9Wxroz:W1kvnLHLy0J3sesA5WiLzOsxroz
MD5:	EA2C48BED74BB2EBDD5989FB057478E2
SHA1:	C3D6BA529488883F8ACBD67727ECB6812E2B8901
SHA-256:	44D6C86798E193A0A225D61B06F456283B227E55BE63CA2BD5D948D573659EDA
SHA-512:	F9CF16C6FF686D8747B3F48B00602CD3D1072C57B9B78CAA5CA4D27E8B9742E179D032F1217BB80E18FF32A2A3B13CBFE64912DBBB9A920E66F9E8E5844CC19F
Malicious:	false
URL:	https://storage2.stgbssint.com/Search/SearchApplication/Resources/Images/Search/closeSprite.png
Preview:	.PNG........IHDR..............2.j....tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.155772, 2014/01/13-19:44:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:d55c5136-5eda-42fa-8d02-0c9d28e1b7d6" xmpMM:DocumentID="xmp.did:A7B453D50F3A11E48DA496ABFC2A25A9" xmpMM:InstanceID="xmp.iid:A7B453D40F3A11E48DA496ABFC2A25A9" xmp:CreatorTool="Adobe Photoshop CC 2014 (Macintosh)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:6dfad076-991f-40d6-b4b9-7fccee9e854a" stRef:documentID="adobe:docid:photoshop:b974d9ae-5239-1177-a0b0-e4f30f33c004"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.K.&....IDATx.R...0

Chrome Cache Entry: 789

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 130 x 40, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	2505
Entropy (8bit):	7.595901850281693
Encrypted:	false
SSDEEP:	48:LqQNn2qhSJ3dqamQagNDp1CJ6T5oE6OFd65lQvhTSE0Z59iZpnz:WY2nqtGCglZF4zmTe5Ezz
MD5:	B254739743874926F3F110BA7EB9C37F
SHA1:	A322076E4CE0300AC9D41C4C608ECB26908EEF8A
SHA-256:	274FEA98A067F69E204AEFC8FD252DCAEC7AEDCC1A841C83CF5E589EACE70D36
SHA-512:	912F400602D42CEA495CA1EFBE6932C13BC1DCC8B4F67AF544D254AD5BA778102238B19EF601651ABD18F584578526EC6418DF6625B1DB06B30346A4D4E601B2
Malicious:	false
URL:	https://storage2.stgbssint.com/Search/SearchApplication/Resources/SpyGlass130x40.png
Preview:	.PNG........IHDR.......(.....2."u....tEXtSoftware.Adobe ImageReadyq.e<...$iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Macintosh)" xmpMM:InstanceID="xmp.iid:792C9E91FABD11E3B8E6D3F3F0625A70" xmpMM:DocumentID="xmp.did:792C9E92FABD11E3B8E6D3F3F0625A70"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:792C9E8FFABD11E3B8E6D3F3F0625A70" stRef:documentID="xmp.did:792C9E90FABD11E3B8E6D3F3F0625A70"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>y..A...;IDATx..[mL[U.>.-.R...j:JKqF..e.C.X f&f.n:.....c.......)....D..8.5...fB...1..c...R....O.>oi....5..r.....

Chrome Cache Entry: 790

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.875
Encrypted:	false
SSDEEP:	3:HKALn:qAL
MD5:	C6CB4F21C7DCEB18C48B802BDE96868D
SHA1:	D44E74B07ED4E8267728C2BCDD16599E9110D05B
SHA-256:	B77A3071A80FC28A1E314D251064103CF265866101F7CDCCCF00B77C80484BD5
SHA-512:	8C65A0458DD4A8B93AEEA70A0CA67DB43B6E1C0DAAB17B7091449335532F3F5489E5B8A1617B42B99EE95B66CD8EF3E572F537121C9960743E100FE560F4C0F0
Malicious:	false
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISEAmkr4Nqu8iHsRIFDT0fUzw=?alt=proto
Preview:	CgkKBw09H1M8GgA=

Chrome Cache Entry: 791

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	1.8680762865405123
Encrypted:	false
SSDEEP:	6:RltpajwqRtl/lcLw5lXH1lI5WYlugl+yXkWn7WRljl3AXptdVeBaRs:RQjwkvlcLw5lXHvI5WI/MzjlMpteBaRs
MD5:	7209017BDEBB31C768CE2A9C5624FF4C
SHA1:	1E01ACC3A925B611B3EC010251712CCDBE033478
SHA-256:	1A07ECDD943CE77F701EAAD2D94510AB8C123FDD7124C1A44AA32F3E258222F0
SHA-512:	3A1BB0271F9B38EDEAFE9C14F0CF4EE937D54EB6E502B5D2B37B2218303ADA7340A21CAB3F053A13C77660F20A131AF497B483804CD645BC7BCD755F95E88636
Malicious:	false
Preview:	............ .h.......(....... ..... .....@...........................................................................................................................................................................................................................333.333.333.....................................................333.333.333.333.................................................333.333.333.333.333.................................................333.333.333.333:333n333.333.333g333.................................333.333A333.333.333Y333[333.333.333.................................333.333.............333.333.333.............................333.333.333.................333.333.............................333.333.333.................333.333.................................333.333Q................333e333.................................333E333.333[333.333.333d333.3338....................................333<333.333.333.333.3334..........................................................

Chrome Cache Entry: 792

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 343 x 105, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2767
Entropy (8bit):	7.583229396861441
Encrypted:	false
SSDEEP:	48:QitvnLUk0J3qYiY0lRYTOdrrNvdX8XLBMrXwIOZHDl6gJDQ/zymP71:DHvYeHdFvp8CrXPOZZnJE22J
MD5:	64F85BA4F1509E24C28DDC9E07DE67D7
SHA1:	A5B98CFB838A57566F29262A121A411C606309D1
SHA-256:	B6E35960862B8A7C2A38D8EDC5A47C977D36DFF572BBF9C0EC6E66DC0927BB77
SHA-512:	72E5F7DC036A5BBDAE0A6FFAD8B6A8877FCAAEEB0D575C5AEDF03A04D260560E4DC17D59F159B85D3727FCB34F2479FCE1A75C0C6B90709EEDDBD11C3993016E
Malicious:	false
Preview:	.PNG........IHDR...W...i......6`q....tEXtSoftware.Adobe ImageReadyq.e<...diTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:91C14195E9ADE011B2BAA20B13B906DB" xmpMM:DocumentID="xmp.did:1C651F5FAE3811E0BC3DBD4E3011D92B" xmpMM:InstanceID="xmp.iid:1C651F5EAE3811E0BC3DBD4E3011D92B" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:2D5E92D02DAEE011B2BAA20B13B906DB" stRef:documentID="xmp.did:91C14195E9ADE011B2BAA20B13B906DB"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..\.....IDATx....n....`R.=c...@......h...v.....$.d.d.

Chrome Cache Entry: 793

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	downloaded
Size (bytes):	1150
Entropy (8bit):	1.8680762865405123
Encrypted:	false
SSDEEP:	6:RltpajwqRtl/lcLw5lXH1lI5WYlugl+yXkWn7WRljl3AXptdVeBaRs:RQjwkvlcLw5lXHvI5WI/MzjlMpteBaRs
MD5:	7209017BDEBB31C768CE2A9C5624FF4C
SHA1:	1E01ACC3A925B611B3EC010251712CCDBE033478
SHA-256:	1A07ECDD943CE77F701EAAD2D94510AB8C123FDD7124C1A44AA32F3E258222F0
SHA-512:	3A1BB0271F9B38EDEAFE9C14F0CF4EE937D54EB6E502B5D2B37B2218303ADA7340A21CAB3F053A13C77660F20A131AF497B483804CD645BC7BCD755F95E88636
Malicious:	false
URL:	https://www.sweetim.com/favicon.ico
Preview:	............ .h.......(....... ..... .....@...........................................................................................................................................................................................................................333.333.333.....................................................333.333.333.333.................................................333.333.333.333.333.................................................333.333.333.333:333n333.333.333g333.................................333.333A333.333.333Y333[333.333.333.................................333.333.............333.333.333.............................333.333.333.................333.333.............................333.333.333.................333.333.................................333.333Q................333e333.................................333E333.333[333.333.333d333.3338....................................333<333.333.333.333.3334..........................................................

Chrome Cache Entry: 794

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 343 x 105, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	2767
Entropy (8bit):	7.583229396861441
Encrypted:	false
SSDEEP:	48:QitvnLUk0J3qYiY0lRYTOdrrNvdX8XLBMrXwIOZHDl6gJDQ/zymP71:DHvYeHdFvp8CrXPOZZnJE22J
MD5:	64F85BA4F1509E24C28DDC9E07DE67D7
SHA1:	A5B98CFB838A57566F29262A121A411C606309D1
SHA-256:	B6E35960862B8A7C2A38D8EDC5A47C977D36DFF572BBF9C0EC6E66DC0927BB77
SHA-512:	72E5F7DC036A5BBDAE0A6FFAD8B6A8877FCAAEEB0D575C5AEDF03A04D260560E4DC17D59F159B85D3727FCB34F2479FCE1A75C0C6B90709EEDDBD11C3993016E
Malicious:	false
URL:	https://se-p-static-content.seccint.com/search/images/homepage/button_bg.png
Preview:	.PNG........IHDR...W...i......6`q....tEXtSoftware.Adobe ImageReadyq.e<...diTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:91C14195E9ADE011B2BAA20B13B906DB" xmpMM:DocumentID="xmp.did:1C651F5FAE3811E0BC3DBD4E3011D92B" xmpMM:InstanceID="xmp.iid:1C651F5EAE3811E0BC3DBD4E3011D92B" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:2D5E92D02DAEE011B2BAA20B13B906DB" stRef:documentID="xmp.did:91C14195E9ADE011B2BAA20B13B906DB"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..\.....IDATx....n....`R.=c...@......h...v.....$.d.d.

Chrome Cache Entry: 795

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (13154)
Category:	downloaded
Size (bytes):	68050
Entropy (8bit):	4.667702493663889
Encrypted:	false
SSDEEP:	1536:TkWbx6DXVeE0fGimaLbST1NFNGwVG99lFNoA:TkWPLY1bNGwVG99lz
MD5:	8A55941B84E4FB2086FABED7A8AFB490
SHA1:	5AC0014FED010BE36A894029B7D1A20E2EBFA8E3
SHA-256:	C68C474690B6A5B91F4A705B73F361407640FEE35E57729CB6E90325DCC821F8
SHA-512:	E06E3ACA929BDAC84914D0438A313428E55873B64327F8F858EB2746C5A71735A9FF23F7F5B4525DDB65F2BDE44698B5502B7B0DF0B224013B52EC29EE0B8317
Malicious:	false
URL:	https://www.sweetim.com/installbar.asp?barid={C598706C-038F-11EF-8C2C-ECF4BBEA1588}
Preview:	<head>. <title>Search</title>. <style xmlns="http://www.w3.org/1999/html">. html{height:100%;min-width:700px;position:relative}body{font-family:Arial;padding:0;margin:0;background-color:#ffffff}body a img{border:none;outline:none !important}body .header{background-color:#3f5362;height:28px;border-bottom:1px solid #222e36;border-top:1px solid #222e36;position:relative;white-space:nowrap;z-index:999;width:100%}body .header.rtl .side1{float:right}body .header.rtl .side1 .categories_wrapper .header-item{float:right}body .header.rtl .side1 .categories_wrapper li #liMenu_wrapper #liMenu_inner_wrapper #liMore .dropdown-item-wrapper .dropdown-item{padding-left:26px;padding-right:8px}body .header.rtl .side1 .categories_wrapper li .header-item-btn.open{padding-left:6px;padding-right:13px}body .header.rtl .side2{float:left}body .header.rtl .side2 #bing_element_wrapper{left:15px}body .header .categories_wrapper{display:inline;list-style:none;margin:0;-webkit-margin-after:0em;-webkit-m

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Entropy (8bit):	7.998107654907973
TrID:	Win32 Executable (generic) a (10002005/4) 99.39% UPX compressed Win32 Executable (30571/9) 0.30% Win32 EXE Yoda's Crypter (26571/9) 0.26% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02%
File name:	BundleSweetIMSetup.exe
File size:	4'666'160 bytes
MD5:	bcc96659d6a46536dbde959fb9d60f67
SHA1:	eb2352a46bf4d0112346814b406f2af3484cb93f
SHA256:	beb0423b1afe047964ad168060a8fd92c550814f6797b937ee0092004640aa18
SHA512:	b032b75347af699cc84a3342f70ebf8e528efe20a570e48310db084dc0f299169ff14cf32c7cc1da64648a85befef2e0e77f476df33e14cfa632e874c3c9c6c3
SSDEEP:	98304:SHuKO2Hse93G1fVqQkYc/EL+s72wJO2MzvK26/LOgIM:SHu92HvW1tq1kpSwc2KCjb
TLSH:	F926338051208E56C7697CBE722FF3F177181866FDAAD7E23A998E4F754D2F11E28104
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........._...1...1...1..t_...1.3.....1.......1.....,.1.......1..t\...1.......1..tJ...1...0...1.......1.......1.......1.Rich..1........

File Icon


Icon Hash:	0f31b0696d31238f

Static PE Info

General

Entrypoint:	0xc265c0
Entrypoint Section:	UPX1
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x4D9C5D2D [Wed Apr 6 12:31:41 2011 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	8c28e421a54474fdf86d6c8ffec809c3

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	10/01/2011 00:00:00 04/02/2014 23:59:59
Subject Chain	CN=SweetIM Technologies Ltd, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=SweetIM Technologies Ltd, L=Ra'anana, S=Israel, C=IL
Version:	3
Thumbprint MD5:	A36613788258E5245F39EF4CFB2872A1
Thumbprint SHA-1:	D279C09CD09A2FCAA6009E3896737D7698DC0335
Thumbprint SHA-256:	4FBF81E4F024AC92EEA227FDF32D2ABD2286CCF36ABF7D4C239A9DD5A062E159
Serial:	5E3BF2B52DA9EA7F1B539A7F018F4EC6

Entrypoint Preview

Instruction
pushad
mov esi, 007C2000h
lea edi, dword ptr [esi-003C1000h]
push edi
mov ebp, esp
lea ebx, dword ptr [esp-00003E80h]
xor eax, eax
push eax
cmp esp, ebx
jne 00007F00D0FCDF0Dh
inc esi
inc esi
push ebx
push 0082422Eh
push edi
add ebx, 04h
push ebx
push 004645B5h
push esi
add ebx, 04h
push ebx
push eax
mov dword ptr [ebx], 00000003h
nop
nop
nop
nop
nop
push ebp
push edi
push esi
push ebx
sub esp, 7Ch
mov edx, dword ptr [esp+00000090h]
mov dword ptr [esp+74h], 00000000h
mov byte ptr [esp+73h], 00000000h
mov ebp, dword ptr [esp+0000009Ch]
lea eax, dword ptr [edx+04h]
mov dword ptr [esp+78h], eax
mov eax, 00000001h
movzx ecx, byte ptr [edx+02h]
mov ebx, eax
shl ebx, cl
mov ecx, ebx
dec ecx
mov dword ptr [esp+6Ch], ecx
movzx ecx, byte ptr [edx+01h]
shl eax, cl
dec eax
mov dword ptr [esp+68h], eax
mov eax, dword ptr [esp+000000A8h]
movzx esi, byte ptr [edx]
mov dword ptr [ebp+00h], 00000000h
mov dword ptr [esp+60h], 00000000h
mov dword ptr [eax], 00000000h
mov eax, 00000300h
mov dword ptr [esp+64h], esi
mov dword ptr [esp+5Ch], 00000001h
mov dword ptr [esp+58h], 00000001h
mov dword ptr [esp+54h], 00000001h

Rich Headers

Programming Language:

[C++] VS2005 build 50727
[ASM] VS2008 SP1 build 30729
[ C ] VS2008 SP1 build 30729
[C++] VS2008 build 21022
[ C ] VS2005 build 50727
[C++] VS2008 SP1 build 30729
[IMP] VS2005 build 50727
[RES] VS2008 build 21022
[LNK] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8338a0	0x31c	.rsrc
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x828000	0xb8a0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x471200	0x2130	UPX1
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x833bbc	0xc	.rsrc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x827180	0x48	UPX1
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x57684	0x40	UPX0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
UPX0	0x1000	0x3c1000	0x0	d41d8cd98f00b204e9800998ecf8427e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
UPX1	0x3c2000	0x466000	0x465200	0b5ebe77023515e87092b5c86594bc00	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x828000	0xc000	0xbc00	8c27cc8edbe103469e16604a123fa79e	False	0.5828000332446809	data	6.057834848241296	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
MY_CUSTOM	0x5f5c4	0x12b67	empty	English	United States	0
MY_CUSTOM	0x7212c	0x10a4	empty	English	United States	0
MY_CUSTOM	0x731d0	0xe45	empty	English	United States	0
MY_CUSTOM	0x74018	0x2e1e	empty	English	United States	0
MY_CUSTOM	0x76e38	0xb110	empty	English	United States	0
MY_CUSTOM	0x81f48	0x50f4	empty	English	United States	0
MY_CUSTOM	0x8703c	0x3c0db0	empty			0
MY_CUSTOM	0x447dec	0x340bc0	data			1.0003108978271484
MY_CUSTOM	0x7889ac	0x84554	data	English	United States	1.0003247016803312
RT_ICON	0x8285c8	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	English	United States	0.33963414634146344
RT_ICON	0x828c34	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	United States	0.4475806451612903
RT_ICON	0x828f20	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	United States	0.6047297297297297
RT_ICON	0x82904c	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.31769722814498935
RT_ICON	0x829ef8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.35875451263537905
RT_ICON	0x82a7a4	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.3338150289017341
RT_ICON	0x82ad10	0x48fc	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9933633055020338
RT_ICON	0x82f610	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.2270746887966805
RT_ICON	0x831bbc	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.31848030018761725
RT_ICON	0x832c68	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.5292553191489362
RT_DIALOG	0x8179e4	0x3ee	data	English	United States	1.010934393638171
RT_DIALOG	0x817dd4	0x28c	data	English	United States	1.0168711656441718
RT_DIALOG	0x818060	0x1f4	data	English	United States	1.022
RT_DIALOG	0x818254	0x1c6	data	English	United States	1.024229074889868
RT_DIALOG	0x81841c	0x164	data	English	United States	1.0308988764044944
RT_GROUP_ICON	0x8330d4	0x92	data	English	United States	0.6438356164383562
RT_VERSION	0x83316c	0x424	data	English	United States	0.4518867924528302
RT_MANIFEST	0x833594	0x30b	ASCII text, with CRLF line terminators	English	United States	0.4595635430038511

Imports

DLL	Import
KERNEL32.DLL	LoadLibraryA, GetProcAddress, VirtualProtect, VirtualAlloc, VirtualFree, ExitProcess
ADVAPI32.dll	FreeSid
COMCTL32.dll	InitCommonControlsEx
GDI32.dll	BitBlt
ole32.dll	CoInitialize
OLEAUT32.dll	SysAllocStringLen
RPCRT4.dll	UuidFromStringW
SHELL32.dll
SHLWAPI.dll	UrlGetPartW
urlmon.dll	ObtainUserAgentString
USER32.dll	GetDC
VERSION.dll	VerQueryValueW
WININET.dll	InternetOpenW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 26, 2024 07:42:13.280258894 CEST	49675	443	192.168.2.4	173.222.162.32
Apr 26, 2024 07:42:20.801733017 CEST	49733	80	192.168.2.4	13.249.98.125
Apr 26, 2024 07:42:20.926338911 CEST	80	49733	13.249.98.125	192.168.2.4
Apr 26, 2024 07:42:20.926654100 CEST	49733	80	192.168.2.4	13.249.98.125
Apr 26, 2024 07:42:20.926795006 CEST	49733	80	192.168.2.4	13.249.98.125
Apr 26, 2024 07:42:21.051322937 CEST	80	49733	13.249.98.125	192.168.2.4
Apr 26, 2024 07:42:21.051527023 CEST	80	49733	13.249.98.125	192.168.2.4
Apr 26, 2024 07:42:21.051702023 CEST	49733	80	192.168.2.4	13.249.98.125
Apr 26, 2024 07:42:21.059329987 CEST	49734	443	192.168.2.4	13.249.98.125
Apr 26, 2024 07:42:21.059381962 CEST	443	49734	13.249.98.125	192.168.2.4
Apr 26, 2024 07:42:21.059478998 CEST	49734	443	192.168.2.4	13.249.98.125
Apr 26, 2024 07:42:21.073822021 CEST	49734	443	192.168.2.4	13.249.98.125
Apr 26, 2024 07:42:21.073854923 CEST	443	49734	13.249.98.125	192.168.2.4
Apr 26, 2024 07:42:21.348936081 CEST	443	49734	13.249.98.125	192.168.2.4
Apr 26, 2024 07:42:21.349030972 CEST	49734	443	192.168.2.4	13.249.98.125
Apr 26, 2024 07:42:21.418073893 CEST	49734	443	192.168.2.4	13.249.98.125
Apr 26, 2024 07:42:21.418106079 CEST	443	49734	13.249.98.125	192.168.2.4
Apr 26, 2024 07:42:21.419087887 CEST	443	49734	13.249.98.125	192.168.2.4
Apr 26, 2024 07:42:21.419167995 CEST	49734	443	192.168.2.4	13.249.98.125
Apr 26, 2024 07:42:21.424596071 CEST	49734	443	192.168.2.4	13.249.98.125
Apr 26, 2024 07:42:21.468157053 CEST	443	49734	13.249.98.125	192.168.2.4
Apr 26, 2024 07:42:21.664138079 CEST	443	49734	13.249.98.125	192.168.2.4
Apr 26, 2024 07:42:21.664190054 CEST	443	49734	13.249.98.125	192.168.2.4
Apr 26, 2024 07:42:21.664206028 CEST	49734	443	192.168.2.4	13.249.98.125
Apr 26, 2024 07:42:21.664222956 CEST	443	49734	13.249.98.125	192.168.2.4
Apr 26, 2024 07:42:21.664237022 CEST	49734	443	192.168.2.4	13.249.98.125
Apr 26, 2024 07:42:21.664288044 CEST	49734	443	192.168.2.4	13.249.98.125
Apr 26, 2024 07:42:21.667562962 CEST	49734	443	192.168.2.4	13.249.98.125
Apr 26, 2024 07:42:21.667663097 CEST	443	49734	13.249.98.125	192.168.2.4
Apr 26, 2024 07:42:21.667730093 CEST	49734	443	192.168.2.4	13.249.98.125
Apr 26, 2024 07:42:22.889631033 CEST	49675	443	192.168.2.4	173.222.162.32
Apr 26, 2024 07:42:36.120603085 CEST	49735	443	192.168.2.4	13.85.23.86
Apr 26, 2024 07:42:36.120645046 CEST	443	49735	13.85.23.86	192.168.2.4
Apr 26, 2024 07:42:36.120713949 CEST	49735	443	192.168.2.4	13.85.23.86
Apr 26, 2024 07:42:36.122854948 CEST	49735	443	192.168.2.4	13.85.23.86
Apr 26, 2024 07:42:36.122870922 CEST	443	49735	13.85.23.86	192.168.2.4
Apr 26, 2024 07:42:36.623984098 CEST	443	49735	13.85.23.86	192.168.2.4
Apr 26, 2024 07:42:36.624067068 CEST	49735	443	192.168.2.4	13.85.23.86
Apr 26, 2024 07:42:36.628418922 CEST	49735	443	192.168.2.4	13.85.23.86
Apr 26, 2024 07:42:36.628443003 CEST	443	49735	13.85.23.86	192.168.2.4
Apr 26, 2024 07:42:36.628753901 CEST	443	49735	13.85.23.86	192.168.2.4
Apr 26, 2024 07:42:36.772629976 CEST	49735	443	192.168.2.4	13.85.23.86
Apr 26, 2024 07:42:37.125137091 CEST	49735	443	192.168.2.4	13.85.23.86
Apr 26, 2024 07:42:37.168121099 CEST	443	49735	13.85.23.86	192.168.2.4
Apr 26, 2024 07:42:37.445571899 CEST	443	49735	13.85.23.86	192.168.2.4
Apr 26, 2024 07:42:37.445647955 CEST	443	49735	13.85.23.86	192.168.2.4
Apr 26, 2024 07:42:37.445667028 CEST	443	49735	13.85.23.86	192.168.2.4
Apr 26, 2024 07:42:37.445710897 CEST	443	49735	13.85.23.86	192.168.2.4
Apr 26, 2024 07:42:37.445728064 CEST	443	49735	13.85.23.86	192.168.2.4
Apr 26, 2024 07:42:37.445748091 CEST	443	49735	13.85.23.86	192.168.2.4
Apr 26, 2024 07:42:37.445753098 CEST	49735	443	192.168.2.4	13.85.23.86
Apr 26, 2024 07:42:37.445753098 CEST	49735	443	192.168.2.4	13.85.23.86
Apr 26, 2024 07:42:37.445776939 CEST	49735	443	192.168.2.4	13.85.23.86
Apr 26, 2024 07:42:37.445779085 CEST	443	49735	13.85.23.86	192.168.2.4
Apr 26, 2024 07:42:37.445831060 CEST	49735	443	192.168.2.4	13.85.23.86
Apr 26, 2024 07:42:37.445831060 CEST	49735	443	192.168.2.4	13.85.23.86
Apr 26, 2024 07:42:37.445940971 CEST	443	49735	13.85.23.86	192.168.2.4
Apr 26, 2024 07:42:37.445960045 CEST	443	49735	13.85.23.86	192.168.2.4
Apr 26, 2024 07:42:37.446019888 CEST	49735	443	192.168.2.4	13.85.23.86
Apr 26, 2024 07:42:37.446019888 CEST	49735	443	192.168.2.4	13.85.23.86
Apr 26, 2024 07:42:37.446037054 CEST	443	49735	13.85.23.86	192.168.2.4
Apr 26, 2024 07:42:37.446177959 CEST	443	49735	13.85.23.86	192.168.2.4
Apr 26, 2024 07:42:37.446320057 CEST	49735	443	192.168.2.4	13.85.23.86
Apr 26, 2024 07:42:37.816957951 CEST	49735	443	192.168.2.4	13.85.23.86
Apr 26, 2024 07:42:37.816994905 CEST	443	49735	13.85.23.86	192.168.2.4
Apr 26, 2024 07:42:37.817013025 CEST	49735	443	192.168.2.4	13.85.23.86
Apr 26, 2024 07:42:37.817029953 CEST	443	49735	13.85.23.86	192.168.2.4
Apr 26, 2024 07:42:57.302691936 CEST	49733	80	192.168.2.4	13.249.98.125
Apr 26, 2024 07:42:57.427485943 CEST	80	49733	13.249.98.125	192.168.2.4
Apr 26, 2024 07:42:57.427630901 CEST	49733	80	192.168.2.4	13.249.98.125
Apr 26, 2024 07:42:57.505825043 CEST	49741	443	192.168.2.4	13.249.98.125
Apr 26, 2024 07:42:57.505872965 CEST	443	49741	13.249.98.125	192.168.2.4
Apr 26, 2024 07:42:57.506098986 CEST	49741	443	192.168.2.4	13.249.98.125
Apr 26, 2024 07:42:57.506504059 CEST	49741	443	192.168.2.4	13.249.98.125
Apr 26, 2024 07:42:57.506515980 CEST	443	49741	13.249.98.125	192.168.2.4
Apr 26, 2024 07:42:57.768811941 CEST	443	49741	13.249.98.125	192.168.2.4
Apr 26, 2024 07:42:57.768889904 CEST	49741	443	192.168.2.4	13.249.98.125
Apr 26, 2024 07:42:57.989202023 CEST	49741	443	192.168.2.4	13.249.98.125
Apr 26, 2024 07:42:57.989222050 CEST	443	49741	13.249.98.125	192.168.2.4
Apr 26, 2024 07:42:57.989665031 CEST	443	49741	13.249.98.125	192.168.2.4
Apr 26, 2024 07:42:57.989761114 CEST	49741	443	192.168.2.4	13.249.98.125
Apr 26, 2024 07:42:57.990164995 CEST	49741	443	192.168.2.4	13.249.98.125
Apr 26, 2024 07:42:58.032128096 CEST	443	49741	13.249.98.125	192.168.2.4
Apr 26, 2024 07:42:58.193651915 CEST	443	49741	13.249.98.125	192.168.2.4
Apr 26, 2024 07:42:58.193702936 CEST	443	49741	13.249.98.125	192.168.2.4
Apr 26, 2024 07:42:58.193782091 CEST	49741	443	192.168.2.4	13.249.98.125
Apr 26, 2024 07:42:58.193782091 CEST	49741	443	192.168.2.4	13.249.98.125
Apr 26, 2024 07:42:58.193794966 CEST	443	49741	13.249.98.125	192.168.2.4
Apr 26, 2024 07:42:58.194108009 CEST	49741	443	192.168.2.4	13.249.98.125
Apr 26, 2024 07:42:58.206434011 CEST	443	49741	13.249.98.125	192.168.2.4
Apr 26, 2024 07:42:58.206444979 CEST	443	49741	13.249.98.125	192.168.2.4
Apr 26, 2024 07:42:58.206492901 CEST	443	49741	13.249.98.125	192.168.2.4
Apr 26, 2024 07:42:58.206515074 CEST	49741	443	192.168.2.4	13.249.98.125
Apr 26, 2024 07:42:58.206528902 CEST	443	49741	13.249.98.125	192.168.2.4
Apr 26, 2024 07:42:58.206578016 CEST	49741	443	192.168.2.4	13.249.98.125
Apr 26, 2024 07:42:58.206578016 CEST	49741	443	192.168.2.4	13.249.98.125
Apr 26, 2024 07:42:58.224195957 CEST	443	49741	13.249.98.125	192.168.2.4
Apr 26, 2024 07:42:58.224438906 CEST	49741	443	192.168.2.4	13.249.98.125
Apr 26, 2024 07:42:58.228503942 CEST	49741	443	192.168.2.4	13.249.98.125
Apr 26, 2024 07:42:58.228610039 CEST	49741	443	192.168.2.4	13.249.98.125
Apr 26, 2024 07:42:58.784734011 CEST	49745	80	192.168.2.4	108.157.173.24
Apr 26, 2024 07:42:58.786443949 CEST	49746	80	192.168.2.4	108.157.173.24
Apr 26, 2024 07:42:58.787199020 CEST	49747	80	192.168.2.4	108.157.173.24
Apr 26, 2024 07:42:58.909117937 CEST	80	49745	108.157.173.24	192.168.2.4
Apr 26, 2024 07:42:58.909208059 CEST	49745	80	192.168.2.4	108.157.173.24
Apr 26, 2024 07:42:58.909565926 CEST	49745	80	192.168.2.4	108.157.173.24
Apr 26, 2024 07:42:58.911716938 CEST	80	49746	108.157.173.24	192.168.2.4
Apr 26, 2024 07:42:58.911808014 CEST	49746	80	192.168.2.4	108.157.173.24
Apr 26, 2024 07:42:58.912014008 CEST	80	49747	108.157.173.24	192.168.2.4
Apr 26, 2024 07:42:58.912069082 CEST	49747	80	192.168.2.4	108.157.173.24
Apr 26, 2024 07:42:59.033878088 CEST	80	49745	108.157.173.24	192.168.2.4
Apr 26, 2024 07:42:59.033917904 CEST	80	49745	108.157.173.24	192.168.2.4
Apr 26, 2024 07:42:59.078715086 CEST	49745	80	192.168.2.4	108.157.173.24
Apr 26, 2024 07:42:59.166934967 CEST	49748	443	192.168.2.4	108.157.173.24
Apr 26, 2024 07:42:59.166980028 CEST	443	49748	108.157.173.24	192.168.2.4
Apr 26, 2024 07:42:59.167047024 CEST	49748	443	192.168.2.4	108.157.173.24
Apr 26, 2024 07:42:59.167289019 CEST	49748	443	192.168.2.4	108.157.173.24
Apr 26, 2024 07:42:59.167305946 CEST	443	49748	108.157.173.24	192.168.2.4
Apr 26, 2024 07:42:59.424720049 CEST	443	49748	108.157.173.24	192.168.2.4
Apr 26, 2024 07:42:59.425251007 CEST	49748	443	192.168.2.4	108.157.173.24
Apr 26, 2024 07:42:59.425271034 CEST	443	49748	108.157.173.24	192.168.2.4
Apr 26, 2024 07:42:59.426312923 CEST	443	49748	108.157.173.24	192.168.2.4
Apr 26, 2024 07:42:59.426376104 CEST	49748	443	192.168.2.4	108.157.173.24
Apr 26, 2024 07:42:59.427710056 CEST	49748	443	192.168.2.4	108.157.173.24
Apr 26, 2024 07:42:59.427771091 CEST	443	49748	108.157.173.24	192.168.2.4
Apr 26, 2024 07:42:59.428051949 CEST	49748	443	192.168.2.4	108.157.173.24
Apr 26, 2024 07:42:59.428061962 CEST	443	49748	108.157.173.24	192.168.2.4
Apr 26, 2024 07:42:59.471776962 CEST	49748	443	192.168.2.4	108.157.173.24
Apr 26, 2024 07:42:59.738498926 CEST	443	49748	108.157.173.24	192.168.2.4
Apr 26, 2024 07:42:59.750005007 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:42:59.750053883 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:42:59.750114918 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:42:59.750302076 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:42:59.750318050 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:42:59.756011009 CEST	443	49748	108.157.173.24	192.168.2.4
Apr 26, 2024 07:42:59.756026983 CEST	443	49748	108.157.173.24	192.168.2.4
Apr 26, 2024 07:42:59.756068945 CEST	443	49748	108.157.173.24	192.168.2.4
Apr 26, 2024 07:42:59.756082058 CEST	49748	443	192.168.2.4	108.157.173.24
Apr 26, 2024 07:42:59.756093979 CEST	443	49748	108.157.173.24	192.168.2.4
Apr 26, 2024 07:42:59.756117105 CEST	49748	443	192.168.2.4	108.157.173.24
Apr 26, 2024 07:42:59.765768051 CEST	443	49748	108.157.173.24	192.168.2.4
Apr 26, 2024 07:42:59.765964031 CEST	49748	443	192.168.2.4	108.157.173.24
Apr 26, 2024 07:42:59.765980005 CEST	443	49748	108.157.173.24	192.168.2.4
Apr 26, 2024 07:42:59.776773930 CEST	443	49748	108.157.173.24	192.168.2.4
Apr 26, 2024 07:42:59.776842117 CEST	49748	443	192.168.2.4	108.157.173.24
Apr 26, 2024 07:42:59.776849985 CEST	443	49748	108.157.173.24	192.168.2.4
Apr 26, 2024 07:42:59.780252934 CEST	443	49748	108.157.173.24	192.168.2.4
Apr 26, 2024 07:42:59.780337095 CEST	49748	443	192.168.2.4	108.157.173.24
Apr 26, 2024 07:42:59.780344009 CEST	443	49748	108.157.173.24	192.168.2.4
Apr 26, 2024 07:42:59.783726931 CEST	443	49748	108.157.173.24	192.168.2.4
Apr 26, 2024 07:42:59.783812046 CEST	49748	443	192.168.2.4	108.157.173.24
Apr 26, 2024 07:42:59.783817053 CEST	443	49748	108.157.173.24	192.168.2.4
Apr 26, 2024 07:42:59.787386894 CEST	443	49748	108.157.173.24	192.168.2.4
Apr 26, 2024 07:42:59.787446022 CEST	49748	443	192.168.2.4	108.157.173.24
Apr 26, 2024 07:42:59.787455082 CEST	443	49748	108.157.173.24	192.168.2.4
Apr 26, 2024 07:42:59.827982903 CEST	49748	443	192.168.2.4	108.157.173.24
Apr 26, 2024 07:42:59.863394022 CEST	443	49748	108.157.173.24	192.168.2.4
Apr 26, 2024 07:42:59.863449097 CEST	49748	443	192.168.2.4	108.157.173.24
Apr 26, 2024 07:42:59.863455057 CEST	443	49748	108.157.173.24	192.168.2.4
Apr 26, 2024 07:42:59.868566990 CEST	443	49748	108.157.173.24	192.168.2.4
Apr 26, 2024 07:42:59.868647099 CEST	49748	443	192.168.2.4	108.157.173.24
Apr 26, 2024 07:42:59.868654013 CEST	443	49748	108.157.173.24	192.168.2.4
Apr 26, 2024 07:42:59.869263887 CEST	49748	443	192.168.2.4	108.157.173.24
Apr 26, 2024 07:42:59.875586987 CEST	443	49748	108.157.173.24	192.168.2.4
Apr 26, 2024 07:42:59.875684977 CEST	49748	443	192.168.2.4	108.157.173.24
Apr 26, 2024 07:42:59.883367062 CEST	443	49748	108.157.173.24	192.168.2.4
Apr 26, 2024 07:42:59.883428097 CEST	49748	443	192.168.2.4	108.157.173.24
Apr 26, 2024 07:42:59.885936022 CEST	443	49748	108.157.173.24	192.168.2.4
Apr 26, 2024 07:42:59.886007071 CEST	49748	443	192.168.2.4	108.157.173.24
Apr 26, 2024 07:42:59.886015892 CEST	443	49748	108.157.173.24	192.168.2.4
Apr 26, 2024 07:42:59.905186892 CEST	443	49748	108.157.173.24	192.168.2.4
Apr 26, 2024 07:42:59.905231953 CEST	443	49748	108.157.173.24	192.168.2.4
Apr 26, 2024 07:42:59.905263901 CEST	49748	443	192.168.2.4	108.157.173.24
Apr 26, 2024 07:42:59.905271053 CEST	443	49748	108.157.173.24	192.168.2.4
Apr 26, 2024 07:42:59.905291080 CEST	49748	443	192.168.2.4	108.157.173.24
Apr 26, 2024 07:42:59.905301094 CEST	443	49748	108.157.173.24	192.168.2.4
Apr 26, 2024 07:42:59.905453920 CEST	49748	443	192.168.2.4	108.157.173.24
Apr 26, 2024 07:42:59.905462980 CEST	443	49748	108.157.173.24	192.168.2.4
Apr 26, 2024 07:42:59.905473948 CEST	49748	443	192.168.2.4	108.157.173.24
Apr 26, 2024 07:43:00.062257051 CEST	49753	443	192.168.2.4	13.249.98.78
Apr 26, 2024 07:43:00.062290907 CEST	443	49753	13.249.98.78	192.168.2.4
Apr 26, 2024 07:43:00.062355995 CEST	49753	443	192.168.2.4	13.249.98.78
Apr 26, 2024 07:43:00.062536955 CEST	49753	443	192.168.2.4	13.249.98.78
Apr 26, 2024 07:43:00.062547922 CEST	443	49753	13.249.98.78	192.168.2.4
Apr 26, 2024 07:43:00.122178078 CEST	49754	443	192.168.2.4	13.249.98.124
Apr 26, 2024 07:43:00.122263908 CEST	443	49754	13.249.98.124	192.168.2.4
Apr 26, 2024 07:43:00.122359991 CEST	49754	443	192.168.2.4	13.249.98.124
Apr 26, 2024 07:43:00.122606039 CEST	49754	443	192.168.2.4	13.249.98.124
Apr 26, 2024 07:43:00.122654915 CEST	443	49754	13.249.98.124	192.168.2.4
Apr 26, 2024 07:43:00.143595934 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:00.147001028 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:00.147027969 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:00.147403002 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:00.147460938 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:00.148124933 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:00.148175955 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:00.148183107 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:00.149353981 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:00.149411917 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:00.149521112 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:00.149525881 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:00.189850092 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:00.319786072 CEST	443	49753	13.249.98.78	192.168.2.4
Apr 26, 2024 07:43:00.320066929 CEST	49753	443	192.168.2.4	13.249.98.78
Apr 26, 2024 07:43:00.320095062 CEST	443	49753	13.249.98.78	192.168.2.4
Apr 26, 2024 07:43:00.321130037 CEST	443	49753	13.249.98.78	192.168.2.4
Apr 26, 2024 07:43:00.321187973 CEST	49753	443	192.168.2.4	13.249.98.78
Apr 26, 2024 07:43:00.322092056 CEST	49753	443	192.168.2.4	13.249.98.78
Apr 26, 2024 07:43:00.322153091 CEST	443	49753	13.249.98.78	192.168.2.4
Apr 26, 2024 07:43:00.322252035 CEST	49753	443	192.168.2.4	13.249.98.78
Apr 26, 2024 07:43:00.368122101 CEST	443	49753	13.249.98.78	192.168.2.4
Apr 26, 2024 07:43:00.374203920 CEST	49753	443	192.168.2.4	13.249.98.78
Apr 26, 2024 07:43:00.374218941 CEST	443	49753	13.249.98.78	192.168.2.4
Apr 26, 2024 07:43:00.383018017 CEST	443	49754	13.249.98.124	192.168.2.4
Apr 26, 2024 07:43:00.383249998 CEST	49754	443	192.168.2.4	13.249.98.124
Apr 26, 2024 07:43:00.383276939 CEST	443	49754	13.249.98.124	192.168.2.4
Apr 26, 2024 07:43:00.387294054 CEST	443	49754	13.249.98.124	192.168.2.4
Apr 26, 2024 07:43:00.387367964 CEST	49754	443	192.168.2.4	13.249.98.124
Apr 26, 2024 07:43:00.388281107 CEST	49754	443	192.168.2.4	13.249.98.124
Apr 26, 2024 07:43:00.388371944 CEST	443	49754	13.249.98.124	192.168.2.4
Apr 26, 2024 07:43:00.388544083 CEST	49754	443	192.168.2.4	13.249.98.124
Apr 26, 2024 07:43:00.388555050 CEST	443	49754	13.249.98.124	192.168.2.4
Apr 26, 2024 07:43:00.419826984 CEST	49753	443	192.168.2.4	13.249.98.78
Apr 26, 2024 07:43:00.435034037 CEST	49754	443	192.168.2.4	13.249.98.124
Apr 26, 2024 07:43:00.514245987 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:00.520828962 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:00.520889997 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:00.520922899 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:00.527487040 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:00.527539968 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:00.527571917 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:00.540604115 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:00.540657043 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:00.540683985 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:00.553739071 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:00.553808928 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:00.553836107 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:00.566869020 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:00.566947937 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:00.566981077 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:00.580070019 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:00.580132008 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:00.580167055 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:00.593293905 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:00.593364954 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:00.593400002 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:00.606336117 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:00.606396914 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:00.606424093 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:00.658046961 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:00.658072948 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:00.698721886 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:00.698782921 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:00.698807001 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:00.705045938 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:00.705554008 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:00.705560923 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:00.715665102 CEST	49733	80	192.168.2.4	13.249.98.125
Apr 26, 2024 07:43:00.718105078 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:00.718158007 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:00.718163967 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:00.731226921 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:00.731331110 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:00.731338024 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:00.740612030 CEST	443	49753	13.249.98.78	192.168.2.4
Apr 26, 2024 07:43:00.740633011 CEST	443	49753	13.249.98.78	192.168.2.4
Apr 26, 2024 07:43:00.740695000 CEST	49753	443	192.168.2.4	13.249.98.78
Apr 26, 2024 07:43:00.740699053 CEST	443	49753	13.249.98.78	192.168.2.4
Apr 26, 2024 07:43:00.740740061 CEST	49753	443	192.168.2.4	13.249.98.78
Apr 26, 2024 07:43:00.742052078 CEST	49753	443	192.168.2.4	13.249.98.78
Apr 26, 2024 07:43:00.742084980 CEST	443	49753	13.249.98.78	192.168.2.4
Apr 26, 2024 07:43:00.744404078 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:00.744455099 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:00.744472027 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:00.757602930 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:00.757673025 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:00.757698059 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:00.770802975 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:00.770857096 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:00.770864964 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:00.783896923 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:00.783952951 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:00.783961058 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:00.792052984 CEST	443	49754	13.249.98.124	192.168.2.4
Apr 26, 2024 07:43:00.792140007 CEST	443	49754	13.249.98.124	192.168.2.4
Apr 26, 2024 07:43:00.792274952 CEST	49754	443	192.168.2.4	13.249.98.124
Apr 26, 2024 07:43:00.792299986 CEST	443	49754	13.249.98.124	192.168.2.4
Apr 26, 2024 07:43:00.792318106 CEST	443	49754	13.249.98.124	192.168.2.4
Apr 26, 2024 07:43:00.792368889 CEST	49754	443	192.168.2.4	13.249.98.124
Apr 26, 2024 07:43:00.794380903 CEST	49754	443	192.168.2.4	13.249.98.124
Apr 26, 2024 07:43:00.794400930 CEST	443	49754	13.249.98.124	192.168.2.4
Apr 26, 2024 07:43:00.797220945 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:00.797353029 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:00.797359943 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:00.810241938 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:00.810286999 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:00.810292959 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:00.814121962 CEST	49755	443	192.168.2.4	13.249.98.124
Apr 26, 2024 07:43:00.814165115 CEST	443	49755	13.249.98.124	192.168.2.4
Apr 26, 2024 07:43:00.815673113 CEST	49755	443	192.168.2.4	13.249.98.124
Apr 26, 2024 07:43:00.815881014 CEST	49755	443	192.168.2.4	13.249.98.124
Apr 26, 2024 07:43:00.815900087 CEST	443	49755	13.249.98.124	192.168.2.4
Apr 26, 2024 07:43:00.823676109 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:00.823759079 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:00.823766947 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:00.835655928 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:00.837012053 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:00.837018013 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:00.847206116 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:00.847270966 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:00.847275972 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:00.856487036 CEST	49756	443	192.168.2.4	108.157.173.24
Apr 26, 2024 07:43:00.856530905 CEST	443	49756	108.157.173.24	192.168.2.4
Apr 26, 2024 07:43:00.856972933 CEST	49756	443	192.168.2.4	108.157.173.24
Apr 26, 2024 07:43:00.857168913 CEST	49756	443	192.168.2.4	108.157.173.24
Apr 26, 2024 07:43:00.857186079 CEST	443	49756	108.157.173.24	192.168.2.4
Apr 26, 2024 07:43:00.857980967 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:00.858221054 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:00.858226061 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:00.869282961 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:00.869518042 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:00.869524002 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:00.880520105 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:00.880579948 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:00.880584955 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:00.891805887 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:00.891885996 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:00.891891956 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:00.903243065 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:00.903342009 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:00.903347969 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:00.908417940 CEST	49758	443	192.168.2.4	13.249.98.124
Apr 26, 2024 07:43:00.908474922 CEST	443	49758	13.249.98.124	192.168.2.4
Apr 26, 2024 07:43:00.908549070 CEST	49758	443	192.168.2.4	13.249.98.124
Apr 26, 2024 07:43:00.908729076 CEST	49758	443	192.168.2.4	13.249.98.124
Apr 26, 2024 07:43:00.908741951 CEST	443	49758	13.249.98.124	192.168.2.4
Apr 26, 2024 07:43:00.914457083 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:00.914514065 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:00.914520979 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:00.921030998 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:00.921098948 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:00.921104908 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:00.931129932 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:00.931178093 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:00.931217909 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:00.931224108 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:00.931263924 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:00.937541962 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:00.943895102 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:00.943931103 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:00.943948984 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:00.943955898 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:00.943989992 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:00.950644016 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:00.956861019 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:00.956899881 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:00.956914902 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:00.956921101 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:00.956959009 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:00.963143110 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:00.969839096 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:00.969877005 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:00.969926119 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:00.969932079 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:00.969971895 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:00.970634937 CEST	49759	443	192.168.2.4	13.249.98.78
Apr 26, 2024 07:43:00.970664978 CEST	443	49759	13.249.98.78	192.168.2.4
Apr 26, 2024 07:43:00.970789909 CEST	49759	443	192.168.2.4	13.249.98.78
Apr 26, 2024 07:43:00.971055984 CEST	49759	443	192.168.2.4	13.249.98.78
Apr 26, 2024 07:43:00.971066952 CEST	443	49759	13.249.98.78	192.168.2.4
Apr 26, 2024 07:43:00.976175070 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:00.982208014 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:00.982244968 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:00.982270002 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:00.982275963 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:00.982316971 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:00.988461971 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:00.994858027 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:00.994914055 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:00.994914055 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:00.994940042 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:00.995161057 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.001418114 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.007457972 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.007518053 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.007524014 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.010643959 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.010777950 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.010782957 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.017138958 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.017205000 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.017211914 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.023544073 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.023736000 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.023742914 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.029676914 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.029779911 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.029786110 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.036067963 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.036118031 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.036123037 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.042493105 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.042557955 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.042568922 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.049022913 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.049083948 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.049089909 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.054924011 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.055062056 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.055067062 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.060597897 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.060662031 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.060667038 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.066529989 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.066663027 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.066668034 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.069957018 CEST	443	49755	13.249.98.124	192.168.2.4
Apr 26, 2024 07:43:01.070184946 CEST	49755	443	192.168.2.4	13.249.98.124
Apr 26, 2024 07:43:01.070204973 CEST	443	49755	13.249.98.124	192.168.2.4
Apr 26, 2024 07:43:01.070559978 CEST	443	49755	13.249.98.124	192.168.2.4
Apr 26, 2024 07:43:01.070939064 CEST	49755	443	192.168.2.4	13.249.98.124
Apr 26, 2024 07:43:01.071002007 CEST	443	49755	13.249.98.124	192.168.2.4
Apr 26, 2024 07:43:01.071146965 CEST	49755	443	192.168.2.4	13.249.98.124
Apr 26, 2024 07:43:01.072582960 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.072638988 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.072643995 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.078485012 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.078541040 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.078547001 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.086968899 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.087003946 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.087025881 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.087030888 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.087269068 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.092747927 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.098320007 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.098359108 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.098414898 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.098421097 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.098462105 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.103957891 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.109190941 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.109226942 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.109339952 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.109354019 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.109428883 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.112118959 CEST	443	49755	13.249.98.124	192.168.2.4
Apr 26, 2024 07:43:01.113142014 CEST	443	49756	108.157.173.24	192.168.2.4
Apr 26, 2024 07:43:01.113436937 CEST	49756	443	192.168.2.4	108.157.173.24
Apr 26, 2024 07:43:01.113506079 CEST	443	49756	108.157.173.24	192.168.2.4
Apr 26, 2024 07:43:01.113936901 CEST	443	49756	108.157.173.24	192.168.2.4
Apr 26, 2024 07:43:01.114201069 CEST	49756	443	192.168.2.4	108.157.173.24
Apr 26, 2024 07:43:01.114295006 CEST	443	49756	108.157.173.24	192.168.2.4
Apr 26, 2024 07:43:01.114337921 CEST	49756	443	192.168.2.4	108.157.173.24
Apr 26, 2024 07:43:01.114700079 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.119216919 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.119271994 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.119277954 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.123210907 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.123250961 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.123296976 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.123302937 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.123342037 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.127604961 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.131659985 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.131702900 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.131707907 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.135600090 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.135637999 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.135684967 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.135690928 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.135729074 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.139816046 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.145539045 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.145576000 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.145582914 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.145587921 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.145651102 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.149108887 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.152935028 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.152973890 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.153002977 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.153007984 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.153048038 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.156117916 CEST	443	49756	108.157.173.24	192.168.2.4
Apr 26, 2024 07:43:01.156608105 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.159568071 CEST	49756	443	192.168.2.4	108.157.173.24
Apr 26, 2024 07:43:01.160183907 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.160222054 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.160249949 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.160254955 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.160299063 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.163707972 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.167352915 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.167387962 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.167412043 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.167417049 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.167454958 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.168283939 CEST	443	49758	13.249.98.124	192.168.2.4
Apr 26, 2024 07:43:01.168606043 CEST	49758	443	192.168.2.4	13.249.98.124
Apr 26, 2024 07:43:01.168667078 CEST	443	49758	13.249.98.124	192.168.2.4
Apr 26, 2024 07:43:01.170126915 CEST	443	49758	13.249.98.124	192.168.2.4
Apr 26, 2024 07:43:01.170206070 CEST	49758	443	192.168.2.4	13.249.98.124
Apr 26, 2024 07:43:01.170469046 CEST	49758	443	192.168.2.4	13.249.98.124
Apr 26, 2024 07:43:01.170550108 CEST	443	49758	13.249.98.124	192.168.2.4
Apr 26, 2024 07:43:01.170681000 CEST	49758	443	192.168.2.4	13.249.98.124
Apr 26, 2024 07:43:01.170690060 CEST	443	49758	13.249.98.124	192.168.2.4
Apr 26, 2024 07:43:01.170789957 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.174125910 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.174160957 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.174197912 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.174202919 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.174242973 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.177433014 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.180819035 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.180857897 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.180867910 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.180872917 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.180923939 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.184170008 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.187289953 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.187395096 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.187400103 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.188870907 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.188930988 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.188935995 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.192050934 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.192114115 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.192118883 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.195465088 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.195553064 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.195557117 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.198465109 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.198524952 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.198529005 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.201282978 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.201335907 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.201340914 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.204207897 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.204262018 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.204267025 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.207108021 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.207180023 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.207185030 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.210091114 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.210150957 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.210155964 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.212954044 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.213016033 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.213021040 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.215847015 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.215919971 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.215924978 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.217149973 CEST	49758	443	192.168.2.4	13.249.98.124
Apr 26, 2024 07:43:01.218683958 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.218751907 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.218758106 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.221371889 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.221440077 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.221447945 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.224746943 CEST	443	49759	13.249.98.78	192.168.2.4
Apr 26, 2024 07:43:01.224955082 CEST	49759	443	192.168.2.4	13.249.98.78
Apr 26, 2024 07:43:01.224962950 CEST	443	49759	13.249.98.78	192.168.2.4
Apr 26, 2024 07:43:01.225591898 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.225653887 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.225658894 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.225668907 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.225702047 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.225981951 CEST	443	49759	13.249.98.78	192.168.2.4
Apr 26, 2024 07:43:01.226058006 CEST	49759	443	192.168.2.4	13.249.98.78
Apr 26, 2024 07:43:01.226349115 CEST	49759	443	192.168.2.4	13.249.98.78
Apr 26, 2024 07:43:01.226411104 CEST	443	49759	13.249.98.78	192.168.2.4
Apr 26, 2024 07:43:01.226532936 CEST	49759	443	192.168.2.4	13.249.98.78
Apr 26, 2024 07:43:01.226537943 CEST	443	49759	13.249.98.78	192.168.2.4
Apr 26, 2024 07:43:01.228440046 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.231045008 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.231082916 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.231131077 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.231136084 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.231175900 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.233755112 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.236448050 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.236489058 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.236505032 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.236520052 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.236577988 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.239113092 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.241714001 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.241755009 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.241775990 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.241795063 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.241950035 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.244280100 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.246804953 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.246843100 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.246891975 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.246900082 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.247287035 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.249316931 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.251885891 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.251919031 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.251965046 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.251971960 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.252017021 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.254460096 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.257002115 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.257052898 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.257061005 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.258208990 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.258270025 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.258275032 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.260715008 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.260771036 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.260778904 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.263118982 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.263180971 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.263189077 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.265599012 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.265674114 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.265681028 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.268120050 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.268171072 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.268177986 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.270453930 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.270502090 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.270509005 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.272931099 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.273128986 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.273134947 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.275304079 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.275409937 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.275415897 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.277597904 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.277663946 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.277669907 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.279388905 CEST	49759	443	192.168.2.4	13.249.98.78
Apr 26, 2024 07:43:01.280025005 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.280143023 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.280149937 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.282349110 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.282468081 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.282474995 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.284713030 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.284769058 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.284776926 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.288258076 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.288301945 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.288305044 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.288312912 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.288352013 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.290558100 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.292903900 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.292932987 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.292948961 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.292958021 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.293004990 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.295553923 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.297513962 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.297555923 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.297561884 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.299757957 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.299782991 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.299797058 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.299803972 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.299843073 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.302007914 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.304265022 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.304295063 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.304320097 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.304327011 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.304367065 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.306444883 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.308644056 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.308672905 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.308717966 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.308726072 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.308765888 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.310833931 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.312994003 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.313052893 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.313080072 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.313086987 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.313222885 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.315145969 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.316317081 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.316418886 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.316432953 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.318376064 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.318456888 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.318480015 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.320683002 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.320852995 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.320861101 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.322810888 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.322875023 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.322890997 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.324634075 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.324702978 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.324714899 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.326638937 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.326684952 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.326695919 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.328676939 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.328720093 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.328727007 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.330722094 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.330770969 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.330780983 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.332876921 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.332917929 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.332928896 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.334693909 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.334758997 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.334765911 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.336605072 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.336755037 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.336766005 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.338632107 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.338684082 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.338694096 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.341530085 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.341555119 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.341592073 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.341602087 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.341773987 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.343378067 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.345276117 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.345299959 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.345341921 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.345351934 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.345388889 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.347218990 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.348983049 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.349046946 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.349056959 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.350919008 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.350990057 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.350995064 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.352750063 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.352777004 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.352823019 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.352832079 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.352869987 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.354562998 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.356462955 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.356492996 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.356513977 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.356523991 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.356738091 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.358215094 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.360069036 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.360115051 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.360122919 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.361844063 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.361876965 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.361907959 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.361917019 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.361962080 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.363548040 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.364552021 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.364609957 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.364619017 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.366322994 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.366372108 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.366384029 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.368046045 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.368098021 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.368113995 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.369827986 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.369887114 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.369893074 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.371494055 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.371535063 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.371541977 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.373267889 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.373326063 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.373334885 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.374974012 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.375025988 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.375036001 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.376713037 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.376784086 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.376790047 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.378417969 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.378474951 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.378485918 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.381609917 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.381661892 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.381669044 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.381679058 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.381728888 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.381736040 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.383455038 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.383498907 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.383506060 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.385071039 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.385184050 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.385195971 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.386715889 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.386795044 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.386806965 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.388439894 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.388499022 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.388504982 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.390028954 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.390073061 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.390083075 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.390999079 CEST	443	49756	108.157.173.24	192.168.2.4
Apr 26, 2024 07:43:01.391145945 CEST	443	49756	108.157.173.24	192.168.2.4
Apr 26, 2024 07:43:01.391197920 CEST	49756	443	192.168.2.4	108.157.173.24
Apr 26, 2024 07:43:01.391628981 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.391669989 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.391679049 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.393110991 CEST	49756	443	192.168.2.4	108.157.173.24
Apr 26, 2024 07:43:01.393158913 CEST	443	49756	108.157.173.24	192.168.2.4
Apr 26, 2024 07:43:01.393258095 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.393310070 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.393317938 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.394867897 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.394911051 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.394918919 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.396589041 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.396642923 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.396650076 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.398111105 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.398154974 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.398161888 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.399689913 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.399735928 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.399744034 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.401171923 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.401210070 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.401220083 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.402874947 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.402925014 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.402935028 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.404361963 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.404423952 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.404436111 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.405930996 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.405980110 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.405987978 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.407440901 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.407493114 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.407504082 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.408902884 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.409024000 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.409033060 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.410470009 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.410514116 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.410522938 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.411866903 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.411978960 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.411986113 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.413348913 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.413392067 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.413400888 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.414773941 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.414865017 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.414879084 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.416342974 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.416399002 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.416423082 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.417644024 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.417753935 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.417761087 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.419116020 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.419184923 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.419190884 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.420695066 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.420763016 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.420768976 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.422112942 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.422219038 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.422230959 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.423388004 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.423469067 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.423475981 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.426073074 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.426100969 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.426122904 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.426127911 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.426167011 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.427442074 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.428803921 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.428849936 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.428855896 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.430227041 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.430260897 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.430278063 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.430285931 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.430324078 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.431651115 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.432912111 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.432975054 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.432979107 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.434195995 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.434267998 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.434331894 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.434338093 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.434376001 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.435451031 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.436744928 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.436770916 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.436793089 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.436799049 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.436835051 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.438101053 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.439426899 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.439481020 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.439487934 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.440701962 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.440735102 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.440781116 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.440793991 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.441039085 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.441960096 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.443583012 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.443619967 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.443633080 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.443644047 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.443706989 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.444791079 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.445853949 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.445905924 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.446033955 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.446048021 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.446090937 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.447117090 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.448492050 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.448549986 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.448563099 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.449722052 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.449805021 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.449817896 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.450949907 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.451036930 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.451095104 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.451108932 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.451148987 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.452214003 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.453489065 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.453566074 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.453573942 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.453603983 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.453651905 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.454720974 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.455916882 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.455979109 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.455991030 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.457149982 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.457205057 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.457217932 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.458358049 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.458446026 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.458501101 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.458519936 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.458561897 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.458568096 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.459635973 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.459688902 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.459701061 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.460745096 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.460799932 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.460810900 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.462008953 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.462074995 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.462088108 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.463423967 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.463479042 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.463485956 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.464452982 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.464517117 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.464528084 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.465396881 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.466500044 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.466509104 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.466628075 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.466691017 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.466697931 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.467735052 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.467895031 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.467901945 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.468801022 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.468869925 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.468878031 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.469911098 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.470038891 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.470047951 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.471097946 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.471158981 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.471173048 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.472184896 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.472477913 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.472485065 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.473438025 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.473494053 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.473500967 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.474447966 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.474495888 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.474503040 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.475596905 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.475661993 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.475668907 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.476648092 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.477734089 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.477763891 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.477801085 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.477812052 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.477834940 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.478844881 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.478899956 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.478907108 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.480091095 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.480943918 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.480998039 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.481004953 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.481014967 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.481036901 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.482042074 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.483164072 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.483211994 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.483349085 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.483377934 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.484229088 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.484311104 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.484328032 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.485265017 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.486320019 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.486381054 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.486407042 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.486444950 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.486452103 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.487333059 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.488199949 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.488214016 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.488348961 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.488552094 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.488559961 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.489584923 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.490416050 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.490453959 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.490478992 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.490494013 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.490516901 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.491493940 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.492150068 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.492163897 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.492455959 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.492800951 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.492811918 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.493535042 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.494540930 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.494586945 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.494601011 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.494640112 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.494645119 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.496438980 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.496495962 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.496514082 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.496555090 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.497505903 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.497558117 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.497562885 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.497580051 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.497601032 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.498541117 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.499516964 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.499564886 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.499574900 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.499586105 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.499614954 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.500632048 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.500688076 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.500699997 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.501863003 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.502480984 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.502521992 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.502537966 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.502549887 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.503536940 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.503566027 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.503592014 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.503597975 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.504638910 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.504713058 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.504720926 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.505584955 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.506460905 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.506506920 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.506521940 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.506556988 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.506680965 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.507477999 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.507528067 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.507539988 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.508443117 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.508959055 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.508972883 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.509427071 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.509579897 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.509592056 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.510360003 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.510423899 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.510437012 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.511301994 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.511383057 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.511392117 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.512423038 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.512478113 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.512490988 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.513320923 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.514286995 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.514353037 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.514373064 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.514413118 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.514425993 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.515218973 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.515371084 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.515391111 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.516064882 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.516130924 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.516140938 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.517509937 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.517560005 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.517566919 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.517580032 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.517613888 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.518393040 CEST	443	49755	13.249.98.124	192.168.2.4
Apr 26, 2024 07:43:01.518467903 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.518619061 CEST	443	49755	13.249.98.124	192.168.2.4
Apr 26, 2024 07:43:01.518686056 CEST	49755	443	192.168.2.4	13.249.98.124
Apr 26, 2024 07:43:01.519354105 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.519406080 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.519437075 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.519462109 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.519670963 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.520327091 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.520461082 CEST	49755	443	192.168.2.4	13.249.98.124
Apr 26, 2024 07:43:01.520478964 CEST	443	49755	13.249.98.124	192.168.2.4
Apr 26, 2024 07:43:01.521306992 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.521361113 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.521368027 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.521390915 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.521594048 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.522332907 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.523221016 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.523277998 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.523292065 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.523308039 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.523339033 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.524030924 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.525023937 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.525077105 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.525090933 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.525114059 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.525922060 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.525973082 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.525993109 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.526036024 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.526823997 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.527708054 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.527745962 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.527769089 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.527791977 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.527955055 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.528670073 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.529589891 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.529630899 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.529643059 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.529664993 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.529947042 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.530467987 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.531313896 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.531363964 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.531383991 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.532207012 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.532258987 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.532268047 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.532290936 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.532504082 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.533152103 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.534025908 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.534090996 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.534109116 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.534975052 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.535024881 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.535043001 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.535768032 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.535821915 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.535821915 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.535840034 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.536034107 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.537051916 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.537626982 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.537668943 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.537699938 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.537722111 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.537763119 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.538431883 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.539336920 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.539400101 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.539419889 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.540277004 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.540335894 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.540355921 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.540801048 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.541256905 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.541274071 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.541659117 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.541704893 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.541717052 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.542526960 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.542582035 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.542598963 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.543564081 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.543710947 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.543724060 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.544219017 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.544279099 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.544285059 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.546176910 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.546231985 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.546238899 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.546408892 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.546583891 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.546591043 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.547565937 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.547643900 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.547703981 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.547712088 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.547755003 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.548383951 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.549216032 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.549285889 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.549307108 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.550029993 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.550092936 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.550148964 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.550169945 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.550209999 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.550890923 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.551732063 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.551789999 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.551795006 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.551817894 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.551971912 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.552604914 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.553019047 CEST	49761	443	192.168.2.4	13.249.98.78
Apr 26, 2024 07:43:01.553059101 CEST	443	49761	13.249.98.78	192.168.2.4
Apr 26, 2024 07:43:01.553435087 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.553488970 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.553505898 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.553524971 CEST	49761	443	192.168.2.4	13.249.98.78
Apr 26, 2024 07:43:01.554011106 CEST	49761	443	192.168.2.4	13.249.98.78
Apr 26, 2024 07:43:01.554028988 CEST	443	49761	13.249.98.78	192.168.2.4
Apr 26, 2024 07:43:01.554225922 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.554281950 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.554284096 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.554294109 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.554339886 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.555258036 CEST	443	49758	13.249.98.124	192.168.2.4
Apr 26, 2024 07:43:01.555285931 CEST	443	49758	13.249.98.124	192.168.2.4
Apr 26, 2024 07:43:01.555335999 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.555335045 CEST	49758	443	192.168.2.4	13.249.98.124
Apr 26, 2024 07:43:01.555363894 CEST	443	49758	13.249.98.124	192.168.2.4
Apr 26, 2024 07:43:01.555459023 CEST	443	49758	13.249.98.124	192.168.2.4
Apr 26, 2024 07:43:01.555501938 CEST	49758	443	192.168.2.4	13.249.98.124
Apr 26, 2024 07:43:01.555929899 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.555970907 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.555980921 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.556001902 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.556515932 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.556675911 CEST	49758	443	192.168.2.4	13.249.98.124
Apr 26, 2024 07:43:01.556701899 CEST	443	49758	13.249.98.124	192.168.2.4
Apr 26, 2024 07:43:01.556773901 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.557583094 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.557643890 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.557643890 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.557672024 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.557713985 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.558423042 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.559174061 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.559216022 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.559264898 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.559286118 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.559330940 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.560147047 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.560904980 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.560947895 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.560969114 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.560992002 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.561043024 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.561619043 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.562129021 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.562829971 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.562851906 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.562988997 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.563066006 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.563075066 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.563843966 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.563898087 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.563916922 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.564543962 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.564589977 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.564609051 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.565395117 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.565443039 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.565462112 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.566241026 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.566304922 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.566323996 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.566973925 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.567063093 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.567080021 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.567867994 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.568077087 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.568097115 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.568541050 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.568602085 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.568608999 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.569386959 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.569444895 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.569452047 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.570195913 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.570256948 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.570266962 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.570931911 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.571275949 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.571294069 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.571727991 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.571774006 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.571789980 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.572467089 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.572520971 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.572540045 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.573254108 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.573925972 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.573997974 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.574001074 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.574023008 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.574070930 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.574754000 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.575300932 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.575321913 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.575556040 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.575606108 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.575617075 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.576364040 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.576414108 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.576431990 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.576992989 CEST	49763	443	192.168.2.4	108.157.173.24
Apr 26, 2024 07:43:01.577023983 CEST	443	49763	108.157.173.24	192.168.2.4
Apr 26, 2024 07:43:01.577086926 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.577130079 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.577146053 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.577152967 CEST	49763	443	192.168.2.4	108.157.173.24
Apr 26, 2024 07:43:01.577950001 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.578011036 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.578028917 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.578121901 CEST	49763	443	192.168.2.4	108.157.173.24
Apr 26, 2024 07:43:01.578131914 CEST	443	49763	108.157.173.24	192.168.2.4
Apr 26, 2024 07:43:01.578671932 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.578722000 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.578738928 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.579395056 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.579454899 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.579471111 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.580198050 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.580281973 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.580297947 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.580979109 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.581078053 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.581094980 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.581979990 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.582031012 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.582088947 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.582110882 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.582158089 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.582807064 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.583498955 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.583573103 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.583633900 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.583656073 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.583700895 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.584297895 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.584995031 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.585051060 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.585073948 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.585769892 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.585829973 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.585839033 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.585851908 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.585892916 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.586522102 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.587305069 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.587359905 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.587392092 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.587414026 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.587456942 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.588018894 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.588772058 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.588844061 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.588898897 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.588922024 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.588964939 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.589452982 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.590234041 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.590281010 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.590301991 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.590985060 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.591059923 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.591103077 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.591114998 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.591166973 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.591775894 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.592410088 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.592456102 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.592466116 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.593180895 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.593239069 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.593246937 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.593849897 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.593902111 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.593910933 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.594564915 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.594633102 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.594683886 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.594696045 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.594769001 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.595288992 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.596034050 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.596085072 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.596091986 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.596784115 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.596833944 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.596852064 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.596859932 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.596997023 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.597480059 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.598216057 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.598298073 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.598325014 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.598334074 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.598371983 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.598910093 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.600411892 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.600469112 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.600476027 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.600630045 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.600682974 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.600689888 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.600845098 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.600892067 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.600898027 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.601465940 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.601541042 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.601547003 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.602152109 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.602197886 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.602204084 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.603245020 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.603302002 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.603308916 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.603610992 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.603661060 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.603667021 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.604384899 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.604880095 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.604887009 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.604990959 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.605448008 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.605454922 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.605773926 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.605827093 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.605834007 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.606542110 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.606606007 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.606616020 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.607060909 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.607233047 CEST	443	49759	13.249.98.78	192.168.2.4
Apr 26, 2024 07:43:01.607244015 CEST	443	49759	13.249.98.78	192.168.2.4
Apr 26, 2024 07:43:01.607265949 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.607271910 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.607310057 CEST	49759	443	192.168.2.4	13.249.98.78
Apr 26, 2024 07:43:01.607314110 CEST	443	49759	13.249.98.78	192.168.2.4
Apr 26, 2024 07:43:01.607322931 CEST	443	49759	13.249.98.78	192.168.2.4
Apr 26, 2024 07:43:01.607374907 CEST	49759	443	192.168.2.4	13.249.98.78
Apr 26, 2024 07:43:01.607777119 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.607827902 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.607842922 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.608556986 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.608619928 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.608625889 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.609159946 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.609213114 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.609219074 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.609868050 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.609929085 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.609936953 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.610594988 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.610641956 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.610650063 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.611243963 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.611495972 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.611505032 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.611974955 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.612422943 CEST	49759	443	192.168.2.4	13.249.98.78
Apr 26, 2024 07:43:01.612446070 CEST	443	49759	13.249.98.78	192.168.2.4
Apr 26, 2024 07:43:01.612456083 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.612462044 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.612643957 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.612848043 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.612854958 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.613270044 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.613338947 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.613346100 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.614450932 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.614527941 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.614535093 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.614913940 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.614970922 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.614978075 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.615338087 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.615405083 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.615411043 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.616081953 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.616132975 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.616139889 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.616760969 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.616898060 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.616904020 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.617387056 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.617434978 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.617441893 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.618257046 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.618318081 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.618324041 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.618339062 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.618824959 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.618961096 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.619671106 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.619726896 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.619734049 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.620304108 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.620368004 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.620374918 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.620975018 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.621018887 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.621069908 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.621078014 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.621118069 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.621568918 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.622262001 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.622332096 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.622356892 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.622364044 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.622402906 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.622968912 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.623605967 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.623655081 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.623738050 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.623744011 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.623789072 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.624258995 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.624938011 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.625057936 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.625109911 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.625117064 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.625169039 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.625600100 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.625828028 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.625885010 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.625891924 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.626920938 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.627046108 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.627053022 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.627756119 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.627804041 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.627826929 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.627834082 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.627871037 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.628521919 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.628694057 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.628739119 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.628746033 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.629589081 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.629777908 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.629832983 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.629839897 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.629879951 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.630422115 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.631283998 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.631333113 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.631340027 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.631581068 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.631632090 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.631638050 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.632379055 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.632417917 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.632441044 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.632451057 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.633277893 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.633337021 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.633344889 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.633383989 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.633392096 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.634324074 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.634382963 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.634390116 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.634877920 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.634923935 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.634927034 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.634937048 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.635289907 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.635296106 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.638768911 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.638796091 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.638926029 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.638926029 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.638952971 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.639025927 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.642504930 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.642529964 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.642569065 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.642597914 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.642610073 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.646831989 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.646859884 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.646945953 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.646945953 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.646967888 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.650557041 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.650578976 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.650619030 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.650629997 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.650645971 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.654001951 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.654032946 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.654072046 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.654081106 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.654119968 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.658287048 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.658308029 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.658353090 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.658377886 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.658396959 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.661758900 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.661783934 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.661829948 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.661845922 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.661875010 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.665072918 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.665095091 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.665137053 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.665169001 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.665200949 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.668474913 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.668499947 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.668544054 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.668566942 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.668602943 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.672492981 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.672516108 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.672558069 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.672581911 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.672610998 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.675715923 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.675744057 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.675796986 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.675820112 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.675837040 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.679045916 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.679064989 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.679104090 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.679122925 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.679142952 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.682760000 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.682791948 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.682828903 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.682847023 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.682863951 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.685887098 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.685911894 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.685957909 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.685973883 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.685986996 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.689038038 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.689066887 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.689102888 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.689131021 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.689146996 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.692071915 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.692092896 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.692127943 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.692145109 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.692161083 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.695631981 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.695662022 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.695707083 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.695729971 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.695746899 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.698491096 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.698533058 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.698575974 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.698590994 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.698616982 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.700299025 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.700368881 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.700385094 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.700476885 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.700485945 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.700524092 CEST	443	49751	192.178.50.65	192.168.2.4
Apr 26, 2024 07:43:01.700527906 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.700563908 CEST	49751	443	192.168.2.4	192.178.50.65
Apr 26, 2024 07:43:01.808872938 CEST	443	49761	13.249.98.78	192.168.2.4
Apr 26, 2024 07:43:01.809242010 CEST	49761	443	192.168.2.4	13.249.98.78
Apr 26, 2024 07:43:01.809278011 CEST	443	49761	13.249.98.78	192.168.2.4
Apr 26, 2024 07:43:01.809627056 CEST	443	49761	13.249.98.78	192.168.2.4
Apr 26, 2024 07:43:01.810405016 CEST	49761	443	192.168.2.4	13.249.98.78
Apr 26, 2024 07:43:01.810472012 CEST	443	49761	13.249.98.78	192.168.2.4
Apr 26, 2024 07:43:01.810537100 CEST	49761	443	192.168.2.4	13.249.98.78
Apr 26, 2024 07:43:01.834769964 CEST	443	49763	108.157.173.24	192.168.2.4
Apr 26, 2024 07:43:01.837452888 CEST	49763	443	192.168.2.4	108.157.173.24
Apr 26, 2024 07:43:01.837471962 CEST	443	49763	108.157.173.24	192.168.2.4
Apr 26, 2024 07:43:01.838536024 CEST	443	49763	108.157.173.24	192.168.2.4
Apr 26, 2024 07:43:01.838792086 CEST	49763	443	192.168.2.4	108.157.173.24
Apr 26, 2024 07:43:01.841375113 CEST	49763	443	192.168.2.4	108.157.173.24
Apr 26, 2024 07:43:01.841437101 CEST	443	49763	108.157.173.24	192.168.2.4
Apr 26, 2024 07:43:01.841578960 CEST	49763	443	192.168.2.4	108.157.173.24
Apr 26, 2024 07:43:01.852121115 CEST	443	49761	13.249.98.78	192.168.2.4
Apr 26, 2024 07:43:01.858025074 CEST	49761	443	192.168.2.4	13.249.98.78
Apr 26, 2024 07:43:01.888109922 CEST	443	49763	108.157.173.24	192.168.2.4
Apr 26, 2024 07:43:01.889343023 CEST	49763	443	192.168.2.4	108.157.173.24
Apr 26, 2024 07:43:01.889348030 CEST	443	49763	108.157.173.24	192.168.2.4
Apr 26, 2024 07:43:01.905064106 CEST	49725	80	192.168.2.4	152.195.50.149
Apr 26, 2024 07:43:01.936134100 CEST	49763	443	192.168.2.4	108.157.173.24
Apr 26, 2024 07:43:02.029628038 CEST	80	49725	152.195.50.149	192.168.2.4
Apr 26, 2024 07:43:02.029670000 CEST	49725	80	192.168.2.4	152.195.50.149
Apr 26, 2024 07:43:02.114321947 CEST	443	49763	108.157.173.24	192.168.2.4
Apr 26, 2024 07:43:02.114398956 CEST	443	49763	108.157.173.24	192.168.2.4
Apr 26, 2024 07:43:02.114528894 CEST	49763	443	192.168.2.4	108.157.173.24
Apr 26, 2024 07:43:02.115309000 CEST	49763	443	192.168.2.4	108.157.173.24
Apr 26, 2024 07:43:02.115322113 CEST	443	49763	108.157.173.24	192.168.2.4
Apr 26, 2024 07:43:02.126967907 CEST	443	49761	13.249.98.78	192.168.2.4
Apr 26, 2024 07:43:02.127051115 CEST	443	49761	13.249.98.78	192.168.2.4
Apr 26, 2024 07:43:02.127111912 CEST	49761	443	192.168.2.4	13.249.98.78
Apr 26, 2024 07:43:02.128357887 CEST	49761	443	192.168.2.4	13.249.98.78
Apr 26, 2024 07:43:02.128374100 CEST	443	49761	13.249.98.78	192.168.2.4
Apr 26, 2024 07:43:02.909354925 CEST	49766	443	192.168.2.4	142.250.217.228
Apr 26, 2024 07:43:02.909385920 CEST	443	49766	142.250.217.228	192.168.2.4
Apr 26, 2024 07:43:02.909446001 CEST	49766	443	192.168.2.4	142.250.217.228
Apr 26, 2024 07:43:02.909723997 CEST	49766	443	192.168.2.4	142.250.217.228
Apr 26, 2024 07:43:02.909740925 CEST	443	49766	142.250.217.228	192.168.2.4
Apr 26, 2024 07:43:03.300012112 CEST	443	49766	142.250.217.228	192.168.2.4
Apr 26, 2024 07:43:03.300256014 CEST	49766	443	192.168.2.4	142.250.217.228
Apr 26, 2024 07:43:03.300270081 CEST	443	49766	142.250.217.228	192.168.2.4
Apr 26, 2024 07:43:03.302848101 CEST	443	49766	142.250.217.228	192.168.2.4
Apr 26, 2024 07:43:03.302934885 CEST	49766	443	192.168.2.4	142.250.217.228
Apr 26, 2024 07:43:03.303956032 CEST	49766	443	192.168.2.4	142.250.217.228
Apr 26, 2024 07:43:03.304017067 CEST	443	49766	142.250.217.228	192.168.2.4
Apr 26, 2024 07:43:03.357105970 CEST	49766	443	192.168.2.4	142.250.217.228
Apr 26, 2024 07:43:03.357120037 CEST	443	49766	142.250.217.228	192.168.2.4
Apr 26, 2024 07:43:03.407660007 CEST	49766	443	192.168.2.4	142.250.217.228
Apr 26, 2024 07:43:03.823983908 CEST	49767	443	192.168.2.4	23.193.120.112
Apr 26, 2024 07:43:03.824022055 CEST	443	49767	23.193.120.112	192.168.2.4
Apr 26, 2024 07:43:03.824110985 CEST	49767	443	192.168.2.4	23.193.120.112
Apr 26, 2024 07:43:03.825445890 CEST	49767	443	192.168.2.4	23.193.120.112
Apr 26, 2024 07:43:03.825460911 CEST	443	49767	23.193.120.112	192.168.2.4
Apr 26, 2024 07:43:04.084922075 CEST	443	49767	23.193.120.112	192.168.2.4
Apr 26, 2024 07:43:04.085009098 CEST	49767	443	192.168.2.4	23.193.120.112
Apr 26, 2024 07:43:04.086672068 CEST	49767	443	192.168.2.4	23.193.120.112
Apr 26, 2024 07:43:04.086682081 CEST	443	49767	23.193.120.112	192.168.2.4
Apr 26, 2024 07:43:04.086914062 CEST	443	49767	23.193.120.112	192.168.2.4
Apr 26, 2024 07:43:04.136487007 CEST	49767	443	192.168.2.4	23.193.120.112
Apr 26, 2024 07:43:04.180115938 CEST	443	49767	23.193.120.112	192.168.2.4
Apr 26, 2024 07:43:04.329117060 CEST	443	49767	23.193.120.112	192.168.2.4
Apr 26, 2024 07:43:04.329242945 CEST	443	49767	23.193.120.112	192.168.2.4
Apr 26, 2024 07:43:04.329313040 CEST	49767	443	192.168.2.4	23.193.120.112
Apr 26, 2024 07:43:04.358992100 CEST	49767	443	192.168.2.4	23.193.120.112
Apr 26, 2024 07:43:04.359078884 CEST	443	49767	23.193.120.112	192.168.2.4
Apr 26, 2024 07:43:04.396763086 CEST	49768	443	192.168.2.4	23.193.120.112
Apr 26, 2024 07:43:04.396794081 CEST	443	49768	23.193.120.112	192.168.2.4
Apr 26, 2024 07:43:04.397043943 CEST	49768	443	192.168.2.4	23.193.120.112
Apr 26, 2024 07:43:04.397245884 CEST	49768	443	192.168.2.4	23.193.120.112
Apr 26, 2024 07:43:04.397254944 CEST	443	49768	23.193.120.112	192.168.2.4
Apr 26, 2024 07:43:04.518891096 CEST	49770	443	192.168.2.4	192.178.50.46
Apr 26, 2024 07:43:04.518929958 CEST	443	49770	192.178.50.46	192.168.2.4
Apr 26, 2024 07:43:04.518981934 CEST	49770	443	192.168.2.4	192.178.50.46
Apr 26, 2024 07:43:04.519190073 CEST	49770	443	192.168.2.4	192.178.50.46
Apr 26, 2024 07:43:04.519211054 CEST	443	49770	192.178.50.46	192.168.2.4
Apr 26, 2024 07:43:04.658211946 CEST	443	49768	23.193.120.112	192.168.2.4
Apr 26, 2024 07:43:04.658322096 CEST	49768	443	192.168.2.4	23.193.120.112
Apr 26, 2024 07:43:04.659446001 CEST	49768	443	192.168.2.4	23.193.120.112
Apr 26, 2024 07:43:04.659451962 CEST	443	49768	23.193.120.112	192.168.2.4
Apr 26, 2024 07:43:04.659691095 CEST	443	49768	23.193.120.112	192.168.2.4
Apr 26, 2024 07:43:04.660876036 CEST	49768	443	192.168.2.4	23.193.120.112
Apr 26, 2024 07:43:04.708112955 CEST	443	49768	23.193.120.112	192.168.2.4
Apr 26, 2024 07:43:04.906352043 CEST	443	49768	23.193.120.112	192.168.2.4
Apr 26, 2024 07:43:04.906428099 CEST	443	49768	23.193.120.112	192.168.2.4
Apr 26, 2024 07:43:04.906537056 CEST	49768	443	192.168.2.4	23.193.120.112
Apr 26, 2024 07:43:04.910423040 CEST	443	49770	192.178.50.46	192.168.2.4
Apr 26, 2024 07:43:04.914170027 CEST	49770	443	192.168.2.4	192.178.50.46
Apr 26, 2024 07:43:04.914194107 CEST	443	49770	192.178.50.46	192.168.2.4
Apr 26, 2024 07:43:04.915497065 CEST	443	49770	192.178.50.46	192.168.2.4
Apr 26, 2024 07:43:04.915572882 CEST	49770	443	192.168.2.4	192.178.50.46
Apr 26, 2024 07:43:04.915915012 CEST	49768	443	192.168.2.4	23.193.120.112
Apr 26, 2024 07:43:04.915950060 CEST	443	49768	23.193.120.112	192.168.2.4
Apr 26, 2024 07:43:04.915981054 CEST	49768	443	192.168.2.4	23.193.120.112
Apr 26, 2024 07:43:04.915986061 CEST	443	49768	23.193.120.112	192.168.2.4
Apr 26, 2024 07:43:04.918171883 CEST	443	49770	192.178.50.46	192.168.2.4
Apr 26, 2024 07:43:04.918230057 CEST	49770	443	192.168.2.4	192.178.50.46
Apr 26, 2024 07:43:04.919111967 CEST	49770	443	192.168.2.4	192.178.50.46
Apr 26, 2024 07:43:04.919213057 CEST	443	49770	192.178.50.46	192.168.2.4
Apr 26, 2024 07:43:04.919254065 CEST	49770	443	192.168.2.4	192.178.50.46
Apr 26, 2024 07:43:04.964138031 CEST	443	49770	192.178.50.46	192.168.2.4
Apr 26, 2024 07:43:04.966242075 CEST	49770	443	192.168.2.4	192.178.50.46
Apr 26, 2024 07:43:04.966254950 CEST	443	49770	192.178.50.46	192.168.2.4
Apr 26, 2024 07:43:05.013117075 CEST	49770	443	192.168.2.4	192.178.50.46
Apr 26, 2024 07:43:05.555392027 CEST	443	49770	192.178.50.46	192.168.2.4
Apr 26, 2024 07:43:05.555421114 CEST	443	49770	192.178.50.46	192.168.2.4
Apr 26, 2024 07:43:05.555484056 CEST	49770	443	192.168.2.4	192.178.50.46
Apr 26, 2024 07:43:05.555514097 CEST	443	49770	192.178.50.46	192.168.2.4
Apr 26, 2024 07:43:05.562621117 CEST	443	49770	192.178.50.46	192.168.2.4
Apr 26, 2024 07:43:05.562695026 CEST	49770	443	192.168.2.4	192.178.50.46
Apr 26, 2024 07:43:05.562702894 CEST	443	49770	192.178.50.46	192.168.2.4
Apr 26, 2024 07:43:05.575442076 CEST	443	49770	192.178.50.46	192.168.2.4
Apr 26, 2024 07:43:05.575542927 CEST	49770	443	192.168.2.4	192.178.50.46
Apr 26, 2024 07:43:05.575553894 CEST	443	49770	192.178.50.46	192.168.2.4
Apr 26, 2024 07:43:05.581518888 CEST	443	49770	192.178.50.46	192.168.2.4
Apr 26, 2024 07:43:05.581600904 CEST	49770	443	192.168.2.4	192.178.50.46
Apr 26, 2024 07:43:05.581713915 CEST	49770	443	192.168.2.4	192.178.50.46
Apr 26, 2024 07:43:05.581732035 CEST	443	49770	192.178.50.46	192.168.2.4
Apr 26, 2024 07:43:13.294980049 CEST	443	49766	142.250.217.228	192.168.2.4
Apr 26, 2024 07:43:13.295058966 CEST	443	49766	142.250.217.228	192.168.2.4
Apr 26, 2024 07:43:13.295900106 CEST	49766	443	192.168.2.4	142.250.217.228
Apr 26, 2024 07:43:13.672420979 CEST	49766	443	192.168.2.4	142.250.217.228
Apr 26, 2024 07:43:13.672436953 CEST	443	49766	142.250.217.228	192.168.2.4
Apr 26, 2024 07:43:14.688987017 CEST	49771	443	192.168.2.4	13.85.23.86
Apr 26, 2024 07:43:14.689028978 CEST	443	49771	13.85.23.86	192.168.2.4
Apr 26, 2024 07:43:14.689093113 CEST	49771	443	192.168.2.4	13.85.23.86
Apr 26, 2024 07:43:14.689620018 CEST	49771	443	192.168.2.4	13.85.23.86
Apr 26, 2024 07:43:14.689632893 CEST	443	49771	13.85.23.86	192.168.2.4
Apr 26, 2024 07:43:15.186134100 CEST	443	49771	13.85.23.86	192.168.2.4
Apr 26, 2024 07:43:15.186220884 CEST	49771	443	192.168.2.4	13.85.23.86
Apr 26, 2024 07:43:15.188476086 CEST	49771	443	192.168.2.4	13.85.23.86
Apr 26, 2024 07:43:15.188488007 CEST	443	49771	13.85.23.86	192.168.2.4
Apr 26, 2024 07:43:15.188808918 CEST	443	49771	13.85.23.86	192.168.2.4
Apr 26, 2024 07:43:15.199985981 CEST	49771	443	192.168.2.4	13.85.23.86
Apr 26, 2024 07:43:15.244124889 CEST	443	49771	13.85.23.86	192.168.2.4
Apr 26, 2024 07:43:15.660588026 CEST	443	49771	13.85.23.86	192.168.2.4
Apr 26, 2024 07:43:15.660633087 CEST	443	49771	13.85.23.86	192.168.2.4
Apr 26, 2024 07:43:15.660650015 CEST	443	49771	13.85.23.86	192.168.2.4
Apr 26, 2024 07:43:15.660708904 CEST	49771	443	192.168.2.4	13.85.23.86
Apr 26, 2024 07:43:15.660728931 CEST	443	49771	13.85.23.86	192.168.2.4
Apr 26, 2024 07:43:15.660777092 CEST	49771	443	192.168.2.4	13.85.23.86
Apr 26, 2024 07:43:15.660917044 CEST	443	49771	13.85.23.86	192.168.2.4
Apr 26, 2024 07:43:15.660950899 CEST	443	49771	13.85.23.86	192.168.2.4
Apr 26, 2024 07:43:15.660973072 CEST	49771	443	192.168.2.4	13.85.23.86
Apr 26, 2024 07:43:15.660976887 CEST	443	49771	13.85.23.86	192.168.2.4
Apr 26, 2024 07:43:15.661016941 CEST	49771	443	192.168.2.4	13.85.23.86
Apr 26, 2024 07:43:15.661020994 CEST	443	49771	13.85.23.86	192.168.2.4
Apr 26, 2024 07:43:15.661067009 CEST	443	49771	13.85.23.86	192.168.2.4
Apr 26, 2024 07:43:15.661108971 CEST	49771	443	192.168.2.4	13.85.23.86
Apr 26, 2024 07:43:15.666909933 CEST	49771	443	192.168.2.4	13.85.23.86
Apr 26, 2024 07:43:15.666929007 CEST	443	49771	13.85.23.86	192.168.2.4
Apr 26, 2024 07:43:15.666950941 CEST	49771	443	192.168.2.4	13.85.23.86
Apr 26, 2024 07:43:15.666955948 CEST	443	49771	13.85.23.86	192.168.2.4
Apr 26, 2024 07:43:29.036658049 CEST	80	49747	108.157.173.24	192.168.2.4
Apr 26, 2024 07:43:29.036745071 CEST	49747	80	192.168.2.4	108.157.173.24
Apr 26, 2024 07:43:29.037153006 CEST	80	49746	108.157.173.24	192.168.2.4
Apr 26, 2024 07:43:29.037247896 CEST	49746	80	192.168.2.4	108.157.173.24
Apr 26, 2024 07:43:29.693387985 CEST	49746	80	192.168.2.4	108.157.173.24
Apr 26, 2024 07:43:29.693449020 CEST	49747	80	192.168.2.4	108.157.173.24
Apr 26, 2024 07:43:29.818193913 CEST	80	49746	108.157.173.24	192.168.2.4
Apr 26, 2024 07:43:29.818238974 CEST	80	49747	108.157.173.24	192.168.2.4
Apr 26, 2024 07:43:30.016257048 CEST	49723	80	192.168.2.4	23.45.182.77
Apr 26, 2024 07:43:30.017227888 CEST	49724	80	192.168.2.4	23.45.182.69
Apr 26, 2024 07:43:30.141289949 CEST	80	49723	23.45.182.77	192.168.2.4
Apr 26, 2024 07:43:30.141379118 CEST	49723	80	192.168.2.4	23.45.182.77
Apr 26, 2024 07:43:30.146775961 CEST	80	49724	23.45.182.69	192.168.2.4
Apr 26, 2024 07:43:30.148232937 CEST	49724	80	192.168.2.4	23.45.182.69
Apr 26, 2024 07:43:44.045523882 CEST	49745	80	192.168.2.4	108.157.173.24
Apr 26, 2024 07:43:44.169537067 CEST	80	49745	108.157.173.24	192.168.2.4
Apr 26, 2024 07:44:02.827363014 CEST	49773	443	192.168.2.4	142.250.217.228
Apr 26, 2024 07:44:02.827410936 CEST	443	49773	142.250.217.228	192.168.2.4
Apr 26, 2024 07:44:02.827537060 CEST	49773	443	192.168.2.4	142.250.217.228
Apr 26, 2024 07:44:02.827750921 CEST	49773	443	192.168.2.4	142.250.217.228
Apr 26, 2024 07:44:02.827770948 CEST	443	49773	142.250.217.228	192.168.2.4
Apr 26, 2024 07:44:03.155102015 CEST	443	49773	142.250.217.228	192.168.2.4
Apr 26, 2024 07:44:03.155448914 CEST	49773	443	192.168.2.4	142.250.217.228
Apr 26, 2024 07:44:03.155467033 CEST	443	49773	142.250.217.228	192.168.2.4
Apr 26, 2024 07:44:03.155807018 CEST	443	49773	142.250.217.228	192.168.2.4
Apr 26, 2024 07:44:03.156204939 CEST	49773	443	192.168.2.4	142.250.217.228
Apr 26, 2024 07:44:03.156270027 CEST	443	49773	142.250.217.228	192.168.2.4
Apr 26, 2024 07:44:03.201066017 CEST	49773	443	192.168.2.4	142.250.217.228
Apr 26, 2024 07:44:13.190537930 CEST	443	49773	142.250.217.228	192.168.2.4
Apr 26, 2024 07:44:13.190614939 CEST	443	49773	142.250.217.228	192.168.2.4
Apr 26, 2024 07:44:13.190963984 CEST	49773	443	192.168.2.4	142.250.217.228
Apr 26, 2024 07:44:13.672450066 CEST	49773	443	192.168.2.4	142.250.217.228
Apr 26, 2024 07:44:13.672480106 CEST	443	49773	142.250.217.228	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 26, 2024 07:42:20.620439053 CEST	57935	53	192.168.2.4	1.1.1.1
Apr 26, 2024 07:42:20.783103943 CEST	53	57935	1.1.1.1	192.168.2.4
Apr 26, 2024 07:42:41.601035118 CEST	138	138	192.168.2.4	192.168.2.255
Apr 26, 2024 07:42:58.504651070 CEST	57917	53	192.168.2.4	1.1.1.1
Apr 26, 2024 07:42:58.504765987 CEST	53994	53	192.168.2.4	1.1.1.1
Apr 26, 2024 07:42:58.630494118 CEST	53	62457	1.1.1.1	192.168.2.4
Apr 26, 2024 07:42:58.634149075 CEST	53	57917	1.1.1.1	192.168.2.4
Apr 26, 2024 07:42:58.637898922 CEST	53	53994	1.1.1.1	192.168.2.4
Apr 26, 2024 07:42:58.682163954 CEST	53	50996	1.1.1.1	192.168.2.4
Apr 26, 2024 07:42:59.037771940 CEST	56369	53	192.168.2.4	1.1.1.1
Apr 26, 2024 07:42:59.037904024 CEST	62517	53	192.168.2.4	1.1.1.1
Apr 26, 2024 07:42:59.165827036 CEST	53	56369	1.1.1.1	192.168.2.4
Apr 26, 2024 07:42:59.166295052 CEST	53	62517	1.1.1.1	192.168.2.4
Apr 26, 2024 07:42:59.623853922 CEST	59144	53	192.168.2.4	1.1.1.1
Apr 26, 2024 07:42:59.624206066 CEST	62976	53	192.168.2.4	1.1.1.1
Apr 26, 2024 07:42:59.748660088 CEST	53	59144	1.1.1.1	192.168.2.4
Apr 26, 2024 07:42:59.749422073 CEST	53	62976	1.1.1.1	192.168.2.4
Apr 26, 2024 07:42:59.912571907 CEST	63352	53	192.168.2.4	1.1.1.1
Apr 26, 2024 07:42:59.912728071 CEST	62621	53	192.168.2.4	1.1.1.1
Apr 26, 2024 07:42:59.916140079 CEST	63244	53	192.168.2.4	1.1.1.1
Apr 26, 2024 07:42:59.916516066 CEST	61445	53	192.168.2.4	1.1.1.1
Apr 26, 2024 07:43:00.044639111 CEST	53	61445	1.1.1.1	192.168.2.4
Apr 26, 2024 07:43:00.056727886 CEST	53	49474	1.1.1.1	192.168.2.4
Apr 26, 2024 07:43:00.060882092 CEST	53	63244	1.1.1.1	192.168.2.4
Apr 26, 2024 07:43:00.099720001 CEST	53	62621	1.1.1.1	192.168.2.4
Apr 26, 2024 07:43:00.107503891 CEST	53	63352	1.1.1.1	192.168.2.4
Apr 26, 2024 07:43:00.780458927 CEST	55239	53	192.168.2.4	1.1.1.1
Apr 26, 2024 07:43:00.780846119 CEST	63053	53	192.168.2.4	1.1.1.1
Apr 26, 2024 07:43:00.806551933 CEST	61930	53	192.168.2.4	1.1.1.1
Apr 26, 2024 07:43:00.806672096 CEST	54541	53	192.168.2.4	1.1.1.1
Apr 26, 2024 07:43:00.907563925 CEST	53	55239	1.1.1.1	192.168.2.4
Apr 26, 2024 07:43:00.907850981 CEST	53	63053	1.1.1.1	192.168.2.4
Apr 26, 2024 07:43:00.941181898 CEST	53	61930	1.1.1.1	192.168.2.4
Apr 26, 2024 07:43:01.036196947 CEST	53	54541	1.1.1.1	192.168.2.4
Apr 26, 2024 07:43:01.422599077 CEST	53338	53	192.168.2.4	1.1.1.1
Apr 26, 2024 07:43:01.422785997 CEST	55037	53	192.168.2.4	1.1.1.1
Apr 26, 2024 07:43:01.550498009 CEST	53	53338	1.1.1.1	192.168.2.4
Apr 26, 2024 07:43:01.645312071 CEST	53	55037	1.1.1.1	192.168.2.4
Apr 26, 2024 07:43:01.865204096 CEST	53	50060	1.1.1.1	192.168.2.4
Apr 26, 2024 07:43:02.765089035 CEST	55968	53	192.168.2.4	1.1.1.1
Apr 26, 2024 07:43:02.765213966 CEST	51647	53	192.168.2.4	1.1.1.1
Apr 26, 2024 07:43:02.890152931 CEST	53	51647	1.1.1.1	192.168.2.4
Apr 26, 2024 07:43:02.890537977 CEST	53	55968	1.1.1.1	192.168.2.4
Apr 26, 2024 07:43:04.392204046 CEST	53619	53	192.168.2.4	1.1.1.1
Apr 26, 2024 07:43:04.392348051 CEST	62882	53	192.168.2.4	1.1.1.1
Apr 26, 2024 07:43:04.517396927 CEST	53	58277	1.1.1.1	192.168.2.4
Apr 26, 2024 07:43:04.518404007 CEST	53	62882	1.1.1.1	192.168.2.4
Apr 26, 2024 07:43:04.518419027 CEST	53	53619	1.1.1.1	192.168.2.4
Apr 26, 2024 07:43:18.973505020 CEST	53	62965	1.1.1.1	192.168.2.4
Apr 26, 2024 07:43:38.185092926 CEST	53	54222	1.1.1.1	192.168.2.4
Apr 26, 2024 07:43:58.282268047 CEST	53	57034	1.1.1.1	192.168.2.4
Apr 26, 2024 07:44:01.079168081 CEST	53	64476	1.1.1.1	192.168.2.4

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Apr 26, 2024 07:43:01.036386967 CEST	192.168.2.4	1.1.1.1	c268	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 26, 2024 07:42:20.620439053 CEST	192.168.2.4	1.1.1.1	0xe798	Standard query (0)	content.sweetim.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 07:42:58.504651070 CEST	192.168.2.4	1.1.1.1	0xbfb	Standard query (0)	www.sweetim.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 07:42:58.504765987 CEST	192.168.2.4	1.1.1.1	0xd191	Standard query (0)	www.sweetim.com	65	IN (0x0001)	false
Apr 26, 2024 07:42:59.037771940 CEST	192.168.2.4	1.1.1.1	0x4921	Standard query (0)	www.sweetim.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 07:42:59.037904024 CEST	192.168.2.4	1.1.1.1	0x334c	Standard query (0)	www.sweetim.com	65	IN (0x0001)	false
Apr 26, 2024 07:42:59.623853922 CEST	192.168.2.4	1.1.1.1	0x5f0c	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 07:42:59.624206066 CEST	192.168.2.4	1.1.1.1	0xbf5d	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Apr 26, 2024 07:42:59.912571907 CEST	192.168.2.4	1.1.1.1	0xdda	Standard query (0)	storage2.stgbssint.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 07:42:59.912728071 CEST	192.168.2.4	1.1.1.1	0xe57b	Standard query (0)	storage2.stgbssint.com	65	IN (0x0001)	false
Apr 26, 2024 07:42:59.916140079 CEST	192.168.2.4	1.1.1.1	0xa9ab	Standard query (0)	se-p-static-content.seccint.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 07:42:59.916516066 CEST	192.168.2.4	1.1.1.1	0x6a93	Standard query (0)	se-p-static-content.seccint.com	65	IN (0x0001)	false
Apr 26, 2024 07:43:00.780458927 CEST	192.168.2.4	1.1.1.1	0xf246	Standard query (0)	se-p-static-content.seccint.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 07:43:00.780846119 CEST	192.168.2.4	1.1.1.1	0xad7b	Standard query (0)	se-p-static-content.seccint.com	65	IN (0x0001)	false
Apr 26, 2024 07:43:00.806551933 CEST	192.168.2.4	1.1.1.1	0x48bb	Standard query (0)	storage2.stgbssint.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 07:43:00.806672096 CEST	192.168.2.4	1.1.1.1	0xc707	Standard query (0)	storage2.stgbssint.com	65	IN (0x0001)	false
Apr 26, 2024 07:43:01.422599077 CEST	192.168.2.4	1.1.1.1	0x33cc	Standard query (0)	www.sweetim.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 07:43:01.422785997 CEST	192.168.2.4	1.1.1.1	0x7167	Standard query (0)	www.sweetim.com	65	IN (0x0001)	false
Apr 26, 2024 07:43:02.765089035 CEST	192.168.2.4	1.1.1.1	0x14ff	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 07:43:02.765213966 CEST	192.168.2.4	1.1.1.1	0xc429	Standard query (0)	www.google.com	65	IN (0x0001)	false
Apr 26, 2024 07:43:04.392204046 CEST	192.168.2.4	1.1.1.1	0x3b0f	Standard query (0)	chrome.google.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 07:43:04.392348051 CEST	192.168.2.4	1.1.1.1	0xe923	Standard query (0)	chrome.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 26, 2024 07:42:20.783103943 CEST	1.1.1.1	192.168.2.4	0xe798	No error (0)	content.sweetim.com	mystart.sweetim.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 07:42:20.783103943 CEST	1.1.1.1	192.168.2.4	0xe798	No error (0)	mystart.sweetim.com	d1a7vclbryqy69.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 07:42:20.783103943 CEST	1.1.1.1	192.168.2.4	0xe798	No error (0)	d1a7vclbryqy69.cloudfront.net		13.249.98.125	A (IP address)	IN (0x0001)	false
Apr 26, 2024 07:42:20.783103943 CEST	1.1.1.1	192.168.2.4	0xe798	No error (0)	d1a7vclbryqy69.cloudfront.net		13.249.98.3	A (IP address)	IN (0x0001)	false
Apr 26, 2024 07:42:20.783103943 CEST	1.1.1.1	192.168.2.4	0xe798	No error (0)	d1a7vclbryqy69.cloudfront.net		13.249.98.117	A (IP address)	IN (0x0001)	false
Apr 26, 2024 07:42:20.783103943 CEST	1.1.1.1	192.168.2.4	0xe798	No error (0)	d1a7vclbryqy69.cloudfront.net		13.249.98.99	A (IP address)	IN (0x0001)	false
Apr 26, 2024 07:42:58.634149075 CEST	1.1.1.1	192.168.2.4	0xbfb	No error (0)	www.sweetim.com	d1p1fga02t8l00.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 07:42:58.634149075 CEST	1.1.1.1	192.168.2.4	0xbfb	No error (0)	d1p1fga02t8l00.cloudfront.net		108.157.173.24	A (IP address)	IN (0x0001)	false
Apr 26, 2024 07:42:58.634149075 CEST	1.1.1.1	192.168.2.4	0xbfb	No error (0)	d1p1fga02t8l00.cloudfront.net		108.157.173.45	A (IP address)	IN (0x0001)	false
Apr 26, 2024 07:42:58.634149075 CEST	1.1.1.1	192.168.2.4	0xbfb	No error (0)	d1p1fga02t8l00.cloudfront.net		108.157.173.21	A (IP address)	IN (0x0001)	false
Apr 26, 2024 07:42:58.634149075 CEST	1.1.1.1	192.168.2.4	0xbfb	No error (0)	d1p1fga02t8l00.cloudfront.net		108.157.173.105	A (IP address)	IN (0x0001)	false
Apr 26, 2024 07:42:58.637898922 CEST	1.1.1.1	192.168.2.4	0xd191	No error (0)	www.sweetim.com	d1p1fga02t8l00.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 07:42:59.165827036 CEST	1.1.1.1	192.168.2.4	0x4921	No error (0)	www.sweetim.com	d1p1fga02t8l00.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 07:42:59.165827036 CEST	1.1.1.1	192.168.2.4	0x4921	No error (0)	d1p1fga02t8l00.cloudfront.net		108.157.173.24	A (IP address)	IN (0x0001)	false
Apr 26, 2024 07:42:59.165827036 CEST	1.1.1.1	192.168.2.4	0x4921	No error (0)	d1p1fga02t8l00.cloudfront.net		108.157.173.105	A (IP address)	IN (0x0001)	false
Apr 26, 2024 07:42:59.165827036 CEST	1.1.1.1	192.168.2.4	0x4921	No error (0)	d1p1fga02t8l00.cloudfront.net		108.157.173.45	A (IP address)	IN (0x0001)	false
Apr 26, 2024 07:42:59.165827036 CEST	1.1.1.1	192.168.2.4	0x4921	No error (0)	d1p1fga02t8l00.cloudfront.net		108.157.173.21	A (IP address)	IN (0x0001)	false
Apr 26, 2024 07:42:59.166295052 CEST	1.1.1.1	192.168.2.4	0x334c	No error (0)	www.sweetim.com	d1p1fga02t8l00.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 07:42:59.748660088 CEST	1.1.1.1	192.168.2.4	0x5f0c	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 07:42:59.748660088 CEST	1.1.1.1	192.168.2.4	0x5f0c	No error (0)	googlehosted.l.googleusercontent.com		192.178.50.65	A (IP address)	IN (0x0001)	false
Apr 26, 2024 07:42:59.749422073 CEST	1.1.1.1	192.168.2.4	0xbf5d	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 07:43:00.044639111 CEST	1.1.1.1	192.168.2.4	0x6a93	No error (0)	se-p-static-content.seccint.com	dw0k3g0iqpx8s.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 07:43:00.060882092 CEST	1.1.1.1	192.168.2.4	0xa9ab	No error (0)	se-p-static-content.seccint.com	dw0k3g0iqpx8s.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 07:43:00.060882092 CEST	1.1.1.1	192.168.2.4	0xa9ab	No error (0)	dw0k3g0iqpx8s.cloudfront.net		13.249.98.78	A (IP address)	IN (0x0001)	false
Apr 26, 2024 07:43:00.060882092 CEST	1.1.1.1	192.168.2.4	0xa9ab	No error (0)	dw0k3g0iqpx8s.cloudfront.net		13.249.98.25	A (IP address)	IN (0x0001)	false
Apr 26, 2024 07:43:00.060882092 CEST	1.1.1.1	192.168.2.4	0xa9ab	No error (0)	dw0k3g0iqpx8s.cloudfront.net		13.249.98.127	A (IP address)	IN (0x0001)	false
Apr 26, 2024 07:43:00.060882092 CEST	1.1.1.1	192.168.2.4	0xa9ab	No error (0)	dw0k3g0iqpx8s.cloudfront.net		13.249.98.124	A (IP address)	IN (0x0001)	false
Apr 26, 2024 07:43:00.099720001 CEST	1.1.1.1	192.168.2.4	0xe57b	No error (0)	storage2.stgbssint.com	dw0k3g0iqpx8s.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 07:43:00.107503891 CEST	1.1.1.1	192.168.2.4	0xdda	No error (0)	storage2.stgbssint.com	dw0k3g0iqpx8s.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 07:43:00.107503891 CEST	1.1.1.1	192.168.2.4	0xdda	No error (0)	dw0k3g0iqpx8s.cloudfront.net		13.249.98.124	A (IP address)	IN (0x0001)	false
Apr 26, 2024 07:43:00.107503891 CEST	1.1.1.1	192.168.2.4	0xdda	No error (0)	dw0k3g0iqpx8s.cloudfront.net		13.249.98.78	A (IP address)	IN (0x0001)	false
Apr 26, 2024 07:43:00.107503891 CEST	1.1.1.1	192.168.2.4	0xdda	No error (0)	dw0k3g0iqpx8s.cloudfront.net		13.249.98.127	A (IP address)	IN (0x0001)	false
Apr 26, 2024 07:43:00.107503891 CEST	1.1.1.1	192.168.2.4	0xdda	No error (0)	dw0k3g0iqpx8s.cloudfront.net		13.249.98.25	A (IP address)	IN (0x0001)	false
Apr 26, 2024 07:43:00.907563925 CEST	1.1.1.1	192.168.2.4	0xf246	No error (0)	se-p-static-content.seccint.com	dw0k3g0iqpx8s.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 07:43:00.907563925 CEST	1.1.1.1	192.168.2.4	0xf246	No error (0)	dw0k3g0iqpx8s.cloudfront.net		13.249.98.124	A (IP address)	IN (0x0001)	false
Apr 26, 2024 07:43:00.907563925 CEST	1.1.1.1	192.168.2.4	0xf246	No error (0)	dw0k3g0iqpx8s.cloudfront.net		13.249.98.25	A (IP address)	IN (0x0001)	false
Apr 26, 2024 07:43:00.907563925 CEST	1.1.1.1	192.168.2.4	0xf246	No error (0)	dw0k3g0iqpx8s.cloudfront.net		13.249.98.78	A (IP address)	IN (0x0001)	false
Apr 26, 2024 07:43:00.907563925 CEST	1.1.1.1	192.168.2.4	0xf246	No error (0)	dw0k3g0iqpx8s.cloudfront.net		13.249.98.127	A (IP address)	IN (0x0001)	false
Apr 26, 2024 07:43:00.907850981 CEST	1.1.1.1	192.168.2.4	0xad7b	No error (0)	se-p-static-content.seccint.com	dw0k3g0iqpx8s.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 07:43:00.941181898 CEST	1.1.1.1	192.168.2.4	0x48bb	No error (0)	storage2.stgbssint.com	dw0k3g0iqpx8s.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 07:43:00.941181898 CEST	1.1.1.1	192.168.2.4	0x48bb	No error (0)	dw0k3g0iqpx8s.cloudfront.net		13.249.98.78	A (IP address)	IN (0x0001)	false
Apr 26, 2024 07:43:00.941181898 CEST	1.1.1.1	192.168.2.4	0x48bb	No error (0)	dw0k3g0iqpx8s.cloudfront.net		13.249.98.124	A (IP address)	IN (0x0001)	false
Apr 26, 2024 07:43:00.941181898 CEST	1.1.1.1	192.168.2.4	0x48bb	No error (0)	dw0k3g0iqpx8s.cloudfront.net		13.249.98.127	A (IP address)	IN (0x0001)	false
Apr 26, 2024 07:43:00.941181898 CEST	1.1.1.1	192.168.2.4	0x48bb	No error (0)	dw0k3g0iqpx8s.cloudfront.net		13.249.98.25	A (IP address)	IN (0x0001)	false
Apr 26, 2024 07:43:01.036196947 CEST	1.1.1.1	192.168.2.4	0xc707	No error (0)	storage2.stgbssint.com	dw0k3g0iqpx8s.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 07:43:01.550498009 CEST	1.1.1.1	192.168.2.4	0x33cc	No error (0)	www.sweetim.com	d1p1fga02t8l00.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 07:43:01.550498009 CEST	1.1.1.1	192.168.2.4	0x33cc	No error (0)	d1p1fga02t8l00.cloudfront.net		108.157.173.24	A (IP address)	IN (0x0001)	false
Apr 26, 2024 07:43:01.550498009 CEST	1.1.1.1	192.168.2.4	0x33cc	No error (0)	d1p1fga02t8l00.cloudfront.net		108.157.173.105	A (IP address)	IN (0x0001)	false
Apr 26, 2024 07:43:01.550498009 CEST	1.1.1.1	192.168.2.4	0x33cc	No error (0)	d1p1fga02t8l00.cloudfront.net		108.157.173.45	A (IP address)	IN (0x0001)	false
Apr 26, 2024 07:43:01.550498009 CEST	1.1.1.1	192.168.2.4	0x33cc	No error (0)	d1p1fga02t8l00.cloudfront.net		108.157.173.21	A (IP address)	IN (0x0001)	false
Apr 26, 2024 07:43:01.645312071 CEST	1.1.1.1	192.168.2.4	0x7167	No error (0)	www.sweetim.com	d1p1fga02t8l00.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 07:43:02.890152931 CEST	1.1.1.1	192.168.2.4	0xc429	No error (0)	www.google.com			65	IN (0x0001)	false
Apr 26, 2024 07:43:02.890537977 CEST	1.1.1.1	192.168.2.4	0x14ff	No error (0)	www.google.com		142.250.217.228	A (IP address)	IN (0x0001)	false
Apr 26, 2024 07:43:04.518404007 CEST	1.1.1.1	192.168.2.4	0xe923	No error (0)	chrome.google.com	www3.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 07:43:04.518419027 CEST	1.1.1.1	192.168.2.4	0x3b0f	No error (0)	chrome.google.com	www3.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 07:43:04.518419027 CEST	1.1.1.1	192.168.2.4	0x3b0f	No error (0)	www3.l.google.com		192.178.50.46	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

content.sweetim.com

slscr.update.microsoft.com

www.sweetim.com

clients2.googleusercontent.com

https:

se-p-static-content.seccint.com

storage2.stgbssint.com

fs.microsoft.com

chrome.google.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49733	13.249.98.125	80	6936	C:\Users\user\Desktop\BundleSweetIMSetup.exe

Timestamp	Bytes transferred	Direction	Data
Apr 26, 2024 07:42:20.926795006 CEST	403	OUT	GET /bi/track.gif?prodid=1&compid=35&actid=100&cargo=WV:6.2;SC:0;SSN:145695948050;C_FILEVER:1.3.0.3;C_BUILDTIME:1302091979;C_REPORT:;B_IMVER:3.6.0002;B_IEVER:4.2.0004;B_BUILDTIME:1318168523;B_INFO:;; HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: content.sweetim.com
Apr 26, 2024 07:42:21.051527023 CEST	762	IN	HTTP/1.1 301 Moved Permanently Server: CloudFront Date: Fri, 26 Apr 2024 05:42:20 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Location: https://content.sweetim.com/bi/track.gif?prodid=1&compid=35&actid=100&cargo=WV:6.2;SC:0;SSN:145695948050;C_FILEVER:1.3.0.3;C_BUILDTIME:1302091979;C_REPORT:;B_IMVER:3.6.0002;B_IEVER:4.2.0004;B_BUILDTIME:1318168523;B_INFO:;; X-Cache: Redirect from cloudfront Via: 1.1 9fe397b69d772fbd7341985885a78974.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-P5 X-Amz-Cf-Id: pCnEGTs6l-aQvgYysSFcDKyiH-Y2wcoiM8QPXiEKMrflTXMq5EWWUA== Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 43 6c 6f 75 64 46 72 6f 6e 74 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>CloudFront</center></body></html>
Apr 26, 2024 07:42:57.302691936 CEST	495	OUT	GET /bi/track.gif?prodid=1&compid=35&actid=102&cargo=WV:6.2;SC:0;SSN:145695948050;C_FILEVER:1.3.0.3;C_BUILDTIME:1302091979;C_REPORT:;B_IMVER:3.6.0002;B_IEVER:4.2.0004;B_BUILDTIME:1318168523;B_INFO:;; HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: content.sweetim.com Cookie: UserId=C0736790-038F-11EF-AAC5-BF869E32CC1E; UserData=2024-04-26T05%3A42%3A21.577Z
Apr 26, 2024 07:42:57.427485943 CEST	762	IN	HTTP/1.1 301 Moved Permanently Server: CloudFront Date: Fri, 26 Apr 2024 05:42:57 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Location: https://content.sweetim.com/bi/track.gif?prodid=1&compid=35&actid=102&cargo=WV:6.2;SC:0;SSN:145695948050;C_FILEVER:1.3.0.3;C_BUILDTIME:1302091979;C_REPORT:;B_IMVER:3.6.0002;B_IEVER:4.2.0004;B_BUILDTIME:1318168523;B_INFO:;; X-Cache: Redirect from cloudfront Via: 1.1 9fe397b69d772fbd7341985885a78974.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-P5 X-Amz-Cf-Id: uxunMBC88zu5oqTa1MNJCYfauOYP5eGVSwGRCs_ErJw43Qb9-52K_A== Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 43 6c 6f 75 64 46 72 6f 6e 74 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>CloudFront</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49745	108.157.173.24	80	4020	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Apr 26, 2024 07:42:58.909565926 CEST	489	OUT	GET /installbar.asp?barid={C598706C-038F-11EF-8C2C-ECF4BBEA1588} HTTP/1.1 Host: www.sweetim.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Apr 26, 2024 07:42:59.033917904 CEST	623	IN	HTTP/1.1 301 Moved Permanently Server: CloudFront Date: Fri, 26 Apr 2024 05:42:58 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Location: https://www.sweetim.com/installbar.asp?barid={C598706C-038F-11EF-8C2C-ECF4BBEA1588} X-Cache: Redirect from cloudfront Via: 1.1 942d82cfe2f7cdc64ac3357fc7b8dc1c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-P3 X-Amz-Cf-Id: kJEj70J8h8u0lDjrXLWAuA6GUjEFVUFA-JVyQ3aTX1ur9O9hTeSRuw== Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 43 6c 6f 75 64 46 72 6f 6e 74 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>CloudFront</center></body></html>
Apr 26, 2024 07:43:44.045523882 CEST	6	OUT	Data Raw: 00 Data Ascii:

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49734	13.249.98.125	443	6936	C:\Users\user\Desktop\BundleSweetIMSetup.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 05:42:21 UTC	427	OUT	GET /bi/track.gif?prodid=1&compid=35&actid=100&cargo=WV:6.2;SC:0;SSN:145695948050;C_FILEVER:1.3.0.3;C_BUILDTIME:1302091979;C_REPORT:;B_IMVER:3.6.0002;B_IEVER:4.2.0004;B_BUILDTIME:1318168523;B_INFO:;; HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: content.sweetim.com Connection: Keep-Alive
2024-04-26 05:42:21 UTC	1051	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 Content-Length: 68050 Connection: close accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Content-DPR, Device-Memory, DPR, Viewport-Width, Width, Downlink, ECT, RTT, Save-Data access-control-allow-origin: * date: Fri, 26 Apr 2024 05:42:21 GMT etag: W/"109d2-WsABT+0BC+NqiUApt9GiDi6/qOM" server: istio-envoy set-cookie: UserId=C0736790-038F-11EF-AAC5-BF869E32CC1E; Domain=content.sweetim.com; Path=/; Expires=Mon, 24 Apr 2034 05:42:21 GMT set-cookie: UserData=2024-04-26T05%3A42%3A21.577Z; Domain=content.sweetim.com; Path=/; Expires=Mon, 24 Apr 2034 05:42:21 GMT vary: Accept-Encoding x-envoy-upstream-service-time: 11 x-powered-by: Express X-Cache: Miss from cloudfront Via: 1.1 aab97f44d1fd9aa4917e5ee232773a52.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-P5 X-Amz-Cf-Id: TVB7GDSEnwic7M4fVeoGVRCKJDemO0AWFIGyi1j-Ynp-XXIm_me0EQ==
2024-04-26 05:42:21 UTC	1996	IN	Data Raw: 3c 68 65 61 64 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 53 65 61 72 63 68 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 68 74 6d 6c 22 3e 0a 20 20 20 20 20 20 20 20 68 74 6d 6c 7b 68 65 69 67 68 74 3a 31 30 30 25 3b 6d 69 6e 2d 77 69 64 74 68 3a 37 30 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 7d 62 6f 64 79 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 41 72 69 61 6c 3b 70 61 64 64 69 6e 67 3a 30 3b 6d 61 72 67 69 6e 3a 30 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 66 66 66 7d 62 6f 64 79 20 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 6e 6f 6e 65 3b 6f 75 74 6c 69 6e 65 3a 6e 6f 6e 65 20 21 69 6d 70 6f 72 74 61 6e 74 7d 62 Data Ascii: <head> <title>Search</title> <style xmlns="http://www.w3.org/1999/html"> html{height:100%;min-width:700px;position:relative}body{font-family:Arial;padding:0;margin:0;background-color:#ffffff}body a img{border:none;outline:none !important}b

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49735	13.85.23.86	443

Timestamp	Bytes transferred	Direction	Data
2024-04-26 05:42:37 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=6NvAnKL1OPtr5PT&MD=RuvlYw+b HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-04-26 05:42:37 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: ad30a467-ffac-4be6-88d2-377dff0593dc MS-RequestId: 36436bca-f33f-4c34-9579-a5e24999e211 MS-CV: 9+1IPDWGo0uhTJxG.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 26 Apr 2024 05:42:36 GMT Connection: close Content-Length: 24490
2024-04-26 05:42:37 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-04-26 05:42:37 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49741	13.249.98.125	443	6936	C:\Users\user\Desktop\BundleSweetIMSetup.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 05:42:57 UTC	519	OUT	GET /bi/track.gif?prodid=1&compid=35&actid=102&cargo=WV:6.2;SC:0;SSN:145695948050;C_FILEVER:1.3.0.3;C_BUILDTIME:1302091979;C_REPORT:;B_IMVER:3.6.0002;B_IEVER:4.2.0004;B_BUILDTIME:1318168523;B_INFO:;; HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: content.sweetim.com Connection: Keep-Alive Cookie: UserId=C0736790-038F-11EF-AAC5-BF869E32CC1E; UserData=2024-04-26T05%3A42%3A21.577Z
2024-04-26 05:42:58 UTC	793	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 Content-Length: 68050 Connection: close accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Content-DPR, Device-Memory, DPR, Viewport-Width, Width, Downlink, ECT, RTT, Save-Data access-control-allow-origin: * date: Fri, 26 Apr 2024 05:42:58 GMT etag: W/"109d2-WsABT+0BC+NqiUApt9GiDi6/qOM" server: istio-envoy vary: Accept-Encoding x-envoy-upstream-service-time: 23 x-powered-by: Express X-Cache: Miss from cloudfront Via: 1.1 456dd60f1399d8458ed20abe4eae33a0.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-P5 X-Amz-Cf-Id: 0hZf8gXX7Ts7DHISC5X-baGpwwI7t-G3C6-kylVIYL16ZoeAFaMIDQ==
2024-04-26 05:42:58 UTC	3682	IN	Data Raw: 3c 68 65 61 64 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 53 65 61 72 63 68 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 68 74 6d 6c 22 3e 0a 20 20 20 20 20 20 20 20 68 74 6d 6c 7b 68 65 69 67 68 74 3a 31 30 30 25 3b 6d 69 6e 2d 77 69 64 74 68 3a 37 30 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 7d 62 6f 64 79 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 41 72 69 61 6c 3b 70 61 64 64 69 6e 67 3a 30 3b 6d 61 72 67 69 6e 3a 30 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 66 66 66 7d 62 6f 64 79 20 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 6e 6f 6e 65 3b 6f 75 74 6c 69 6e 65 3a 6e 6f 6e 65 20 21 69 6d 70 6f 72 74 61 6e 74 7d 62 Data Ascii: <head> <title>Search</title> <style xmlns="http://www.w3.org/1999/html"> html{height:100%;min-width:700px;position:relative}body{font-family:Arial;padding:0;margin:0;background-color:#ffffff}body a img{border:none;outline:none !important}b
2024-04-26 05:42:58 UTC	8568	IN	Data Raw: 65 6e 20 2e 61 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 30 7d 62 6f 64 79 20 2e 68 65 61 64 65 72 20 2e 63 61 74 65 67 6f 72 69 65 73 5f 77 72 61 70 70 65 72 2e 73 65 6c 65 63 74 65 64 7b 63 6f 6c 6f 72 3a 23 66 66 66 3b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 32 38 70 78 3b 70 61 64 64 69 6e 67 3a 30 20 37 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 30 38 38 36 64 37 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 7d 62 6f 64 79 20 2e 68 65 61 64 65 72 20 23 62 69 6e 67 5f 65 6c 65 6d 65 6e 74 5f 77 72 61 70 70 65 72 7b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 72 69 67 68 74 3a 31 35 70 78 3b 74 6f 70 3a 30 3b 63 6f 6c 6f 72 3a 23 63 63 63 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 33 70 78 3b 66 6f 6e 74 2d Data Ascii: en .a{margin-left:0}body .header .categories_wrapper.selected{color:#fff;display:block;line-height:28px;padding:0 7px;background:#0886d7;font-weight:bold}body .header #bing_element_wrapper{position:absolute;right:15px;top:0;color:#ccc;font-size:13px;font-
2024-04-26 05:42:58 UTC	1428	IN	Data Raw: 63 6f 6c 6f 72 3a 23 38 32 35 39 61 62 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 7d 2e 73 75 67 67 65 73 74 2d 69 74 65 6d 2d 77 72 61 70 70 65 72 20 2e 68 69 73 74 6f 72 79 2d 69 74 65 6d 2d 78 2d 62 74 6e 7b 66 6c 6f 61 74 3a 72 69 67 68 74 3b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 2e 73 75 67 67 65 73 74 2d 69 74 65 6d 2d 77 72 61 70 70 65 72 20 2e 68 69 73 74 6f 72 79 2d 69 74 65 6d 2d 78 2d 62 74 6e 3a 68 6f 76 65 72 7b 63 75 72 73 6f 72 3a 70 6f 69 6e 74 65 72 7d 2e 73 75 67 67 65 73 74 2d 69 74 65 6d 2d 77 72 61 70 70 65 72 20 2e 68 69 73 74 6f 72 79 2d 69 74 65 6d 2d 78 2d 62 74 6e 2d 73 65 6c 65 63 74 65 64 7b 66 6c 6f 61 74 3a 72 69 67 68 74 3b 63 75 72 73 6f 72 3a 70 6f 69 6e 74 65 72 7d 23 73 75 67 67 65 73 74 4c 69 73 74 57 72 61 70 Data Ascii: color:#8259ab;font-weight:bold}.suggest-item-wrapper .history-item-x-btn{float:right;display:none}.suggest-item-wrapper .history-item-x-btn:hover{cursor:pointer}.suggest-item-wrapper .history-item-x-btn-selected{float:right;cursor:pointer}#suggestListWrap
2024-04-26 05:42:58 UTC	5712	IN	Data Raw: 20 20 20 20 2f 2f 20 73 69 6d 70 6c 65 20 64 61 74 61 20 74 79 70 65 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 74 20 3d 3d 20 22 73 74 72 69 6e 67 22 29 20 6f 62 6a 20 3d 20 27 22 27 20 2b 20 6f 62 6a 20 2b 20 27 22 27 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 53 74 72 69 6e 67 28 6f 62 6a 29 3b 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 65 6c 73 65 20 7b 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 2f 20 72 65 63 75 72 73 65 20 61 72 72 61 79 20 6f 72 20 6f 62 6a 65 63 74 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 6e 2c 20 76 2c 20 6a 73 6f 6e 20 3d 20 5b 5d 2c 20 61 72 72 20 3d 20 28 6f 62 6a 20 26 26 20 6f 62 6a 2e 63 6f 6e 73 Data Ascii: // simple data type if (t == "string") obj = '"' + obj + '"'; return String(obj); } else { // recurse array or object var n, v, json = [], arr = (obj && obj.cons

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49748	108.157.173.24	443	4020	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 05:42:59 UTC	717	OUT	GET /installbar.asp?barid={C598706C-038F-11EF-8C2C-ECF4BBEA1588} HTTP/1.1 Host: www.sweetim.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 05:42:59 UTC	1042	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 Content-Length: 68050 Connection: close accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Content-DPR, Device-Memory, DPR, Viewport-Width, Width, Downlink, ECT, RTT, Save-Data access-control-allow-origin: * date: Fri, 26 Apr 2024 05:42:59 GMT etag: W/"109d2-WsABT+0BC+NqiUApt9GiDi6/qOM" server: istio-envoy set-cookie: UserId=D725A570-038F-11EF-AAC5-BF869E32CC1E; Domain=www.sweetim.com; Path=/; Expires=Mon, 24 Apr 2034 05:42:59 GMT set-cookie: UserData=2024-04-26T05%3A42%3A59.655Z; Domain=www.sweetim.com; Path=/; Expires=Mon, 24 Apr 2034 05:42:59 GMT vary: Accept-Encoding x-envoy-upstream-service-time: 9 x-powered-by: Express X-Cache: Miss from cloudfront Via: 1.1 50fb19eda678e6a896981a444fb09aa6.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-P3 X-Amz-Cf-Id: 4SRws1HQnzseCiaz3bvepZ1NBILLJBfqhaV5Ur7FcGGUECcbr3VdCw==
2024-04-26 05:42:59 UTC	577	IN	Data Raw: 3c 68 65 61 64 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 53 65 61 72 63 68 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 68 74 6d 6c 22 3e 0a 20 20 20 20 20 20 20 20 68 74 6d 6c 7b 68 65 69 67 68 74 3a 31 30 30 25 3b 6d 69 6e 2d 77 69 64 74 68 3a 37 30 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 7d 62 6f 64 79 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 41 72 69 61 6c 3b 70 61 64 64 69 6e 67 3a 30 3b 6d 61 72 67 69 6e 3a 30 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 66 66 66 7d 62 6f 64 79 20 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 6e 6f 6e 65 3b 6f 75 74 6c 69 6e 65 3a 6e 6f 6e 65 20 21 69 6d 70 6f 72 74 61 6e 74 7d 62 Data Ascii: <head> <title>Search</title> <style xmlns="http://www.w3.org/1999/html"> html{height:100%;min-width:700px;position:relative}body{font-family:Arial;padding:0;margin:0;background-color:#ffffff}body a img{border:none;outline:none !important}b
2024-04-26 05:42:59 UTC	12852	IN	Data Raw: 23 6c 69 4d 65 6e 75 5f 77 72 61 70 70 65 72 20 23 6c 69 4d 65 6e 75 5f 69 6e 6e 65 72 5f 77 72 61 70 70 65 72 20 23 6c 69 4d 6f 72 65 20 2e 64 72 6f 70 64 6f 77 6e 2d 69 74 65 6d 2d 77 72 61 70 70 65 72 20 2e 64 72 6f 70 64 6f 77 6e 2d 69 74 65 6d 7b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 32 36 70 78 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 38 70 78 7d 62 6f 64 79 20 2e 68 65 61 64 65 72 2e 72 74 6c 20 2e 73 69 64 65 31 20 2e 63 61 74 65 67 6f 72 69 65 73 5f 77 72 61 70 70 65 72 20 6c 69 20 2e 68 65 61 64 65 72 2d 69 74 65 6d 2d 62 74 6e 2e 6f 70 65 6e 7b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 36 70 78 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 31 33 70 78 7d 62 6f 64 79 20 2e 68 65 61 64 65 72 2e 72 74 6c 20 2e 73 69 64 65 32 7b 66 6c 6f 61 74 3a Data Ascii: #liMenu_wrapper #liMenu_inner_wrapper #liMore .dropdown-item-wrapper .dropdown-item{padding-left:26px;padding-right:8px}body .header.rtl .side1 .categories_wrapper li .header-item-btn.open{padding-left:6px;padding-right:13px}body .header.rtl .side2{float:
2024-04-26 05:42:59 UTC	2856	IN	Data Raw: 2f 67 2c 20 27 27 29 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 7d 0a 0a 20 20 20 20 76 61 72 20 4a 53 4f 4e 20 3d 20 4a 53 4f 4e 20 7c 7c 20 7b 7d 3b 0a 0a 2f 2f 20 69 6d 70 6c 65 6d 65 6e 74 20 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 20 73 65 72 69 61 6c 69 7a 61 74 69 6f 6e 0a 20 20 20 20 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 20 3d 20 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 20 7c 7c 20 66 75 6e 63 74 69 6f 6e 20 28 6f 62 6a 29 20 7b 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 74 20 3d 20 74 79 70 65 6f 66 20 28 6f 62 6a 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 74 20 21 3d 20 22 6f 62 6a 65 63 74 22 20 7c 7c 20 6f 62 6a 20 3d 3d 3d 20 6e 75 6c 6c 29 20 7b 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 2f Data Ascii: /g, ''); } } var JSON = JSON \|\| {};// implement JSON.stringify serialization JSON.stringify = JSON.stringify \|\| function (obj) { var t = typeof (obj); if (t != "object" \|\| obj === null) { //
2024-04-26 05:42:59 UTC	8568	IN	Data Raw: 30 5d 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 20 3d 3d 3d 20 70 61 72 61 6d 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 76 61 6c 20 3d 20 70 61 69 72 5b 31 5d 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 62 72 65 61 6b 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 76 61 6c 3b 0a 20 20 20 20 20 20 20 20 7d 2c 0a 20 20 20 20 20 20 20 20 55 70 64 61 74 65 55 72 6c 3a 20 66 75 6e 63 74 69 6f 6e 20 28 6b 65 79 2c 20 6e 65 77 76 61 6c 2c 20 61 64 64 49 66 4e 6f 74 45 78 69 73 74 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 70 61 72 61 6d 20 3d Data Ascii: 0].toLowerCase() === param.toLowerCase()) { val = pair[1]; break; } } return val; }, UpdateUrl: function (key, newval, addIfNotExist) { var param =
2024-04-26 05:42:59 UTC	2856	IN	Data Raw: 6d 6f 76 65 48 69 73 74 6f 72 79 46 72 6f 6d 53 75 67 67 65 73 74 28 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 69 6e 64 65 78 53 75 67 67 65 73 74 4c 69 73 74 28 29 3b 0a 20 20 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 20 20 66 75 6e 63 74 69 6f 6e 20 72 65 6d 6f 76 65 48 69 73 74 6f 72 79 46 72 6f 6d 53 75 67 67 65 73 74 28 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 73 75 67 67 65 73 74 57 72 61 70 70 65 72 2e 69 6e 6e 65 72 48 54 4d 4c 20 3d 20 22 22 3b 0a 20 20 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 20 20 66 75 6e 63 74 69 6f 6e 20 75 70 64 61 74 65 48 69 73 74 6f 72 79 43 6f 6f 6b 69 65 28 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 68 69 73 20 3d 20 7b 0a 20 20 20 20 20 20 20 Data Ascii: moveHistoryFromSuggest(); } indexSuggestList(); } function removeHistoryFromSuggest() { suggestWrapper.innerHTML = ""; } function updateHistoryCookie() { var his = {
2024-04-26 05:42:59 UTC	2856	IN	Data Raw: 74 6f 72 79 49 74 65 6d 73 28 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 67 65 74 48 69 73 74 6f 72 79 49 74 65 6d 73 46 72 6f 6d 43 6f 6f 6b 69 65 28 29 3b 0a 20 20 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 20 20 66 75 6e 63 74 69 6f 6e 20 6f 6e 43 6c 65 61 72 41 6c 6c 43 6c 69 63 6b 28 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 68 69 73 74 6f 72 79 49 74 65 6d 73 20 3d 20 5b 5d 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6c 65 61 72 48 69 73 74 6f 72 79 46 72 6f 6d 43 6f 6f 6b 69 65 28 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 72 65 6d 6f 76 65 48 69 73 74 6f 72 79 46 72 6f 6d 53 75 67 67 65 73 74 28 29 3b 0a 20 20 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 20 20 66 75 6e 63 74 69 6f 6e 20 63 6c 65 61 72 48 69 73 Data Ascii: toryItems() { return getHistoryItemsFromCookie(); } function onClearAllClick() { historyItems = []; clearHistoryFromCookie(); removeHistoryFromSuggest(); } function clearHis
2024-04-26 05:42:59 UTC	2856	IN	Data Raw: 74 72 69 6e 67 2e 73 74 61 72 74 73 57 69 74 68 28 73 75 67 67 65 73 74 2c 20 74 65 72 6d 29 20 3f 20 28 74 65 72 6d 20 2b 20 27 3c 62 3e 27 20 2b 20 73 75 67 67 65 73 74 2e 72 65 70 6c 61 63 65 28 74 65 72 6d 2c 20 27 27 29 20 2b 20 27 3c 2f 62 3e 27 29 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3a 20 28 27 3c 62 3e 27 20 2b 20 73 75 67 67 65 73 74 20 2b 20 27 3c 2f 62 3e 27 29 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 6e 65 77 53 75 67 67 65 73 74 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 54 65 78 74 4e 6f 64 65 28 76 61 6c 29 3b 0a 0a 20 20 20 20 20 20 20 20 73 70 61 6e 2e 69 6e 6e 65 72 48 54 4d 4c 20 3d 20 6e 65 77 53 75 67 67 65 73 74 2e 74 65 78 74 43 6f 6e 74 65 6e 74 3b 0a 20 20 20 20 20 20 20 20 65 6c 2e 73 65 74 41 74 74 72 Data Ascii: tring.startsWith(suggest, term) ? (term + '<b>' + suggest.replace(term, '') + '</b>') : ('<b>' + suggest + '</b>'), newSuggest = document.createTextNode(val); span.innerHTML = newSuggest.textContent; el.setAttr
2024-04-26 05:42:59 UTC	2856	IN	Data Raw: 20 20 20 20 20 20 76 61 72 20 73 65 6c 65 63 74 65 64 20 3d 20 73 75 67 67 65 73 74 4c 69 73 74 2e 63 68 69 6c 64 4e 6f 64 65 73 5b 67 65 74 53 65 6c 65 63 74 65 64 4e 6f 64 65 28 29 5d 3b 0a 20 20 20 20 20 20 20 20 69 66 20 28 73 65 6c 65 63 74 65 64 20 26 26 20 73 65 6c 65 63 74 65 64 2e 74 61 67 4e 61 6d 65 20 3d 3d 3d 20 27 4c 49 27 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 72 65 6d 6f 76 65 48 6f 76 65 72 28 73 65 6c 65 63 74 65 64 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 73 65 6c 65 63 74 65 64 4e 6f 64 65 20 3d 20 2d 31 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 7d 0a 0a 20 20 20 20 66 75 6e 63 74 69 6f 6e 20 6f 6e 4d 6f 75 73 65 45 6e 74 65 72 28 65 76 65 6e 74 29 20 7b 0a 20 20 20 20 20 20 20 20 76 61 72 20 6e 65 77 53 65 6c 65 63 Data Ascii: var selected = suggestList.childNodes[getSelectedNode()]; if (selected && selected.tagName === 'LI') { removeHover(selected); selectedNode = -1; } } function onMouseEnter(event) { var newSelec
2024-04-26 05:42:59 UTC	1428	IN	Data Raw: 4d 61 6e 61 67 65 72 2e 67 65 74 53 61 76 65 64 48 69 73 74 6f 72 79 53 74 61 74 65 28 29 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 73 75 67 67 65 73 74 4c 69 73 74 2e 69 6e 6e 65 72 48 54 4d 4c 20 3d 20 27 27 3b 0a 20 20 20 20 20 20 20 20 68 69 73 74 6f 72 79 4d 61 6e 61 67 65 72 2e 61 70 70 65 6e 64 48 69 73 74 6f 72 79 49 74 65 6d 73 28 29 3b 0a 20 20 20 20 20 20 20 20 6f 70 65 6e 53 75 67 67 65 73 74 57 72 61 70 70 65 72 28 29 3b 0a 20 20 20 20 7d 0a 0a 20 20 20 20 66 75 6e 63 74 69 6f 6e 20 69 73 53 75 67 67 65 73 74 4f 70 65 6e 28 29 20 7b 0a 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 73 75 67 67 65 73 74 57 72 61 70 70 65 72 2e 73 74 79 6c 65 2e 64 69 73 70 6c 61 Data Ascii: Manager.getSavedHistoryState()) { return; } suggestList.innerHTML = ''; historyManager.appendHistoryItems(); openSuggestWrapper(); } function isSuggestOpen() { return suggestWrapper.style.displa
2024-04-26 05:42:59 UTC	1428	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 73 75 67 67 65 73 74 4c 69 73 74 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 63 72 65 61 74 65 53 75 67 67 65 73 74 45 6c 28 72 65 73 2e 74 65 72 6d 2c 20 72 65 73 2e 69 74 65 6d 73 5b 69 5d 2c 20 73 75 67 67 65 73 74 4c 69 73 74 2e 63 68 69 6c 64 4e 6f 64 65 73 2e 6c 65 6e 67 74 68 2c 20 66 61 6c 73 65 29 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 20 65 6c 73 65 20 69 66 20 28 21 69 73 48 69 73 74 6f 72 79 49 74 65 6d 28 6a 29 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 75 70 64 61 74 65 53 75 67 67 65 73 74 45 6c 28 73 75 67 67 65 73 74 4c 69 73 74 2e 63 68 69 6c 64 4e 6f 64 65 73 5b 6a 5d 2c 20 72 65 73 2e 74 65 72 6d 2c 20 72 65 73 2e 69 74 65 6d 73 5b 69 5d 29 3b 0a 20 20 Data Ascii: suggestList.appendChild(createSuggestEl(res.term, res.items[i], suggestList.childNodes.length, false)); } else if (!isHistoryItem(j)) { updateSuggestEl(suggestList.childNodes[j], res.term, res.items[i]);

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49751	192.178.50.65	443	4020	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 05:43:00 UTC	564	OUT	GET /crx/blobs/AfQPRnlSkk0SHkG5PXvb3F_Q7hH-5ddsxHHT56Cx-_JWux0fg0SnDHAT6sRgPwMxLj9QK3jdbgroAjU8smhTZreN3EjllobyDxCd6anURJdX2LwhsxiO4Wd9jGJUvOZjNG0AxlKa5b7kLavSfewVpsPdhgIchnuqABvb/EFAIDNBMNNNIBPCAJPCGLCLEFINDMKAJ_24_4_1_2.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 05:43:00 UTC	574	IN	HTTP/1.1 200 OK X-GUploader-UploadID: ABPtcPqyxoft4NWfa9VH6EIIWmasQiicFPs6XSy3siOM8eMjynU4j0Dp2v79xodgtxvHhur8fIKLSCiBFg Accept-Ranges: bytes Content-Length: 1376124 X-Goog-Hash: crc32c=1TO8VQ== Server: UploadServer Date: Thu, 25 Apr 2024 11:51:53 GMT Expires: Fri, 25 Apr 2025 11:51:53 GMT Cache-Control: public, max-age=31536000 Age: 64267 Last-Modified: Mon, 22 Apr 2024 05:01:44 GMT ETag: f4a13e4a_1a1e8bed_06a0c69a_2324c73f_0d9c8f3c Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 05:43:00 UTC	681	IN	Data Raw: 43 72 32 34 03 00 00 00 19 04 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 8f fb bf 5c 37 63 94 3c b0 ee 01 c4 b5 a6 9a b1 9f 46 74 6f 16 38 a0 32 27 35 dd f0 71 6b 0e dc f6 25 cb b2 ed ea fb 32 d5 af 1e 03 43 03 46 f0 a7 39 db 23 96 1d 65 e5 78 51 f0 84 b0 0e 12 ac 0e 5b dc c9 d6 4c 7c 00 d5 b8 1b 88 33 3e 2f da eb aa f7 1a 75 c2 ae 3a 54 de 37 8f 10 d2 28 e6 84 79 4d 15 b4 f3 bd 3f 56 d3 3c 3f 18 ab fc 2e 05 c0 1e 08 31 b6 61 d0 fd 9f 4f 3f 64 0d 17 93 bc ad 41 c7 48 be 00 27 a8 4d 70 42 92 05 54 a6 6d b8 de 56 6e 20 49 70 ee 10 3e 6b d2 7c 31 bd 1b 6e a4 3c 46 62 9f 08 66 93 f9 2a 51 31 a8 db b5 9d b9 0f 73 e8 a0 09 32 01 e9 7b 2a 8a 36 a0 cf 17 b0 50 70 9d a2 f9 a4 6f 62 4d Data Ascii: Cr240"0H0\7c<Fto82'5qk%2CF9#exQ[L\|3>/u:T7(yM?V<?.1aO?dAH'MpBTmVn Ip>k\|1n<FbfQ1s2{*6PpobM
2024-04-26 05:43:00 UTC	1255	IN	Data Raw: 37 ee 43 48 3c 84 ab 74 ac e7 09 37 64 03 aa 12 29 4a 45 11 53 9c a0 3f 79 f4 34 05 a9 e3 5b 96 20 7d 31 5f 99 ad 94 93 f8 33 95 c4 0a 5d 31 22 73 b0 27 33 23 02 03 01 00 01 12 80 01 7d 72 9f 53 db ba c8 0b 1b 1d 5b 7e 57 c6 72 c0 22 db 7b 12 5b 84 b5 16 86 1a 0e 37 6b 17 9b c6 7d d5 e6 c0 17 2d dd 14 4e 53 4d 6a 2d fd 45 bc 06 29 4d 1f ec 8e d9 ec 31 8e 01 a2 34 ec e9 e1 8e 57 ab 3f e7 0d ca 9d 63 b9 b3 73 b2 ca 3c 14 e9 01 31 36 1a ad 6e a0 b2 8a f4 5b ca 81 12 6e c3 0a 17 cc a1 a3 49 0f 5d 4a 1f 71 23 46 d7 39 9b 2d 14 3e 18 3a de 7c 7b 7b db 28 f8 6e 9c 00 1a a6 01 0a 5b 30 59 30 13 06 07 2a 86 48 ce 3d 02 01 06 08 2a 86 48 ce 3d 03 01 07 03 42 00 04 b4 02 f9 a9 1c ae e1 0c 84 f8 dc 9b 17 72 98 a5 e0 32 d5 db 2b 59 d8 49 c0 ef be e8 6b f9 f8 62 52 b8 Data Ascii: 7CH<t7d)JES?y4[ }1_3]1"s'3#}rS[~Wr"{[7k}-NSMj-E)M14W?cs<16n[nI]Jq#F9->:\|{{(n[0Y0H=H=Br2+YIkbR
2024-04-26 05:43:00 UTC	1255	IN	Data Raw: 00 6c 69 62 73 2f 55 54 05 00 01 94 9d 26 66 0a 00 20 00 00 00 00 00 01 00 18 00 00 02 c2 18 da 94 da 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03 00 50 4b 07 08 00 00 00 00 02 00 00 00 00 00 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 2d 00 62 72 6f 77 73 65 72 2f 55 54 05 00 01 94 9d 26 66 0a 00 20 00 00 00 00 00 01 00 18 00 00 02 c2 18 da 94 da 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03 00 50 4b 07 08 00 00 00 00 02 00 00 00 00 00 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 07 00 2d 00 63 6f 6d 6d 6f 6e 2f 55 54 05 00 01 96 9d 26 66 0a 00 20 00 00 00 00 00 01 00 18 00 00 2f f3 19 da 94 da 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03 00 50 Data Ascii: libs/UT&f PKPK!-browser/UT&f PKPK!-common/UT&f /P
2024-04-26 05:43:00 UTC	1255	IN	Data Raw: 20 ff bd 43 ea 11 52 6b 2b 6a b7 45 d1 9c e2 99 6f 86 9c a7 3e 3e 5d 2c eb 8a 62 cb 50 ad c5 f2 76 b1 2c ac ad cc 6d 9a 12 c1 99 b4 66 93 e4 4a e5 82 25 44 95 a9 61 fa c0 09 4b 5b 8b 4d 4a f4 e3 f2 fa e2 62 01 7f 4b 89 4b e6 ec 11 ba ff f9 47 d4 b0 ed a6 a2 d9 0f 8f 56 7e 04 05 42 80 f3 30 63 95 c6 b9 43 3e 79 81 17 96 58 82 8c 22 43 0a 56 62 e7 a5 fd 2f d9 19 25 97 1e f7 dc d9 53 66 88 e6 95 e5 a0 38 75 da f7 2f fa bb 42 ab f0 e8 03 d3 a6 33 db dc 24 37 c9 3a d9 f4 2a e5 0d 0c aa da ab 2d b7 5a 35 10 6c ba 33 69 a7 4a 0a 5b 8a e5 70 89 0c d7 c2 22 a1 08 16 de 80 c9 5e 57 31 5d 72 e3 0e 32 a0 f8 fd 25 48 a2 a4 65 8f f6 9e c9 da 74 60 2f b7 78 1b fd a6 aa 91 42 61 1a 09 25 b6 fc c0 ee 99 31 38 e7 32 0f 55 10 fc 27 f6 47 cd 8c 1d 49 3f e2 03 cf b1 cf 54 a0 Data Ascii: CRk+jEo>>],bPv,mfJ%DaK[MJbKKGV~B0cC>yX"CVb/%Sf8u/B3$7:*-Z5l3iJ[p"^W1]r2%Het`/xBa%182U'GI?T
2024-04-26 05:43:00 UTC	1255	IN	Data Raw: 7e 6d d5 2e ea 01 9f 51 c7 14 70 42 27 57 bb 6d 53 70 c0 6e cd c6 40 2a 06 78 74 da ce 42 5d fc b3 e7 96 a1 a7 a8 5b 8b 27 cb 74 7e b2 aa 08 97 af cf 4c e4 0a 16 0c 81 93 07 cf 96 ba f9 56 1c 47 2e 8a b6 f6 95 7d f2 57 61 de 46 de af 37 d4 23 2c c7 f9 47 be 06 c3 01 4c c0 52 18 c3 6d 64 17 09 da 08 86 6a 87 16 3b 9e 30 d6 c0 13 ef af 6e 0b ed 3f 60 4d 99 63 f3 09 50 4b 07 08 7c 75 24 57 03 01 00 00 6a 02 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 09 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 55 54 05 00 01 96 9d 26 66 0a 00 20 00 00 00 00 00 01 00 18 00 00 2f f3 19 da 94 da 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03 00 50 4b 07 08 00 00 00 00 02 00 00 00 00 00 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 Data Ascii: ~m.QpB'WmSpn@*xtB]['t~LVG.}WaF7#,GLRmdj;0n?`McPK\|u$WjPK!-_locales/UT&f /PKPK!
2024-04-26 05:43:00 UTC	1255	IN	Data Raw: d1 53 14 3f 56 3a 37 27 4d bd 4e 46 a3 a3 d1 d1 b6 6a ed db 5d 6c eb 92 1c c4 9d f8 f7 4b cd 0a 57 43 6c e0 f6 ff dd 53 fc 33 d4 64 4a 94 8b da e0 e1 5d bf b6 73 ec 20 4d db f7 57 95 7d e8 2a 73 fd d1 68 19 62 fa b4 0d d3 1a be 4d 2f 7f 47 e0 ff 15 a3 06 9b 6d fc 15 9a ab f4 ea d6 ef e9 7d 78 84 62 f5 c5 7b 1e e3 8a ad c5 ca 1f e2 bb 30 ad 89 0e e2 e8 61 d6 0c 20 d7 0c 88 e9 bd dd c2 ff 49 a8 2a 14 be 50 c6 b6 21 f6 11 18 6f 5d f7 f7 a6 1e 62 5a 3c d4 78 e2 f2 a4 de ea ad e7 15 18 0c 87 43 42 af c2 85 89 f7 4e 5a 81 51 d4 ac bb ea ec 5d 5a c8 86 bf 76 c8 be 2a 84 bb b9 17 c5 45 6b 28 dc 66 69 0e a2 fd 84 8e e2 3c de 69 b8 1f a6 94 93 a5 29 66 c4 25 22 cd b6 73 a8 01 44 f1 b2 a3 10 7b 7e 52 69 8d ed 0f 6f 6e 47 8d 65 da 0c c1 f9 6e a3 bd d4 dc 8e c9 03 cd Data Ascii: S?V:7'MNFj]lKWClS3dJ]s MW}shbM/Gm}xb{0a IP!o]bZ<xCBNZQ]Zv*Ek(fi<i)f%"sD{~RionGen
2024-04-26 05:43:00 UTC	1255	IN	Data Raw: 61 74 65 2e 6a 73 55 54 05 00 01 ac ef 56 65 0a 00 20 00 00 00 00 00 01 00 18 00 00 1e 45 bf 10 19 da 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ad 55 5d 6f e2 38 14 7d 9f 5f e1 e6 a1 4a 46 69 5a ba 1a 69 15 94 d5 a4 25 65 a3 a1 09 2a b4 d2 3e 21 e3 5c c0 bb c1 46 b6 03 45 94 ff be d7 09 50 a0 dd d1 3e 4c 5e 20 d7 e7 dc 7b 7c bf 72 fd f5 57 3d 5f be 92 b8 93 df 25 e4 3e cf 1e d2 4e 92 0d d3 b8 87 c6 d1 c7 e7 8b 05 93 7b b9 58 2b 3e 9d 19 72 7b d3 fa 46 e2 42 8e 81 0c d6 da c0 5c 93 54 30 a9 16 52 51 03 85 05 c7 65 49 9e 2c 58 93 27 d0 a0 96 50 04 b5 9b 2c 1f a6 f7 49 d8 20 b8 98 48 35 a7 86 4b 41 98 14 86 72 01 05 99 81 02 2e 08 d7 3e a1 a2 20 0a e6 68 d7 c8 35 33 20 0b 25 17 a0 cc 9a c8 c9 4f 24 d4 44 8e c1 75 b5 58 94 1c 94 f6 91 cf 27 68 5f 07 Data Ascii: ate.jsUTVe EU]o8}_JFiZi%e*>!\FEP>L^ {\|rW=_%>N{X+>r{FB\T0RQeI,X'P,I H5KAr.> h53 %O$DuX'h_
2024-04-26 05:43:00 UTC	1255	IN	Data Raw: 6f db 36 14 7d cf af 60 f4 10 50 31 4d db 59 37 14 72 85 c1 4b d2 2d 43 17 17 89 9f 16 07 01 2d 5d 5b 4c 29 52 20 a9 26 aa a1 ff de 4b f9 6b 69 87 a0 0f 15 0c c8 bc 3c f7 eb 9c 7b 35 38 fd 59 cf d1 29 99 5c 4c ff b8 24 e7 d3 eb f7 57 17 97 d7 b3 ab c9 07 34 3e 7c ff 1c 05 30 39 37 55 63 e5 aa f0 e4 6c 38 fa 95 4c 72 b3 00 72 db 38 0f a5 23 57 3a 33 b6 32 56 78 c8 03 78 a2 14 b9 09 60 47 6e c0 81 fd 0c 39 ef c2 5c 4f 67 57 e7 97 c9 06 21 f5 d2 d8 52 78 69 34 c9 8c f6 42 6a c8 49 01 16 a4 26 d2 31 22 74 4e 2c 94 68 77 e8 eb 0b 20 95 35 15 58 df 10 b3 7c a5 84 ce 51 62 72 57 57 95 92 60 1d 43 7f b9 44 7b c3 09 99 61 20 a9 3d 28 05 99 af 85 ea e0 1e b2 42 cb 0c 4f 58 4a 06 15 7a ef 6b 42 e7 6d 55 c2 6e 6a b0 12 bc b0 0d f1 e6 07 ca 40 f7 7d 21 9d 6d 1b 05 53 Data Ascii: o6}`P1MY7rK-C-][L)R &Kki<{58Y)\L$W4>\|097Ucl8Lrr8#W:32Vxx`Gn9\OgW!Rxi4BjI&1"tN,hw 5X\|QbrWW`CD{a =(BOXJzkBmUnj@}!mS
2024-04-26 05:43:00 UTC	1255	IN	Data Raw: 0a 25 59 ac a4 e5 42 42 c2 96 a0 41 48 26 8c cf b8 4c 98 86 15 ca 0d ee b5 4b 60 99 56 19 68 bb 61 6a fe 0b 17 aa 8d 02 0f 37 79 96 a5 02 b4 f1 71 bf 98 a3 7c 13 30 36 45 43 42 5a 48 53 88 6d ce d3 4a dd 42 bc 94 22 c6 5f e8 4a 0c 19 ee ee 7c c2 cd 8d 57 5c d7 3e 68 01 96 eb 0d b3 ea ff 70 03 b7 77 8e 54 b2 c6 0a 1e 49 5a b3 0d e3 98 0d 4e 1a 31 9f a5 af 9c eb 42 4e f9 73 1d 87 8c d3 3c 11 72 c1 ac e6 09 30 03 b1 06 5b 19 56 1a 9d 6e eb 44 fa 98 75 76 2e 8c 81 95 90 75 a2 31 71 76 29 cc 4e f2 71 9b 06 3c 27 c9 e3 1d 1d 5c 06 2d 78 4a 87 62 32 ad 16 b1 4d 37 0c 37 ce 44 92 80 64 b9 4c c1 18 74 51 a0 89 67 2d ac 45 21 7a bb c2 23 c9 10 ee 52 b3 2e 87 73 ad 56 bf 48 17 fa fa af 7d 06 6f c4 0a cd da 22 56 ab 15 3a c2 0d 83 92 ce 77 82 41 2d 0a be 19 67 d8 28 Data Ascii: %YBBAH&LK`Vhaj7yq\|06ECBZHSmJB"_J\|W\>hpwTIZN1BNs<r0[VnDuv.u1qv)Nq<'\-xJb2M77DdLtQg-E!z#R.sVH}o"V:wA-g(
2024-04-26 05:43:00 UTC	1255	IN	Data Raw: ad 57 aa 22 f1 1b da 9e 6e 32 08 7b 91 f6 c4 98 a3 e6 57 7b e0 be 5e b3 82 aa 3c 99 61 72 c3 23 7b 7c 6c e8 d0 99 56 cf 98 8f 50 06 c2 8c 93 05 92 13 a6 01 ff 63 e0 b5 33 8e bf ae 32 7e 6b b1 b4 26 14 3e a5 10 5d 55 25 91 43 73 31 63 ec f8 ae 61 dc d4 eb 61 f6 de fa e6 81 f0 0a 88 26 ae e3 e5 17 ae f9 0a 6b 90 65 40 b3 9d 6f 2a a8 1e ed b5 d2 cb cb d1 4e 52 3d 8b 9e 3c 57 97 cd 58 6b a5 5d a7 9a dc f1 d5 02 41 c7 9d 6d 4b 07 4b 0d f3 12 df 33 88 df 7a 95 ee b5 70 db ba 38 f4 95 8f bf ed 4e 93 24 90 41 8e cd e3 7a e5 d3 90 46 96 fe 0d d0 33 e8 f8 78 95 74 d3 41 cb 0b 50 ee 33 6c 77 f0 eb b1 f2 f4 e9 2f 4c 0a 68 d6 38 d1 5b 2a 9f 42 c7 41 04 15 ce 8f 13 9e 89 93 ef b0 71 76 db ac ec 88 f9 f5 48 5a 4f 5a fb 43 69 1f 61 fd 40 fa 61 ec ed 42 dc c0 a9 0d 46 b9 Data Ascii: W"n2{W{^<ar#{\|lVPc32~k&>]U%Cs1caa&ke@oNR=<WXk]AmKK3zp8N$AzF3xtAP3lw/Lh8[BAqvHZOZCia@aBF

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49753	13.249.98.78	443	4020	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 05:43:00 UTC	626	OUT	GET /search/images/homepage/button_bg.png HTTP/1.1 Host: se-p-static-content.seccint.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.sweetim.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 05:43:00 UTC	470	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 2767 Connection: close Date: Fri, 26 Apr 2024 05:43:01 GMT Last-Modified: Thu, 06 Jul 2017 14:19:26 GMT ETag: "64f85ba4f1509e24c28ddc9e07de67d7" x-amz-version-id: null Accept-Ranges: bytes Server: AmazonS3 X-Cache: Miss from cloudfront Via: 1.1 e65779811ad331617179859160ead1b4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-P5 X-Amz-Cf-Id: 1VJFOfHjIGw8d2mKx7sGXTviIIQqsWuhJPGyY0WIQagaYFzdPxOo-g==
2024-04-26 05:43:00 UTC	2767	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 57 00 00 00 69 08 06 00 00 00 8e 36 60 71 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 64 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 30 2d 63 30 36 30 20 36 31 2e 31 33 34 37 37 37 2c 20 32 30 31 30 2f 30 32 2f 31 32 2d 31 37 3a 33 32 3a 30 30 20 20 Data Ascii: PNGIHDRWi6`qtEXtSoftwareAdobe ImageReadyqe<diTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49754	13.249.98.124	443	4020	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 05:43:00 UTC	634	OUT	GET /Search/SearchApplication/Resources/SpyGlass130x40.png HTTP/1.1 Host: storage2.stgbssint.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.sweetim.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 05:43:00 UTC	470	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 2505 Connection: close Date: Fri, 26 Apr 2024 05:43:01 GMT Last-Modified: Wed, 28 Feb 2018 09:59:06 GMT ETag: "b254739743874926f3f110ba7eb9c37f" x-amz-version-id: null Accept-Ranges: bytes Server: AmazonS3 X-Cache: Miss from cloudfront Via: 1.1 a6d7db01f7a0edcb49cd879115321646.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-P5 X-Amz-Cf-Id: 1oGAUwXc8D2JR0K6IBFVA8TZfWzdkGAWEZVVZ-KWz9yUVoE3h2_Peg==
2024-04-26 05:43:00 UTC	2505	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 82 00 00 00 28 08 06 00 00 00 32 84 22 75 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 24 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 33 2d 63 30 31 31 20 36 36 2e 31 34 35 36 36 31 2c 20 32 30 31 32 2f 30 32 2f 30 36 2d 31 34 3a 35 36 3a 32 37 20 20 Data Ascii: PNGIHDR(2"utEXtSoftwareAdobe ImageReadyqe<$iTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49755	13.249.98.124	443	4020	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 05:43:01 UTC	645	OUT	GET /Search/SearchApplication/Resources/Images/Search/closeSprite.png HTTP/1.1 Host: storage2.stgbssint.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.sweetim.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 05:43:01 UTC	470	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 1240 Connection: close Date: Fri, 26 Apr 2024 05:43:02 GMT Last-Modified: Wed, 28 Feb 2018 09:59:06 GMT ETag: "ea2c48bed74bb2ebdd5989fb057478e2" x-amz-version-id: null Accept-Ranges: bytes Server: AmazonS3 X-Cache: Miss from cloudfront Via: 1.1 103ec34eaa00ebfa54ccec8bb9510672.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-P5 X-Amz-Cf-Id: OMsgzo2vCNzv334Ka4-BvHRpHbOcpTlaoyAkwpxI2Yw8czU-bCuIFA==
2024-04-26 05:43:01 UTC	1240	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 0c 00 00 00 18 08 06 00 00 00 ce 32 1c 6a 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 86 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 35 2d 63 30 32 31 20 37 39 2e 31 35 35 37 37 32 2c 20 32 30 31 34 2f 30 31 2f 31 33 2d 31 39 3a 34 34 3a 30 30 20 20 Data Ascii: PNGIHDR2jtEXtSoftwareAdobe ImageReadyqe<iTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.155772, 2014/01/13-19:44:00

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49756	108.157.173.24	443	4020	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 05:43:01 UTC	1116	OUT	GET /favicon.ico HTTP/1.1 Host: www.sweetim.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-arch: "x86" sec-ch-ua-platform-version: "10.0.0" dpr: 1 downlink: 1.3 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-platform: "Windows" device-memory: 8 rtt: 350 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 viewport-width: 1280 sec-ch-ua-full-version: "117.0.5938.132" ect: 3g Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.sweetim.com/installbar.asp?barid={C598706C-038F-11EF-8C2C-ECF4BBEA1588} Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: UserId=D725A570-038F-11EF-AAC5-BF869E32CC1E; UserData=2024-04-26T05%3A42%3A59.655Z; st=SearchWeb; _hse=true
2024-04-26 05:43:01 UTC	481	IN	HTTP/1.1 200 OK Content-Type: image/x-icon Content-Length: 1150 Connection: close cache-control: public, max-age=31536000 date: Fri, 26 Apr 2024 05:43:01 GMT etag: "47e-HgGsw6klthGz7AECUXEszb4DNHg" server: istio-envoy x-envoy-upstream-service-time: 0 x-powered-by: Express X-Cache: Miss from cloudfront Via: 1.1 4c3c3d48e1596e1c2c468662d48c7cc8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-P3 X-Amz-Cf-Id: vNHdeNo4r8I4Q06IaQHL_qUUiouzTSQjPj5iaqnqSF6yA35IRKjezw==
2024-04-26 05:43:01 UTC	1150	IN	Data Raw: 00 00 01 00 01 00 10 10 00 00 01 00 20 00 68 04 00 00 16 00 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 40 04 00 00 13 0b 00 00 13 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: h( @

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49758	13.249.98.124	443	4020	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 05:43:01 UTC	391	OUT	GET /search/images/homepage/button_bg.png HTTP/1.1 Host: se-p-static-content.seccint.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 05:43:01 UTC	470	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 2767 Connection: close Date: Fri, 26 Apr 2024 05:43:02 GMT Last-Modified: Thu, 06 Jul 2017 14:19:26 GMT ETag: "64f85ba4f1509e24c28ddc9e07de67d7" x-amz-version-id: null Accept-Ranges: bytes Server: AmazonS3 X-Cache: Miss from cloudfront Via: 1.1 550095e901774e11f1c0214c5ce186ae.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-P5 X-Amz-Cf-Id: D7Z45FnDcl-9gpnZaWAsFD39KHz9RYjh1bhlgdldoo49lClysubTDQ==
2024-04-26 05:43:01 UTC	2767	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 57 00 00 00 69 08 06 00 00 00 8e 36 60 71 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 64 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 30 2d 63 30 36 30 20 36 31 2e 31 33 34 37 37 37 2c 20 32 30 31 30 2f 30 32 2f 31 32 2d 31 37 3a 33 32 3a 30 30 20 20 Data Ascii: PNGIHDRWi6`qtEXtSoftwareAdobe ImageReadyqe<diTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49759	13.249.98.78	443	4020	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 05:43:01 UTC	399	OUT	GET /Search/SearchApplication/Resources/SpyGlass130x40.png HTTP/1.1 Host: storage2.stgbssint.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 05:43:01 UTC	470	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 2505 Connection: close Date: Fri, 26 Apr 2024 05:43:02 GMT Last-Modified: Wed, 28 Feb 2018 09:59:06 GMT ETag: "b254739743874926f3f110ba7eb9c37f" x-amz-version-id: null Accept-Ranges: bytes Server: AmazonS3 X-Cache: Miss from cloudfront Via: 1.1 550095e901774e11f1c0214c5ce186ae.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-P5 X-Amz-Cf-Id: 2A4sX9cBvcZwi_VgQSP8tFWP3xyWnfbJNMFqoYL600DqMJVjkMENog==
2024-04-26 05:43:01 UTC	2505	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 82 00 00 00 28 08 06 00 00 00 32 84 22 75 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 24 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 33 2d 63 30 31 31 20 36 36 2e 31 34 35 36 36 31 2c 20 32 30 31 32 2f 30 32 2f 30 36 2d 31 34 3a 35 36 3a 32 37 20 20 Data Ascii: PNGIHDR(2"utEXtSoftwareAdobe ImageReadyqe<$iTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49761	13.249.98.78	443	4020	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 05:43:01 UTC	410	OUT	GET /Search/SearchApplication/Resources/Images/Search/closeSprite.png HTTP/1.1 Host: storage2.stgbssint.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 05:43:02 UTC	470	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 1240 Connection: close Date: Fri, 26 Apr 2024 05:43:03 GMT Last-Modified: Wed, 28 Feb 2018 09:59:06 GMT ETag: "ea2c48bed74bb2ebdd5989fb057478e2" x-amz-version-id: null Accept-Ranges: bytes Server: AmazonS3 X-Cache: Miss from cloudfront Via: 1.1 55a2e492c74577abf8547dc740add63e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-P5 X-Amz-Cf-Id: YfXfyze0vObAPCGfJHr2-NIWYPuv0vlkzkz9xa_YcKE8c6Kln4PG0g==
2024-04-26 05:43:02 UTC	1240	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 0c 00 00 00 18 08 06 00 00 00 ce 32 1c 6a 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 86 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 35 2d 63 30 32 31 20 37 39 2e 31 35 35 37 37 32 2c 20 32 30 31 34 2f 30 31 2f 31 33 2d 31 39 3a 34 34 3a 30 30 20 20 Data Ascii: PNGIHDR2jtEXtSoftwareAdobe ImageReadyqe<iTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.155772, 2014/01/13-19:44:00

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49763	108.157.173.24	443	4020	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 05:43:01 UTC	467	OUT	GET /favicon.ico HTTP/1.1 Host: www.sweetim.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: UserId=D725A570-038F-11EF-AAC5-BF869E32CC1E; UserData=2024-04-26T05%3A42%3A59.655Z; st=SearchWeb; _hse=true
2024-04-26 05:43:02 UTC	481	IN	HTTP/1.1 200 OK Content-Type: image/x-icon Content-Length: 1150 Connection: close cache-control: public, max-age=31536000 date: Fri, 26 Apr 2024 05:43:02 GMT etag: "47e-HgGsw6klthGz7AECUXEszb4DNHg" server: istio-envoy x-envoy-upstream-service-time: 1 x-powered-by: Express X-Cache: Miss from cloudfront Via: 1.1 6fbeae74487f866b555dc44d03fcc2a6.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-P3 X-Amz-Cf-Id: hI3VfKeBr9kVbp1AzeRy-nFT4X6NZrt0_d-BB5BAdaw4exXa5MTUCg==
2024-04-26 05:43:02 UTC	1150	IN	Data Raw: 00 00 01 00 01 00 10 10 00 00 01 00 20 00 68 04 00 00 16 00 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 40 04 00 00 13 0b 00 00 13 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: h( @

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49767	23.193.120.112	443

Timestamp	Bytes transferred	Direction	Data
2024-04-26 05:43:04 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-26 05:43:04 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (chd/0712) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus-z1 Cache-Control: public, max-age=91288 Date: Fri, 26 Apr 2024 05:43:04 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49768	23.193.120.112	443

Timestamp	Bytes transferred	Direction	Data
2024-04-26 05:43:04 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-26 05:43:04 UTC	530	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0DZ+oYgAAAABSxwJpMgMuSLkfS640ajfFQVRBRURHRTEyMTkAY2VmYzI1ODMtYTliMi00NGE3LTk3NTUtYjc2ZDE3ZTA1Zjdm Cache-Control: public, max-age=91301 Date: Fri, 26 Apr 2024 05:43:04 GMT Content-Length: 55 Connection: close X-CID: 2
2024-04-26 05:43:04 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49770	192.178.50.46	443	4020	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 05:43:04 UTC	393	OUT	GET /webstore/inlineinstall/detail/efaidnbmnnnibpcajpcglclefindmkaj HTTP/1.1 Host: chrome.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 05:43:05 UTC	1457	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 26 Apr 2024 05:43:05 GMT Content-Disposition: attachment; filename="json.txt"; filename*=UTF-8''json.txt P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Security-Policy: require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/chromewebstore/2 Content-Security-Policy: script-src 'report-sample' 'nonce-fd3RXVuFRhq1fQpFRHX6YQ' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';worker-src 'self';report-uri /webstore/cspreport Report-To: {"group":"coop_chromewebstore","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/chromewebstore"}]} Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="coop_chromewebstore" Server: ESF X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Set-Cookie: NID=513=Qg4jUGwXrNas-9AG1-c7G-eXMuWPdLKZxTkUjbgSOMedUj5KXbZ3sCfMR9Enlg7ID9q0BVCmqRej2UCg6uL_S4sTMvUnHbVV0YZoVOBaEfIB4kuDWVmgtAIJ7ejKDHasgWtG6GqpEVa0-H0MI-aCsJMBGNYUE6mURWTH7yKx8gQ; expires=Sat, 26-Oct-2024 05:43:05 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-26 05:43:05 UTC	1457	IN	Data Raw: 31 34 30 66 0d 0a 7b 22 69 63 6f 6e 5f 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 6c 68 33 2e 67 6f 6f 67 6c 65 75 73 65 72 63 6f 6e 74 65 6e 74 2e 63 6f 6d 2f 61 71 61 68 47 7a 33 65 75 58 61 64 6d 74 6d 70 38 4e 5a 6e 75 4b 50 6f 55 6d 34 63 6d 65 77 4e 59 30 41 49 31 61 5f 63 4d 73 43 32 38 63 66 76 42 32 42 78 33 4e 41 72 59 39 4d 69 35 30 6f 32 7a 46 34 35 55 68 37 34 52 6d 6d 71 2d 42 68 36 64 4a 52 73 56 41 62 6d 3d 77 31 32 38 2d 68 31 32 38 2d 65 33 36 35 2d 72 6a 2d 73 63 30 78 30 30 66 66 66 66 66 66 22 2c 22 76 65 72 69 66 69 65 64 5f 73 69 74 65 22 3a 22 77 77 77 2e 61 64 6f 62 65 2e 63 6f 6d 22 2c 22 6c 6f 63 61 6c 69 7a 65 64 5f 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 44 6f 20 6d 6f 72 65 20 69 6e 20 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 Data Ascii: 140f{"icon_url":"https://lh3.googleusercontent.com/aqahGz3euXadmtmp8NZnuKPoUm4cmewNY0AI1a_cMsC28cfvB2Bx3NArY9Mi50o2zF45Uh74Rmmq-Bh6dJRsVAbm=w128-h128-e365-rj-sc0x00ffffff","verified_site":"www.adobe.com","localized_description":"Do more in Google Chrome
2024-04-26 05:43:05 UTC	1457	IN	Data Raw: 2a 5c 22 5c 6e 20 20 20 20 20 20 20 20 5d 5c 6e 20 20 20 20 7d 2c 5c 6e 20 20 20 20 5c 22 69 63 6f 6e 73 5c 22 3a 20 7b 5c 6e 20 20 20 20 20 20 20 20 5c 22 31 36 5c 22 3a 20 5c 22 62 72 6f 77 73 65 72 2f 69 6d 61 67 65 73 2f 61 63 72 6f 62 61 74 5f 64 63 5f 61 70 70 69 63 6f 6e 5f 31 36 2e 70 6e 67 5c 22 2c 5c 6e 20 20 20 20 20 20 20 20 5c 22 34 38 5c 22 3a 20 5c 22 62 72 6f 77 73 65 72 2f 69 6d 61 67 65 73 2f 61 63 72 6f 62 61 74 5f 64 63 5f 61 70 70 69 63 6f 6e 5f 34 38 2e 70 6e 67 5c 22 2c 5c 6e 20 20 20 20 20 20 20 20 5c 22 31 32 38 5c 22 3a 20 5c 22 62 72 6f 77 73 65 72 2f 69 6d 61 67 65 73 2f 61 63 72 6f 62 61 74 5f 64 63 5f 61 70 70 69 63 6f 6e 5f 31 32 38 2e 70 6e 67 5c 22 5c 6e 20 20 20 20 7d 2c 5c 6e 20 20 20 20 5c 22 61 63 74 69 6f 6e 5c 22 3a Data Ascii: *\"\n ]\n },\n \"icons\": {\n \"16\": \"browser/images/acrobat_dc_appicon_16.png\",\n \"48\": \"browser/images/acrobat_dc_appicon_48.png\",\n \"128\": \"browser/images/acrobat_dc_appicon_128.png\"\n },\n \"action\":
2024-04-26 05:43:05 UTC	1457	IN	Data Raw: 65 6e 74 2d 73 63 72 69 70 74 2e 63 73 73 5c 22 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 5d 2c 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 5c 22 6a 73 5c 22 3a 20 5b 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 5c 22 63 6f 6e 74 65 6e 74 5f 73 63 72 69 70 74 73 2f 67 64 72 69 76 65 2d 63 6f 6e 74 65 6e 74 2d 73 63 72 69 70 74 2e 6a 73 5c 22 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 5d 2c 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 5c 22 72 75 6e 5f 61 74 5c 22 3a 20 5c 22 64 6f 63 75 6d 65 6e 74 5f 65 6e 64 5c 22 5c 6e 20 20 20 20 20 20 20 20 7d 2c 5c 6e 20 20 20 20 20 20 20 20 7b 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 5c 22 6d 61 74 63 68 65 73 5c 22 3a 20 5b 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 5c 22 68 74 74 70 73 3a 2f 2f 6d Data Ascii: ent-script.css\"\n ],\n \"js\": [\n \"content_scripts/gdrive-content-script.js\"\n ],\n \"run_at\": \"document_end\"\n },\n {\n \"matches\": [\n \"https://m
2024-04-26 05:43:05 UTC	772	IN	Data Raw: 74 74 70 73 3a 2f 2f 75 73 65 2e 74 79 70 65 6b 69 74 2e 6e 65 74 20 68 74 74 70 73 3a 2f 2f 61 73 73 65 74 73 2e 61 64 6f 62 65 64 74 6d 2e 63 6f 6d 20 68 74 74 70 73 3a 2f 2f 2a 2e 61 64 6f 62 65 63 6f 6e 74 65 6e 74 2e 69 6f 20 68 74 74 70 73 3a 2f 2f 2a 2e 61 64 6f 62 65 6c 6f 67 69 6e 2e 63 6f 6d 20 68 74 74 70 73 3a 2f 2f 6c 6f 63 61 6c 2d 74 65 73 74 2e 61 63 72 6f 62 61 74 2e 63 6f 6d 3a 2a 20 68 74 74 70 73 3a 2f 2f 6c 6f 63 61 6c 2d 74 65 73 74 2e 61 63 72 6f 62 61 74 2e 61 64 6f 62 65 2e 63 6f 6d 3a 2a 20 68 74 74 70 73 3a 2f 2f 2a 2e 61 63 72 6f 62 61 74 2e 63 6f 6d 20 68 74 74 70 73 3a 2f 2f 2a 2e 61 64 6f 62 65 2e 63 6f 6d 5c 22 5c 6e 20 20 20 20 7d 2c 5c 6e 20 20 20 20 5c 22 68 6f 73 74 5f 70 65 72 6d 69 73 73 69 6f 6e 73 5c 22 3a 20 5b 5c Data Ascii: ttps://use.typekit.net https://assets.adobedtm.com https://.adobecontent.io https://.adobelogin.com https://local-test.acrobat.com:* https://local-test.acrobat.adobe.com:* https://.acrobat.com https://.adobe.com\"\n },\n \"host_permissions\": [\
2024-04-26 05:43:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49771	13.85.23.86	443

Timestamp	Bytes transferred	Direction	Data
2024-04-26 05:43:15 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=6NvAnKL1OPtr5PT&MD=RuvlYw+b HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-04-26 05:43:15 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "Mx1RoJH/qEwpWfKllx7sbsl28AuERz5IYdcsvtTJcgM=_2160" MS-CorrelationId: 2af5ff55-6622-4e2f-baab-0909aae71aac MS-RequestId: 34508662-ff95-41bb-b980-0744911411d0 MS-CV: Of8rcOHaIkepG1zv.0 X-Microsoft-SLSClientCache: 2160 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 26 Apr 2024 05:43:14 GMT Connection: close Content-Length: 25457
2024-04-26 05:43:15 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 51 22 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 db 8e 00 00 14 00 00 00 00 00 10 00 51 22 00 00 20 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 f3 43 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 0d 92 6f db e5 21 f3 43 43 4b ed 5a 09 38 55 5b df 3f 93 99 90 29 99 e7 29 ec 73 cc 4a 66 32 cf 84 32 64 c8 31 c7 11 52 38 87 90 42 66 09 99 87 32 0f 19 0a 09 51 a6 a8 08 29 53 86 4a 52 84 50 df 46 83 ba dd 7b df fb 7e ef 7d ee 7d bf ef 9e e7 d9 67 ef 35 ee b5 fe eb 3f ff b6 96 81 a2 0a 04 fc 31 40 21 5b 3f a5 ed 1b 04 0e 85 42 a0 10 04 64 12 6c a5 de aa a1 d8 ea f3 58 01 f2 f5 67 0b 5e 9b bd e8 a0 90 1d bf 40 88 9d eb 49 b4 87 9b ab 8b 9d 2b 46 c8 c7 c5 19 92 Data Ascii: MSCFQ"DQ" AdCenvironment.cabo!CCKZ8U[?))sJf22d1R8Bf2Q)SJRPF{~}}g5?1@![?BdlXg^@I+F
2024-04-26 05:43:15 UTC	9633	IN	Data Raw: 21 6f b3 eb a6 cc f5 31 be cf 05 e2 a9 fe fa 57 6d 19 30 b3 c2 c5 66 c9 6a df f5 e7 f0 78 bd c7 a8 9e 25 e3 f9 bc ed 6b 54 57 08 2b 51 82 44 12 fb b9 53 8c cc f4 60 12 8a 76 cc 40 40 41 9b dc 5c 17 ff 5c f9 5e 17 35 98 24 56 4b 74 ef 42 10 c8 af bf 7f c6 7f f2 37 7d 5a 3f 1c f2 99 79 4a 91 52 00 af 38 0f 17 f5 2f 79 81 65 d9 a9 b5 6b e4 c7 ce f6 ca 7a 00 6f 4b 30 44 24 22 3c cf ed 03 a5 96 8f 59 29 bc b6 fd 04 e1 70 9f 32 4a 27 fd 55 af 2f fe b6 e5 8e 33 bb 62 5f 9a db 57 40 e9 f1 ce 99 66 90 8c ff 6a 62 7f dd c5 4a 0b 91 26 e2 39 ec 19 4a 71 63 9d 7b 21 6d c3 9c a3 a2 3c fa 7f 7d 96 6a 90 78 a6 6d d2 e1 9c f9 1d fc 38 d8 94 f4 c6 a5 0a 96 86 a4 bd 9e 1a ae 04 42 83 b8 b5 80 9b 22 38 20 b5 25 e5 64 ec f7 f4 bf 7e 63 59 25 0f 7a 2e 39 57 76 a2 71 aa 06 8a Data Ascii: !o1Wm0fjx%kTW+QDS`v@@A\\^5$VKtB7}Z?yJR8/yekzoK0D$"<Y)p2J'U/3b_W@fjbJ&9Jqc{!m<}jxm8B"8 %d~cY%z.9Wvq

Target ID:	0
Start time:	07:42:18
Start date:	26/04/2024
Path:	C:\Users\user\Desktop\BundleSweetIMSetup.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\BundleSweetIMSetup.exe"
Imagebase:	0x400000
File size:	4'666'160 bytes
MD5 hash:	BCC96659D6A46536DBDE959FB9D60F67
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	07:42:26
Start date:	26/04/2024
Path:	C:\Users\user\AppData\Local\Temp\SweetIMSetup.exe
Wow64 process (32bit):	true
Commandline:	/s /w /v" /qn SIMHP=0 SIMSP=0 "
Imagebase:	0x400000
File size:	3'935'664 bytes
MD5 hash:	CED6A16415E6AE2243ACC2B776B9D965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	07:42:26
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	MSIEXEC.EXE /i "C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B}\SweetIMSetup.msi" /qn SIMHP=0 SIMSP=0 SETUPEXEDIR="C:\Users\user\AppData\Local\Temp"
Imagebase:	0xb0000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	07:42:26
Start date:	26/04/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\msiexec.exe /V
Imagebase:	0x7ff6accf0000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	07:42:27
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding A265C8E8A3BB4B1A10A4D9F720E583B6
Imagebase:	0xb0000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	07:42:30
Start date:	26/04/2024
Path:	C:\Users\user\AppData\Local\Temp\{A81A974F-8A22-43E6-9243-5198FF758DA1}\VistaCookiesCollector.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\{A81A974F-8A22-43E6-9243-5198FF758DA1}\VistaCookiesCollector.exe http://sweetim.com,C:\Users\user\AppData\LocalLow\simcookies.dat
Imagebase:	0x400000
File size:	65'840 bytes
MD5 hash:	8E11C6FCF30B1DC4C7069144B80C2709
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 18%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	07:42:33
Start date:	26/04/2024
Path:	C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe" -AutoStartIM
Imagebase:	0x400000
File size:	114'992 bytes
MD5 hash:	15A4D1A8C15CB3C0C13C3F36899475E6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 30%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	07:42:36
Start date:	26/04/2024
Path:	C:\Users\user\AppData\Local\Temp\SweetIESetup.exe
Wow64 process (32bit):	true
Commandline:	/s /w /v" /qn SIMOB=0 SIMADDREGIE={UserSelectedHP=1,UserSelectedDS=1} "
Imagebase:	0x400000
File size:	3'410'880 bytes
MD5 hash:	4E3FCE1D8BE37088E4E40B829DA24091
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	07:42:36
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	MSIEXEC.EXE /i "C:\Users\user\AppData\Local\Temp\{B3CA5B4C-F637-458C-81D6-CD8DADBE9841}\SweetIESetup.msi" /qn SIMOB=0 SIMADDREGIE={UserSelectedHP=1,UserSelectedDS=1} SETUPEXEDIR="C:\Users\user\AppData\Local\Temp"
Imagebase:	0xb0000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	07:42:37
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding F0CC6D3E1A3C8837D5C7D007B45C879F
Imagebase:	0xb0000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	07:42:56
Start date:	26/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://www.sweetim.com/installbar.asp?barid={C598706C-038F-11EF-8C2C-ECF4BBEA1588}
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	07:42:56
Start date:	26/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1960,i,7459701528248846225,13626864308159879949,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Function 0429ED80 Relevance: 1.2, Instructions: 1248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1944544419.0000000004296000.00000004.00000020.00020000.00000000.sdmp, Offset: 04296000, based on PE: false

Associated: 00000000.00000003.1918635774.00000000042A1000.00000004.00000020.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.1933803776.00000000042A4000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4272000_BundleSweetIMSetup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db398c65cd0c85cb97368f9b253e73d749d99a5f03896d437053df3f9c2c36fa
Instruction ID: 0695908db047844c04c617abcdb73099722222a10fd3d4755660db46aca9ef1b
Opcode Fuzzy Hash: db398c65cd0c85cb97368f9b253e73d749d99a5f03896d437053df3f9c2c36fa
Instruction Fuzzy Hash: D7929C9295E7C11FDB5787704D7A991BFB06E6310070E86CFC8CA8E8A3E3499909D367

Uniqueness

Uniqueness Score: -1.00%

Function 0429ED80 Relevance: 1.2, Instructions: 1248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1944544419.0000000004296000.00000004.00000020.00020000.00000000.sdmp, Offset: 0429C000, based on PE: false

Associated: 00000000.00000003.1933803776.00000000042A4000.00000004.00000020.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.1941087262.00000000042AC000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4272000_BundleSweetIMSetup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35d447416fe94c763cca08425af06bd7bb205f377fe68a23ddbb9e3029de77f7
Instruction ID: 0695908db047844c04c617abcdb73099722222a10fd3d4755660db46aca9ef1b
Opcode Fuzzy Hash: 35d447416fe94c763cca08425af06bd7bb205f377fe68a23ddbb9e3029de77f7
Instruction Fuzzy Hash: D7929C9295E7C11FDB5787704D7A991BFB06E6310070E86CFC8CA8E8A3E3499909D367

Uniqueness

Uniqueness Score: -1.00%

Function 0429ED80 Relevance: 1.2, Instructions: 1239COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1944544419.0000000004296000.00000004.00000020.00020000.00000000.sdmp, Offset: 0429D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4272000_BundleSweetIMSetup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cd1055967fea9b0c3a82f9b2a3f01d1eabfb76e12e98c2a76825f4965809c56
Instruction ID: 39268c1e5c66f3392530ac33c376cd3ae87b1a8c745838442d1cbfb09655b2a9
Opcode Fuzzy Hash: 6cd1055967fea9b0c3a82f9b2a3f01d1eabfb76e12e98c2a76825f4965809c56
Instruction Fuzzy Hash: 69929D5295E7C11FDB5787700DBA991BFB06E6310070E86CFC8CA8E8A3E7499909D367

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: SweetIMSetup.exePID: 7004, Parent PID: 6936COMMON

Execution Graph

Execution Coverage:	11.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	9.2%
Total number of Nodes:	2000
Total number of Limit Nodes:	81

Executed Functions

Function 00413EA3 Relevance: 70.7, APIs: 16, Strings: 24, Instructions: 653
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 00413EA8
wsprintfA.USER32 ref: 004140EC

Part of subcall function 0040191F: GetLastError.KERNEL32(02151168,00000000,0041E21A,removeasmajorupgrade,00000000,00000000,00000001,?,?,00000000,reboot,00000000,00000000,00000000,runfromtemp,00000000), ref: 00401935
Part of subcall function 0040191F: SysFreeString.OLEAUT32(?), ref: 00401953
Part of subcall function 0040191F: SetLastError.KERNEL32(?,00000001,?,00000000), ref: 00401973

Part of subcall function 004016F0: lstrlenW.KERNEL32(00436494,74DF34C0,74DF2EE0,00000000,00000000,?,0041FD7B,?,?,00000001,?,80000000,00000003,00000000,00000003,00000080), ref: 00401743
Part of subcall function 004016F0: WideCharToMultiByte.KERNEL32(00000000,00000000,00436494,000000FF,?,00000002,00000000,00000000,?,0041FD7B,?,?,00000001,?,80000000,00000003), ref: 0040176B

Part of subcall function 004025BC: __EH_prolog.LIBCMT ref: 004025C1

Part of subcall function 00409F70: __EH_prolog.LIBCMT ref: 00409F75
Part of subcall function 00409F70: GetLastError.KERNEL32(00000000,00000104), ref: 00409FA1
Part of subcall function 00409F70: SetLastError.KERNEL32(00000000,?,00000000,?,00000001), ref: 00409FD6

Part of subcall function 004014FF: __EH_prolog.LIBCMT ref: 00401504
Part of subcall function 004014FF: SetLastError.KERNEL32(?,?,00000000,74DF2EE0,?,0041FD71,?,?,00000001,?,80000000,00000003,00000000,00000003,00000080,00000000), ref: 0040156A

Part of subcall function 0040A71D: __EH_prolog.LIBCMT ref: 0040A722
Part of subcall function 0040A71D: LoadLibraryA.KERNEL32(00000000,?,00000000,?,00000003,?,0041463A,?,00000000,?,00000001,00000000,00442430,00000000,00000032,?), ref: 0040A753
Part of subcall function 0040A71D: GetLastError.KERNEL32(?,0041463A,?,00000000,?,00000001,00000000,00442430,00000000,00000032,?,00000032), ref: 0040A764

Part of subcall function 0040A8FA: GetProcAddress.KERNEL32(?,RunISMSISetup), ref: 0040A90A
Part of subcall function 0040A8FA: GetLastError.KERNEL32 ref: 0040A914

wsprintfA.USER32 ref: 00414137
wsprintfA.USER32 ref: 00414157
lstrlenA.KERNEL32(00000000,00000000,00000000,00000000), ref: 004141AF
lstrlenA.KERNEL32(?), ref: 00414230
lstrcatA.KERNEL32(?,0043DAC8), ref: 00414246
lstrcatA.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00414301
wsprintfA.USER32 ref: 0041435A
wsprintfA.USER32 ref: 0041438E
lstrcatA.KERNEL32(?,00000000), ref: 004143E5
wsprintfA.USER32 ref: 00414456
wsprintfA.USER32 ref: 00414471
wsprintfA.USER32 ref: 0041450B
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,00000000), ref: 00414707

Part of subcall function 00413D18: __EH_prolog.LIBCMT ref: 00413D1D
Part of subcall function 00413D18: GetTempPathA.KERNEL32(00000400,00000000,00000000,00000003), ref: 00413D4F
Part of subcall function 00413D18: FindFirstFileA.KERNEL32(00000000,?,|dC,*.mst,?,00000000,00000000,?,00000001), ref: 00413DD1
Part of subcall function 00413D18: CompareFileTime.KERNEL32(?,?), ref: 00413DEE
Part of subcall function 00413D18: DeleteFileA.KERNEL32(00000000,?,?,?,00000001,00000000,?,00000001), ref: 00413E54
Part of subcall function 00413D18: FindNextFileA.KERNEL32(00000000,?), ref: 00413E6E

Strings

\, xrefs: 004141B5
4$D, xrefs: 00414263
|dC, xrefs: 00414577
%s%s%s%s%s%s, xrefs: 004140E6
4$D, xrefs: 00414025
ISSCRIPTCMDLINE, xrefs: 004141F1, 004141FD, 00414207, 0041426E
%s /f%s "%s" %s, xrefs: 004144E8
%s /p "%s" %s, xrefs: 00414450
%s /j%s "%s" %s, xrefs: 004144BE
0$D, xrefs: 004140A8
TRANSFORMS=", xrefs: 00413F04
tdC, xrefs: 0041425A
0$D, xrefs: 00414098
%s %s, xrefs: 00414388
%s="%s", xrefs: 00414354
%s TRANSFORMS="%s", xrefs: 00414131
ActiveMark.dat, xrefs: 00414393
tdC, xrefs: 00414547
|dC, xrefs: 0041426F
%s /x "%s" %s, xrefs: 004144A0
/p"%s" %s, xrefs: 0041446B
%s /a "%s"%s, xrefs: 004144FF
%s /i "%s" %s, xrefs: 00414440
TRANSFORMS=, xrefs: 00413F35

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: wsprintf$ErrorLast$H_prolog$File$Timelstrcatlstrlen$Find$AddressByteCharCompareDeleteFirstFreeLibraryLoadMultiNextPathProcStringSystemTempWide
String ID: %s %s$%s /a "%s"%s$%s /f%s "%s" %s$%s /i "%s" %s$%s /j%s "%s" %s$%s /p "%s" %s$%s /x "%s" %s$%s TRANSFORMS="%s"$%s%s%s%s%s%s$%s="%s"$/p"%s" %s$0$D$0$D$4$D$4$D$ActiveMark.dat$ISSCRIPTCMDLINE$TRANSFORMS=$TRANSFORMS="$\$tdC$tdC$|dC$|dC
API String ID: 1008137369-1261308446
Opcode ID: 9c262b8f7c59074c6a629f34ee9eda31d9b95ba98371923fc9865bf9e6c96085
Instruction ID: 14eb990ffad4f9568558a39ce652d059c6757e4c979fc51e2508f71c49f58924
Opcode Fuzzy Hash: 9c262b8f7c59074c6a629f34ee9eda31d9b95ba98371923fc9865bf9e6c96085
Instruction Fuzzy Hash: 16420471D04218AADF20DBA0CC81BEE7779AB45304F1440BFF50AA71C1DB789B89CB69

Uniqueness

Uniqueness Score: -1.00%

Function 004101BC Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 120
librarystringloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 004101C1
lstrcpyA.KERNEL32(C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B},?,?), ref: 004101D8
lstrcpyA.KERNEL32(00443D50,?), ref: 004101E2
LoadLibraryA.KERNEL32(Msi.dll), ref: 00410205
GetProcAddress.KERNEL32(00000000,MsiQueryProductStateA), ref: 00410224

Part of subcall function 00402375: __EH_prolog.LIBCMT ref: 0040237A

Part of subcall function 00401581: __EH_prolog.LIBCMT ref: 00401586
Part of subcall function 00401581: GetLastError.KERNEL32(02151168,00000000,00000000,?,0041E199,?,00000000,reboot,00000000,00000000,00000000,runfromtemp,00000000,00000001,00000001,00000000), ref: 004015AF
Part of subcall function 00401581: SetLastError.KERNEL32(?,00000000,?,0041E199,?,00000000,reboot,00000000,00000000,00000000,runfromtemp,00000000,00000001,00000001,00000000), ref: 004015DD

Part of subcall function 004016F0: lstrlenW.KERNEL32(00436494,74DF34C0,74DF2EE0,00000000,00000000,?,0041FD7B,?,?,00000001,?,80000000,00000003,00000000,00000003,00000080), ref: 00401743
Part of subcall function 004016F0: WideCharToMultiByte.KERNEL32(00000000,00000000,00436494,000000FF,?,00000002,00000000,00000000,?,0041FD7B,?,?,00000001,?,80000000,00000003), ref: 0040176B

Part of subcall function 004025BC: __EH_prolog.LIBCMT ref: 004025C1

Part of subcall function 00409F70: __EH_prolog.LIBCMT ref: 00409F75
Part of subcall function 00409F70: GetLastError.KERNEL32(00000000,00000104), ref: 00409FA1
Part of subcall function 00409F70: SetLastError.KERNEL32(00000000,?,00000000,?,00000001), ref: 00409FD6

Strings

tdC, xrefs: 00410254
ProductCode, xrefs: 0041028A
C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B}\Setup.INI, xrefs: 00410234
Msi.dll, xrefs: 00410200
|dC, xrefs: 0041026A
C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B}, xrefs: 004101D3
MsiQueryProductStateA, xrefs: 0041021E
Startup, xrefs: 0041028F

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: H_prolog$ErrorLast$lstrcpy$AddressByteCharLibraryLoadMultiProcWidelstrlen
String ID: C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B}$C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B}\Setup.INI$Msi.dll$MsiQueryProductStateA$ProductCode$Startup$tdC$|dC
API String ID: 1129170967-3113224644
Opcode ID: 4da015a2dfada147bf9245ae58214c3b552348513d75d08bbd39ad31faa11db1
Instruction ID: 58226bd76efee846d6959de343797b5e200357f0817412cffed51d7c1baf02a6
Opcode Fuzzy Hash: 4da015a2dfada147bf9245ae58214c3b552348513d75d08bbd39ad31faa11db1
Instruction Fuzzy Hash: E641A131D01219EFCF05EFA1C945ADEBBB4AF18704F10805BF81563192DBB89A94CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00415269 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 194
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00420613: lstrcpyA.KERNEL32(00000001,00442430,?,00000000,00000000), ref: 00420633
Part of subcall function 00420613: lstrcpyA.KERNEL32(00000000,00442430), ref: 00420639
Part of subcall function 00420613: GetFileVersionInfoSizeA.VERSION(00000000,00000000), ref: 00420642
Part of subcall function 00420613: GetFileVersionInfoA.VERSION(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 0042066D
Part of subcall function 00420613: VerQueryValueA.VERSION(00000000,0043E0A4,00000000,00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 004206A2
Part of subcall function 00420613: wsprintfA.USER32 ref: 004206CC
Part of subcall function 00420613: VerQueryValueA.VERSION(00000000,\VarFileInfo\Translation,00000000,00000000,0043E0A4,00000000,00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 004206F6

Part of subcall function 00420EF7: lstrcpyA.KERNEL32(?,00000000,?,00000000), ref: 00420F26
Part of subcall function 00420EF7: lstrcpyA.KERNEL32(?,?,?,00000000), ref: 00420F32

GetVersionExA.KERNEL32(?,?,?,00000001,00000000,00000000), ref: 0041531D
GetTempPathA.KERNEL32(00000400,00000000,?,?,00000001,00000000,00000000), ref: 004153AA
GetWindowsDirectoryA.KERNEL32(00000000,00000400,?,?,00000001,00000000,00000000), ref: 004153CF
wsprintfA.USER32 ref: 004154B8

Strings

SupportOSMsi30, xrefs: 0041532E
SupportOSMsi12, xrefs: 0041533E
Msi.DLL, xrefs: 004152A9
Y, xrefs: 00415450
SupportOS, xrefs: 00415345, 0041534B

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: lstrcpy$Version$FileInfoQueryValuewsprintf$DirectoryPathSizeTempWindows
String ID: Msi.DLL$SupportOS$SupportOSMsi12$SupportOSMsi30$Y
API String ID: 3417613323-835925834
Opcode ID: 4f8dfe36798ef94ba97aa7ffead675af4eb47f3d8f4aec6fd40e97ad48b4c574
Instruction ID: 620f16ec86a7931f0017723438644b6c20194c40a031239036005d52006f1718
Opcode Fuzzy Hash: 4f8dfe36798ef94ba97aa7ffead675af4eb47f3d8f4aec6fd40e97ad48b4c574
Instruction Fuzzy Hash: 8F510671A05659EBEF209B65DC04BEA77B8AB84308F1404BBE605E3181DB7CDEC48B5D

Uniqueness

Uniqueness Score: -1.00%

Function 004207E4 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 88librarystringloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(KERNEL32,0000044F,00000000), ref: 004207FE
GetProcAddress.KERNEL32(00000000,GetDiskFreeSpaceExA), ref: 00420816
lstrcpyA.KERNEL32(?,?), ref: 0042082C

Part of subcall function 00420CFA: CharNextA.USER32(00000000,00420D25,74DE83C0,00000000,00000000,0041C213,?,74DE83C0,00000000), ref: 00420D04

GetDiskFreeSpaceExA.KERNELBASE(?,00406C10,00000400,00000000,?), ref: 00420861

Part of subcall function 00420AEB: CharNextA.USER32(?,74DE8B60,?,00000000,00420C84,?,?,00401E26,?,C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B},?,?,?,00000104), ref: 00420B00
Part of subcall function 00420AEB: CharPrevA.USER32(?,?,74DE8B60,?,00000000,00420C84,?,?,00401E26,?,C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B},?,?,?,00000104), ref: 00420B09
Part of subcall function 00420AEB: CharNextA.USER32(00000000,?,?,00401E26,?,C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B},?,?,?,00000104), ref: 00420B21
Part of subcall function 00420AEB: CharNextA.USER32(00000000,?,00401E26,?,C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B},?,?,?,00000104), ref: 00420B27

GetDiskFreeSpaceA.KERNEL32(?,00000000,?,00000000,00000000), ref: 004208BC
FreeLibrary.KERNEL32(0000044F), ref: 004208E0

Strings

KERNEL32, xrefs: 004207F4
GetDiskFreeSpaceExA, xrefs: 00420810

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: Char$Next$Free$DiskLibrarySpace$AddressLoadPrevProclstrcpy
String ID: GetDiskFreeSpaceExA$KERNEL32
API String ID: 711836960-2868000099
Opcode ID: 31872fbbc97fb7e305fa4055a83fdcbbd2ab37acb5544c350440022e4b0a1095
Instruction ID: 52b30cabf4eab4b8bce74ee59a8e60cce33e4acbec4d49c24e9d528cf066a4aa
Opcode Fuzzy Hash: 31872fbbc97fb7e305fa4055a83fdcbbd2ab37acb5544c350440022e4b0a1095
Instruction Fuzzy Hash: 0A311AB2A0025DABCF10DFA5D8849DFBBFCBB08310F5081A6E555E7252DA34DA44CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00404008 Relevance: 12.1, APIs: 8, Instructions: 61memoryfileCOMMON

Download Yara Rule

APIs

GetFileSize.KERNEL32(?,00000000,00000000,?,00000000,?,00403215,000000FF,?,?,00000000,000000FF,?,74DE8B60,?,00000000), ref: 00404016
GetProcessHeap.KERNEL32(00000008,00000001,?,00403215,000000FF,?,?,00000000,000000FF,?), ref: 00404035
RtlAllocateHeap.NTDLL(00000000,?,00403215,000000FF,?,?,00000000,000000FF,?), ref: 00404038
ReadFile.KERNELBASE(?,00000000,00000000,00000000,00000000,?,00403215,000000FF,?,?,00000000,000000FF,?), ref: 00404056
GetProcessHeap.KERNEL32(00000000,00000000,00000000,00000000,?,00403215,000000FF,?,?,00000000,000000FF,?), ref: 00404074
HeapFree.KERNEL32(00000000,?,00403215,000000FF,?,?,00000000,000000FF,?), ref: 00404077
GetProcessHeap.KERNEL32(00000000,00000000,?,00403215,000000FF,?,?,00000000,000000FF,?), ref: 00404083
HeapFree.KERNEL32(00000000,?,00403215,000000FF,?,?,00000000,000000FF,?), ref: 00404086

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: Heap$Process$FileFree$AllocateReadSize
String ID:
API String ID: 3605603088-0
Opcode ID: 2e3915a82b6920d76a7f0eb4efcae5ee14de5d5b3f378b080e4d2497bb0471ed
Instruction ID: 2f92f49b8bd053433d4c4ebd0ebfc2d85ec07220a95d70ff98fc06e2c8e14aa0
Opcode Fuzzy Hash: 2e3915a82b6920d76a7f0eb4efcae5ee14de5d5b3f378b080e4d2497bb0471ed
Instruction Fuzzy Hash: 151186715042057FEB10ABA5DC4CF6B3B6CDF85724F01816AFA04DB190CA749800CB78

Uniqueness

Uniqueness Score: -1.00%

Function 0041AD16 Relevance: 3.1, APIs: 2, Instructions: 67COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,?,?), ref: 0041AD43
GetSystemInfo.KERNELBASE(?,?,?), ref: 0041AD83

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: InfoSystemVersion
String ID:
API String ID: 1934062620-0
Opcode ID: 7c068f0f100b94e8adfbe31a446dcd521352a9bc7a9b351846718b74bd46e3ed
Instruction ID: 960f14a74b2d4bd285954005ada4d868c4f2650f8c1e33dcadc0e800b090c640
Opcode Fuzzy Hash: 7c068f0f100b94e8adfbe31a446dcd521352a9bc7a9b351846718b74bd46e3ed
Instruction Fuzzy Hash: 34217FB0D02629DBDF20CF94D845BEEBBB5EB44302F50405BE509A3780D7784A84CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 004213BE Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNELBASE(?,00001004,0041CA77,00000014,0041CA77,?,?,?,00000000), ref: 004213D2

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: f2c5954b0879a35d3449f508275630fa45f583632f663badc58c97b207ffc58c
Instruction ID: f1b88fb7da1ad2f9c85fddaedb67e38f8266722f0b4c2387903e5a5c6787fd00
Opcode Fuzzy Hash: f2c5954b0879a35d3449f508275630fa45f583632f663badc58c97b207ffc58c
Instruction Fuzzy Hash: BCE086313002086AEB01EFA4EC02E9B37AD9B44748F500025FB05E91E1EAB0D94187A4

Uniqueness

Uniqueness Score: -1.00%

Function 00404DE4 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acffcc010dddb7a6a31ecdca460e7c07fe15e28c63bb4281974fa0c29f58670d
Instruction ID: 5ca9ff18eb06532004dff265180d4021c07b9e00f9ca0b6d1bf0e5e05ac1e64f
Opcode Fuzzy Hash: acffcc010dddb7a6a31ecdca460e7c07fe15e28c63bb4281974fa0c29f58670d
Instruction Fuzzy Hash: B4E0863220435157C320DF05DC01E57BBA5AFC1714F08486EF69457252C3A5A815C795

Uniqueness

Uniqueness Score: -1.00%

Function 0041E070 Relevance: 72.7, APIs: 18, Strings: 23, Instructions: 922
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitialize.OLE32(00000000), ref: 0041E07F

Part of subcall function 0041ED52: __EH_prolog.LIBCMT ref: 0041ED57

Part of subcall function 0041EDDD: __EH_prolog.LIBCMT ref: 0041EDE2
Part of subcall function 0041EDDD: SysAllocString.OLEAUT32(?), ref: 0041EEDC
Part of subcall function 0041EDDD: SysStringLen.OLEAUT32(00000000), ref: 0041EEEF
Part of subcall function 0041EDDD: SysFreeString.OLEAUT32(00000000), ref: 0041EEFA

Part of subcall function 0041EDDD: SysFreeString.OLEAUT32(00000000), ref: 0041EF31

CoUninitialize.OLE32(?,00000001,?,?,?,00000001), ref: 0041ED43

Part of subcall function 0040A7BD: __EH_prolog.LIBCMT ref: 0040A7C2
Part of subcall function 0040A7BD: GetModuleFileNameA.KERNEL32(00000000,00000400,?,00000400,?,00000000,0043647C,00436474,00000000), ref: 0040A827

Part of subcall function 0040A71D: __EH_prolog.LIBCMT ref: 0040A722
Part of subcall function 0040A71D: LoadLibraryA.KERNEL32(00000000,?,00000000,?,00000003,?,0041463A,?,00000000,?,00000001,00000000,00442430,00000000,00000032,?), ref: 0040A753
Part of subcall function 0040A71D: GetLastError.KERNEL32(?,0041463A,?,00000000,?,00000001,00000000,00442430,00000000,00000032,?,00000032), ref: 0040A764

Part of subcall function 0040191F: GetLastError.KERNEL32(02151168,00000000,0041E21A,removeasmajorupgrade,00000000,00000000,00000001,?,?,00000000,reboot,00000000,00000000,00000000,runfromtemp,00000000), ref: 00401935
Part of subcall function 0040191F: SysFreeString.OLEAUT32(?), ref: 00401953
Part of subcall function 0040191F: SetLastError.KERNEL32(?,00000001,?,00000000), ref: 00401973

Part of subcall function 0040A8FA: GetProcAddress.KERNEL32(?,RunISMSISetup), ref: 0040A90A
Part of subcall function 0040A8FA: GetLastError.KERNEL32 ref: 0040A914

wsprintfA.USER32 ref: 0041E256
wsprintfA.USER32 ref: 0041E2D0
lstrcpyA.KERNEL32(?,00000001,removeasmajorupgrade,00000000,00000000,00000001,?,?,00000000,reboot,00000000,00000000,00000000,runfromtemp,00000000,00000001), ref: 0041E332
lstrlenA.KERNEL32(?,?,00000000), ref: 0041E33F
lstrcpyA.KERNEL32(?,-00000003,?,00000000), ref: 0041E39E
GetTempPathA.KERNEL32(00000104,00000000,?,00000104,tempdisk1folder,?,00000000,00000000,?,00000001,?,00000000,removeasmajorupgrade,00000000,00000000,00000001), ref: 0041E49D
lstrcpyA.KERNEL32(C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B},00000000,tempdisk1folder,?,00000000,00000000,?,00000001,?,00000000,removeasmajorupgrade,00000000,00000000,00000001,?,?), ref: 0041E53C
lstrlenA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B},?,00000000), ref: 0041E554
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 0041E644

Part of subcall function 004029BB: __EH_prolog.LIBCMT ref: 004029C0
Part of subcall function 004029BB: SetLastError.KERNEL32(?,?,00000000,00000104,?,0041E59F,02151168,?,00000001,?,00000000,C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B},?,00000000), ref: 00402A26

Part of subcall function 0041883F: __EH_prolog.LIBCMT ref: 00418844

Part of subcall function 00401CF2: __EH_prolog.LIBCMT ref: 00401CF7
Part of subcall function 00401CF2: GetLastError.KERNEL32(004364B4,00000004,?,0041EEC5,?,00000004,?,?,00000000,?,?,?,00000000,02151168,00000000,00000000), ref: 00401D1A
Part of subcall function 00401CF2: SysFreeString.OLEAUT32(?), ref: 00401D38
Part of subcall function 00401CF2: SetLastError.KERNEL32(?,00000001,?,0041EEC5,?,00000004,?,?,00000000,?,?,?,00000000,02151168,00000000,00000000), ref: 00401D58

Part of subcall function 00402D6A: lstrlenW.KERNEL32(004364D8,02151168,00000104,00000000,004364BC,?,0041E536,tempdisk1folder,?,00000000,00000000,?,00000001,?,00000000,removeasmajorupgrade), ref: 00402DBD
Part of subcall function 00402D6A: WideCharToMultiByte.KERNEL32(00000000,00000000,004364D8,000000FF,?,00000002,00000000,00000000,?,0041E536,tempdisk1folder,?,00000000,00000000,?,00000001), ref: 00402DE5

CopyFileA.KERNEL32(?,00000000,00000000), ref: 0041E727

Part of subcall function 004022FB: __EH_prolog.LIBCMT ref: 00402300
Part of subcall function 004022FB: GetLastError.KERNEL32(74DE8B60,00000104), ref: 0040232C
Part of subcall function 004022FB: SetLastError.KERNEL32(00000000,?,00000000,?,00000001), ref: 00402361

CopyFileA.KERNEL32(?,00000000,00000000), ref: 0041E821
CopyFileA.KERNEL32(?,00000000,00000000), ref: 0041E964
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 0041EA8A
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 0041EB33
wsprintfA.USER32 ref: 0041EBEE
CoUninitialize.OLE32(?,00000001), ref: 0041EC84

Strings

4$D, xrefs: 0041E7BB
Languages, xrefs: 0041E9A9, 0041E9F7
tdC, xrefs: 0041E18A
reboot, xrefs: 0041E0D8
runfromtemp, xrefs: 0041E0C8
count, xrefs: 0041E9A4
key%d, xrefs: 0041E9DC
%s\%04x.mst, xrefs: 0041EAE0, 0041EB07
Skin, xrefs: 0041E897
4$D, xrefs: 0041E4B7
ISSetup.dll, xrefs: 0041E760
tempdisk1folder, xrefs: 0041E437
removeasmajorupgrade, xrefs: 0041E1B7
setup.isn, xrefs: 0041E8C2
Startup, xrefs: 0041E89C
%s %s, xrefs: 0041E250
%s /q"%s" /tempdisk1folder"%s" %s, xrefs: 0041EBE8
ISSetup.dll, xrefs: 0041E7A2, 0041E7C5
C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B}, xrefs: 0041E08E, 0041E537, 0041E542, 0041EBD6
|dC, xrefs: 0041E19C
%s%s, xrefs: 0041E2CA
4$D, xrefs: 0041E45D
%s\0x%04x.ini, xrefs: 0041EA37, 0041EA5E

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: ErrorLast$H_prolog$File$CopyString$Free$lstrcpylstrlenwsprintf$Uninitialize$AddressAllocByteCharInitializeLibraryLoadModuleMultiNamePathProcTempWide
String ID: %s %s$%s /q"%s" /tempdisk1folder"%s" %s$%s%s$%s\%04x.mst$%s\0x%04x.ini$4$D$4$D$4$D$C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B}$ISSetup.dll$ISSetup.dll$Languages$Skin$Startup$count$key%d$reboot$removeasmajorupgrade$runfromtemp$setup.isn$tdC$tempdisk1folder$|dC
API String ID: 2023700203-4291814005
Opcode ID: 3355d35ce9f45090e68720d9ee4899572ab987d5c029114cb25280f7a05e88c0
Instruction ID: 3214510fa0d9b7779b927ef0dc8f36ecd35df5f773c7b5d414b4a59d9882a2de
Opcode Fuzzy Hash: 3355d35ce9f45090e68720d9ee4899572ab987d5c029114cb25280f7a05e88c0
Instruction Fuzzy Hash: 21724071D00119AADB24EBA2DC95EEEB778AF14304F5044AFE50673192EB389F85CF58

Uniqueness

Uniqueness Score: -1.00%

Function 004134C4 Relevance: 46.1, APIs: 12, Strings: 14, Instructions: 561
librarystringloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 004134C9
SendMessageA.USER32(?,00000401,00000000,00000001), ref: 0041361C
SendMessageA.USER32(?,00000401,00000000,00000000), ref: 00413676
LoadLibraryA.KERNELBASE(Msi.dll,000000AC,00000000,?,00000000,00000000), ref: 00413790
GetProcAddress.KERNEL32(00000000,MsiGetProductInfoA), ref: 004137B6
GetProcAddress.KERNEL32(00000000,MsiSourceListEnumSourcesA), ref: 004137C1
lstrcmpiA.KERNEL32(-0000003B,?), ref: 0041380A
lstrcpyA.KERNEL32(?,00442430,?,?,?,00000000), ref: 004138DE
FreeLibrary.KERNELBASE(00000000,?,?,?,?,00000000,00000000,00000001), ref: 00413A34

Strings

PackageName, xrefs: 0041386C
PackageCode, xrefs: 004137DE
Msi.dll, xrefs: 00413781
MsiSourceListEnumSourcesA, xrefs: 004137B8
ISSCHEDULEREBOOT=1, xrefs: 00413B17
MsiGetProductInfoA, xrefs: 004137B0
|dC, xrefs: 00413828
tdC, xrefs: 0041381C
ISSCHEDULEREBOOT=1, xrefs: 00413B09
|dC, xrefs: 00413905
Y, xrefs: 00413ACB
InstallSource, xrefs: 00413897
instmsi30.exe, xrefs: 0041365E, 00413663, 00413664
2, xrefs: 00413789

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: AddressLibraryMessageProcSend$FreeH_prologLoadlstrcmpilstrcpy
String ID: ISSCHEDULEREBOOT=1$2$ISSCHEDULEREBOOT=1$InstallSource$Msi.dll$MsiGetProductInfoA$MsiSourceListEnumSourcesA$PackageCode$PackageName$Y$instmsi30.exe$tdC$|dC$|dC
API String ID: 3757715066-1917324869
Opcode ID: d70eec0494088fae2122cf077ffb539fe95bef68640dbbe3b0c5f24f7eabdb1d
Instruction ID: 2fdd2689b09216258a7020ffca6f3edcfbfb15df49e8d6af11d02c25c2ff20e1
Opcode Fuzzy Hash: d70eec0494088fae2122cf077ffb539fe95bef68640dbbe3b0c5f24f7eabdb1d
Instruction Fuzzy Hash: 422280B1D0025AAFDF10DFA5CC85BEEBBB9AF04305F00406BE505B7291DB789A85CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0040EE2B Relevance: 33.4, APIs: 12, Strings: 7, Instructions: 133
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040F736: RegOpenKeyExA.KERNELBASE(00000104,00000000,00000000,00000104,0041DD97,00000000,00000000,?,00421F70,80000002,System\CurrentControlSet\Control\Windows,00020019,00000000,00000000,?,00000104), ref: 0040F750
Part of subcall function 0040F736: RegCloseKey.ADVAPI32(?,?,00421F70,80000002,System\CurrentControlSet\Control\Windows,00020019,00000000,00000000,?,00000104,00000000,00000000,?,00000104,00000000,00000104), ref: 0040F761

RegDeleteValueA.KERNELBASE(?,ISSetup,80000002,Software\Microsoft\Windows\CurrentVersion\Run,000F003F), ref: 0040EE55
RegCloseKey.KERNELBASE(?), ref: 0040EE63
CharNextA.USER32 ref: 0040EE8B
lstrcmpA.KERNEL32(00000000,%IS_V%), ref: 0040EE9A
lstrcpyA.KERNEL32(?,?), ref: 0040EEB1
RegQueryValueExA.ADVAPI32(000F003F,?,?,80000002,?,?,80000002), ref: 0040EF0A
RegDeleteValueA.ADVAPI32(000F003F,?,?,80000002,?,?,80000002), ref: 0040EF16
RegCloseKey.ADVAPI32(000F003F,?,80000002,?,?,80000002), ref: 0040EF24
lstrcpyA.KERNEL32(?,?,?,80000002,?,?,80000002), ref: 0040EF3D
RegCloseKey.ADVAPI32(000F003F,80000002,Software\Microsoft\Windows\CurrentVersion,000F003F), ref: 0040EF66
lstrcpyA.KERNEL32( /qn SIMHP=0 SIMSP=0 ,?,/verbose,?,00000001), ref: 0040EFA6
RegCloseKey.ADVAPI32(?,/verbose,?,00000001), ref: 0040EFB0

Strings

Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 0040EE33
Software\Microsoft\Windows\CurrentVersion, xrefs: 0040EEC0
verbose, xrefs: 0040EE6E
ISSetup, xrefs: 0040EE4D
/verbose, xrefs: 0040EF88
/qn SIMHP=0 SIMSP=0 , xrefs: 0040EF9A
%IS_V%, xrefs: 0040EE91

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: Close$Valuelstrcpy$Delete$CharNextOpenQuerylstrcmp
String ID: /qn SIMHP=0 SIMSP=0 $%IS_V%$/verbose$ISSetup$Software\Microsoft\Windows\CurrentVersion$Software\Microsoft\Windows\CurrentVersion\Run$verbose
API String ID: 153511641-3338454517
Opcode ID: 8ab0b062d7573d7041c14d37fee9c495ada2a87ca4eeb5cac56eab8ab603bb78
Instruction ID: 7c1460d64c7c90556ad5fdd5cef9ff5d1eca526f62588a36a76764264be20143
Opcode Fuzzy Hash: 8ab0b062d7573d7041c14d37fee9c495ada2a87ca4eeb5cac56eab8ab603bb78
Instruction Fuzzy Hash: A2418971D0120AFBDB20DF91DD46AEEBB75AF04345F20403AF605B61E0CB789A55CB6A

Uniqueness

Uniqueness Score: -1.00%

Function 00420613 Relevance: 24.6, APIs: 10, Strings: 4, Instructions: 142
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpyA.KERNEL32(00000001,00442430,?,00000000,00000000), ref: 00420633
lstrcpyA.KERNEL32(00000000,00442430), ref: 00420639
GetFileVersionInfoSizeA.VERSION(00000000,00000000), ref: 00420642
GetFileVersionInfoA.VERSION(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 0042066D
VerQueryValueA.VERSION(00000000,0043E0A4,00000000,00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 004206A2
wsprintfA.USER32 ref: 004206CC
VerQueryValueA.VERSION(00000000,\VarFileInfo\Translation,00000000,00000000,0043E0A4,00000000,00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 004206F6
wsprintfA.USER32 ref: 0042075E
wsprintfA.USER32 ref: 00420778
lstrcpyA.KERNEL32(00000000,00000000), ref: 0042078B

Strings

%u.%u.%u.%u, xrefs: 004206C4
0$D, xrefs: 00420624
\VarFileInfo\Translation, xrefs: 004206EE
%s,%u, xrefs: 00420772

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: lstrcpywsprintf$FileInfoQueryValueVersion$Size
String ID: %s,%u$%u.%u.%u.%u$0$D$\VarFileInfo\Translation
API String ID: 2127022127-836452801
Opcode ID: 3adaa8116db20be78a4ffcec8ec3e71b4d1ef6afe1f48ab559bd80b81f8049e9
Instruction ID: 94fcdf8dca9add85b7a03ca45f9deaa0ff7edd8f986de909ace34ec0d9cabf23
Opcode Fuzzy Hash: 3adaa8116db20be78a4ffcec8ec3e71b4d1ef6afe1f48ab559bd80b81f8049e9
Instruction Fuzzy Hash: CC41D4B2900228BBDF119F55DC45EEF7BBCEF84314F404066FD18A6192D7759A11CB98

Uniqueness

Uniqueness Score: -1.00%

Function 004156E4 Relevance: 23.2, APIs: 2, Strings: 11, Instructions: 423
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 004156E9
lstrcpyA.KERNEL32(?,?,?,?,?,00000400,?,00000000,?,00000104,isnetfx.exe,dotnetfx.exe,00000000), ref: 0041583C

Part of subcall function 00415DB0: __EH_prolog.LIBCMT ref: 00415DB5

Part of subcall function 00403BC0: __EH_prolog.LIBCMT ref: 00403BC5
Part of subcall function 00403BC0: GetLastError.KERNEL32(004364B4,00000001,004364BC,?,00402B1E,?,?,00000000,?,00000000,00429A4C,FFFFFFFF,00000001,?,00000000), ref: 00403BEE
Part of subcall function 00403BC0: SetLastError.KERNEL32(?,00000000,00000000,00000000,?,00402B1E,?,?,00000000,?,00000000,00429A4C,FFFFFFFF,00000001,?,00000000), ref: 00403C43

Part of subcall function 004014FF: __EH_prolog.LIBCMT ref: 00401504
Part of subcall function 004014FF: SetLastError.KERNEL32(?,?,00000000,74DF2EE0,?,0041FD71,?,?,00000001,?,80000000,00000003,00000000,00000003,00000080,00000000), ref: 0040156A

Part of subcall function 00415C68: __EH_prolog.LIBCMT ref: 00415C6D

Part of subcall function 00415D09: __EH_prolog.LIBCMT ref: 00415D0E

Part of subcall function 0040191F: GetLastError.KERNEL32(02151168,00000000,0041E21A,removeasmajorupgrade,00000000,00000000,00000001,?,?,00000000,reboot,00000000,00000000,00000000,runfromtemp,00000000), ref: 00401935
Part of subcall function 0040191F: SysFreeString.OLEAUT32(?), ref: 00401953
Part of subcall function 0040191F: SetLastError.KERNEL32(?,00000001,?,00000000), ref: 00401973

Part of subcall function 00401581: __EH_prolog.LIBCMT ref: 00401586
Part of subcall function 00401581: GetLastError.KERNEL32(02151168,00000000,00000000,?,0041E199,?,00000000,reboot,00000000,00000000,00000000,runfromtemp,00000000,00000001,00000001,00000000), ref: 004015AF
Part of subcall function 00401581: SetLastError.KERNEL32(?,00000000,?,0041E199,?,00000000,reboot,00000000,00000000,00000000,runfromtemp,00000000,00000001,00000001,00000000), ref: 004015DD

Part of subcall function 004016F0: lstrlenW.KERNEL32(00436494,74DF34C0,74DF2EE0,00000000,00000000,?,0041FD7B,?,?,00000001,?,80000000,00000003,00000000,00000003,00000080), ref: 00401743
Part of subcall function 004016F0: WideCharToMultiByte.KERNEL32(00000000,00000000,00436494,000000FF,?,00000002,00000000,00000000,?,0041FD7B,?,?,00000001,?,80000000,00000003), ref: 0040176B

Part of subcall function 00421B63: __EH_prolog.LIBCMT ref: 00421B68
Part of subcall function 00421B63: GetModuleFileNameA.KERNEL32(?,00000104,74DE8B60,00000104,00000000), ref: 00421BA1
Part of subcall function 00421B63: GetTempPathA.KERNEL32(00000104,?), ref: 00421C0C
Part of subcall function 00421B63: GetTempFileNameA.KERNELBASE(?,0043EAA0,00000000,?), ref: 00421C26
Part of subcall function 00421B63: DeleteFileA.KERNELBASE(?,?,?,00442430,00000000,00429A4C,?,?,?,?,?,?), ref: 00421CE0

Part of subcall function 00409F70: __EH_prolog.LIBCMT ref: 00409F75
Part of subcall function 00409F70: GetLastError.KERNEL32(00000000,00000104), ref: 00409FA1
Part of subcall function 00409F70: SetLastError.KERNEL32(00000000,?,00000000,?,00000001), ref: 00409FD6

Part of subcall function 00420C44: lstrlenA.KERNEL32(?,?,?,00401E26,?,C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B},?,?,?,00000104), ref: 00420C4C
Part of subcall function 00420C44: lstrcpynA.KERNEL32(?,?,-00000001,?,00401E26,?,C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B},?,?,?,00000104), ref: 00420C6A
Part of subcall function 00420C44: lstrcatA.KERNEL32(?,?,?,?,00401E26,?,C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B},?,?,?,00000104), ref: 00420C8A

Strings

|dC, xrefs: 00415AB1
/URL, xrefs: 00415821
|dC, xrefs: 00415904
C:\Users\user\AppData\Local\Temp, xrefs: 00415C3B
tdC, xrefs: 004158FA
CabsSize, xrefs: 00415ACF
|dC, xrefs: 0041593D
C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B}, xrefs: 004157AE, 00415B49, 00415B66
isnetfx.exe, xrefs: 004156F6
Cab%d, xrefs: 0041592C
dotnetfx.exe, xrefs: 004156F5

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: ErrorH_prologLast$File$NameTemplstrlen$ByteCharDeleteFreeModuleMultiPathStringWidelstrcatlstrcpylstrcpyn
String ID: /URL$C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B}$Cab%d$CabsSize$dotnetfx.exe$isnetfx.exe$tdC$|dC$|dC$|dC
API String ID: 2677536293-2467509445
Opcode ID: 7156a816af55482a8de88aa9befe6266bfae0fe885cf9342c9abaea975f85d47
Instruction ID: 35f13ad9e1ecfbe7740e68f019fea7dcaa75b65fe015352cf5192bde6c51688b
Opcode Fuzzy Hash: 7156a816af55482a8de88aa9befe6266bfae0fe885cf9342c9abaea975f85d47
Instruction Fuzzy Hash: 56F1A371D01249EFDF10EFA5CC81AEEBB78AF54304F14409EF505A7291EB785A84CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00415010 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 124
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 00415015

Part of subcall function 0040F736: RegOpenKeyExA.KERNELBASE(00000104,00000000,00000000,00000104,0041DD97,00000000,00000000,?,00421F70,80000002,System\CurrentControlSet\Control\Windows,00020019,00000000,00000000,?,00000104), ref: 0040F750
Part of subcall function 0040F736: RegCloseKey.ADVAPI32(?,?,00421F70,80000002,System\CurrentControlSet\Control\Windows,00020019,00000000,00000000,?,00000104,00000000,00000000,?,00000104,00000000,00000104), ref: 0040F761

RegCloseKey.ADVAPI32(00000003,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\RunOnceEntries,000F003F,00000000,00000003,00000000), ref: 00415056
RegEnumValueA.ADVAPI32(00000003,00000000,?,?,00000000,?,00000000,00000000,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\RunOnceEntries,000F003F,00000000,00000003,00000000), ref: 0041509D
RegCloseKey.ADVAPI32(00000000,80000002,Software\Microsoft\Windows\CurrentVersion\RunOnceEx,000F003F,80000002,Software\Microsoft\Windows\CurrentVersion\RunOnce,000F003F), ref: 00415123
RegEnumValueA.ADVAPI32(00000003,00000001,?,00000208,00000000,?,00000000,00000000,80000002,Software\Microsoft\Windows\CurrentVersion\RunOnceEx,000F003F,80000002,Software\Microsoft\Windows\CurrentVersion\RunOnce,000F003F), ref: 00415141
RegCloseKey.ADVAPI32(00000003), ref: 00415157
RegCloseKey.ADVAPI32(00000000,00000000,?,80000002,Software\Microsoft\Windows\CurrentVersion\RunOnceEx,000F003F,80000002,Software\Microsoft\Windows\CurrentVersion\RunOnce,000F003F), ref: 00415174
RegCloseKey.ADVAPI32(00000003,00000000,?,80000002,Software\Microsoft\Windows\CurrentVersion\RunOnceEx,000F003F,80000002,Software\Microsoft\Windows\CurrentVersion\RunOnce,000F003F), ref: 00415181

Strings

Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 004150B9
SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\RunOnceEntries, xrefs: 00415035
Software\Microsoft\Windows\CurrentVersion\RunOnceEx, xrefs: 004150EF

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: Close$EnumValue$H_prologOpen
String ID: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\RunOnceEntries$Software\Microsoft\Windows\CurrentVersion\RunOnce$Software\Microsoft\Windows\CurrentVersion\RunOnceEx
API String ID: 2958348514-2087105512
Opcode ID: 198af3052f18c91d251ac81c90b18cbb3313b89b0f47c974042a8d9429b874dc
Instruction ID: cfa0b968462fe156e64894ea8d459f9a2c5f072bb46969ea4fa36e6ea9062e6c
Opcode Fuzzy Hash: 198af3052f18c91d251ac81c90b18cbb3313b89b0f47c974042a8d9429b874dc
Instruction Fuzzy Hash: 36414872D0021AFEDF25DBE5DD85AFFB778AB58344F10042AE502B2281D7789E84CB65

Uniqueness

Uniqueness Score: -1.00%

Function 00409845 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 40
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(CABINET,00409914,?,00000000), ref: 0040984A
GetProcAddress.KERNEL32(00000000,FDICreate), ref: 0040986A
GetProcAddress.KERNEL32(FDIIsCabinet), ref: 0040987C
GetProcAddress.KERNEL32(FDICopy), ref: 0040988E
GetProcAddress.KERNEL32(FDIDestroy), ref: 004098A0
FreeLibrary.KERNEL32(00000000), ref: 004098D1

Strings

FDICopy, xrefs: 0040987E
CABINET, xrefs: 00409845
FDIIsCabinet, xrefs: 0040986C
FDICreate, xrefs: 00409864
FDIDestroy, xrefs: 00409890

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: AddressProc$Library$FreeLoad
String ID: CABINET$FDICopy$FDICreate$FDIDestroy$FDIIsCabinet
API String ID: 2449869053-2243815904
Opcode ID: f316897856bf6f482f964d270212c0a8d7094aea55af8f2112b9156da3298567
Instruction ID: 4cadbd745e6401950ca459dc050b0044f0ef1f95ae624ef10ba884ba71eb1454
Opcode Fuzzy Hash: f316897856bf6f482f964d270212c0a8d7094aea55af8f2112b9156da3298567
Instruction Fuzzy Hash: 25012879930A22ABDB11AB30EE0AB123BA5F706315F806037B404A62B5C7F84844EB5C

Uniqueness

Uniqueness Score: -1.00%

Function 0041FB99 Relevance: 16.7, APIs: 11, Instructions: 183
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 0041FB9E
CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,?,00000000), ref: 0041FBD6
GetLastError.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000,?,?,00000000), ref: 0041FBE0
CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000080,00000000,00000000,?,00000000,00000000,?,80000000,00000003,00000000,00000003), ref: 0041FC22
GetLastError.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000,?,?,00000000), ref: 0041FC2C
CloseHandle.KERNEL32(?,?,80000000,00000003,00000000,00000003,00000080,00000000,?,?,00000000), ref: 0041FC3E
ReadFile.KERNELBASE(?,?,?,?,00000000,?,80000000,00000003,00000000,00000003,00000080,00000000,?,?,00000000), ref: 0041FCBB
WriteFile.KERNELBASE(?,?,?,?,00000000,?,80000000,00000003,00000000,00000003,00000080,00000000,?,?,00000000), ref: 0041FCEA
FindCloseChangeNotification.KERNELBASE(?,?,80000000,00000003,00000000,00000003,00000080,00000000,?,?,00000000), ref: 0041FD41
FlushFileBuffers.KERNEL32(?,?,80000000,00000003,00000000,00000003,00000080,00000000,?,?,00000000), ref: 0041FD46
CloseHandle.KERNEL32(?,?,80000000,00000003,00000000,00000003,00000080,00000000,?,?,00000000), ref: 0041FD4F

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: File$Close$CreateErrorHandleLast$BuffersChangeFindFlushH_prologNotificationReadWrite
String ID:
API String ID: 2919287784-0
Opcode ID: 30ca96eee21139d7ad21377cce83b0e9a36b00abbccaecfc36e14fb73ffbf01c
Instruction ID: 5b9670617b21e1789a64c02569fbcaa0ae4ae9afc4ba2a5826f07d6c83ba0603
Opcode Fuzzy Hash: 30ca96eee21139d7ad21377cce83b0e9a36b00abbccaecfc36e14fb73ffbf01c
Instruction Fuzzy Hash: 6B615C72D00109AFDF11DFA4D881AEEBBB5FF08314F14802AE501B6291D73A5D96DB68

Uniqueness

Uniqueness Score: -1.00%

Function 0041CEBE Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 118
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 0041CEC3

Part of subcall function 0041D1E0: __EH_prolog.LIBCMT ref: 0041D1E5
Part of subcall function 0041D1E0: LoadCursorA.USER32(00000000,00007F02), ref: 0041D21C
Part of subcall function 0041D1E0: SetCursor.USER32(00000000), ref: 0041D229
Part of subcall function 0041D1E0: wsprintfA.USER32 ref: 0041D2B9

Part of subcall function 0041C1FE: lstrcpyA.KERNEL32(00002F19,?,?,74DE83C0,00000000), ref: 0041C229

Part of subcall function 00420C44: lstrlenA.KERNEL32(?,?,?,00401E26,?,C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B},?,?,?,00000104), ref: 00420C4C
Part of subcall function 00420C44: lstrcpynA.KERNEL32(?,?,-00000001,?,00401E26,?,C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B},?,?,?,00000104), ref: 00420C6A
Part of subcall function 00420C44: lstrcatA.KERNEL32(?,?,?,?,00401E26,?,C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B},?,?,?,00000104), ref: 00420C8A

Part of subcall function 00402375: __EH_prolog.LIBCMT ref: 0040237A

Part of subcall function 00407585: __EH_prolog.LIBCMT ref: 0040758A
Part of subcall function 00407585: lstrcmpA.KERNEL32(?,00442430,?,?,00442430,?,?,?,Languages,00000000,?,0041CF62,Languages,count,00000000,?), ref: 004075B9

wsprintfA.USER32 ref: 0041CF86

Part of subcall function 004025BC: __EH_prolog.LIBCMT ref: 004025C1

wsprintfA.USER32 ref: 0041CFC3

Part of subcall function 0041D1E0: SetCursor.USER32(?,?,?,00000000), ref: 0041D318

Strings

Languages, xrefs: 0041CF4F, 0041CF59, 0041CFA0
key, xrefs: 0041CF7B
C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B}, xrefs: 0041CEF1, 0041CEF7, 0041CF21
count, xrefs: 0041CF54
%s%d, xrefs: 0041CF80
%#04x.ini, xrefs: 0041CFBD

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: H_prolog$Cursorwsprintf$Loadlstrcatlstrcmplstrcpylstrcpynlstrlen
String ID: %#04x.ini$%s%d$C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B}$Languages$count$key
API String ID: 3994470762-2527180459
Opcode ID: 69e9fa996e3c19e6407638601b068ec51ea12f6acd5157651f22d0d6bc839fe2
Instruction ID: dbfa792d46e93ff5ee3b1a6e7b1e3b867a3a268b090465e108d7f33f5aca4491
Opcode Fuzzy Hash: 69e9fa996e3c19e6407638601b068ec51ea12f6acd5157651f22d0d6bc839fe2
Instruction Fuzzy Hash: 714152B1D40219BADB10EBA5DC82FEEBB79EF08308F10046BF505B61C1DB785B85CA58

Uniqueness

Uniqueness Score: -1.00%

Function 0041C961 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 311
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 0041C966

Part of subcall function 0041C446: LoadLibraryA.KERNEL32(msi.dll,?,?,00000000), ref: 0041C479
Part of subcall function 0041C446: GetProcAddress.KERNEL32(00000000,MsiGetProductInfoA), ref: 0041C488
Part of subcall function 0041C446: FreeLibrary.KERNEL32(?,?,00000000), ref: 0041C60E

IsValidCodePage.KERNEL32(?,?,00000000), ref: 0041CA7C
lstrlenA.KERNEL32(?,?,000003E8,00000000,?,?,00000000), ref: 0041CC68
lstrlenA.KERNEL32(00000002,?,000003E8,00000000,?,?,00000000), ref: 0041CC8C
wsprintfA.USER32 ref: 0041CCDE

Part of subcall function 0041D6F3: wsprintfA.USER32 ref: 0041D750
Part of subcall function 0041D6F3: CharNextA.USER32(?), ref: 0041D763
Part of subcall function 0041D6F3: CharNextA.USER32(00000000), ref: 0041D766

Part of subcall function 0041D1E0: __EH_prolog.LIBCMT ref: 0041D1E5
Part of subcall function 0041D1E0: LoadCursorA.USER32(00000000,00007F02), ref: 0041D21C
Part of subcall function 0041D1E0: SetCursor.USER32(00000000), ref: 0041D229
Part of subcall function 0041D1E0: wsprintfA.USER32 ref: 0041D2B9

Strings

C:\Users\user\AppData\Local\Temp, xrefs: 0041CA23
C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B}, xrefs: 0041CB3A
/LangTransform, xrefs: 0041CB57, 0041CB8F

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: wsprintf$CharCursorH_prologLibraryLoadNextlstrlen$AddressCodeFreePageProcValid
String ID: /LangTransform$C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B}
API String ID: 1372367309-2161585720
Opcode ID: a5aed610fef04e5e4791d0b18418ce05c3c5b0f255704df3409c9fc1bb6720f5
Instruction ID: 0e7f2b20ff60cfe418df481f2f273fdbb101509d26e0a3147f59ba7c13d21b19
Opcode Fuzzy Hash: a5aed610fef04e5e4791d0b18418ce05c3c5b0f255704df3409c9fc1bb6720f5
Instruction Fuzzy Hash: 33A1D6B1A44219AADF20EB71EC81BEF77ACEF44344F10446FF615D2181EB389A858B5C

Uniqueness

Uniqueness Score: -1.00%

Function 00402E01 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 299
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 00402E06
CreateFileA.KERNELBASE(?,40000000,00000001,00000000,00000002,00000080,00000000,74DE8B60,?,00000000), ref: 00402E35
WriteFile.KERNELBASE(?,004364E4,00000000,?,00000000,00000001,00000001,00000001,00000001,00000000,00000000,00000000,],00000000,00000000,?), ref: 00402FB0

Part of subcall function 00406510: __EH_prolog.LIBCMT ref: 00406515

WriteFile.KERNELBASE(?,004364E4,00000000,?,00000000,00000001,00000001,00000001,00000001,00000001,00000000,00000000), ref: 004030F8
WriteFile.KERNELBASE(?,004364E4,00000000,?,00000000,0043D138,00000000,?), ref: 00403152
FindCloseChangeNotification.KERNELBASE(000000FF,00000001,?,00000000,?,00000000), ref: 004031A6

Strings

], xrefs: 00402EAA, 00402EB6
dC, xrefs: 00403129

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: File$Write$H_prolog$ChangeCloseCreateFindNotification
String ID: ]$dC
API String ID: 2749126053-168518200
Opcode ID: 0ec9212995f985392dcb655a1eb67b03f449707724f1a654a50840c1cd003eb5
Instruction ID: e2038fc4c5936c7de2bbd0d9e3655459ba8081b643560a11a4cae73694e52818
Opcode Fuzzy Hash: 0ec9212995f985392dcb655a1eb67b03f449707724f1a654a50840c1cd003eb5
Instruction Fuzzy Hash: 0DC15974D00259AEDF05EBA5CC85AEEBB78BF14308F1040AEF511B72C2DB785A44CB69

Uniqueness

Uniqueness Score: -1.00%

Function 004025BC Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 209
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 004025C1
lstrcpynA.KERNEL32(00429A4C,?,?,00000001,00000001,00000000,00000000,?,?,00000000,?,00000000,00000000,00000000,00000001,00000000), ref: 004027FA

Part of subcall function 00403843: __EH_prolog.LIBCMT ref: 00403848

lstrcpynA.KERNEL32(00429A4C,00000000,?,00000001,00000000,?,?,00000000,00000000,?,00000104,00000000), ref: 0040281A

Strings

dC, xrefs: 00402714
dC, xrefs: 004026EA
dC, xrefs: 004027EE
dC, xrefs: 00402739
0$D, xrefs: 00402655

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: H_prologlstrcpyn
String ID: 0$D$dC$dC$dC$dC
API String ID: 588646068-44948036
Opcode ID: 1061769552f674a4e7e065192ac03a005c3b1d25edd5b8d745cb6ec46cde2e13
Instruction ID: 8dff8b1d25f6a5f814979d9962ba0c22f5f97c92322531c46a1203b7ca201555
Opcode Fuzzy Hash: 1061769552f674a4e7e065192ac03a005c3b1d25edd5b8d745cb6ec46cde2e13
Instruction Fuzzy Hash: 1C819A76800259EACF12EF99D9859EEBBB8AF15304F00807FF501732D2D7789A45CB69

Uniqueness

Uniqueness Score: -1.00%

Function 004222C3 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 234fileCOMMON

Download Yara Rule

APIs

GetTempFileNameA.KERNEL32(00000000,_is,00000000,00000000,?,00000104,?,00000000), ref: 00422431
GetTempPathA.KERNEL32(00000104,00000000,?,00000104,00442434,00000104,00000000), ref: 0042230B

Part of subcall function 004022FB: __EH_prolog.LIBCMT ref: 00402300
Part of subcall function 004022FB: GetLastError.KERNEL32(74DE8B60,00000104), ref: 0040232C
Part of subcall function 004022FB: SetLastError.KERNEL32(00000000,?,00000000,?,00000001), ref: 00402361

__EH_prolog.LIBCMT ref: 004222C8

Part of subcall function 00402D6A: lstrlenW.KERNEL32(004364D8,02151168,00000104,00000000,004364BC,?,0041E536,tempdisk1folder,?,00000000,00000000,?,00000001,?,00000000,removeasmajorupgrade), ref: 00402DBD
Part of subcall function 00402D6A: WideCharToMultiByte.KERNEL32(00000000,00000000,004364D8,000000FF,?,00000002,00000000,00000000,?,0041E536,tempdisk1folder,?,00000000,00000000,?,00000001), ref: 00402DE5

DeleteFileA.KERNEL32(00000000), ref: 00422452

Strings

|dC, xrefs: 004223A0, 004223C0, 004223A6
.tmp, xrefs: 0042247B
_is, xrefs: 00422426

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: ErrorFileH_prologLastTemp$ByteCharDeleteMultiNamePathWidelstrlen
String ID: .tmp$_is$|dC
API String ID: 2761551898-3041101126
Opcode ID: b80e292ca4600a48da18e565cf0c719e940951e2921c43f2ef30e7f78d888204
Instruction ID: edb1e7715c6970854a525b32f298c56bd97450a0f84d944efaeb4099caf128ce
Opcode Fuzzy Hash: b80e292ca4600a48da18e565cf0c719e940951e2921c43f2ef30e7f78d888204
Instruction Fuzzy Hash: 4491B470C01258EEDB11EFA5C945BDEBB78AF18308F50409EF94573282DB785B49CB65

Uniqueness

Uniqueness Score: -1.00%

Function 00421B63 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 130filestringCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00421B68
GetModuleFileNameA.KERNEL32(?,00000104,74DE8B60,00000104,00000000), ref: 00421BA1

Part of subcall function 0041F8F3: __EH_prolog.LIBCMT ref: 0041F8F8
Part of subcall function 0041F8F3: lstrcpyA.KERNEL32(00000001,?,?,00000104,?,?,00421BB9,?), ref: 0041F93F
Part of subcall function 0041F8F3: CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,?,00421BB9,?), ref: 0041F965
Part of subcall function 0041F8F3: GetLastError.KERNEL32(?,?,00421BB9,?), ref: 0041F976

GetTempPathA.KERNEL32(00000104,?), ref: 00421C0C
GetTempFileNameA.KERNELBASE(?,0043EAA0,00000000,?), ref: 00421C26
lstrcpyA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B}\Setup.INI), ref: 00421C62
DeleteFileA.KERNELBASE(?,?,?,00442430,00000000,00429A4C,?,?,?,?,?,?), ref: 00421CE0

Strings

C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B}\Setup.INI, xrefs: 00421C47, 00421C52, 00421C5A

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: File$H_prologNameTemplstrcpy$CreateDeleteErrorLastModulePath
String ID: C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B}\Setup.INI
API String ID: 2290668817-1030839668
Opcode ID: 05123e423701c1cb315b24e4f5b14f31cc244d3c84a74bbbe2b6e51bbb7a1330
Instruction ID: f693517df12815df2147a603a55396e72e02532b35e04a4745702d6d69a86869
Opcode Fuzzy Hash: 05123e423701c1cb315b24e4f5b14f31cc244d3c84a74bbbe2b6e51bbb7a1330
Instruction Fuzzy Hash: 9541527290116DBFDF15EBA5DD55ADEBB78AB14304F4040EAE209A3191DB385B88CF18

Uniqueness

Uniqueness Score: -1.00%

Function 0041D1E0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 116COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0041D1E5
LoadCursorA.USER32(00000000,00007F02), ref: 0041D21C
SetCursor.USER32(00000000), ref: 0041D229
wsprintfA.USER32 ref: 0041D2B9
SetCursor.USER32(?,?,?,00000000), ref: 0041D318

Strings

%s: %s, xrefs: 0041D2B3
C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B}, xrefs: 0041D23D

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: Cursor$H_prologLoadwsprintf
String ID: %s: %s$C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B}
API String ID: 778846815-3035542176
Opcode ID: 14081fe66699a5bd4232463cd47a29ac969650a1337d8e217fe8c2ccc8ee2a62
Instruction ID: 59191497b2af04cf91cbe096d09d104a1f5d0ba17791582dff3f5662f5539e58
Opcode Fuzzy Hash: 14081fe66699a5bd4232463cd47a29ac969650a1337d8e217fe8c2ccc8ee2a62
Instruction Fuzzy Hash: C241A5B1D0021AABDF11EF64DC45BEA77B8FB04308F10447BF615A6191DB389A88CF99

Uniqueness

Uniqueness Score: -1.00%

Function 004104AD Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 85memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00410ED5: __EH_prolog.LIBCMT ref: 00410EDA

Part of subcall function 00410E40: __EH_prolog.LIBCMT ref: 00410E45

Part of subcall function 00410347: GetSystemDefaultLCID.KERNEL32(00410509,?,?,?,00000000,?,?,?), ref: 00410347

GlobalAlloc.KERNEL32(00000042,00000001,?,?,?,00000000,?,?,?), ref: 0041052F
GlobalLock.KERNEL32(00000000), ref: 00410536

Part of subcall function 00410F5E: __EH_prolog.LIBCMT ref: 00410F63
Part of subcall function 00410F5E: wsprintfA.USER32 ref: 00410F92

GlobalHandle.KERNEL32 ref: 00410582
GlobalUnlock.KERNEL32(00000000), ref: 00410585
GlobalHandle.KERNEL32 ref: 00410591
GlobalFree.KERNEL32(00000000), ref: 00410594

Strings

xGD, xrefs: 004104B5

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: Global$H_prolog$Handle$AllocDefaultFreeLockSystemUnlockwsprintf
String ID: xGD
API String ID: 1414631992-1797962929
Opcode ID: f1aeb05f5f157ec477f14dc9fddf4d87844086028583a8be7888a0f63e7bf064
Instruction ID: 4057799fb3b8c8c719ac1c8dde85317df205063c7c8eb0d6cc1c690542519d66
Opcode Fuzzy Hash: f1aeb05f5f157ec477f14dc9fddf4d87844086028583a8be7888a0f63e7bf064
Instruction Fuzzy Hash: 10212D75500205BFDB10EFB5EC44A9A7BF9EB8A310B11447AE855D3260E778D9C1CF18

Uniqueness

Uniqueness Score: -1.00%

Function 004208EE Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(COMCTL32,00000000,?,?,?,0041ECDD,?,00000001), ref: 004208F9
GetProcAddress.KERNEL32(00000000,InitCommonControlsEx), ref: 0042090B
#17.COMCTL32(?,?,?,0041ECDD,?,00000001), ref: 0042092B
FreeLibrary.KERNEL32(00000000,?,?,?,0041ECDD,?,00000001), ref: 00420932

Strings

COMCTL32, xrefs: 004208F4
InitCommonControlsEx, xrefs: 00420905
, xrefs: 00420920

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: $COMCTL32$InitCommonControlsEx
API String ID: 145871493-1772614818
Opcode ID: ae5d696aa5291a69a6b8d90b5c1e697f5203b6a018d967d79f153a751000f855
Instruction ID: e7b6636786a91027ce4e6c037a9c0f60b7dc8a49e753a6a24cac30e6a9550691
Opcode Fuzzy Hash: ae5d696aa5291a69a6b8d90b5c1e697f5203b6a018d967d79f153a751000f855
Instruction Fuzzy Hash: C1E09B70501222BBDB106B51EC0DA9F7EE8EF09741F515115F44391193DB789544CDBD

Uniqueness

Uniqueness Score: -1.00%

Function 00401E46 Relevance: 12.1, APIs: 8, Instructions: 78windowregistryCOMMON

Download Yara Rule

APIs

LoadIconA.USER32(0040F6A2,?), ref: 00401E74
LoadCursorA.USER32(00000000,00007F00), ref: 00401E83
GetStockObject.GDI32(00000004), ref: 00401E8E
RegisterClassA.USER32(00000003), ref: 00401EA6
CreateWindowExA.USER32(00000000,80000000,00000000,00000000,00000000,00000000,00000000,00000000,0040F6A2,?), ref: 00401ECB
GetMessageA.USER32(?,00000000,00000000,00000000), ref: 00401EE6
TranslateMessage.USER32(?), ref: 00401EF0
DispatchMessageA.USER32(?), ref: 00401EFA

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: Message$Load$ClassCreateCursorDispatchIconObjectRegisterStockTranslateWindow
String ID:
API String ID: 1812404604-0
Opcode ID: 4b45a1a340826c8a160264e5a1cb32051e6a7ec7cbd69cbd6848ffc40038e732
Instruction ID: 25c93cfba722d033c973ad52396ca6241f7530a06ad33cdcab3fa6cd77c026a7
Opcode Fuzzy Hash: 4b45a1a340826c8a160264e5a1cb32051e6a7ec7cbd69cbd6848ffc40038e732
Instruction Fuzzy Hash: B521E9B2D0121ABBCB109FA5EC48ADFBBBCEF59764B119026F605E2150D7749501CBAC

Uniqueness

Uniqueness Score: -1.00%

Function 00430F54 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 241fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(00000001,80000000,?,0000000C,00000001,00000080,00000000,74DE8B61,00000000,00000000), ref: 00431107
GetLastError.KERNEL32 ref: 00431113
GetFileType.KERNELBASE(00000000), ref: 00431128
CloseHandle.KERNEL32(00000000), ref: 00431133

Strings

@, xrefs: 00431140
H, xrefs: 0043117A

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: File$CloseCreateErrorHandleLastType
String ID: @$H
API String ID: 1809617866-104103126
Opcode ID: be4818f9846bacc2bf249a641e90ed0529d707798336d4f84e42b3a0d9e3f1fa
Instruction ID: 0144dc0da9b958c1641af19e5a9d54ed90ea732434333996b0068ac0ef2a563d
Opcode Fuzzy Hash: be4818f9846bacc2bf249a641e90ed0529d707798336d4f84e42b3a0d9e3f1fa
Instruction Fuzzy Hash: 56814A319042855BEF348BA8C8547EF7B709F0D328F24625BE961A63E1C7BD4985C74E

Uniqueness

Uniqueness Score: -1.00%

Function 0041C73F Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 144stringCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0041C744

Part of subcall function 0041AD16: GetVersionExA.KERNEL32(?,?,?), ref: 0041AD43
Part of subcall function 0041AD16: GetSystemInfo.KERNELBASE(?,?,?), ref: 0041AD83

Part of subcall function 00406B7B: __EH_prolog.LIBCMT ref: 00406B80

Part of subcall function 00407585: __EH_prolog.LIBCMT ref: 0040758A
Part of subcall function 00407585: lstrcmpA.KERNEL32(?,00442430,?,?,00442430,?,?,?,Languages,00000000,?,0041CF62,Languages,count,00000000,?), ref: 004075B9

lstrlenA.KERNEL32(?,?,?,?,00000000), ref: 0041C86E

Part of subcall function 004101BC: __EH_prolog.LIBCMT ref: 004101C1
Part of subcall function 004101BC: lstrcpyA.KERNEL32(C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B},?,?), ref: 004101D8
Part of subcall function 004101BC: lstrcpyA.KERNEL32(00443D50,?), ref: 004101E2
Part of subcall function 004101BC: LoadLibraryA.KERNEL32(Msi.dll), ref: 00410205
Part of subcall function 004101BC: GetProcAddress.KERNEL32(00000000,MsiQueryProductStateA), ref: 00410224

Part of subcall function 0041AF1A: wsprintfA.USER32 ref: 0041AF38
Part of subcall function 0041AF1A: lstrcmpA.KERNEL32(?,?), ref: 0041AF49

Strings

KEY, xrefs: 0041C860
PASSWORD, xrefs: 0041C85B
Source, xrefs: 0041C7BF
Startup, xrefs: 0041C7C4

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: H_prolog$lstrcmplstrcpy$AddressInfoLibraryLoadProcSystemVersionlstrlenwsprintf
String ID: KEY$PASSWORD$Source$Startup
API String ID: 1527751837-3958804870
Opcode ID: a55e46046bdfb699b42df412dd0336252b0bbde1670bc1a895f7b8469485a149
Instruction ID: a415b2e3d9d6c2f6cd518e494f0729b9aac58e0a01f702ae4f1f1f1dce09522a
Opcode Fuzzy Hash: a55e46046bdfb699b42df412dd0336252b0bbde1670bc1a895f7b8469485a149
Instruction Fuzzy Hash: B051C5B0941344EADB20EB71CDC2BEEB7B49F15314F10406FE256621D2DB782A99CB6D

Uniqueness

Uniqueness Score: -1.00%

Function 0041FF9B Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 87fileCOMMON

Download Yara Rule

APIs

CreateFileMappingA.KERNEL32(?,00000000,00000002,00000000,00000000,00000000), ref: 0041FFB3
MapViewOfFile.KERNELBASE(00000000,00000004,00000000,00000000,00000000,?,00000000), ref: 0041FFCD
UnmapViewOfFile.KERNEL32(?,00000000,74DF34C0,?,00000000), ref: 00420064
FindCloseChangeNotification.KERNELBASE(?,?,00000000), ref: 0042006F

Strings

.rdata, xrefs: 0042001B
.debug, xrefs: 0041FFF6

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: File$View$ChangeCloseCreateFindMappingNotificationUnmap
String ID: .debug$.rdata
API String ID: 3767000111-4039274918
Opcode ID: d7afde1fa5f653998c07344b63c33ba9d9b85f277a9e8fbcbbbaf8e14326c861
Instruction ID: 751ddbebea9c56fd5370b31b8f6768e33ed1dd7b0d5f4746f71358c907d9b809
Opcode Fuzzy Hash: d7afde1fa5f653998c07344b63c33ba9d9b85f277a9e8fbcbbbaf8e14326c861
Instruction Fuzzy Hash: 5321BF71700118EFEB109F58EC84EAEBBA6EB44344F95846AE50597252C775AC44CB68

Uniqueness

Uniqueness Score: -1.00%

Function 0040F6C8 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 29registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE(80000001,Software\InstallShield\ISWI\7.0\SetupExeLog,00000000,00000001,00000000,?,?,?,0040E584,00000000,00000000), ref: 0040F6DF
RegQueryValueExA.ADVAPI32(00000000,SetupLogFileName,00000000,00000000, /qn SIMHP=0 SIMSP=0 ,00000000,?,?,?,0040E584), ref: 0040F705
RegCloseKey.ADVAPI32(00000000,?,?,?,0040E584), ref: 0040F719

Strings

SetupLogFileName, xrefs: 0040F6FD
/qn SIMHP=0 SIMSP=0 , xrefs: 0040F6F4
Software\InstallShield\ISWI\7.0\SetupExeLog, xrefs: 0040F6D5

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: /qn SIMHP=0 SIMSP=0 $SetupLogFileName$Software\InstallShield\ISWI\7.0\SetupExeLog
API String ID: 3677997916-1193828301
Opcode ID: d6103bdb960139f94793f6f4ed5f2f5d9f3aa5ed357951fe527d3312887a233f
Instruction ID: eef36d89a9085ad4c7e60bc6d233b99113575d06b555fb6f7bc5a74d7ec2c873
Opcode Fuzzy Hash: d6103bdb960139f94793f6f4ed5f2f5d9f3aa5ed357951fe527d3312887a233f
Instruction Fuzzy Hash: 5FF03070A40209BBEB10DB61ED87F9A7F78AB04B48F205076F501B61D0E3F59A489A18

Uniqueness

Uniqueness Score: -1.00%

Function 0041FEAC Relevance: 9.1, APIs: 6, Instructions: 94fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(00000001,80000000,00000003,00000000,00000003,00000080,00000000,00000000,?,00000000), ref: 0041FED6
GetLastError.KERNEL32(?,00000000), ref: 0041FEE3
ReadFile.KERNELBASE(00000000,?,00000040,?,00000000,?,00000000), ref: 0041FF03
ReadFile.KERNELBASE(00000000,?,00000018,?,00000000,00000000,?,00000000,00000000,?,00000000), ref: 0041FF26
ReadFile.KERNEL32(00000000,?,00000028,?,00000000,00000000,?,00000000,00000001,?,00000000), ref: 0041FF5C
CloseHandle.KERNEL32(00000000,00000000,00000000,?,00000000,00000001,?,00000000), ref: 0041FF8D

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: File$Read$CloseCreateErrorHandleLast
String ID:
API String ID: 2896028077-0
Opcode ID: 34fc13879ed650730f70328480c1112bced05b05db996ff5e4d4d4124828ebbc
Instruction ID: 195dbd3075abd17775e1ac2395f307fb28509b263bed01babb5b9efa08c42bac
Opcode Fuzzy Hash: 34fc13879ed650730f70328480c1112bced05b05db996ff5e4d4d4124828ebbc
Instruction Fuzzy Hash: 7B316475D00218BBDB20EBA1CC85EEFBBBCEF49710F1040ABF515A2181D6B49A85CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00421000 Relevance: 9.1, APIs: 6, Instructions: 87processstringwindowCOMMON

Download Yara Rule

APIs

lstrcpyA.KERNEL32(?,00000000,?,?,?,?,?,000000FF), ref: 0042104D
CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,?,?,?,?,?,?,?,000000FF), ref: 0042106A
MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 00421081
PeekMessageA.USER32(?,00000000,00000000,00000000,00000000), ref: 00421097
GetExitCodeProcess.KERNELBASE(?,00000001), ref: 004210B6
CloseHandle.KERNEL32(?,?,?,?,?,?,000000FF), ref: 004210C7

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: Process$CloseCodeCreateExitHandleMessageMultipleObjectsPeekWaitlstrcpy
String ID:
API String ID: 324600049-0
Opcode ID: 7f4a3d4e33b91daddb3ea929f00414fc9b111da97e120e58226bafed796cf2f3
Instruction ID: 3dffdf06a737291873f8f2a6e8652bb0006e18bbc540970b1494574d247ef6e5
Opcode Fuzzy Hash: 7f4a3d4e33b91daddb3ea929f00414fc9b111da97e120e58226bafed796cf2f3
Instruction Fuzzy Hash: 70215C71E01129BACB20DB9AED48DEFBF7CEF45750F504126F604E2161D3349A44CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0041F8F3 Relevance: 7.6, APIs: 5, Instructions: 87filestringCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0041F8F8
lstrcpyA.KERNEL32(00000001,?,?,00000104,?,?,00421BB9,?), ref: 0041F93F

Part of subcall function 0041FEAC: CreateFileA.KERNELBASE(00000001,80000000,00000003,00000000,00000003,00000080,00000000,00000000,?,00000000), ref: 0041FED6
Part of subcall function 0041FEAC: GetLastError.KERNEL32(?,00000000), ref: 0041FEE3

CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,?,00421BB9,?), ref: 0041F965
GetLastError.KERNEL32(?,?,00421BB9,?), ref: 0041F976
ReadFile.KERNELBASE(?,004364BC,0000002E,00000000,00000000,?,?,00000000,00000000,?,?,00421BB9,?), ref: 0041F9D6

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: File$CreateErrorLast$H_prologReadlstrcpy
String ID:
API String ID: 4136833577-0
Opcode ID: a6d87eeaf4506dc50ad78a2cfb4dfea8d531212b8077b885fc0bce7e2f0c90fe
Instruction ID: fd4749d7c02e4a30908832120bb4ab8b7105f271f2f7e71e18ecca959968e374
Opcode Fuzzy Hash: a6d87eeaf4506dc50ad78a2cfb4dfea8d531212b8077b885fc0bce7e2f0c90fe
Instruction Fuzzy Hash: D231A170600744AEC7219F25D805BDBBAE8EF94700F00852FF99A92291C7B89985CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00401F13 Relevance: 7.5, APIs: 5, Instructions: 46windowtimeCOMMON

Download Yara Rule

APIs

DefWindowProcA.USER32(?,?,?,?), ref: 00401F32
PostMessageA.USER32(?,00000002,00000000,00000000), ref: 00401F65
KillTimer.USER32(?,000005DC), ref: 00401F7C
PostQuitMessage.USER32(00000000), ref: 00401F84
SetTimer.USER32(?,000005DC,000003E8,00000000), ref: 00401FA5

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: MessagePostTimer$KillProcQuitWindow
String ID:
API String ID: 707289242-0
Opcode ID: 7cdc30b1d889f0f5f9c58d4b10e16d4ab04c1d32c1917dd8dd486fde117d0a18
Instruction ID: 6c29bbbabaf7df6c4fe3fe7762a70853ec3ad68589ee213309b5fedc805840f3
Opcode Fuzzy Hash: 7cdc30b1d889f0f5f9c58d4b10e16d4ab04c1d32c1917dd8dd486fde117d0a18
Instruction Fuzzy Hash: DB11253464420AFFDB109F60ED49B5A3B70EB14712F808032FA05AA2F1CBB99861DF1D

Uniqueness

Uniqueness Score: -1.00%

Function 004225D1 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 143COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004225D6

Part of subcall function 00402A71: __EH_prolog.LIBCMT ref: 00402A76

Part of subcall function 00401CF2: __EH_prolog.LIBCMT ref: 00401CF7
Part of subcall function 00401CF2: GetLastError.KERNEL32(004364B4,00000004,?,0041EEC5,?,00000004,?,?,00000000,?,?,?,00000000,02151168,00000000,00000000), ref: 00401D1A
Part of subcall function 00401CF2: SysFreeString.OLEAUT32(?), ref: 00401D38
Part of subcall function 00401CF2: SetLastError.KERNEL32(?,00000001,?,0041EEC5,?,00000004,?,?,00000000,?,?,?,00000000,02151168,00000000,00000000), ref: 00401D58

Part of subcall function 00402838: __EH_prolog.LIBCMT ref: 0040283D
Part of subcall function 00402838: GetLastError.KERNEL32(02151168,00000000,00000000,?,0041E413,?,00000000,removeasmajorupgrade,00000000,00000000,00000001,?,?,00000000,reboot,00000000), ref: 00402866
Part of subcall function 00402838: SetLastError.KERNEL32(?,00000000,?,0041E413,?,00000000,removeasmajorupgrade,00000000,00000000,00000001,?,?,00000000,reboot,00000000,00000000), ref: 00402894

CreateDirectoryA.KERNELBASE(00000000,00000000,?,00000000,0043DF90,?,00000000,00000001,?,00000000,00000001,?,00000000,?,00000000,?), ref: 004226EC
GetLastError.KERNEL32 ref: 004226F6

Strings

\, xrefs: 00422664

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: ErrorLast$H_prolog$CreateDirectoryFreeString
String ID: \
API String ID: 2554313312-2967466578
Opcode ID: 7e1c5595750a28a712c47e280ad4efadc4dbc49538d62b38b6cd69d877d996fb
Instruction ID: d485dd608b56c80c984296212773c132c9594d07c51ed861b2ff1dd6c8db9454
Opcode Fuzzy Hash: 7e1c5595750a28a712c47e280ad4efadc4dbc49538d62b38b6cd69d877d996fb
Instruction Fuzzy Hash: 8951B471D05219EADF10EFA4C9859EE7B78AF11308F10412FE816772D2DB789B09CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0042D3B9 Relevance: 6.2, APIs: 4, Instructions: 170fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,00000000,00000000,00000000,00000100,00000000,00000000), ref: 0042D433
GetLastError.KERNEL32 ref: 0042D43D
ReadFile.KERNEL32(?,?,00000001,00000000,00000000), ref: 0042D503
GetLastError.KERNEL32 ref: 0042D50D

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: ErrorFileLastRead
String ID:
API String ID: 1948546556-0
Opcode ID: 799493770de8340921651b0047e1a4e61d7f5f04ed652fe5703e540b5390cdac
Instruction ID: 7981ace893b7f94823c480724b864cb9fedd9fead8594b11d5d11a185c4c065f
Opcode Fuzzy Hash: 799493770de8340921651b0047e1a4e61d7f5f04ed652fe5703e540b5390cdac
Instruction Fuzzy Hash: 6851D770F043A5AFDF21CF58E88079A7BB0AF12308F94459BE8518B251C3B8D985CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 0042996C Relevance: 6.1, APIs: 4, Instructions: 81COMMON

Download Yara Rule

APIs

GetVersion.KERNEL32 ref: 00429992

Part of subcall function 0042B8DF: HeapCreate.KERNELBASE(00000000,00001000,00000000,004299CA,00000001), ref: 0042B8F0
Part of subcall function 0042B8DF: HeapDestroy.KERNEL32 ref: 0042B92F

GetCommandLineA.KERNEL32 ref: 004299F2
GetStartupInfoA.KERNEL32(?), ref: 00429A1D
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 00429A40

Part of subcall function 00429A99: ExitProcess.KERNEL32 ref: 00429AB6

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: Heap$CommandCreateDestroyExitHandleInfoLineModuleProcessStartupVersion
String ID:
API String ID: 2057626494-0
Opcode ID: a0f4c82722fd59e793e131dea25edea367108f14881c217c00c55e1684b3fb53
Instruction ID: ea1197d6243cf218909449a6121b9f8e50b3c8dc489a28588beda4277db79b1a
Opcode Fuzzy Hash: a0f4c82722fd59e793e131dea25edea367108f14881c217c00c55e1684b3fb53
Instruction Fuzzy Hash: 132191B1A00725ABDB08AFA6AC46B6E7BB8EF05714F90413FF9059A291DB384840C658

Uniqueness

Uniqueness Score: -1.00%

Function 00406CFF Relevance: 6.1, APIs: 4, Instructions: 59stringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000001,0000044F,?,00000000,00000000,00406C10,?,00000400,00000000,00000000,00000001,00000000,0000044F,00000000,?,?), ref: 00406D1E
SetErrorMode.KERNELBASE(00008003,?,00000000,00000000,00406C10,?,00000400,00000000,00000000,00000001,00000000,0000044F,00000000,?,?), ref: 00406D2D
GetWindowsDirectoryA.KERNEL32(0000044F,00000000,?,00000000,00000000,00406C10,?,00000400,00000000,00000000,00000001,00000000,0000044F,00000000,?,?), ref: 00406D45
lstrcpyA.KERNEL32(0000044F,00442430,?,00000000,00000000,00406C10,?,00000400,00000000,00000000,00000001,00000000,0000044F,00000000,?,?), ref: 00406D62

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: DirectoryErrorModePathTempWindowslstrcpy
String ID:
API String ID: 3576100887-0
Opcode ID: b7d73adfd307bc68c164d3fabc87294ee3dcfcdc1990260a0ccc111e1119790e
Instruction ID: b69d5535ef00b8b7c4e708a5800bd473e2155ca5b900a041e0349cb83e74812d
Opcode Fuzzy Hash: b7d73adfd307bc68c164d3fabc87294ee3dcfcdc1990260a0ccc111e1119790e
Instruction Fuzzy Hash: E10192213002127BE62037771D4AF2B69AD9FD1794F02443EB90AE6192E679C814827E

Uniqueness

Uniqueness Score: -1.00%

Function 00420E5D Relevance: 6.0, APIs: 4, Instructions: 35fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00420DE9: GetFileAttributesA.KERNELBASE(00000000,0041DDB5,00000000,00000000,?,?,?,00000000,00000000,?,?,00000001,00000000,?,00000001,Startup), ref: 00420DED

SetErrorMode.KERNELBASE(00008001,00000000,00416396,00000000,00416396,?,00416396,00000000), ref: 00420E8A
SetFileAttributesA.KERNELBASE(00416396,00000080,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000,00000000), ref: 00420E92
DeleteFileA.KERNELBASE(00416396,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000,00000000), ref: 00420E99
SetErrorMode.KERNELBASE(00000000,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000,00000000), ref: 00420EA8

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: File$AttributesErrorMode$Delete
String ID:
API String ID: 3807840792-0
Opcode ID: 3c5fe63f5666f1c64aaade41331113c6172d77fb4af8d8a870dc681e98d1c8f8
Instruction ID: c6563bbdc57ee089265497e618facf5b0e236b0b9bc09db3df052aa0227a2a10
Opcode Fuzzy Hash: 3c5fe63f5666f1c64aaade41331113c6172d77fb4af8d8a870dc681e98d1c8f8
Instruction Fuzzy Hash: 8DF0E5323022323EE72027667C41F9B629CAF95754F03482BF241D5192CAA998C1467D

Uniqueness

Uniqueness Score: -1.00%

Function 00420EB2 Relevance: 6.0, APIs: 4, Instructions: 24fileCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00008001,00416396,00420E7A,00416396,00000000,00416396,?,00416396,00000000), ref: 00420EBE
CreateFileA.KERNELBASE(?,80000000,00000000,00000000,00000003,00000080,00000000,?,?,?,?,?,?,?,?,?), ref: 00420ED6
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000,00000000), ref: 00420EE3
FindCloseChangeNotification.KERNELBASE(00000000,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000,00000000), ref: 00420EEB

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: ErrorMode$ChangeCloseCreateFileFindNotification
String ID:
API String ID: 2956594108-0
Opcode ID: 2ff4a59268e39a730ff0fbe24609641005d5b1b40bfc619e416976da47b3024a
Instruction ID: 405786629e7b6d2f2016d5b4e0e9099925bb3a2aebc893b014746877b525b16b
Opcode Fuzzy Hash: 2ff4a59268e39a730ff0fbe24609641005d5b1b40bfc619e416976da47b3024a
Instruction Fuzzy Hash: EFE08C317882217AF2206370BC0AF4B3A54BB04B30F238A12F346BD0E0CAE524808B5C

Uniqueness

Uniqueness Score: -1.00%

Function 004031BB Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 414COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004031C0

Part of subcall function 0040C4B0: CreateFileA.KERNELBASE(?,80000000,00000001,00000000,00000003,00000001,00000000,00000000,?,004031E7,000000FF,?,74DE8B60,?,00000000), ref: 0040C4EA

FindCloseChangeNotification.KERNELBASE(000000FF,00000001,00000001,00000001,00000001,00000001,?,00000000,?,00000000,00000000,00000000,00000000,0043D138,FFFFFFFF,00000000), ref: 004036B6

Part of subcall function 00404192: __EH_prolog.LIBCMT ref: 00404197

Part of subcall function 0040477B: __EH_prolog.LIBCMT ref: 00404780

Strings

, xrefs: 00403316, 0040336E, 00403379, 00403600, 00403608

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: H_prolog$ChangeCloseCreateFileFindNotification
String ID:
API String ID: 929830201-410699589
Opcode ID: b3d9f8627aa223e6ae7cb68b7baa1b69447d7cec07cb323bfdee7a143655eeda
Instruction ID: bd79244b645d401699d35c1eff96bbf2ca76abef40d1807dbf078776b69c0f53
Opcode Fuzzy Hash: b3d9f8627aa223e6ae7cb68b7baa1b69447d7cec07cb323bfdee7a143655eeda
Instruction Fuzzy Hash: 2DF17B75D01289AADF11EBE5D881EEEBB7CAF55308F1040AFF54173282DA385B45CB29

Uniqueness

Uniqueness Score: -1.00%

Function 0041BE05 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 145COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0041BE0A

Part of subcall function 00402375: __EH_prolog.LIBCMT ref: 0040237A

Part of subcall function 00401581: __EH_prolog.LIBCMT ref: 00401586
Part of subcall function 00401581: GetLastError.KERNEL32(02151168,00000000,00000000,?,0041E199,?,00000000,reboot,00000000,00000000,00000000,runfromtemp,00000000,00000001,00000001,00000000), ref: 004015AF
Part of subcall function 00401581: SetLastError.KERNEL32(?,00000000,?,0041E199,?,00000000,reboot,00000000,00000000,00000000,runfromtemp,00000000,00000001,00000001,00000000), ref: 004015DD

GetModuleFileNameA.KERNEL32(00000000), ref: 0041BF5F

Part of subcall function 0041F8F3: __EH_prolog.LIBCMT ref: 0041F8F8
Part of subcall function 0041F8F3: lstrcpyA.KERNEL32(00000001,?,?,00000104,?,?,00421BB9,?), ref: 0041F93F
Part of subcall function 0041F8F3: CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,?,00421BB9,?), ref: 0041F965
Part of subcall function 0041F8F3: GetLastError.KERNEL32(?,?,00421BB9,?), ref: 0041F976

Strings

tdC, xrefs: 0041BE99

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: H_prolog$ErrorLast$File$CreateModuleNamelstrcpy
String ID: tdC
API String ID: 3951192609-1123919639
Opcode ID: 0de6e3f85053bf967be40e01bcf5d1c78179038eb81943f48b7db040f9511d5a
Instruction ID: efea19c4320025fb9385961dfa47d0e25604c03ed376d227f94fb28ac2888fc5
Opcode Fuzzy Hash: 0de6e3f85053bf967be40e01bcf5d1c78179038eb81943f48b7db040f9511d5a
Instruction Fuzzy Hash: C3514EF1904744AED720DF799885AD7BBECBF19304F80486FA2AE93201C3786544CB29

Uniqueness

Uniqueness Score: -1.00%

Function 0041010A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47stringCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0041010F

Part of subcall function 004025BC: __EH_prolog.LIBCMT ref: 004025C1

lstrcmpA.KERNEL32(00000000,00442430,?,?,00442430,00000000,00000104,?,00000003,00000000), ref: 00410168

Strings

0$D, xrefs: 00410144

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: H_prolog$lstrcmp
String ID: 0$D
API String ID: 4174983478-1534285997
Opcode ID: 1422c27b0368775e830e3ea70d2da50d2d876fdb24f23ad93b414bbc74c8c6fb
Instruction ID: 7a9f2032f419e15734138953a80e5f7d15bd585069acb9fc2485cfea9ae567f6
Opcode Fuzzy Hash: 1422c27b0368775e830e3ea70d2da50d2d876fdb24f23ad93b414bbc74c8c6fb
Instruction Fuzzy Hash: C601D872A00218BBEF24DB55DD46BDE7B78EB45714F00446BF604A2180D7BC9A44CA65

Uniqueness

Uniqueness Score: -1.00%

Function 0040FBF2 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

Part of subcall function 0041010A: __EH_prolog.LIBCMT ref: 0041010F
Part of subcall function 0041010A: lstrcmpA.KERNEL32(00000000,00442430,?,?,00442430,00000000,00000104,?,00000003,00000000), ref: 00410168

GetTickCount.KERNEL32 ref: 0040FC1E

Part of subcall function 0040FBAF: GetTickCount.KERNEL32 ref: 0040FBC9
Part of subcall function 0040FBAF: GetTickCount.KERNEL32 ref: 0040FBDA

Strings

SplashTime, xrefs: 0040FBFA
Startup, xrefs: 0040FBFF

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: CountTick$H_prologlstrcmp
String ID: SplashTime$Startup
API String ID: 3312283085-926283664
Opcode ID: 4163f4fce0209446c350b72b6d7b682e3047a131d82f615007014c18e45af6b5
Instruction ID: b500f0ec68b69b4bd4225037aa643765ae73a5ee5a8f44701727d59769f55901
Opcode Fuzzy Hash: 4163f4fce0209446c350b72b6d7b682e3047a131d82f615007014c18e45af6b5
Instruction Fuzzy Hash: BCD012329401216ED214EF24FD5AE9977B4EB49701F12117AF604670F1DE686A458B5C

Uniqueness

Uniqueness Score: -1.00%

Function 004221F3 Relevance: 4.6, APIs: 3, Instructions: 69COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004221F8

Part of subcall function 00402838: __EH_prolog.LIBCMT ref: 0040283D
Part of subcall function 00402838: GetLastError.KERNEL32(02151168,00000000,00000000,?,0041E413,?,00000000,removeasmajorupgrade,00000000,00000000,00000001,?,?,00000000,reboot,00000000), ref: 00402866
Part of subcall function 00402838: SetLastError.KERNEL32(?,00000000,?,0041E413,?,00000000,removeasmajorupgrade,00000000,00000000,00000001,?,?,00000000,reboot,00000000,00000000), ref: 00402894

UuidToStringA.RPCRT4(?,?), ref: 00422234

Part of subcall function 00402D6A: lstrlenW.KERNEL32(004364D8,02151168,00000104,00000000,004364BC,?,0041E536,tempdisk1folder,?,00000000,00000000,?,00000001,?,00000000,removeasmajorupgrade), ref: 00402DBD
Part of subcall function 00402D6A: WideCharToMultiByte.KERNEL32(00000000,00000000,004364D8,000000FF,?,00000002,00000000,00000000,?,0041E536,tempdisk1folder,?,00000000,00000000,?,00000001), ref: 00402DE5

Part of subcall function 004022FB: __EH_prolog.LIBCMT ref: 00402300
Part of subcall function 004022FB: GetLastError.KERNEL32(74DE8B60,00000104), ref: 0040232C
Part of subcall function 004022FB: SetLastError.KERNEL32(00000000,?,00000000,?,00000001), ref: 00402361

Part of subcall function 0042287A: __EH_prolog.LIBCMT ref: 0042287F
Part of subcall function 0042287A: CharUpperA.USER32(00000000,00000000,?,00000000,?,?,004364BC), ref: 004228A5

RpcStringFreeA.RPCRT4(?), ref: 00422284

Part of subcall function 00403B2D: __EH_prolog.LIBCMT ref: 00403B32
Part of subcall function 00403B2D: GetLastError.KERNEL32(?,00000104,00000000,?,00402244,?,00000000,02151168,00000000), ref: 00403B5A
Part of subcall function 00403B2D: SetLastError.KERNEL32(?,?,00000000,00000000,?,00000104,00000000,?,00402244,?,00000000,02151168,00000000), ref: 00403BA7

Part of subcall function 00401CF2: __EH_prolog.LIBCMT ref: 00401CF7
Part of subcall function 00401CF2: GetLastError.KERNEL32(004364B4,00000004,?,0041EEC5,?,00000004,?,?,00000000,?,?,?,00000000,02151168,00000000,00000000), ref: 00401D1A
Part of subcall function 00401CF2: SysFreeString.OLEAUT32(?), ref: 00401D38
Part of subcall function 00401CF2: SetLastError.KERNEL32(?,00000001,?,0041EEC5,?,00000004,?,?,00000000,?,?,?,00000000,02151168,00000000,00000000), ref: 00401D58

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: ErrorLast$H_prolog$String$CharFree$ByteMultiUpperUuidWidelstrlen
String ID:
API String ID: 1364089029-0
Opcode ID: 6937ebdcd0010d660cfd32cb723d8c5d9277aa503c93cd58d01f98c115dba8b9
Instruction ID: d1d6bb408459ba66341a3973ececed2d3d12c0a88aef9bd2f39aa7d7f0f762dd
Opcode Fuzzy Hash: 6937ebdcd0010d660cfd32cb723d8c5d9277aa503c93cd58d01f98c115dba8b9
Instruction Fuzzy Hash: C9215672D00108ABDB11EF95D945BEDBBB8EF08304F20806FE551B3281DB785A05CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00428EA2 Relevance: 4.6, APIs: 3, Instructions: 51COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,?,00428E8D,00000000,00000000,00000000,0041D3DB), ref: 00428EB7
TerminateProcess.KERNEL32(00000000), ref: 00428EBE
ExitProcess.KERNEL32 ref: 00428F3F

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 82477ec68f16d5c2a215b372348368e778f8c142e422374d0e30e162648598d8
Instruction ID: 439ac86c4fbbbad79e2fc580b60dd2d8bbf02ef4bf8505d176756a3d869842df
Opcode Fuzzy Hash: 82477ec68f16d5c2a215b372348368e778f8c142e422374d0e30e162648598d8
Instruction Fuzzy Hash: 23012B31706321AFCA14AB28FD8561E77B5AB42758F93403FF84497191CF3C98418B1D

Uniqueness

Uniqueness Score: -1.00%

Function 00405443 Relevance: 4.5, APIs: 3, Instructions: 40fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000,?,0040CC94,00000000,00000000,?,00000000,?,?,0040C4C3), ref: 00405463
GetFileSize.KERNEL32(00000000,00000000,?,0040CC94,00000000,00000000,?,00000000,?,?,0040C4C3,?,004031E7,000000FF,?,74DE8B60), ref: 0040546E
FindCloseChangeNotification.KERNELBASE(00000000,?,0040CC94,00000000,00000000,?,00000000,?,?,0040C4C3,?,004031E7,000000FF,?,74DE8B60,?), ref: 004054A2

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: File$ChangeCloseCreateFindNotificationSize
String ID:
API String ID: 4178644524-0
Opcode ID: 8fde2b30f74bb51d96042435e0be75e7930e01369e2cdd6c6eda802e2f580cb0
Instruction ID: 2c7b378aeabc11832d89b9ede0ff79c1c68b6bf830cb8a1397284c5b242b197e
Opcode Fuzzy Hash: 8fde2b30f74bb51d96042435e0be75e7930e01369e2cdd6c6eda802e2f580cb0
Instruction Fuzzy Hash: 1CF06230705A117BEA30AA259C40BAB2648DB02761F128275F960FA2D0D7B9D8828A6D

Uniqueness

Uniqueness Score: -1.00%

Function 00408DBE Relevance: 4.5, APIs: 3, Instructions: 35memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,0041E0C3,?,00000000,00000000,02151168,?,00000000,?,0041ED6D,?,000000FF,00000000,?,0041E0C3), ref: 00408DD6
SysAllocStringLen.OLEAUT32(00000000,-00000001), ref: 00408DDD
MultiByteToWideChar.KERNEL32(00000000,00000000,0041E0C3,000000FF,00000000,-00000001,?,00000000,?,0041ED6D,?,000000FF,00000000,?,0041E0C3,00000000), ref: 00408DF3

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: ByteCharMultiWide$AllocString
String ID:
API String ID: 262959230-0
Opcode ID: fd274a0803024e5ffe2f5781e65232e753bf55ce621dd83079b373fb09a10f9f
Instruction ID: af01873644c012e77a3f598e07fd4046b7ce5a162c17e4336a1a67cca3da1ca8
Opcode Fuzzy Hash: fd274a0803024e5ffe2f5781e65232e753bf55ce621dd83079b373fb09a10f9f
Instruction Fuzzy Hash: 60E06DB210011DBFAB102F669CC8CEBBF6DEE452F47018236F91886161CA358C008AB0

Uniqueness

Uniqueness Score: -1.00%

Function 0042093B Relevance: 4.5, APIs: 3, Instructions: 32fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00420C44: lstrlenA.KERNEL32(?,?,?,00401E26,?,C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B},?,?,?,00000104), ref: 00420C4C
Part of subcall function 00420C44: lstrcpynA.KERNEL32(?,?,-00000001,?,00401E26,?,C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B},?,?,?,00000104), ref: 00420C6A
Part of subcall function 00420C44: lstrcatA.KERNEL32(?,?,?,?,00401E26,?,C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B},?,?,?,00000104), ref: 00420C8A

CreateFileA.KERNELBASE(?,C0000000,00000000,00000000,00000002,00000080,00000000,?,?), ref: 00420971
CloseHandle.KERNEL32(00000000), ref: 00420981
DeleteFileA.KERNELBASE(?), ref: 0042098E

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: File$CloseCreateDeleteHandlelstrcatlstrcpynlstrlen
String ID:
API String ID: 4178870998-0
Opcode ID: d418bba11bb1840345df3105c9ead4aa07fecea17c00cafd7d01879e930cc856
Instruction ID: 654e1543646e58ad09d866fab23c197c82410db99f9cb7193263a5a2a0cb3f5c
Opcode Fuzzy Hash: d418bba11bb1840345df3105c9ead4aa07fecea17c00cafd7d01879e930cc856
Instruction Fuzzy Hash: 85F065F26001097BEF6067B0AD0AFA776ACBB00318F1186A1F706E10D1D674D9464B5C

Uniqueness

Uniqueness Score: -1.00%

Function 00420E23 Relevance: 4.5, APIs: 3, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00420E06: GetFileAttributesA.KERNELBASE(?,00420E2F,?,00000000,00401C7E,?,00000000,?,00000400), ref: 00420E0A

SetErrorMode.KERNELBASE(00008001,00000000,?,00000000,00401C7E,?,00000000,?,00000400), ref: 00420E3F
RemoveDirectoryA.KERNELBASE(?), ref: 00420E45
SetErrorMode.KERNELBASE(00000000), ref: 00420E54

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: ErrorMode$AttributesDirectoryFileRemove
String ID:
API String ID: 2449359760-0
Opcode ID: 62d53ddd84c9b852e31484cc92b19fac42862430774747a157454aec4ca2e256
Instruction ID: c2d687b438b77a7ed96c26472e172f0f006399f70e4878719734f6efe088be25
Opcode Fuzzy Hash: 62d53ddd84c9b852e31484cc92b19fac42862430774747a157454aec4ca2e256
Instruction Fuzzy Hash: A2E01D3130422175D7501767BC05F5B7FD5ABC1761F46883BB644D6191CA61C891C665

Uniqueness

Uniqueness Score: -1.00%

Function 00413BD5 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 98COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00413BDA

Part of subcall function 004134C4: __EH_prolog.LIBCMT ref: 004134C9

Part of subcall function 004098E1: lstrcpyA.KERNEL32(?,?,?,00000000,00413C70,?,C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B},?,?,00429A4C,00000001,00000000,?,?,00000000), ref: 004098FA
Part of subcall function 004098E1: lstrcpyA.KERNEL32(C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B},?,?,00000000), ref: 00409909

Part of subcall function 0040995B: __EH_prolog.LIBCMT ref: 00409960

Part of subcall function 00409945: FreeLibrary.KERNELBASE(6CBC0000,00413CBF,?,?,C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B},?,?,00429A4C,00000001,00000000,?,?,00000000), ref: 00409954

Strings

C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B}, xrefs: 00413C5F

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: H_prolog$lstrcpy$FreeLibrary
String ID: C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B}
API String ID: 453652589-2458444898
Opcode ID: 80949cb18201c5270043ba6cacef1467be17d25f47d9dc443dfa8830c6ab09f5
Instruction ID: 37f53a2ae9a0ab82f7da90e2a808561965d6668d7d3e9f71d37aba212b3b760a
Opcode Fuzzy Hash: 80949cb18201c5270043ba6cacef1467be17d25f47d9dc443dfa8830c6ab09f5
Instruction Fuzzy Hash: E13175B2A001199ACF21EF65C8416EFB779AF44345F00817FE515B3281EB395F8ACB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040E565 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 97COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040E56A

Part of subcall function 0040F6C8: RegOpenKeyExA.KERNELBASE(80000001,Software\InstallShield\ISWI\7.0\SetupExeLog,00000000,00000001,00000000,?,?,?,0040E584,00000000,00000000), ref: 0040F6DF
Part of subcall function 0040F6C8: RegQueryValueExA.ADVAPI32(00000000,SetupLogFileName,00000000,00000000, /qn SIMHP=0 SIMSP=0 ,00000000,?,?,?,0040E584), ref: 0040F705
Part of subcall function 0040F6C8: RegCloseKey.ADVAPI32(00000000,?,?,?,0040E584), ref: 0040F719

Part of subcall function 0041BE05: __EH_prolog.LIBCMT ref: 0041BE0A
Part of subcall function 0041BE05: GetModuleFileNameA.KERNEL32(00000000), ref: 0041BF5F

Part of subcall function 0040E6B6: __EH_prolog.LIBCMT ref: 0040E6BB

Strings

/f1, xrefs: 0040E67E

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: H_prolog$CloseFileModuleNameOpenQueryValue
String ID: /f1
API String ID: 2986767852-2921927892
Opcode ID: 478fcfb5cbb1e7683c7b58fd8f7e43d2ec666307f603eec7b4150bbfd3749382
Instruction ID: 9a99e969d21ab7a9f3ed421c0995c662ce9ff401745247acc8711eb2e2d5aa73
Opcode Fuzzy Hash: 478fcfb5cbb1e7683c7b58fd8f7e43d2ec666307f603eec7b4150bbfd3749382
Instruction Fuzzy Hash: 8A310970A40619AFCF14EFA5DC41AEEB7B5AB04308F00897FB515A32D1DB389A45CF58

Uniqueness

Uniqueness Score: -1.00%

Function 00422056 Relevance: 3.1, APIs: 2, Instructions: 97COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0042205B

Part of subcall function 00401CF2: __EH_prolog.LIBCMT ref: 00401CF7
Part of subcall function 00401CF2: GetLastError.KERNEL32(004364B4,00000004,?,0041EEC5,?,00000004,?,?,00000000,?,?,?,00000000,02151168,00000000,00000000), ref: 00401D1A
Part of subcall function 00401CF2: SysFreeString.OLEAUT32(?), ref: 00401D38
Part of subcall function 00401CF2: SetLastError.KERNEL32(?,00000001,?,0041EEC5,?,00000004,?,?,00000000,?,?,?,00000000,02151168,00000000,00000000), ref: 00401D58

Part of subcall function 00402A71: __EH_prolog.LIBCMT ref: 00402A76

SearchPathA.KERNELBASE(00429A4C,00000000,00000000,00000104,00000000,00000000,?,?,00000104,?,00000000,?,00000000,00000000,?,004364B4), ref: 00422130

Part of subcall function 00402D6A: lstrlenW.KERNEL32(004364D8,02151168,00000104,00000000,004364BC,?,0041E536,tempdisk1folder,?,00000000,00000000,?,00000001,?,00000000,removeasmajorupgrade), ref: 00402DBD
Part of subcall function 00402D6A: WideCharToMultiByte.KERNEL32(00000000,00000000,004364D8,000000FF,?,00000002,00000000,00000000,?,0041E536,tempdisk1folder,?,00000000,00000000,?,00000001), ref: 00402DE5

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: H_prolog$ErrorLast$ByteCharFreeMultiPathSearchStringWidelstrlen
String ID:
API String ID: 1718721855-0
Opcode ID: a56dcf15b303c175d349cce93b64685c82103b323fee21eb00bd1c0de383688c
Instruction ID: 7281f7eb01d0a4b88eea5be283aa6d2405ce5e402544478713ab92ff65becab1
Opcode Fuzzy Hash: a56dcf15b303c175d349cce93b64685c82103b323fee21eb00bd1c0de383688c
Instruction Fuzzy Hash: 5731AD71C01128EADB15EBA1D955BDEBB78AF14308F10806FA416732D2DF785B09CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0042D093 Relevance: 3.1, APIs: 2, Instructions: 52COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(00000000,00000100,004311B7,0042D06B,004311B7,004311B7,00000100,00000000,004311B7,00000000), ref: 0042D0CD
GetLastError.KERNEL32 ref: 0042D0D7

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: ChangeCloseErrorFindLastNotification
String ID:
API String ID: 1687624791-0
Opcode ID: d6e4f5045375b0681eabfa4df8bde623b73ddc7256529fe2f826ecee34af5c45
Instruction ID: 9e47c801318ad3389be7fb8368fd2611493ffbc3dd8054231ba77c7e811dbeed
Opcode Fuzzy Hash: d6e4f5045375b0681eabfa4df8bde623b73ddc7256529fe2f826ecee34af5c45
Instruction Fuzzy Hash: 4E01F237B0553126CA2436797C49A6F26958F85378FA6421FF850872E2DE1CA882815E

Uniqueness

Uniqueness Score: -1.00%

Function 0040995B Relevance: 3.0, APIs: 2, Instructions: 33stringCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00409960
lstrcpyA.KERNEL32(?,00442898,?,?,?,00000000), ref: 00409991

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: H_prologlstrcpy
String ID:
API String ID: 3221978047-0
Opcode ID: 66ea000716403ea867250840a99ea9121412f419596ed993aed7b553ff1063e5
Instruction ID: 5e19445f66e371b5125042c1bb9af530c88cd094a581702f8e8ede0daf29de76
Opcode Fuzzy Hash: 66ea000716403ea867250840a99ea9121412f419596ed993aed7b553ff1063e5
Instruction Fuzzy Hash: C5F031B06101059BCB14FBA5DD52A6E7B74AB10304F50423FB405B22E2D7389E45DA5D

Uniqueness

Uniqueness Score: -1.00%

Function 0042B8DF Relevance: 3.0, APIs: 2, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000,004299CA,00000001), ref: 0042B8F0

Part of subcall function 0042B797: GetVersionExA.KERNEL32 ref: 0042B7B6

HeapDestroy.KERNEL32 ref: 0042B92F

Part of subcall function 0042B93C: HeapAlloc.KERNEL32(00000000,00000140,0042B918,000003F8), ref: 0042B949

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: Heap$AllocCreateDestroyVersion
String ID:
API String ID: 2507506473-0
Opcode ID: 31d40141270d94cc6a46d3aa6a4055636487e8a3a98ec23df310f2208fc2150e
Instruction ID: 15a62b593e40064b2939184925604b465d4c5a409540050c7cc12b7d7b2423a6
Opcode Fuzzy Hash: 31d40141270d94cc6a46d3aa6a4055636487e8a3a98ec23df310f2208fc2150e
Instruction Fuzzy Hash: E1F0E5B071031169EF105B30BC8132A27A4E741782F90483BF240C41B1EF68C5C0928E

Uniqueness

Uniqueness Score: -1.00%

Function 0040F736 Relevance: 3.0, APIs: 2, Instructions: 26registryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE(00000104,00000000,00000000,00000104,0041DD97,00000000,00000000,?,00421F70,80000002,System\CurrentControlSet\Control\Windows,00020019,00000000,00000000,?,00000104), ref: 0040F750
RegCloseKey.ADVAPI32(?,?,00421F70,80000002,System\CurrentControlSet\Control\Windows,00020019,00000000,00000000,?,00000104,00000000,00000000,?,00000104,00000000,00000104), ref: 0040F761

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: CloseOpen
String ID:
API String ID: 47109696-0
Opcode ID: fcf42b7071bbc811937dc5c00fd557c6fc3bea96d662c0c30168c6d6cc05cf52
Instruction ID: 65e5ab2454bdaf6d8e84c36c64ef74bd3ac68362bc81c5163f3489a93d7c1e2d
Opcode Fuzzy Hash: fcf42b7071bbc811937dc5c00fd557c6fc3bea96d662c0c30168c6d6cc05cf52
Instruction Fuzzy Hash: 0AF06D76100309FBDB289F50CD46F9E7BB9FF00352F20403DE84266290E779AA54DB58

Uniqueness

Uniqueness Score: -1.00%

Function 004092B3 Relevance: 3.0, APIs: 2, Instructions: 24fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,?,?,00000000), ref: 004092CA
GetLastError.KERNEL32(00000000), ref: 004092D5

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: ErrorFileLastRead
String ID:
API String ID: 1948546556-0
Opcode ID: b3954d8a14c549779665d43f20616fe643173d41e1ffe32812fb1309b7b3b8dc
Instruction ID: b3786d8346194a81b066783532a8c1351fa494dd91f8d9d5e775e0898297fa46
Opcode Fuzzy Hash: b3954d8a14c549779665d43f20616fe643173d41e1ffe32812fb1309b7b3b8dc
Instruction Fuzzy Hash: 1FE04F7150020ABBCF01EFE1DC05F9E7BACAB04358F1486A8F511E10E0D375DA04AB18

Uniqueness

Uniqueness Score: -1.00%

Function 004204D4 Relevance: 3.0, APIs: 2, Instructions: 23COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 004204E6

Part of subcall function 00420519: __EH_prolog.LIBCMT ref: 0042051E
Part of subcall function 00420519: lstrlenA.KERNEL32(?,?,?,00442430,?,0000012C,?,?), ref: 00420576

LoadStringA.USER32(?,?,?), ref: 00420511

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: H_prologLoadStringlstrlenwsprintf
String ID:
API String ID: 1702443186-0
Opcode ID: b02884302cfeef6ca01e1a4eda024c24b99831da0c58c30361dc7f9f84136272
Instruction ID: 1ff97d53820bb28816c85ea0110b08f57152111c0e33396a0b6648f6737dc01a
Opcode Fuzzy Hash: b02884302cfeef6ca01e1a4eda024c24b99831da0c58c30361dc7f9f84136272
Instruction Fuzzy Hash: 16E0ED7550010FBBCF01AFA4DC05CDE7BB9FB14309F408025F90496072E636D6659B99

Uniqueness

Uniqueness Score: -1.00%

Function 0042287A Relevance: 3.0, APIs: 2, Instructions: 23COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0042287F

Part of subcall function 00402D6A: lstrlenW.KERNEL32(004364D8,02151168,00000104,00000000,004364BC,?,0041E536,tempdisk1folder,?,00000000,00000000,?,00000001,?,00000000,removeasmajorupgrade), ref: 00402DBD
Part of subcall function 00402D6A: WideCharToMultiByte.KERNEL32(00000000,00000000,004364D8,000000FF,?,00000002,00000000,00000000,?,0041E536,tempdisk1folder,?,00000000,00000000,?,00000001), ref: 00402DE5

CharUpperA.USER32(00000000,00000000,?,00000000,?,?,004364BC), ref: 004228A5

Part of subcall function 004022FB: __EH_prolog.LIBCMT ref: 00402300
Part of subcall function 004022FB: GetLastError.KERNEL32(74DE8B60,00000104), ref: 0040232C
Part of subcall function 004022FB: SetLastError.KERNEL32(00000000,?,00000000,?,00000001), ref: 00402361

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: CharErrorH_prologLast$ByteMultiUpperWidelstrlen
String ID:
API String ID: 4031648777-0
Opcode ID: e6475888946e5a6a9a77991031e5e9c46f6ca0a477bfaac3adc9cdebf6849569
Instruction ID: 65494ebd6a4bf33fe3e8ba5097e30035293bf86bb6232543310295b324e9610c
Opcode Fuzzy Hash: e6475888946e5a6a9a77991031e5e9c46f6ca0a477bfaac3adc9cdebf6849569
Instruction Fuzzy Hash: 9AE06D32C00604DBCB50FBE9D94A79DBBB8FF04318F10866EE452A31D1DB788A05DB54

Uniqueness

Uniqueness Score: -1.00%

Function 0042013A Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00000000,00000000,74DF34C0,0041FF13,00000000,?,00000000,00000000,?,00000000), ref: 0042014E
GetLastError.KERNEL32(?,00000000), ref: 00420156

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 2b00e5b1f5f3d5fe0549baf27db718936553d5fb372dc2ff09323e6b29fd48a5
Instruction ID: 3e934752bce40e7164ea14a281ebd23501888b9b04debd078ae3a7c2ce254d4d
Opcode Fuzzy Hash: 2b00e5b1f5f3d5fe0549baf27db718936553d5fb372dc2ff09323e6b29fd48a5
Instruction Fuzzy Hash: AAE048367042115BCB109F25AC0449B7ED2DBD43B0F014929F551821B2D7718C5596A5

Uniqueness

Uniqueness Score: -1.00%

Function 004095F0 Relevance: 2.6, APIs: 2, Instructions: 95COMMON

Download Yara Rule

APIs

Part of subcall function 00409390: CreateFileA.KERNELBASE(00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,?,?,00409977,00000000,00000000,?,00000000), ref: 004093D3

CloseHandle.KERNEL32(00000000,FFFFD8EB,00000000,00409977), ref: 00409648

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: CloseCreateFileHandle
String ID:
API String ID: 3498533004-0
Opcode ID: 8070ad5413aa0bf9c188c8f5ae3ec1d6536aadafaa8af280628d107603267cfb
Instruction ID: b87e61db47e75556292f6dd9e1d814bad7377b15c9b941538b6f2ea049c4b892
Opcode Fuzzy Hash: 8070ad5413aa0bf9c188c8f5ae3ec1d6536aadafaa8af280628d107603267cfb
Instruction Fuzzy Hash: F0212C725001287ADB206BE5BC85DEF336CDB45358F410577FA01E21C3E6799E008ABD

Uniqueness

Uniqueness Score: -1.00%

Function 00406B7B Relevance: 1.6, APIs: 1, Instructions: 120COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00406B80

Part of subcall function 0041AD16: GetVersionExA.KERNEL32(?,?,?), ref: 0041AD43
Part of subcall function 0041AD16: GetSystemInfo.KERNELBASE(?,?,?), ref: 0041AD83

Part of subcall function 0041C1B0: lstrlenA.KERNEL32(?,?,00000000,00000000,00406BEE,00000000,00000001,00000000,0000044F,00000000,?,?), ref: 0041C1BA
Part of subcall function 0041C1B0: lstrcpyA.KERNEL32(00000000,?,?,00000000,00000000,00406BEE,00000000,00000001,00000000,0000044F,00000000,?,?), ref: 0041C1D6
Part of subcall function 0041C1B0: lstrcpyA.KERNEL32(C:\Users\user\AppData\Local\Temp,?,?,00000000,00000000,00406BEE,00000000,00000001,00000000,0000044F,00000000,?,?), ref: 0041C1DE

Part of subcall function 00406CFF: GetTempPathA.KERNEL32(00000001,0000044F,?,00000000,00000000,00406C10,?,00000400,00000000,00000000,00000001,00000000,0000044F,00000000,?,?), ref: 00406D1E
Part of subcall function 00406CFF: SetErrorMode.KERNELBASE(00008003,?,00000000,00000000,00406C10,?,00000400,00000000,00000000,00000001,00000000,0000044F,00000000,?,?), ref: 00406D2D
Part of subcall function 00406CFF: GetWindowsDirectoryA.KERNEL32(0000044F,00000000,?,00000000,00000000,00406C10,?,00000400,00000000,00000000,00000001,00000000,0000044F,00000000,?,?), ref: 00406D45
Part of subcall function 00406CFF: lstrcpyA.KERNEL32(0000044F,00442430,?,00000000,00000000,00406C10,?,00000400,00000000,00000000,00000001,00000000,0000044F,00000000,?,?), ref: 00406D62

Part of subcall function 0041CEBE: __EH_prolog.LIBCMT ref: 0041CEC3
Part of subcall function 0041CEBE: wsprintfA.USER32 ref: 0041CF86
Part of subcall function 0041CEBE: wsprintfA.USER32 ref: 0041CFC3

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: lstrcpy$H_prologwsprintf$DirectoryErrorInfoModePathSystemTempVersionWindowslstrlen
String ID:
API String ID: 1572838600-0
Opcode ID: 05fc4206e4d519ae0e04e05a242c0e56e86af8c530aea6e58ae29c7fe012134c
Instruction ID: 3aa352bdaa7b785ea94314c5ea2f4d6b200f1442287c693153957bba92762ac3
Opcode Fuzzy Hash: 05fc4206e4d519ae0e04e05a242c0e56e86af8c530aea6e58ae29c7fe012134c
Instruction Fuzzy Hash: 4D31D370B442109BEB14B7725E937BE269A9B54718F00003FF943B62D2EF7D8D92925E

Uniqueness

Uniqueness Score: -1.00%

Function 00427AB7 Relevance: 1.6, APIs: 1, Instructions: 80memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,-0000000F,00000000,?,00000000,00000000,00000000), ref: 00427B9E

Part of subcall function 0042B6F4: InitializeCriticalSection.KERNEL32(00000000,00000000,?,?,00430238,00000009,00000000,00000000,00000001,0042AA98,00000001,00000074,?,?,00000000,00000001), ref: 0042B731
Part of subcall function 0042B6F4: EnterCriticalSection.KERNEL32(?,?,?,00430238,00000009,00000000,00000000,00000001,0042AA98,00000001,00000074,?,?,00000000,00000001), ref: 0042B74C

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: CriticalSection$AllocateEnterHeapInitialize
String ID:
API String ID: 1616793339-0
Opcode ID: dd2ee37d2908af2f2294d7ac1643f2725b7ef1e5e80e42d524f77bf0b9eff4dc
Instruction ID: 6d312c49e9185f34bd3c7d6f54b3582efc9b8d57fe8b42cfde72d50a8c2652c1
Opcode Fuzzy Hash: dd2ee37d2908af2f2294d7ac1643f2725b7ef1e5e80e42d524f77bf0b9eff4dc
Instruction Fuzzy Hash: D221B731B44225ABDB10AF69FC42B9E7B64EB01768F544117F420E76D1C77CB8418A9D

Uniqueness

Uniqueness Score: -1.00%

Function 00427990 Relevance: 1.6, APIs: 1, Instructions: 75memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,00000000,00000000,?,00000000,?,00430238,00000009,00000000,00000000,00000001,0042AA98,00000001,00000074), ref: 00427A64

Part of subcall function 0042B6F4: InitializeCriticalSection.KERNEL32(00000000,00000000,?,?,00430238,00000009,00000000,00000000,00000001,0042AA98,00000001,00000074,?,?,00000000,00000001), ref: 0042B731
Part of subcall function 0042B6F4: EnterCriticalSection.KERNEL32(?,?,?,00430238,00000009,00000000,00000000,00000001,0042AA98,00000001,00000074,?,?,00000000,00000001), ref: 0042B74C

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: CriticalSection$EnterFreeHeapInitialize
String ID:
API String ID: 641406236-0
Opcode ID: 269192babbb5833acde5721490ddd7924fcd5bd82ba113cb2fe416dedd3c8dfe
Instruction ID: 28a29f52988bf89172a52b7001ea7628a37087f53e1ed1003c98ef33a96bc608
Opcode Fuzzy Hash: 269192babbb5833acde5721490ddd7924fcd5bd82ba113cb2fe416dedd3c8dfe
Instruction Fuzzy Hash: 7F21DA72A05225ABDF109B55EC42B9FBB78FF05774F54011BF411A22C0DB7C8A40CAAD

Uniqueness

Uniqueness Score: -1.00%

Function 0041C33B Relevance: 1.6, APIs: 1, Instructions: 58COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0041C340

Part of subcall function 0041C73F: __EH_prolog.LIBCMT ref: 0041C744
Part of subcall function 0041C73F: lstrlenA.KERNEL32(?,?,?,?,00000000), ref: 0041C86E

Part of subcall function 0041C961: __EH_prolog.LIBCMT ref: 0041C966
Part of subcall function 0041C961: IsValidCodePage.KERNEL32(?,?,00000000), ref: 0041CA7C

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: H_prolog$CodePageValidlstrlen
String ID:
API String ID: 2211208318-0
Opcode ID: 640bb4b680d8428f90d16e3a1d571cb21eea9cc700255bf164e1c7b902a806b8
Instruction ID: ebbe5edad7b7ce73e95dc5e5a851f190d82bf37c2507a461ebfee1e5cde49e65
Opcode Fuzzy Hash: 640bb4b680d8428f90d16e3a1d571cb21eea9cc700255bf164e1c7b902a806b8
Instruction Fuzzy Hash: D211C870A40319CACB14F7B2CD926EE77649F14358F10812FE922A21D2EB7C5E85C75D

Uniqueness

Uniqueness Score: -1.00%

Function 0041FE28 Relevance: 1.6, APIs: 1, Instructions: 51fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,00000000,00000138,00000000,00000000), ref: 0041FE63

Part of subcall function 0042013A: SetFilePointer.KERNELBASE(00000000,00000000,00000000,00000000,00000000,74DF34C0,0041FF13,00000000,?,00000000,00000000,?,00000000), ref: 0042014E
Part of subcall function 0042013A: GetLastError.KERNEL32(?,00000000), ref: 00420156

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: File$ErrorLastPointerRead
String ID:
API String ID: 64821003-0
Opcode ID: 5a6fd10768158b153dbeb68efbbbae928733d1699d8592b4385cea2226d8c5f7
Instruction ID: a5b460198df7071348844322edae114eb36f02362f1dc816e87a17c3952b64e9
Opcode Fuzzy Hash: 5a6fd10768158b153dbeb68efbbbae928733d1699d8592b4385cea2226d8c5f7
Instruction Fuzzy Hash: 5901D871300305BBEB115B51DC85FEFBA6CEF50344F10003AB808951A2DBB89D95C668

Uniqueness

Uniqueness Score: -1.00%

Function 00409390 Relevance: 1.5, APIs: 1, Instructions: 46fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,?,?,00409977,00000000,00000000,?,00000000), ref: 004093D3

Part of subcall function 0040935D: SetFilePointer.KERNEL32(00000000,00000000,00000000,004093F1,00000000,004093F1,00000000,00000000,00000002,?,?,?,?,00409977,00000000,00000000), ref: 0040936C
Part of subcall function 0040935D: GetLastError.KERNEL32(00000000,?,?,?,?,00409977,00000000,00000000), ref: 0040937B

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: File$CreateErrorLastPointer
String ID:
API String ID: 2723331319-0
Opcode ID: f988b64e3a7a9b8c04d698d3d5c5f2502a13178b91f1f2032bacd81aa2d59db3
Instruction ID: 43e8e52a715e90aadfac68f1a3a726074283e65d01640faf02567137a8876eaa
Opcode Fuzzy Hash: f988b64e3a7a9b8c04d698d3d5c5f2502a13178b91f1f2032bacd81aa2d59db3
Instruction Fuzzy Hash: 28014876800128BACF119B968C458DFBFBDEF49260F0481A6F924A2191D6304A14DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0040C4B0 Relevance: 1.5, APIs: 1, Instructions: 46fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0040CD2F: GetFileAttributesA.KERNELBASE(?,0040C4B8,?,004031E7,000000FF,?,74DE8B60,?,00000000), ref: 0040CD3C

CreateFileA.KERNELBASE(?,80000000,00000001,00000000,00000003,00000001,00000000,00000000,?,004031E7,000000FF,?,74DE8B60,?,00000000), ref: 0040C4EA

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 0a6c85291bce8ba4e35f91148df6710676a4c09d39759feed857dd042812fa3f
Instruction ID: 2700dd922ad360aad2872322d011fe432f54a22da9e5c63381fbb492d28b4eec
Opcode Fuzzy Hash: 0a6c85291bce8ba4e35f91148df6710676a4c09d39759feed857dd042812fa3f
Instruction Fuzzy Hash: 9001A234204321FADE355F388C85B5773A5AB92764F24476EB8A0BB3D1C679E8428718

Uniqueness

Uniqueness Score: -1.00%

Function 0041ED52 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0041ED57

Part of subcall function 00408DBE: MultiByteToWideChar.KERNEL32(00000000,00000000,0041E0C3,?,00000000,00000000,02151168,?,00000000,?,0041ED6D,?,000000FF,00000000,?,0041E0C3), ref: 00408DD6
Part of subcall function 00408DBE: SysAllocStringLen.OLEAUT32(00000000,-00000001), ref: 00408DDD
Part of subcall function 00408DBE: MultiByteToWideChar.KERNEL32(00000000,00000000,0041E0C3,000000FF,00000000,-00000001,?,00000000,?,0041ED6D,?,000000FF,00000000,?,0041E0C3,00000000), ref: 00408DF3

Part of subcall function 0041EF4E: __EH_prolog.LIBCMT ref: 0041EF53

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: ByteCharH_prologMultiWide$AllocString
String ID:
API String ID: 3359658865-0
Opcode ID: 8461af1d08abe85b958c29dd4f5334a0dbe8291295c8a8e4706ef93040e3fe12
Instruction ID: a104c9c6b2ecf53ec8ed17965cc1085700011650c876502ac03c3daff6fe7a7f
Opcode Fuzzy Hash: 8461af1d08abe85b958c29dd4f5334a0dbe8291295c8a8e4706ef93040e3fe12
Instruction Fuzzy Hash: A7E06571A04610AFC714EF6D9401589BBE0EF58720B10862FF4A9D3781DB7495008758

Uniqueness

Uniqueness Score: -1.00%

Function 004221BF Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

UuidCreate.RPCRT4(?), ref: 004221CF

Part of subcall function 004221F3: __EH_prolog.LIBCMT ref: 004221F8
Part of subcall function 004221F3: UuidToStringA.RPCRT4(?,?), ref: 00422234
Part of subcall function 004221F3: RpcStringFreeA.RPCRT4(?), ref: 00422284

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: StringUuid$CreateFreeH_prolog
String ID:
API String ID: 3305673060-0
Opcode ID: 915aff2d9ab80116cdea702a9fc3f73abc8dab60d36e1b17a51458fcd1f57ec5
Instruction ID: 9280f1a5512b0dbe98bfa00621665162f5387750ed37671c6aec0714126c36b1
Opcode Fuzzy Hash: 915aff2d9ab80116cdea702a9fc3f73abc8dab60d36e1b17a51458fcd1f57ec5
Instruction Fuzzy Hash: 06E04F72900108A7CB00FF5DDD06ADF3779AB81215F510050BD016B101D6B1A71486E5

Uniqueness

Uniqueness Score: -1.00%

Function 0040CD2F Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(?,0040C4B8,?,004031E7,000000FF,?,74DE8B60,?,00000000), ref: 0040CD3C

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 610ce8b2da3444d03fd0c4c23c22fa3b009c5b9b1acbf13af15fcb27963d7fd8
Instruction ID: 47b1c89497ab378b2642fe6e5767a74cebaa604565f78357807421ab14a907cc
Opcode Fuzzy Hash: 610ce8b2da3444d03fd0c4c23c22fa3b009c5b9b1acbf13af15fcb27963d7fd8
Instruction Fuzzy Hash: 1FD012B0701501BBEF205F7C59C46132B494F51725F659B72F528E91E5E73DEC435118

Uniqueness

Uniqueness Score: -1.00%

Function 00420DE9 Relevance: 1.5, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(00000000,0041DDB5,00000000,00000000,?,?,?,00000000,00000000,?,?,00000001,00000000,?,00000001,Startup), ref: 00420DED

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: a990562a17f2efe54dd0d8e4a192a218e5540c45867ad45db911261b1f50e328
Instruction ID: e84274b524c19f23fd4252e51799b94d1dc2fb2cc0d5947f52604efb17535398
Opcode Fuzzy Hash: a990562a17f2efe54dd0d8e4a192a218e5540c45867ad45db911261b1f50e328
Instruction Fuzzy Hash: B8C08C3021411169EA1006347E9972B22C34B50374FA28E62F066E89E2C3A658E2A098

Uniqueness

Uniqueness Score: -1.00%

Function 00420E06 Relevance: 1.5, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(?,00420E2F,?,00000000,00401C7E,?,00000000,?,00000400), ref: 00420E0A

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: e1fa923a7c5ddec283ea7af52ed80c8d2525f01d8d5c68df143d3def0c66a958
Instruction ID: ab2428337902331717d0bdb8526ece210e9b0085914efaf5d75b17f74e315a58
Opcode Fuzzy Hash: e1fa923a7c5ddec283ea7af52ed80c8d2525f01d8d5c68df143d3def0c66a958
Instruction Fuzzy Hash: 0FC08C3020011969E2102B287E0A627A2C34B40720FA28E23F065C02F7D7B45CF2A018

Uniqueness

Uniqueness Score: -1.00%

Function 00409945 Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

FreeLibrary.KERNELBASE(6CBC0000,00413CBF,?,?,C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B},?,?,00429A4C,00000001,00000000,?,?,00000000), ref: 00409954

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 0a23568bb18c7dceeb8dd4794b7acddf1a30e66876609b562cd9638acf4a3e28
Instruction ID: f3b6f1561a8c4c17b66990b8147c3dbae7f77a6518d596066385ebffc416e16c
Opcode Fuzzy Hash: 0a23568bb18c7dceeb8dd4794b7acddf1a30e66876609b562cd9638acf4a3e28
Instruction Fuzzy Hash: 41B0926060010257CE00AB35995A5062758A60230530094397015E2293CA39D8008A1C

Uniqueness

Uniqueness Score: -1.00%

Function 0041FAA6 Relevance: 1.3, APIs: 1, Instructions: 7stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(004364BC,0041F9EC), ref: 0041FAB2

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: lstrcmpi
String ID:
API String ID: 1586166983-0
Opcode ID: af7841e1511708443b59dbf1bb550e148c2fee9578cb4c4a51736c2e609b25bd
Instruction ID: 72b34a910fbd54397dd1a57041b65e792349bea6d35aa6378d2aa83b50b2be9b
Opcode Fuzzy Hash: af7841e1511708443b59dbf1bb550e148c2fee9578cb4c4a51736c2e609b25bd
Instruction Fuzzy Hash: AEB092711A60199ACB051F30EC0AAA03A21BB02206B256674A106C50F0C7220012AB04

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00422B9D Relevance: 91.1, APIs: 26, Strings: 26, Instructions: 118libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(wininet.dll,00000000,004087FF,?,00000000,?,00408A30,?,00000000,?,00000000,00000001,00000000), ref: 00422BB2
GetProcAddress.KERNEL32(00000000,InternetOpenA), ref: 00422BD2
GetProcAddress.KERNEL32(InternetOpenUrlA), ref: 00422BE4
GetProcAddress.KERNEL32(InternetConnectA), ref: 00422BF6
GetProcAddress.KERNEL32(InternetCrackUrlA), ref: 00422C08
GetProcAddress.KERNEL32(InternetCreateUrlA), ref: 00422C1A
GetProcAddress.KERNEL32(InternetCloseHandle), ref: 00422C2C
GetProcAddress.KERNEL32(InternetReadFile), ref: 00422C3E
GetProcAddress.KERNEL32(HttpQueryInfoA), ref: 00422C50
GetProcAddress.KERNEL32(FtpFindFirstFileA), ref: 00422C62
GetProcAddress.KERNEL32(InternetGetLastResponseInfoA), ref: 00422C74
GetProcAddress.KERNEL32(InternetSetOptionA), ref: 00422C86
GetProcAddress.KERNEL32(InternetGetConnectedState), ref: 00422C98
GetProcAddress.KERNEL32(InternetAutodial), ref: 00422CAA
GetProcAddress.KERNEL32(InternetErrorDlg), ref: 00422CBC
GetProcAddress.KERNEL32(HttpOpenRequestA), ref: 00422CCE
GetProcAddress.KERNEL32(HttpSendRequestA), ref: 00422CE0
GetProcAddress.KERNEL32(HttpSendRequestExA), ref: 00422CF2
GetProcAddress.KERNEL32(HttpEndRequestA), ref: 00422D04
GetProcAddress.KERNEL32(InternetQueryOptionA), ref: 00422D16
GetProcAddress.KERNEL32(InternetQueryDataAvailable), ref: 00422D28
GetProcAddress.KERNEL32(InternetCanonicalizeUrlA), ref: 00422D3A
GetProcAddress.KERNEL32(InternetGetCookieA), ref: 00422D4C
GetProcAddress.KERNEL32(InternetSetCookieA), ref: 00422D5E
GetProcAddress.KERNEL32(InternetSetStatusCallbackA), ref: 00422D70
GetProcAddress.KERNEL32(InternetSetStatusCallback), ref: 00422D86

Strings

InternetSetOptionA, xrefs: 00422C76
InternetQueryDataAvailable, xrefs: 00422D18
InternetGetConnectedState, xrefs: 00422C88
InternetReadFile, xrefs: 00422C2E
InternetOpenUrlA, xrefs: 00422BD4
wininet.dll, xrefs: 00422BAD
HttpSendRequestA, xrefs: 00422CD0
InternetGetLastResponseInfoA, xrefs: 00422C64
InternetCanonicalizeUrlA, xrefs: 00422D2A
InternetCrackUrlA, xrefs: 00422BF8
InternetCloseHandle, xrefs: 00422C1C
InternetSetStatusCallback, xrefs: 00422D7B
InternetConnectA, xrefs: 00422BE6
InternetErrorDlg, xrefs: 00422CAC
HttpEndRequestA, xrefs: 00422CF4
InternetOpenA, xrefs: 00422BCC
InternetCreateUrlA, xrefs: 00422C0A
InternetGetCookieA, xrefs: 00422D3C
HttpSendRequestExA, xrefs: 00422CE2
HttpOpenRequestA, xrefs: 00422CBE
InternetQueryOptionA, xrefs: 00422D06
FtpFindFirstFileA, xrefs: 00422C52
InternetSetStatusCallbackA, xrefs: 00422D60
HttpQueryInfoA, xrefs: 00422C40
InternetSetCookieA, xrefs: 00422D4E
InternetAutodial, xrefs: 00422C9A

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: FtpFindFirstFileA$HttpEndRequestA$HttpOpenRequestA$HttpQueryInfoA$HttpSendRequestA$HttpSendRequestExA$InternetAutodial$InternetCanonicalizeUrlA$InternetCloseHandle$InternetConnectA$InternetCrackUrlA$InternetCreateUrlA$InternetErrorDlg$InternetGetConnectedState$InternetGetCookieA$InternetGetLastResponseInfoA$InternetOpenA$InternetOpenUrlA$InternetQueryDataAvailable$InternetQueryOptionA$InternetReadFile$InternetSetCookieA$InternetSetOptionA$InternetSetStatusCallback$InternetSetStatusCallbackA$wininet.dll
API String ID: 2238633743-3702687842
Opcode ID: d407672e3b00b0813039beca705d61a57e6e4043f84e57ca1dd714d78f20b21d
Instruction ID: 3853cf1cd588a7616cda52eeea2f533c80e99f11612c41839a7b973dcb8deec8
Opcode Fuzzy Hash: d407672e3b00b0813039beca705d61a57e6e4043f84e57ca1dd714d78f20b21d
Instruction Fuzzy Hash: 2D41F278D51B25BFDF11AF22FC05A393E72E70A75A7205037A4088A1FAD6B60951DF8C

Uniqueness

Uniqueness Score: -1.00%

Function 0042123B Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 119threadmemoryCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00421260
OpenThreadToken.ADVAPI32(00000000,?,?,?,?,?,?,?,?,00415368,?,?,00000001,00000000,00000000), ref: 00421267
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00415368,?,?,00000001,00000000,00000000), ref: 00421277
GetCurrentProcess.KERNEL32(00000008,?,?,?,?,?,?,?,?,?,00415368,?,?,00000001,00000000,00000000), ref: 00421286
OpenProcessToken.ADVAPI32(00000000,?,?,?,?,?,?,?,?,00415368,?,?,00000001,00000000,00000000), ref: 0042128D
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00415368,?,?,00000001,00000000,00000000), ref: 00421293
GetTokenInformation.ADVAPI32(?,00000002,00000000,00000000,hSA,?,?,?,?,?,?,?,?,00415368), ref: 004212AF
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00415368,?,?,00000001,00000000,00000000), ref: 004212B5
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,00000001,00000001,?,?,?,?,?,?,?,?,00415368), ref: 004212DA
AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 004212F7
EqualSid.ADVAPI32(?,?,?,?,?,?,?,?,?,?,00415368,?,?,00000001,00000000,00000000), ref: 00421328
FreeSid.ADVAPI32(?,?,?,?,?,?,?,?,?,00415368,?,?,00000001,00000000,00000000), ref: 00421347

Strings

hSA, xrefs: 0042129E, 004212BC, 004212C7, 004212CD, 004212A7, 004212CC

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: Token$ErrorLast$CurrentInformationOpenProcessThread$AllocateEqualFreeInitialize
String ID: hSA
API String ID: 884311744-700988443
Opcode ID: aea1aa4eb6baee84e7df4dca63ba7ddfc1e4baf7e9e58ee941e3e829f7e6c467
Instruction ID: f469a3b1809832485b330c930bc583c3d161c06b48a21c235e6a0c291fc4db1d
Opcode Fuzzy Hash: aea1aa4eb6baee84e7df4dca63ba7ddfc1e4baf7e9e58ee941e3e829f7e6c467
Instruction Fuzzy Hash: BD31A472A00259BFEF11DBA4AC45AEFBBF9EF15344F904076E900F2160D6359E44CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00413D18 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 114filetimeCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00413D1D
GetTempPathA.KERNEL32(00000400,00000000,00000000,00000003), ref: 00413D4F

Part of subcall function 004014FF: __EH_prolog.LIBCMT ref: 00401504
Part of subcall function 004014FF: SetLastError.KERNEL32(?,?,00000000,74DF2EE0,?,0041FD71,?,?,00000001,?,80000000,00000003,00000000,00000003,00000080,00000000), ref: 0040156A

FindFirstFileA.KERNEL32(00000000,?,|dC,*.mst,?,00000000,00000000,?,00000001), ref: 00413DD1
CompareFileTime.KERNEL32(?,?), ref: 00413DEE
DeleteFileA.KERNEL32(00000000,?,?,?,00000001,00000000,?,00000001), ref: 00413E54
FindNextFileA.KERNEL32(00000000,?), ref: 00413E6E

Strings

|dC, xrefs: 00413D93
4$D, xrefs: 00413D87
*.mst, xrefs: 00413D6E, 00413D92
tdC, xrefs: 00413D7E

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: File$FindH_prolog$CompareDeleteErrorFirstLastNextPathTempTime
String ID: *.mst$4$D$tdC$|dC
API String ID: 4192361366-2201022342
Opcode ID: a51711e3d9dc9f162469c1157b325f75548771979b9ad613e996537daf4817c3
Instruction ID: 09b2d20d0770b5d9108ddfb41bcca3db75bc53d408a5866cea53ac27a9cf4b73
Opcode Fuzzy Hash: a51711e3d9dc9f162469c1157b325f75548771979b9ad613e996537daf4817c3
Instruction Fuzzy Hash: 08415171D01259AEEF15DBA4DC55BDEBBB8AF14304F0080AAF505A3191EB785B48CF68

Uniqueness

Uniqueness Score: -1.00%

Function 00422D97 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 119memoryfileCOMMON

Download Yara Rule

APIs

SearchPathA.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,?,74DEF550,74DF2F30), ref: 00422DBA
GetModuleFileNameA.KERNEL32(?,00000104), ref: 00422DDA
FindFirstFileA.KERNEL32(?,?), ref: 00422DF6
VirtualQuery.KERNEL32(00000000,?,0000001C), ref: 00422E2E
VirtualProtect.KERNEL32(00000000,00000001,00000004,00408A30), ref: 00422E80
VirtualProtect.KERNEL32(00000000,00000001,00408A30,00408A30), ref: 00422E93

Strings

RPAWINET.DLL, xrefs: 00422DA3

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: Virtual$FileProtect$FindFirstModuleNamePathQuerySearch
String ID: RPAWINET.DLL
API String ID: 1867771099-274221676
Opcode ID: 1d045c8d83dedfbc2c1792f3530304953b519e0ba5a71e8eb454e43d8abbe7f7
Instruction ID: 202537dd5bd02fb6e2974613d6d2e439f4700bf25f8820d40688bd6fd34705b9
Opcode Fuzzy Hash: 1d045c8d83dedfbc2c1792f3530304953b519e0ba5a71e8eb454e43d8abbe7f7
Instruction Fuzzy Hash: CF415072A00129BBDF11DB94DD81FEFB7BDAF05300F564066E910F6280D7B4AE459B68

Uniqueness

Uniqueness Score: -1.00%

Function 00421166 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 0042120D: GetVersionExA.KERNEL32(?), ref: 00421227

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,0041C3E9), ref: 00421175
OpenProcessToken.ADVAPI32(00000000,00000028,0041C3E9,?,?,?,?,?,?,0041C3E9), ref: 00421182
LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00421199
AdjustTokenPrivileges.ADVAPI32(0041C3E9,00000000,?,00000000,00000000,00000000), ref: 004211C4
ExitWindowsEx.USER32(00000002,0000FFFF), ref: 004211D2

Strings

SeShutdownPrivilege, xrefs: 00421193

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: ProcessToken$AdjustCurrentExitLookupOpenPrivilegePrivilegesValueVersionWindows
String ID: SeShutdownPrivilege
API String ID: 337752880-3733053543
Opcode ID: 654c637711f3d0129057a77e9faf76c49b865ad8e30e44e2ebd2ae17bd53042c
Instruction ID: 1592780324769039f4501555807589d558b3398acab95ec48eac5c715041dd6e
Opcode Fuzzy Hash: 654c637711f3d0129057a77e9faf76c49b865ad8e30e44e2ebd2ae17bd53042c
Instruction Fuzzy Hash: 86012175A0122ABBDB10DFA5DC0AEAF7BBCEF15345F004125B515E2190D7749604CBB5

Uniqueness

Uniqueness Score: -1.00%

Function 0040A454 Relevance: 6.0, APIs: 4, Instructions: 30COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(?,?,?), ref: 0040A465
SizeofResource.KERNEL32(?,00000000), ref: 0040A471
LoadResource.KERNEL32(?,00000000), ref: 0040A47D
LockResource.KERNEL32(00000000), ref: 0040A484

Part of subcall function 0040A2F6: __EH_prolog.LIBCMT ref: 0040A2FB
Part of subcall function 0040A2F6: GetWindowDC.USER32(00000000,?,?,00000000,00000000), ref: 0040A3DB
Part of subcall function 0040A2F6: CreateDIBitmap.GDI32(00000000,?,00000004,?,?,00000000), ref: 0040A3F6

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: Resource$BitmapCreateFindH_prologLoadLockSizeofWindow
String ID:
API String ID: 3578310943-0
Opcode ID: 36eae1ef15c24a04fa7fd79a1b143d7b59be2b3497ca48ceda1709e8d75934f0
Instruction ID: 412e42af1dc85b84d59a1d0b30548f3aae24c1a7d4c98822a6ae928dc7b65302
Opcode Fuzzy Hash: 36eae1ef15c24a04fa7fd79a1b143d7b59be2b3497ca48ceda1709e8d75934f0
Instruction Fuzzy Hash: C9E0E532101119BFDF011F59DC48CAF7F6DEF492617059036FA4585121CA728C51ABA4

Uniqueness

Uniqueness Score: -1.00%

Function 00421361 Relevance: 3.0, APIs: 2, Instructions: 33COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(00421438,00001004,?,00000014,?,?,?,?,?,?,?,?,?,?,?,00421438), ref: 00421388
TranslateCharsetInfo.GDI32(00000000,?,00000002), ref: 004213A3

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: Info$CharsetLocaleTranslate
String ID:
API String ID: 641124110-0
Opcode ID: fdbead7add8f07b9e3c449411e7ae2bf0fcea3f0dd5ec620230804c97741f916
Instruction ID: bb29429a7abe2564468c2e6e575c38df09c66d702e1e1a888a0238c18081c00a
Opcode Fuzzy Hash: fdbead7add8f07b9e3c449411e7ae2bf0fcea3f0dd5ec620230804c97741f916
Instruction Fuzzy Hash: A5F096B4602109A7EB10DBA1FD45FEE73A9AB04704B901129FA00D56F1E774DD41CB68

Uniqueness

Uniqueness Score: -1.00%

Function 0042E90F Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0002E8C9), ref: 0042E914

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 043419ca89d4f938f0496ab7009b4403287687559f41fce4456226d5abb288ea
Instruction ID: fb2ffd927ed7305ccea48581a67f22c9266e6589586caecbb3438322d220fda7
Opcode Fuzzy Hash: 043419ca89d4f938f0496ab7009b4403287687559f41fce4456226d5abb288ea
Instruction Fuzzy Hash: 3BA0047454371157DF447F517C4550C3F7055457117555475D44541155D7750044D51D

Uniqueness

Uniqueness Score: -1.00%

Function 0042E921 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 0042E926

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 67926777b32cad8dce3cb1b253423c8fc4415e4ee9053d78f832031078b9ce25
Instruction ID: e902dc53ff6a92d1af3359848c55c1605b5d17d8d03bd85144f2039f739bd933
Opcode Fuzzy Hash: 67926777b32cad8dce3cb1b253423c8fc4415e4ee9053d78f832031078b9ce25
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 00412A1E Relevance: 88.0, APIs: 17, Strings: 33, Instructions: 489fileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00412A23
MoveFileA.KERNEL32(00000000,00000000), ref: 00412BB0

Strings

dotnetfx20.exe, xrefs: 00412CC3
\"", xrefs: 00412FB1
/jscmd:, xrefs: 00412FB7
DotNetCoreSetupUILang, xrefs: 00412C7A, 00412F1C
J#CmdLine, xrefs: 00412FC2
/q:a /c:"install /q", xrefs: 00412E19
dotnetredist.exe, xrefs: 00412C45
vjredist.exe, xrefs: 00412DC5
1.1, xrefs: 00412A3A
DotNetVersion, xrefs: 00412E96
0$D, xrefs: 00412E64
DotNetLangPacks, xrefs: 00412F37
Microsoft(R) .NET Framework, xrefs: 00412FEA
"/q:a /c:\", xrefs: 00412FAC
/redistui:S, xrefs: 00412F73
dotnetfx.exe, xrefs: 00412AD9, 00412AE4, 00412B10, 00412CA7
DotNetLangPackCmd, xrefs: 00412EF2, 00412F9F
/redistui:F, xrefs: 00412F7A, 00412F7F
/redistui:F, xrefs: 00412EAE, 00412EB3
DotNetFxCmd, xrefs: 00412ED3
/redistui:S, xrefs: 00412EA7
isnetfx.exe, xrefs: 00412ADF, 00412AE5, 00412B45
J#Version, xrefs: 00412F5C
1033, xrefs: 00412C75, 00412D5C
/langs:, xrefs: 00412F2C
vjredist20.exe, xrefs: 00412DDE
/ver:, xrefs: 00412E8B
/jsharpver:, xrefs: 00412F51
/q:a, xrefs: 00412E75
/l%d, xrefs: 00412E3B
/langcmd:"/q:a /c:\", xrefs: 00412EE7, 00412F94
/coreui:, xrefs: 00412F11
/c:", xrefs: 00412EC1

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: FileH_prologMove
String ID: /c:"$ /coreui:$ /l%d$ /langcmd:"/q:a /c:\"$ /langs:$ /q:a$ /q:a /c:"install /q"$ /redistui:F$ /redistui:S$ /ver:$"/q:a /c:\"$/jscmd:$/jsharpver:$/redistui:F$/redistui:S$0$D$1.1$1033$DotNetCoreSetupUILang$DotNetFxCmd$DotNetLangPackCmd$DotNetLangPacks$DotNetVersion$J#CmdLine$J#Version$Microsoft(R) .NET Framework$\""$dotnetfx.exe$dotnetfx20.exe$dotnetredist.exe$isnetfx.exe$vjredist.exe$vjredist20.exe
API String ID: 486322855-3898491796
Opcode ID: 449df1cf654c77223e16022f16fa7b102a314d9137ba194e612a949d967c04f0
Instruction ID: 1858e3052237c6aa284b379549f6c11e0ce9aa5a4f32efa16459f068880f9b64
Opcode Fuzzy Hash: 449df1cf654c77223e16022f16fa7b102a314d9137ba194e612a949d967c04f0
Instruction Fuzzy Hash: D302B171A00219ABDF15DBA0DD45FEEBB78AF08304F14406BF605E31C1DBB89A95CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040FC2F Relevance: 79.1, APIs: 43, Strings: 2, Instructions: 360windowstringtimeCOMMON

Download Yara Rule

APIs

SetBkMode.GDI32(?,00000001), ref: 0040FC9A
GetDlgCtrlID.USER32(?), ref: 0040FCA3
GetStockObject.GDI32(00000005), ref: 0040FCB9
SendMessageA.USER32(00000405,00000000,00000000), ref: 0040FCFA
PostMessageA.USER32(00000000,00008032,00000000,00000000), ref: 0040FD51
LoadCursorA.USER32(00000000,00000068), ref: 0040FD75
lstrlenA.KERNEL32(?), ref: 0040FDAE
wsprintfA.USER32 ref: 0040FE05
SetWindowTextA.USER32(?,?), ref: 0040FE16
SetTimer.USER32(?,000003E9,000000FA,00000000), ref: 0040FE2A
GetDlgItem.USER32(?,000003E9), ref: 0040FE38
GetDlgItem.USER32(?,000003EB), ref: 0040FE43
GetDlgItem.USER32(?,000003EA), ref: 0040FE4E
SendMessageA.USER32(00000000,00000402,00000000,00000000), ref: 0040FE5F
GetDlgItem.USER32(?,000003EE), ref: 0040FEB2
GetDlgItem.USER32(?,00000409), ref: 0041003C
GetClientRect.USER32(00000000,?), ref: 0041004D
GetClientRect.USER32(?,?), ref: 00410056
GetStockObject.GDI32(00000000), ref: 0041006E
FillRect.USER32(?,?,00000000), ref: 00410082
GetSysColor.USER32(0000000F), ref: 00410086
GetSysColorBrush.USER32(00000000), ref: 00410090
CreateSolidBrush.GDI32(?), ref: 0041009F
FillRect.USER32(?,?,00000000), ref: 004100C4
DeleteObject.GDI32(00000000), ref: 004100C7
DeleteObject.GDI32 ref: 004100DE
DeleteObject.GDI32 ref: 004100EF
DeleteObject.GDI32 ref: 004100F7
DeleteObject.GDI32 ref: 004100FF

Strings

Tahoma, xrefs: 0040FF0C, 0040FF78
Cancel, xrefs: 0040FE7C

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: Object$DeleteItem$Rect$Message$BrushClientColorFillSendStock$CreateCtrlCursorLoadModePostSolidTextTimerWindowlstrlenwsprintf
String ID: Cancel$Tahoma
API String ID: 78965213-1246164628
Opcode ID: 73fb0e50317754b8bd5fc53ace75ca169260e78c1e5c143e1e2783126682ce9d
Instruction ID: cac3a4ea8d1a6edc8c28665ed4f1c4103eb0fd7cdae7b7c4e1b365f06cff5cb8
Opcode Fuzzy Hash: 73fb0e50317754b8bd5fc53ace75ca169260e78c1e5c143e1e2783126682ce9d
Instruction Fuzzy Hash: ADD1A6B1900219BFDB11AFA1ED4AF9E7B7DFB09701F104436F505E61A1DB798A80CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00423A71 Relevance: 65.1, APIs: 26, Strings: 11, Instructions: 336registryfilestringCOMMON

Download Yara Rule

APIs

RegOpenKeyA.ADVAPI32(80000002,?,?), ref: 00423ADD
lstrlenA.KERNEL32(?,?,00000000), ref: 00423AFC
lstrlenA.KERNEL32(?,?,?,00000000), ref: 00423B1B
RegQueryValueExA.ADVAPI32(?,CurrentUser,00000000,00000000,?,?,00000000), ref: 00423B35
RegOpenKeyA.ADVAPI32(80000002,?,i3B), ref: 00423B4B
RegQueryValueExA.ADVAPI32(i3B,DirRoot,00000000,00000000,?,?,?,00000000), ref: 00423B6D
GetWindowsDirectoryA.KERNEL32(?,00000104,?,?,00000000), ref: 00423BCB
lstrcatA.KERNEL32(?,\nsreg.dat,?,00000000), ref: 00423BE3
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,?,00000000), ref: 00423BFC
CreateFileMappingA.KERNEL32(000000FF,00000000,00000002,00000000,00000000,00000000), ref: 00423C13
MapViewOfFile.KERNEL32(?,00000004,00000000,00000000,00000000,?,00000000), ref: 00423C28
RegOpenKeyA.ADVAPI32(80000001,SOFTWARE\Netscape\Netscape Navigator\biff,i3B), ref: 00423C43
RegQueryValueExA.ADVAPI32(i3B,CurrentUser,00000000,00000000,?,?,?,00000000), ref: 00423C6D
lstrcatA.KERNEL32(?,%20,?,00000000), ref: 00423C97
GetFileSize.KERNEL32(?,00000000,?,00000000), ref: 00423CB4
lstrcatA.KERNEL32(?,\prefs.js,?,?,?,?,?,00000000), ref: 00423DDA
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,?,?,?,?,?,00000000), ref: 00423DF7
GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,?,00000000), ref: 00423E06
ReadFile.KERNEL32(00000000,00000000,00000001,?,00000000,?,?,?,?,?,00000000), ref: 00423E26
CloseHandle.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 00423E3D

Part of subcall function 00424141: lstrcatA.KERNEL32(00000000,0043F074,0000003D,@B,00000001), ref: 00424222
Part of subcall function 00424141: lstrcatA.KERNEL32(?,0043F00C,786F7250,00000001,?), ref: 0042425B
Part of subcall function 00424141: lstrcatA.KERNEL32(?,0043DAC8,786F7250,00000001,?), ref: 0042427E

Strings

\prefs.js, xrefs: 00423DD4
ProfileManager, xrefs: 00423CBC
\nsreg.dat, xrefs: 00423BDD
SOFTWARE\Netscape\Netscape Navigator\biff, xrefs: 00423C39
DirRoot, xrefs: 00423B65
SOFTWARE\Netscape\Netscape Navigator\Users\, xrefs: 00423A81
%20, xrefs: 00423C91
d, xrefs: 00423C54
i3B, xrefs: 00423C35, 00423D6A, 00423C6A, 00423AE7, 00423B3B, 00423B6A, 00423B3E, 00423C38
CurrentUser, xrefs: 00423B2D, 00423C65
ProfileLocation, xrefs: 00423CD2, 00423CFE, 00423D0D

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: File$lstrcat$CreateOpenQueryValue$Sizelstrlen$CloseDirectoryHandleMappingReadViewWindows
String ID: %20$CurrentUser$DirRoot$ProfileLocation$ProfileManager$SOFTWARE\Netscape\Netscape Navigator\Users\$SOFTWARE\Netscape\Netscape Navigator\biff$\nsreg.dat$\prefs.js$d$i3B
API String ID: 1474181684-2403575895
Opcode ID: 52e1006d4b8b2d8834b47c8aba1ba6aa0c214a033c749d389fc94f0ab8686073
Instruction ID: e784ee92cb40a4cb972543891d7d411f7f3797507146b7ceb3f2aa3c40ef04af
Opcode Fuzzy Hash: 52e1006d4b8b2d8834b47c8aba1ba6aa0c214a033c749d389fc94f0ab8686073
Instruction Fuzzy Hash: 05B18D72E00169BBDF209FA0EC85AAFBBB8EB04301F5145BBE505E2150D7785F458B58

Uniqueness

Uniqueness Score: -1.00%

Function 0042341B Relevance: 63.4, APIs: 23, Strings: 13, Instructions: 370stringfileregistryCOMMON

Download Yara Rule

APIs

RegQueryValueA.ADVAPI32(80000000,.htm,?,00000000), ref: 00423447
lstrcatA.KERNEL32(?,\shell\open\command,?,00000000), ref: 00423461
RegQueryValueA.ADVAPI32(80000000,?,?,00000000), ref: 0042347D
lstrlenA.KERNEL32(?,?,00000000), ref: 00423492
CharLowerBuffA.USER32(?,00000000,?,00000000), ref: 004234A0
lstrcpynA.KERNEL32(?,00000022,-0000000D,?,00000000), ref: 004234E0
lstrcpynA.KERNEL32(?,00000022,-0000000C,?,00000000), ref: 0042355F
GetWindowsDirectoryA.KERNEL32(?,00000104,?,00000000), ref: 0042357F
lstrcatA.KERNEL32(?,\mozver.dat,?,00000000), ref: 00423591
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,?,00000000), ref: 004235AC
CreateFileMappingA.KERNEL32(000000FF,00000000,00000002,00000000,00000000,00000000), ref: 004235C5
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000,?,00000000), ref: 004235DA
GetFileSize.KERNEL32(000000FF,00000000,?,00000000), ref: 004235EB
lstrcpyA.KERNEL32(00000000,-00000008,?,?,?,?,?,?,?,?,00000000), ref: 0042365E
lstrcpyA.KERNEL32(00000000,-00000005,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004236A3
lstrcatA.KERNEL32(00000000,netscp6.exe,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004236B5
GetShortPathNameA.KERNEL32(?,00000000,00000104), ref: 004236FE
GetShortPathNameA.KERNEL32(00000000,00000000,00000104), ref: 0042370F
lstrcmpiA.KERNEL32(00000000,00000000), ref: 0042371F
CloseHandle.KERNEL32(00000000,?,?,00000000), ref: 004237C8
CloseHandle.KERNEL32(000000FF,?,?,00000000), ref: 004237D7
lstrcpynA.KERNEL32(?,00000022,-0000000D,?,00000000), ref: 0042381E
wsprintfA.USER32 ref: 00423867

Strings

Browser, xrefs: 00423612
PackageName, xrefs: 004235F3
\shell\open\command, xrefs: 0042345B
.htm, xrefs: 0042343C
netscape.exe, xrefs: 004234AC
", xrefs: 004237FB
<oC, xrefs: 00423514
iexplore.exe, xrefs: 004237E6
\mozver.dat, xrefs: 0042358B
%d.%d.%d.%d, xrefs: 00423861
Path, xrefs: 00423664
netscp6.exe, xrefs: 00423527, 004236AF
Version, xrefs: 00423629

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: File$lstrcatlstrcpyn$CloseCreateHandleNamePathQueryShortValuelstrcpy$BuffCharDirectoryLowerMappingSizeViewWindowslstrcmpilstrlenwsprintf
String ID: "$%d.%d.%d.%d$.htm$<oC$Browser$PackageName$Path$Version$\mozver.dat$\shell\open\command$iexplore.exe$netscape.exe$netscp6.exe
API String ID: 72107788-21345124
Opcode ID: 024993004c9abde2ac2b9dd746823e1c80ba280808bd1a1fdbc40f5078a19a14
Instruction ID: 5d364c73d10ed7321bcac676ae9a8a9d5ca1079207b4d57f85e8e8e24589d031
Opcode Fuzzy Hash: 024993004c9abde2ac2b9dd746823e1c80ba280808bd1a1fdbc40f5078a19a14
Instruction Fuzzy Hash: DCD1D3B1A00229BBDF24DFA0DC49BDF7BB8AF44701F5080AAE505E7191DB789B49CB54

Uniqueness

Uniqueness Score: -1.00%

Function 0040E7B3 Relevance: 54.5, APIs: 23, Strings: 8, Instructions: 228stringCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040E7B8

Part of subcall function 004029BB: __EH_prolog.LIBCMT ref: 004029C0
Part of subcall function 004029BB: SetLastError.KERNEL32(?,?,00000000,00000104,?,0041E59F,02151168,?,00000001,?,00000000,C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B},?,00000000), ref: 00402A26

lstrcmpiA.KERNEL32(?,auto), ref: 0040E7FC
CharNextA.USER32 ref: 0040E864
CharNextA.USER32(?,00000001,00000001,00000000), ref: 0040E88F
CharNextA.USER32(?,0043D764,00000000), ref: 0040E8A1
lstrcmpA.KERNEL32(00000000,%IS_E%), ref: 0040E8AF
lstrcpyA.KERNEL32(C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B},00000000), ref: 0040E8C0
CharNextA.USER32(C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B}), ref: 0040E9EA
CharNextA.USER32(C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B},00000000), ref: 0040E9FC
lstrcpyA.KERNEL32(?,00000000), ref: 0040EDE8

Strings

C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B}\Setup.INI, xrefs: 0040E980
auto, xrefs: 0040E7F6
Software\Microsoft\Windows\CurrentVersion, xrefs: 0040E8D3
/f2, xrefs: 0040EA2E
%IS_E%, xrefs: 0040E8A9
C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B}, xrefs: 0040E8B9, 0040E8BF, 0040E92F, 0040E935, 0040E966, 0040E9E9, 0040E9FB, 0040EA0C, 0040EA27, 0040EA39
/auto, xrefs: 0040E812
/f1, xrefs: 0040EA43

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: CharNext$H_prologlstrcpy$ErrorLastlstrcmplstrcmpi
String ID: %IS_E%$/auto$/f1$/f2$C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B}$C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B}\Setup.INI$Software\Microsoft\Windows\CurrentVersion$auto
API String ID: 2909353552-3099715218
Opcode ID: fcd21bc14236f586234e5bbfb4ffc63fc6dc396a3b7f26915f976692730b60d2
Instruction ID: 591bc8073b7527c6548f6b46590ad354ac19582be11b7a4383eb5d113895dd84
Opcode Fuzzy Hash: fcd21bc14236f586234e5bbfb4ffc63fc6dc396a3b7f26915f976692730b60d2
Instruction Fuzzy Hash: EC71DD7190421AFBDB20AF62DC85AFE7A78BB04344F10443BF505B3291CB785A41DBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00423E44 Relevance: 44.0, APIs: 19, Strings: 6, Instructions: 270stringfileregistryCOMMON

Download Yara Rule

APIs

RegOpenKeyA.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders,?), ref: 00423E9B
RegQueryValueExA.ADVAPI32(?,AppData,00000000,00000000,?,?,?,00000000), ref: 00423EC2
GetWindowsDirectoryA.KERNEL32(?,00000104,?,00000000), ref: 00423ED4
lstrcatA.KERNEL32(?,0043E0A4,?,00000000), ref: 00423EEC
lstrcatA.KERNEL32(?,00423384,?,00000000), ref: 00423EF8
lstrcatA.KERNEL32(?,\registry.dat,?,00000000), ref: 00423F06
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,?,00000000), ref: 00423F1F
CreateFileMappingA.KERNEL32(000000FF,00000000,00000002,00000000,00000000,00000000), ref: 00423F40
MapViewOfFile.KERNEL32(00423384,00000004,00000000,00000000,00000000,?,00000000), ref: 00423F60
GetFileSize.KERNEL32(000000FF,00000000,?,00000000), ref: 00423FAC
lstrcpyA.KERNEL32(?,-0000000F,?,?,00000000), ref: 00423FD7
lstrcpyA.KERNEL32(?,-0000000A,?,?,?,?,?,00000000), ref: 00424041
lstrcatA.KERNEL32(?,\prefs.js,?,?,?,?,?,00000000), ref: 00424053
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,?,?,?,?,?,00000000), ref: 0042406C
GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,?,00000000), ref: 004240B2
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,?,?,?,00000000), ref: 004240CF
CloseHandle.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 004240EC
CloseHandle.KERNEL32(00423384,?,?,?,?,?,00000000), ref: 00424126
CloseHandle.KERNEL32(000000FF,?,?,?,?,?,00000000), ref: 00424138

Strings

\prefs.js, xrefs: 0042404D
AppData, xrefs: 00423EBA
directory, xrefs: 00424004, 00424017
CurrentProfile, xrefs: 00423FB4
Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders, xrefs: 00423E8E
\registry.dat, xrefs: 00423F00

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: File$lstrcat$CloseCreateHandle$Sizelstrcpy$DirectoryMappingOpenQueryReadValueViewWindows
String ID: AppData$CurrentProfile$Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders$\prefs.js$\registry.dat$directory
API String ID: 4225840403-745957709
Opcode ID: f70e285609f500bae95e98eda7b2f4fdb7c36acb013bef8862f4a1613c5cb7e3
Instruction ID: 064391a36ea448469b03c0a591f8f9936e9841ba47d944dfdd070d3b5de728db
Opcode Fuzzy Hash: f70e285609f500bae95e98eda7b2f4fdb7c36acb013bef8862f4a1613c5cb7e3
Instruction Fuzzy Hash: 23916F71E00229BFDF20EFA0EC859AFBB78EB44354F51817AF505A2191DB785E84CB58

Uniqueness

Uniqueness Score: -1.00%

Function 004081C2 Relevance: 37.1, APIs: 12, Strings: 9, Instructions: 339COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004081C7
wsprintfA.USER32 ref: 00408261
GetLastError.KERNEL32(00000002,?,80400100,00000000,00000006,ftp://,00000000), ref: 00408320
GetLastError.KERNEL32 ref: 00408326

Strings

dwplayer, xrefs: 004082A2, 004082DF
8eC, xrefs: 004083CE
0eC, xrefs: 004083A6
http://, xrefs: 0040821F
8eC, xrefs: 0040839D
ftp://, xrefs: 00408234, 0040823C, 0040826B
0eC, xrefs: 004083D5
\oC, xrefs: 004083B3
Referer: %s, xrefs: 0040825B

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: ErrorLast$H_prologwsprintf
String ID: 0eC$0eC$8eC$8eC$Referer: %s$\oC$dwplayer$ftp://$http://
API String ID: 3576247870-2498556676
Opcode ID: 5d0402861afe60d3ad0ede806d5d12bec44354ec730297ead657a193d7db9cca
Instruction ID: e510ef79d1f02e9430cdd3cb24b78556f729ad1a154cba9d3d6cff2421bc11c6
Opcode Fuzzy Hash: 5d0402861afe60d3ad0ede806d5d12bec44354ec730297ead657a193d7db9cca
Instruction Fuzzy Hash: 93D1C271D00259EFDB10DFA8C9409AEBBB4BF48314F1481BEE495B7291DB389E05CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00421732 Relevance: 37.0, APIs: 14, Strings: 7, Instructions: 229windowlibraryloaderCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00421737
LoadLibraryA.KERNEL32(Shell32.dll,75C0FB50,00000000,00000000), ref: 0042174E
GetProcAddress.KERNEL32(00000000,ShellExecuteExA), ref: 00421761
MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 0042194D
PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 00421966
TranslateMessage.USER32(?), ref: 00421993
DispatchMessageA.USER32(?), ref: 004219A0
WaitForSingleObject.KERNEL32(?,00000000), ref: 004219AA
GetExitCodeProcess.KERNEL32(?,CCCCCCCC), ref: 004219BD
CloseHandle.KERNEL32(00000000), ref: 004219D9
CloseHandle.KERNEL32(?), ref: 004219DE
FreeLibrary.KERNEL32(00000001), ref: 004219EB

Strings

"%s" %s, xrefs: 004218A9
tdC, xrefs: 00421844
ShellExecuteExA, xrefs: 0042175B
@, xrefs: 004217CE
|dC, xrefs: 004218A3, 004218AE
<, xrefs: 004217A6
Shell32.dll, xrefs: 00421745

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: Message$CloseHandleLibraryWait$AddressCodeDispatchExitFreeH_prologLoadMultipleObjectObjectsPeekProcProcessSingleTranslate
String ID: "%s" %s$<$@$Shell32.dll$ShellExecuteExA$tdC$|dC
API String ID: 1278435167-3938510384
Opcode ID: f1ceaecd8a944bcaefdf358710b91d1ec2ede45b9c8b27247dc61d01933a9afa
Instruction ID: a5a5f66bac4d4b3ac5af2c1fb4324fa4fb12c354cd6b680e9c121f18d58b703f
Opcode Fuzzy Hash: f1ceaecd8a944bcaefdf358710b91d1ec2ede45b9c8b27247dc61d01933a9afa
Instruction Fuzzy Hash: 28916AB1D00229AFDF10DFA4DC84AEEBBB8FB18344F50456BE505A3261D7749A84CF69

Uniqueness

Uniqueness Score: -1.00%

Function 00406DC0 Relevance: 33.6, APIs: 10, Strings: 9, Instructions: 367stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004025BC: __EH_prolog.LIBCMT ref: 004025C1

lstrlenA.KERNEL32(000008AC,00442430,000008AC,00000400,000004AC,00000400,C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B}\Setup.INI,?,00000000,?), ref: 00406E52

Part of subcall function 0040729E: __EH_prolog.LIBCMT ref: 004072A3
Part of subcall function 0040729E: lstrcpyA.KERNEL32(00000000,?,00000001,0000044F,?,00000000,74DF0440,00000000), ref: 0040732D
Part of subcall function 0040729E: lstrcpyA.KERNEL32(00000000,?), ref: 00407353
Part of subcall function 0040729E: lstrcpyA.KERNEL32(000000AC,00000000), ref: 00407373
Part of subcall function 0040729E: lstrlenA.KERNEL32(-000000AC,74DF0440,00000000), ref: 004073AD

lstrlenA.KERNEL32(?,00442430,?,00000002,?,?,?,?,?,?,?,00000000,?), ref: 00406E93
lstrcmpiA.KERNEL32(?,0043D268), ref: 00406EC1
lstrlenA.KERNEL32(00000000,00442430,00000000,00000104,?,?,?,?,?,?,?,00000000,?), ref: 00406F1E
lstrcmpA.KERNEL32(00000000,0043D264,0043D264,00000000,00000104,?,?,?,?,?,?,?,00000000,?), ref: 00406F86
lstrcmpA.KERNEL32(00000000,0043D268,0043D268,00000000,00000104,?,?,?,?,?,?,?,00000000,?), ref: 0040700C

Part of subcall function 004025BC: lstrcpynA.KERNEL32(00429A4C,00000000,?,00000001,00000000,?,?,00000000,00000000,?,00000104,00000000), ref: 0040281A

lstrcmpA.KERNEL32(00000000,0043D260,?,?,?,?,?,?,?,00000000,?), ref: 00406FB6
ExpandEnvironmentStringsA.KERNEL32(000010B4,00000000,00000400,00442430,000010B4,00000400,00442430,0000006D,00000104,00442430,00000009,00000104), ref: 004070C6
lstrcpyA.KERNEL32(000010B4,00000000,?,?,?,?,?,?,?,00000000,?), ref: 004070D6
lstrlenA.KERNEL32(00002908,DotNetVersion,00442430,00002908,00000104,00442430,00002508,00000400,00442430,0000006D,00000104,00442430,00000009,00000104), ref: 0040717B

Strings

1.1, xrefs: 004071A9
1.0, xrefs: 0040718C
DotNetVersion, xrefs: 0040716A
C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B}\Setup.INI, xrefs: 00406DF6
v2.0, xrefs: 004071EE
DotNetSPRequired, xrefs: 00407232
2.0, xrefs: 004071DA
0$D, xrefs: 00406E02
v1.1, xrefs: 004071C6

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: lstrlen$lstrcpy$lstrcmp$H_prolog$EnvironmentExpandStringslstrcmpilstrcpyn
String ID: 0$D$1.0$1.1$2.0$C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B}\Setup.INI$DotNetSPRequired$DotNetVersion$v1.1$v2.0
API String ID: 2956953118-1671022694
Opcode ID: 4e6c55149ff915fe4b431e28f4f5ae7b87e3bf3fb9ff022769733ecff2b70d9e
Instruction ID: 28e4a24d26271d4a74ff82976d54feae223c9156777f12a8b0404819d02166cf
Opcode Fuzzy Hash: 4e6c55149ff915fe4b431e28f4f5ae7b87e3bf3fb9ff022769733ecff2b70d9e
Instruction Fuzzy Hash: 02D115B2A04209BEDB21DB60EC45FDB77BDAB48704F00447EF605A21D1D7B9AA44CB6D

Uniqueness

Uniqueness Score: -1.00%

Function 0040678A Relevance: 28.2, APIs: 14, Strings: 2, Instructions: 229threadinjectionprocessCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040678F

Part of subcall function 00402838: __EH_prolog.LIBCMT ref: 0040283D
Part of subcall function 00402838: GetLastError.KERNEL32(02151168,00000000,00000000,?,0041E413,?,00000000,removeasmajorupgrade,00000000,00000000,00000001,?,?,00000000,reboot,00000000), ref: 00402866
Part of subcall function 00402838: SetLastError.KERNEL32(?,00000000,?,0041E413,?,00000000,removeasmajorupgrade,00000000,00000000,00000001,?,?,00000000,reboot,00000000,00000000), ref: 00402894

Part of subcall function 00402D6A: lstrlenW.KERNEL32(004364D8,02151168,00000104,00000000,004364BC,?,0041E536,tempdisk1folder,?,00000000,00000000,?,00000001,?,00000000,removeasmajorupgrade), ref: 00402DBD
Part of subcall function 00402D6A: WideCharToMultiByte.KERNEL32(00000000,00000000,004364D8,000000FF,?,00000002,00000000,00000000,?,0041E536,tempdisk1folder,?,00000000,00000000,?,00000001), ref: 00402DE5

GetModuleFileNameA.KERNEL32(00000000,00000000,00000104,?,00000104,?,00000000,00000000,C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B},00000001), ref: 004067EB

Part of subcall function 004022FB: __EH_prolog.LIBCMT ref: 00402300
Part of subcall function 004022FB: GetLastError.KERNEL32(74DE8B60,00000104), ref: 0040232C
Part of subcall function 004022FB: SetLastError.KERNEL32(00000000,?,00000000,?,00000001), ref: 00402361

Part of subcall function 00402A71: __EH_prolog.LIBCMT ref: 00402A76

Part of subcall function 00403B2D: __EH_prolog.LIBCMT ref: 00403B32
Part of subcall function 00403B2D: GetLastError.KERNEL32(?,00000104,00000000,?,00402244,?,00000000,02151168,00000000), ref: 00403B5A
Part of subcall function 00403B2D: SetLastError.KERNEL32(?,?,00000000,00000000,?,00000104,00000000,?,00402244,?,00000000,02151168,00000000), ref: 00403BA7

Part of subcall function 00422056: __EH_prolog.LIBCMT ref: 0042205B
Part of subcall function 00422056: SearchPathA.KERNELBASE(00429A4C,00000000,00000000,00000104,00000000,00000000,?,?,00000104,?,00000000,?,00000000,00000000,?,004364B4), ref: 00422130

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000044,00000000,00000000,?,?), ref: 004068B5
GetCurrentProcess.KERNEL32(?,?,00000000,00000000,00000000), ref: 0040697A
GetCurrentProcess.KERNEL32(00000000), ref: 0040697D
DuplicateHandle.KERNEL32(00000000), ref: 00406980
GetThreadContext.KERNEL32(?,?), ref: 004069C3
VirtualProtectEx.KERNEL32(?,?,00000A2D,00000040,?), ref: 00406A00
WriteProcessMemory.KERNEL32(?,?,?,00000A2D,00000000), ref: 00406A13
FlushInstructionCache.KERNEL32(?,?,00000A2D), ref: 00406A1E
SetThreadContext.KERNEL32(?,00010003), ref: 00406A2E
ResumeThread.KERNEL32(?), ref: 00406A37
CloseHandle.KERNEL32(?), ref: 00406A46
CloseHandle.KERNEL32(?), ref: 00406A4B

Strings

C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B}, xrefs: 0040679B
explorer.exe, xrefs: 00406867

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: ErrorH_prologLast$Process$HandleThread$CloseContextCurrent$ByteCacheCharCreateDuplicateFileFlushInstructionMemoryModuleMultiNamePathProtectResumeSearchVirtualWideWritelstrlen
String ID: C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B}$explorer.exe
API String ID: 457729373-2485455447
Opcode ID: f9534dd13c3f27fc933d0dfc5216a17117f50ec172d798abf9c2874d6723b71a
Instruction ID: d6044563f04a3845ff0ec1f8b803b775efdff4d9149c7d699bab9e73d32bf60e
Opcode Fuzzy Hash: f9534dd13c3f27fc933d0dfc5216a17117f50ec172d798abf9c2874d6723b71a
Instruction Fuzzy Hash: DB916CB2D00118AFDB11EBA4CD45ADEBBB8EF09304F0180AAE909B7291DB755E44CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00409CF6 Relevance: 28.2, APIs: 10, Strings: 6, Instructions: 204libraryloaderfileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00409CFB
LoadLibraryA.KERNEL32(crypt32.dll,74DEF550,0043D348,00000000), ref: 00409D13
GetProcAddress.KERNEL32(00000000,CertCompareCertificate), ref: 00409D34
GetProcAddress.KERNEL32(?,CertAddSerializedElementToStore), ref: 00409D41
GetProcAddress.KERNEL32(?,CertFreeCertificateContext), ref: 00409D4E
MultiByteToWideChar.KERNEL32(00000001,00000000,?,000000FF,00000000,00000000,?,00000000), ref: 00409D9C

Part of subcall function 0040A013: SysStringLen.OLEAUT32(?), ref: 0040A021
Part of subcall function 0040A013: SysReAllocStringLen.OLEAUT32(?,?,?), ref: 0040A03D

MultiByteToWideChar.KERNEL32(00000001,00000000,?,000000FF,?,00000000,?,00000001), ref: 00409DCB

Part of subcall function 00409F70: __EH_prolog.LIBCMT ref: 00409F75
Part of subcall function 00409F70: GetLastError.KERNEL32(00000000,00000104), ref: 00409FA1
Part of subcall function 00409F70: SetLastError.KERNEL32(00000000,?,00000000,?,00000001), ref: 00409FD6

Part of subcall function 004016F0: lstrlenW.KERNEL32(00436494,74DF34C0,74DF2EE0,00000000,00000000,?,0041FD7B,?,?,00000001,?,80000000,00000003,00000000,00000003,00000080), ref: 00401743
Part of subcall function 004016F0: WideCharToMultiByte.KERNEL32(00000000,00000000,00436494,000000FF,?,00000002,00000000,00000000,?,0041FD7B,?,?,00000001,?,80000000,00000003), ref: 0040176B

CreateFileA.KERNEL32(00000000,80000000,00000000,00000000,00000003,00000080,00000000), ref: 00409DF1
GetFileSize.KERNEL32(00000000,00000000), ref: 00409E2C
ReadFile.KERNEL32(?,00000000,00000000,?,00000000,?), ref: 00409E53

Part of subcall function 00401581: __EH_prolog.LIBCMT ref: 00401586
Part of subcall function 00401581: GetLastError.KERNEL32(02151168,00000000,00000000,?,0041E199,?,00000000,reboot,00000000,00000000,00000000,runfromtemp,00000000,00000001,00000001,00000000), ref: 004015AF
Part of subcall function 00401581: SetLastError.KERNEL32(?,00000000,?,0041E199,?,00000000,reboot,00000000,00000000,00000000,runfromtemp,00000000,00000001,00000001,00000000), ref: 004015DD

Strings

CertFreeCertificateContext, xrefs: 00409D43
|dC, xrefs: 00409D75
crypt32.dll, xrefs: 00409D0B
CertAddSerializedElementToStore, xrefs: 00409D36
CertCompareCertificate, xrefs: 00409D2E
tdC, xrefs: 00409D7C

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: ErrorLast$AddressByteCharFileH_prologMultiProcWide$String$AllocCreateLibraryLoadReadSizelstrlen
String ID: CertAddSerializedElementToStore$CertCompareCertificate$CertFreeCertificateContext$crypt32.dll$tdC$|dC
API String ID: 27910590-961027101
Opcode ID: add25a106bd6e72a6b6188fc1b354213254e7fcc7fb3f8acc63a32bbae6aae41
Instruction ID: 1a2ae17bae69c4aadf284063c773f88c501ba5c50d09d70af2f1d06ce5cced6b
Opcode Fuzzy Hash: add25a106bd6e72a6b6188fc1b354213254e7fcc7fb3f8acc63a32bbae6aae41
Instruction Fuzzy Hash: EF715371D0414AEEDF11DFA5CC85AEEBBB8AB05314F14817AE111B32D2D7785E44CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00417673 Relevance: 28.2, APIs: 3, Strings: 13, Instructions: 164COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00417678
VariantChangeType.OLEAUT32(?,?,00000000,00000002), ref: 004176B8
VariantClear.OLEAUT32(?), ref: 0041787C

Strings

tdC, xrefs: 004176C6
{1C370964-514B-321C-7237-2B4FD86D8568}, xrefs: 004177F5, 00417805
{7E76A8D6-33D1-0032-16C3-4593092861D0}, xrefs: 004177BF
{E7E2C871-090A-C372-F9AE-C3C6A988D260}, xrefs: 00417786
{78705f0d-e8db-4b2d-8193-982bdda15ecd}, xrefs: 00417711
{021122EA-49DC-4aeb-9D15-DCEAD9BAB1BC}, xrefs: 004177EE
|dC, xrefs: 004176C1
4$D, xrefs: 00417800
{F1B13231-13BE-1231-5401-486BA763DEB6}, xrefs: 00417759
{6741C120-01BA-87F9-8734-5FB9DA8A4445}, xrefs: 0041772A
{F279058C-50B2-4BE4-60C9-369CACF06821}, xrefs: 0041771B
{9B29D757-088E-E8C9-2535-AA319B92C00A}, xrefs: 00417707
Software\Microsoft\Active Setup\Installed Components\%s, xrefs: 00417836

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: Variant$ChangeClearH_prologType
String ID: 4$D$Software\Microsoft\Active Setup\Installed Components\%s$tdC${021122EA-49DC-4aeb-9D15-DCEAD9BAB1BC}${1C370964-514B-321C-7237-2B4FD86D8568}${6741C120-01BA-87F9-8734-5FB9DA8A4445}${78705f0d-e8db-4b2d-8193-982bdda15ecd}${7E76A8D6-33D1-0032-16C3-4593092861D0}${9B29D757-088E-E8C9-2535-AA319B92C00A}${E7E2C871-090A-C372-F9AE-C3C6A988D260}${F1B13231-13BE-1231-5401-486BA763DEB6}${F279058C-50B2-4BE4-60C9-369CACF06821}$|dC
API String ID: 2549134154-4242822911
Opcode ID: 6eb1862402b596d47af675b65cab528a9f8a997a908a05bf0a1233106cb13291
Instruction ID: 4285387e50dc035f0646fada1e83cf06c99d8a568b60c95a607e00e43d563acb
Opcode Fuzzy Hash: 6eb1862402b596d47af675b65cab528a9f8a997a908a05bf0a1233106cb13291
Instruction Fuzzy Hash: A551D770D05148EADB14DBA5C954BEEBBB8EB18304F10806FE516B32C2D7386F45CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0041C446 Relevance: 26.4, APIs: 7, Strings: 8, Instructions: 152librarystringloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(msi.dll,?,?,00000000), ref: 0041C479
GetProcAddress.KERNEL32(00000000,MsiGetProductInfoA), ref: 0041C488
lstrcmpiA.KERNEL32(?,?), ref: 0041C4C2
MessageBoxA.USER32(00000000,?,?,00000024), ref: 0041C58B
FreeLibrary.KERNEL32(?,?,00000000), ref: 0041C60E

Strings

LATERVERSIONINSTALLED, xrefs: 0041C5AB
InstalledProductName, xrefs: 0041C532
2, xrefs: 0041C472
msi.dll, xrefs: 0041C46D
PackageCode, xrefs: 0041C4AA
MsiGetProductInfoA, xrefs: 0041C47F
VersionString, xrefs: 0041C4E8
ONUPGRADE, xrefs: 0041C546

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: Library$AddressFreeLoadMessageProclstrcmpi
String ID: 2$InstalledProductName$LATERVERSIONINSTALLED$MsiGetProductInfoA$ONUPGRADE$PackageCode$VersionString$msi.dll
API String ID: 4182792734-1382829369
Opcode ID: d16d14cd1a7d32673be0b351bd8138e0e1ef713b882002295f85dfd55c7ca0dd
Instruction ID: fbc1d78dae384902be125494ab0f59575b49889bf3c78ffbca3d9dc2b28bf623
Opcode Fuzzy Hash: d16d14cd1a7d32673be0b351bd8138e0e1ef713b882002295f85dfd55c7ca0dd
Instruction Fuzzy Hash: 495184B2944218BADF21DB90DCC5FEEB7BCAB04704F10546BF105E2181D779AA89CF58

Uniqueness

Uniqueness Score: -1.00%

Function 0041097F Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 139stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(PED,000003EE), ref: 00410999
GetWindowTextLengthA.USER32(00000000), ref: 004109AF
GetWindowTextA.USER32(00000000,00000409,0000007F), ref: 004109C4
GetDlgItem.USER32(?,000003EF), ref: 004109CE
GetWindowTextLengthA.USER32(00000000), ref: 004109DE
GetWindowTextA.USER32(00000000,00000409,0000007F), ref: 004109EF
GetDC.USER32(?), ref: 004109F4
lstrlenA.KERNEL32(00000409), ref: 00410A0B
ReleaseDC.USER32(?,00000000), ref: 00410A35
GetWindowRect.USER32(00000000,?), ref: 00410A61
GetWindowPlacement.USER32(?,?), ref: 00410AC0
MoveWindow.USER32(?,?,?,?,?,00000001), ref: 00410ADB
GetWindowPlacement.USER32(00000000,0000002C), ref: 00410AEB
MoveWindow.USER32(00000000,?,?,?,?,00000001), ref: 00410B04

Strings

PED, xrefs: 00410996

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: Window$Text$ItemLengthMovePlacement$RectReleaselstrlen
String ID: PED
API String ID: 164573090-1866647915
Opcode ID: f9cdbf7d14ed06865fd8a15cd3818a28bdf51e5ce09ddd8d5828627d7208a7e0
Instruction ID: 6e69f29222989c1f8b0177438d3dab89e518eea49ae9b7051f03af483fb62a21
Opcode Fuzzy Hash: f9cdbf7d14ed06865fd8a15cd3818a28bdf51e5ce09ddd8d5828627d7208a7e0
Instruction Fuzzy Hash: 34413B72D00219BFDF119FE8CC84AEEBBB9FF08344F15416AE904A7250D7B59A80CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00415E95 Relevance: 25.0, APIs: 7, Strings: 7, Instructions: 458windowCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00415E9A
SendMessageA.USER32(?,00000401,00000000,00000001), ref: 00415EF0

Part of subcall function 0042045D: wsprintfA.USER32 ref: 00420493
Part of subcall function 0042045D: wvsprintfA.USER32(?,?,?), ref: 004204AE

Strings

AM_AFFILIATE, xrefs: 00416023
x, xrefs: 00416471
ActiveMark.dat, xrefs: 00415F30
x, xrefs: 00416475
C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B}, xrefs: 004160FF
PfC, xrefs: 00416300
4$D, xrefs: 0041605B

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: H_prologMessageSendwsprintfwvsprintf
String ID: 4$D$AM_AFFILIATE$ActiveMark.dat$C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B}$PfC$x$x
API String ID: 483945354-3549740976
Opcode ID: 7c0ef4e7a2a310d543665fddbdc3f396e9a9c9b2cb1dac405e5868d2e854604d
Instruction ID: c52a9fb7bb47cef75847c84ff4e99dbd2a3aa7aaaaf1430522d10c105b230f7d
Opcode Fuzzy Hash: 7c0ef4e7a2a310d543665fddbdc3f396e9a9c9b2cb1dac405e5868d2e854604d
Instruction Fuzzy Hash: E602B671900259AFDB14DBA4CD85BEEB7B8AF14304F0044AEE505B7281DB789F88CF69

Uniqueness

Uniqueness Score: -1.00%

Function 00410B92 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 164windowstringCOMMON

Download Yara Rule

APIs

Part of subcall function 00421A02: __EH_prolog.LIBCMT ref: 00421A07
Part of subcall function 00421A02: lstrcpyA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B}\Setup.INI,?), ref: 00421A2B
Part of subcall function 00421A02: lstrcpyA.KERNEL32(?,0x0409), ref: 00421A36
Part of subcall function 00421A02: wsprintfA.USER32 ref: 00421A66
Part of subcall function 00421A02: lstrlenA.KERNEL32(?,?,?,00442430,?,?,?), ref: 00421AAA

lstrcmpiA.KERNEL32(?,?), ref: 00410C43
VerLanguageNameA.KERNEL32(?,?,0000007F,?,00000000,?), ref: 00410C68
lstrcmpiA.KERNEL32(?,?), ref: 00410C7B
lstrcpyA.KERNEL32(?,?,?,00000000,?), ref: 00410CA0
SendMessageA.USER32(00000000,00000143,00000000,?), ref: 00410CB8
SendMessageA.USER32(00000000,00000151,00000000,00000000), ref: 00410CD5
lstrcpyA.KERNEL32(?,Slovenian,?,00000000,?), ref: 00410D0D
lstrcpyA.KERNEL32(?,?,?,00000000,?), ref: 00410D2E
SendMessageA.USER32(00000000,00000143,00000000,?), ref: 00410D45
SendMessageA.USER32(00000000,00000151,00000000,00000000), ref: 00410D5E
SendMessageA.USER32(00000000,0000014C,00000000,?), ref: 00410D88
SendMessageA.USER32(00000000,0000014E,00000000,00000000), ref: 00410D9C

Strings

Slovenian, xrefs: 00410D01
Basque, xrefs: 00410CFA

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: MessageSend$lstrcpy$lstrcmpi$H_prologLanguageNamelstrlenwsprintf
String ID: Basque$Slovenian
API String ID: 834212799-3822051040
Opcode ID: 832fd459c8d6329f2b616d612a7d08b63e21cc4582897cb2e8b4f9f55e7ec06e
Instruction ID: 3ce16d0234114f6fd98d1ea34f7253e441f5d161255cfae75086df8a0cd83c33
Opcode Fuzzy Hash: 832fd459c8d6329f2b616d612a7d08b63e21cc4582897cb2e8b4f9f55e7ec06e
Instruction Fuzzy Hash: DB518E71900219AFDB11CFA4DC85BFA77B8FB49314F50426AF518D61A0E3B8AAC58F54

Uniqueness

Uniqueness Score: -1.00%

Function 004154DC Relevance: 24.6, APIs: 6, Strings: 8, Instructions: 133registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00420EF7: lstrcpyA.KERNEL32(?,00000000,?,00000000), ref: 00420F26
Part of subcall function 00420EF7: lstrcpyA.KERNEL32(?,?,?,00000000), ref: 00420F32

wsprintfA.USER32 ref: 00415537

Part of subcall function 00421000: lstrcpyA.KERNEL32(?,00000000,?,?,?,?,?,000000FF), ref: 0042104D
Part of subcall function 00421000: CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,?,?,?,?,?,?,?,000000FF), ref: 0042106A
Part of subcall function 00421000: MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 00421081
Part of subcall function 00421000: PeekMessageA.USER32(?,00000000,00000000,00000000,00000000), ref: 00421097
Part of subcall function 00421000: GetExitCodeProcess.KERNELBASE(?,00000001), ref: 004210B6
Part of subcall function 00421000: CloseHandle.KERNEL32(?,?,?,?,?,?,000000FF), ref: 004210C7

Part of subcall function 0040F736: RegOpenKeyExA.KERNELBASE(00000104,00000000,00000000,00000104,0041DD97,00000000,00000000,?,00421F70,80000002,System\CurrentControlSet\Control\Windows,00020019,00000000,00000000,?,00000104), ref: 0040F750
Part of subcall function 0040F736: RegCloseKey.ADVAPI32(?,?,00421F70,80000002,System\CurrentControlSet\Control\Windows,00020019,00000000,00000000,?,00000104,00000000,00000000,?,00000104,00000000,00000104), ref: 0040F761

wsprintfA.USER32 ref: 0041556C
RegQueryValueExA.ADVAPI32(00000000,InstallerLocation,00000000,00000000,?,?,80000002,Software\Microsoft\Windows\CurrentVersion\Installer,00020019,00000000,00000001), ref: 0041565F
SetCurrentDirectoryA.KERNEL32(?), ref: 0041566C
RegCloseKey.ADVAPI32(00000000,80000002,Software\Microsoft\Windows\CurrentVersion\Installer,00020019,00000000,00000001), ref: 0041567B

Strings

Software\Microsoft\Windows\CurrentVersion\Installer, xrefs: 0041560B
"%s" /q, xrefs: 00415531
/quiet /norestart, xrefs: 00415575, 004155B2
InstallerLocation, xrefs: 00415650
2.0.2600.0, xrefs: 00415518
/c:"msiinst /delayrebootq", xrefs: 00415591
"%s" /quiet /norestart, xrefs: 00415566
"%s" /c:"msiinst /delayrebootq", xrefs: 00415582

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: Closelstrcpy$Processwsprintf$CodeCreateCurrentDirectoryExitHandleMessageMultipleObjectsOpenPeekQueryValueWait
String ID: "%s" /c:"msiinst /delayrebootq"$"%s" /q$"%s" /quiet /norestart$/c:"msiinst /delayrebootq"$/quiet /norestart$2.0.2600.0$InstallerLocation$Software\Microsoft\Windows\CurrentVersion\Installer
API String ID: 1577088261-1617498336
Opcode ID: 9097d7722fd7ec3d5722bfb0d3bea209ad9bc6e1998939aaf4ec6ada52fdc715
Instruction ID: ee2141dd46d3b24f9f7fca2764aae0a6b727face05cde45719e9d909a98e4351
Opcode Fuzzy Hash: 9097d7722fd7ec3d5722bfb0d3bea209ad9bc6e1998939aaf4ec6ada52fdc715
Instruction Fuzzy Hash: 4E41D871A00215FBDF119B65DC49BDD3BA99F44304F10807BF545AA1D2DBBC8AC48B9D

Uniqueness

Uniqueness Score: -1.00%

Function 0041D808 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 117registrystringCOMMON

Download Yara Rule

APIs

lstrcpyA.KERNEL32(?,SetupBitmapCls,?,?,00000000), ref: 0041D81D
LoadCursorA.USER32(00000000,00007F00), ref: 0041D84E
GetClassInfoA.USER32(?,SetupBitmapCls,?), ref: 0041D86E
RegisterClassA.USER32(00000003), ref: 0041D87C
GetObjectA.GDI32(00000000,00000018,?), ref: 0041D8C6
GetSystemMetrics.USER32(00000000), ref: 0041D8D3
GetSystemMetrics.USER32(00000001), ref: 0041D8E2
CreateWindowExA.USER32(00000080,SetupBitmapCls,SetupBitmapWin,86000000,?,?,?,?,00000000,00000000,?,00000000), ref: 0041D91B
GetLastError.KERNEL32(?,00000000), ref: 0041D927
SetWindowLongA.USER32(00000000,00000000,00000000), ref: 0041D935
ShowWindow.USER32(00000000,00000005,?,00000000), ref: 0041D944
UpdateWindow.USER32(?), ref: 0041D950

Strings

SetupBitmapWin, xrefs: 0041D90C
SetupBitmapCls, xrefs: 0041D810, 0041D819, 0041D861, 0041D911

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: Window$ClassMetricsSystem$CreateCursorErrorInfoLastLoadLongObjectRegisterShowUpdatelstrcpy
String ID: SetupBitmapCls$SetupBitmapWin
API String ID: 2500980582-250169166
Opcode ID: 5a73854f7b7b2eb16eb1aa8299e7963443fd1834ec69544777c890795032b755
Instruction ID: 03adcb7b7334545641dc8c2f861d4baf02efc3f5cfc7b3d02b557173f8e856db
Opcode Fuzzy Hash: 5a73854f7b7b2eb16eb1aa8299e7963443fd1834ec69544777c890795032b755
Instruction Fuzzy Hash: E7411DB5A00605BFD714DFA5DD89BDEBBB8FB08300F10952AF609E6251D774A8408B68

Uniqueness

Uniqueness Score: -1.00%

Function 0041035B Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 108memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00410ED5: __EH_prolog.LIBCMT ref: 00410EDA

Part of subcall function 00410E40: __EH_prolog.LIBCMT ref: 00410E45

GlobalAlloc.KERNEL32(00000042,00000001,00444770,?,?,00000000,00000000,?,?,00410322,?,00000000,?,?,?,?), ref: 004103CF
GlobalLock.KERNEL32(00000000,?,?,00410322,?,00000000,?,?,?,?,?), ref: 004103D6

Strings

xGD, xrefs: 00410361

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: GlobalH_prolog$AllocLock
String ID: xGD
API String ID: 861400310-1797962929
Opcode ID: 1ceede24ddac4cbc76df8e10a897d8745e8f992436f5b1965118abc752188982
Instruction ID: d7dcfe272d038327ceb0a35ef24f1ae067e203113f989abb912cc915921f1e41
Opcode Fuzzy Hash: 1ceede24ddac4cbc76df8e10a897d8745e8f992436f5b1965118abc752188982
Instruction Fuzzy Hash: E4317675600215EFDB10AFB5EC44A9B3BA9EB8A3617524436F915C3260D778D8C1CB2C

Uniqueness

Uniqueness Score: -1.00%

Function 00401072 Relevance: 24.2, APIs: 16, Instructions: 152filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,?,?,00000000,?,?,?,00000000), ref: 00401090
GetFileSize.KERNEL32(00000000,?,?,00000000,?,?,?,00000000), ref: 004010AA
GlobalAlloc.KERNEL32(00000042,0000000A,?,00000000,?,?,?,00000000), ref: 004010B8
CloseHandle.KERNEL32(00000000,?,00000000,?,?,?,00000000), ref: 004010C6

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: File$AllocCloseCreateGlobalHandleSize
String ID:
API String ID: 2025735303-0
Opcode ID: d7f19996e4f572209dc80f7d6b4e55b37d92a17c9215315f30516a0a0e7abf6f
Instruction ID: d4c7a443f8fb40d079b90b9d6cba3231904a473565706b715bfdd1a7139a51b5
Opcode Fuzzy Hash: d7f19996e4f572209dc80f7d6b4e55b37d92a17c9215315f30516a0a0e7abf6f
Instruction Fuzzy Hash: 4351A171600205BBEB219F64DC09B5B7BA4EB09361F21C66AF656EA2F0C778D940CB5C

Uniqueness

Uniqueness Score: -1.00%

Function 0042388B Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 140stringregistryCOMMON

Download Yara Rule

APIs

RegOpenKeyA.ADVAPI32(80000001,SOFTWARE\Netscape\Netscape Navigator\Proxy Information,Z3B), ref: 004238E2
RegQueryValueExA.ADVAPI32(Z3B,Proxy Type,00000000,00000000,?,?), ref: 0042394E
RegQueryValueExA.ADVAPI32(00000001,0000003D,00000000,00000000,?,00000004), ref: 0042398E
lstrcatA.KERNEL32(?,0043F074), ref: 004239A9
lstrcatA.KERNEL32(?,?), ref: 004239B9
RegQueryValueExA.ADVAPI32(00000001,786F7250,00000000,00000000,?,00000100), ref: 004239D4
lstrcatA.KERNEL32(?,0043F00C), ref: 004239E6
lstrlenA.KERNEL32(?,0043DFB0,?), ref: 004239F7
wsprintfA.USER32 ref: 00423A05
lstrcatA.KERNEL32(?,0043DAC8), ref: 00423A1A

Strings

SOFTWARE\Netscape\Netscape Navigator\Proxy Information, xrefs: 004238D8
Proxy Type, xrefs: 00423900
Z3B, xrefs: 004238D1, 00423A67, 00423905, 004238D7

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: lstrcat$QueryValue$Openlstrlenwsprintf
String ID: Proxy Type$SOFTWARE\Netscape\Netscape Navigator\Proxy Information$Z3B
API String ID: 4042173901-2544801564
Opcode ID: 8cb46d8937ddc8c835bf3a3fe2ebbdfef7dd7219b1ca33fdf6c4e3c34022c062
Instruction ID: f12e638fd84184c193fa252f82b18c0cf175a507da21a95ff683e736c46fa01f
Opcode Fuzzy Hash: 8cb46d8937ddc8c835bf3a3fe2ebbdfef7dd7219b1ca33fdf6c4e3c34022c062
Instruction Fuzzy Hash: 6F512BB1E00229EBDF15CF94DC45BDEBBB8AF08304F1090A6E644B6251D7799B48CF98

Uniqueness

Uniqueness Score: -1.00%

Function 0040F986 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 107COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,000003E8), ref: 0040F99F
GetWindowRect.USER32(00000000,?), ref: 0040F9A8
GetSystemMetrics.USER32(00000001), ref: 0040F9B2
GetSystemMetrics.USER32(00000000), ref: 0040F9B6
SetRect.USER32(00000400,00000000,00000000,00000000), ref: 0040F9BF
FindWindowA.USER32(Shell_TrayWnd,00000000), ref: 0040F9F6
IsWindow.USER32(00000000), ref: 0040F9FF
GetWindowRect.USER32(00000000,?), ref: 0040FA15
IntersectRect.USER32(?,?,00000400), ref: 0040FA23
SubtractRect.USER32(00000400,?,?), ref: 0040FA3F
SetWindowPos.USER32(00000000,?,000003E8,0000001E,00000000,00000000,00000005,0000001E), ref: 0040FA7F

Strings

Shell_TrayWnd, xrefs: 0040F9F1
F, xrefs: 0040FA0C

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: RectWindow$MetricsSystem$FindIntersectSubtract
String ID: F$Shell_TrayWnd
API String ID: 301737298-1447713892
Opcode ID: fe6ff8c4712b69a9fdd0bf4f60218ac9525740fba9308a348f01eee37a1ec573
Instruction ID: d4245017ea7ccba689e50257c5bca597ec71994da8b28e86b9cdca5da92b7e14
Opcode Fuzzy Hash: fe6ff8c4712b69a9fdd0bf4f60218ac9525740fba9308a348f01eee37a1ec573
Instruction Fuzzy Hash: 4E31CBB2D00209AFDB10DFE8DD88EEFBBBDEB48715F158026E911B7250D674A9058F64

Uniqueness

Uniqueness Score: -1.00%

Function 0040A536 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 105COMMON

Download Yara Rule

APIs

DefWindowProcA.USER32(?,?,?,?), ref: 0040A561
GetWindowLongA.USER32(?,000000EB), ref: 0040A57A
BeginPaint.USER32(?,?), ref: 0040A58A
EndPaint.USER32(?,?), ref: 0040A5A9
GetWindowLongA.USER32(?,000000EB), ref: 0040A5B9
ctype.LIBCPMT ref: 0040A5CB
SetWindowLongA.USER32(?,000000EB,00000000), ref: 0040A5F0
GetClientRect.USER32(?,?), ref: 0040A600
ClientToScreen.USER32(?,?), ref: 0040A60D
__ftol.LIBCMT ref: 0040A62D
__ftol.LIBCMT ref: 0040A63C
SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,00000256), ref: 0040A64D

Strings

GIF, xrefs: 0040A653

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: Window$Long$ClientPaint__ftol$BeginProcRectScreenctype
String ID: GIF
API String ID: 1302359729-881873598
Opcode ID: 91bfdcbd1fec9f2448bd70e9dfedd2a130df28354c005f0ab24ed3982df5faeb
Instruction ID: 0b9c365b5d92b88b7683cc0d783e8b6bf6f499540459b0c4f5a57f3be30bdbb4
Opcode Fuzzy Hash: 91bfdcbd1fec9f2448bd70e9dfedd2a130df28354c005f0ab24ed3982df5faeb
Instruction Fuzzy Hash: 3031B03250420ABFCF015FA0DC09EAE3B79FF44720F158236F922A61F0CB7699219B59

Uniqueness

Uniqueness Score: -1.00%

Function 0041C679 Relevance: 22.8, APIs: 7, Strings: 6, Instructions: 66stringCOMMON

Download Yara Rule

APIs

lstrcpyA.KERNEL32(?,00442430,00000000,?,?), ref: 0041C693

Part of subcall function 0041C61C: lstrlenA.KERNEL32(?,?,?,?,?,?,0041C6AC,?,REINSTALL,?,?), ref: 0041C62D
Part of subcall function 0041C61C: lstrlenA.KERNEL32(?,?,?,?,?,?,0041C6AC,?,REINSTALL,?,?), ref: 0041C635

lstrcatA.KERNEL32(?, REINSTALL=ALL,?,REINSTALL,?,?), ref: 0041C6C2
lstrcatA.KERNEL32(?, REINSTALLMODE=vomus ,?,REINSTALLMODE,?,REINSTALL,?,?), ref: 0041C6E1
lstrcatA.KERNEL32(?, IS_MINOR_UPGRADE=1,?,IS_MINOR_UPGRADE,?,REINSTALLMODE,?,REINSTALL,?,?), ref: 0041C700
lstrlenA.KERNEL32(?,?,IS_MINOR_UPGRADE,?,REINSTALLMODE,?,REINSTALL,?,?), ref: 0041C709
lstrcatA.KERNEL32(?,0043DAC8,?,?), ref: 0041C719
lstrcatA.KERNEL32(?,?,?,?), ref: 0041C723

Strings

REINSTALLMODE, xrefs: 0041C6C4
IS_MINOR_UPGRADE, xrefs: 0041C6E3
REINSTALLMODE=vomus , xrefs: 0041C6DB
REINSTALL, xrefs: 0041C69F
IS_MINOR_UPGRADE=1, xrefs: 0041C6FA
REINSTALL=ALL, xrefs: 0041C6BC

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: lstrcat$lstrlen$lstrcpy
String ID: IS_MINOR_UPGRADE=1$ REINSTALL=ALL$ REINSTALLMODE=vomus $IS_MINOR_UPGRADE$REINSTALL$REINSTALLMODE
API String ID: 1797936820-1374138384
Opcode ID: 7a85afe8d238317717dcf21dc6f1eef201e624e85e1649add021e5016ab12d8e
Instruction ID: 7af558fb62973b3d3fba47726e6265c27888e5ddeab7907098ec436c15aaab4d
Opcode Fuzzy Hash: 7a85afe8d238317717dcf21dc6f1eef201e624e85e1649add021e5016ab12d8e
Instruction Fuzzy Hash: 6011E7F1B8021937EA10A6629DC6FEF77AD9B94745F001067B605D20C0E7BCD9858B58

Uniqueness

Uniqueness Score: -1.00%

Function 00407AE8 Relevance: 21.2, APIs: 14, Instructions: 154memorywindowfileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00407AED

Part of subcall function 00407CFF: lstrlenA.KERNEL32(?,?,00000000,00407B04,?,?,00000000), ref: 00407D08

CopyFileA.KERNEL32(?,?,00000000), ref: 00407B10
SysAllocStringLen.OLEAUT32(00000000,00000400), ref: 00407B4E
SysAllocStringLen.OLEAUT32(00000000,00000400), ref: 00407B5C
MultiByteToWideChar.KERNEL32(00000000,00000001,?,000000FF,?,00000400), ref: 00407B7B
MultiByteToWideChar.KERNEL32(00000000,00000001,?,000000FF,?,00000400), ref: 00407B90
CreateThread.KERNEL32(00000000,00000000,00407A9C,?,00000000,?), ref: 00407BD6
MsgWaitForMultipleObjects.USER32(00000001,00000000,00000000,000000FF,000000FF), ref: 00407BFA
PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 00407C11
DispatchMessageA.USER32(?), ref: 00407C33

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: AllocByteCharMessageMultiStringWide$CopyCreateDispatchFileH_prologMultipleObjectsPeekThreadWaitlstrlen
String ID:
API String ID: 3407787643-0
Opcode ID: 2ec77a9a0ad9080962d51deac1668ca0af4c7d8c1c654d47e5ec6e5a88a93a9f
Instruction ID: 92bcefd60bbebe537550c4c8f931e5ab2538df603c358cd932c0645a3959d07c
Opcode Fuzzy Hash: 2ec77a9a0ad9080962d51deac1668ca0af4c7d8c1c654d47e5ec6e5a88a93a9f
Instruction Fuzzy Hash: F651B171904205BFDB10AF71CC44EAB7BB9EF04364F10853AF519A61E1C7386A41CB68

Uniqueness

Uniqueness Score: -1.00%

Function 00409B6C Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 144libraryloaderCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00409B71
GetProcAddress.KERNEL32(00000000,WinVerifyTrust), ref: 00409B96
MultiByteToWideChar.KERNEL32(00000001,00000000,00000000,000000FF,00000000,00000000), ref: 00409BD7
MultiByteToWideChar.KERNEL32(00000001,00000000,00000000,000000FF,00000000,?), ref: 00409BFC
GetProcAddress.KERNEL32(?,WTHelperProvDataFromStateData), ref: 00409C66
GetProcAddress.KERNEL32(?,WTHelperGetProvSignerFromChain), ref: 00409C7E
GetProcAddress.KERNEL32(?,WTHelperGetProvCertFromChain), ref: 00409C9D

Part of subcall function 00409CF6: __EH_prolog.LIBCMT ref: 00409CFB
Part of subcall function 00409CF6: LoadLibraryA.KERNEL32(crypt32.dll,74DEF550,0043D348,00000000), ref: 00409D13
Part of subcall function 00409CF6: GetProcAddress.KERNEL32(00000000,CertCompareCertificate), ref: 00409D34
Part of subcall function 00409CF6: GetProcAddress.KERNEL32(?,CertAddSerializedElementToStore), ref: 00409D41
Part of subcall function 00409CF6: GetProcAddress.KERNEL32(?,CertFreeCertificateContext), ref: 00409D4E
Part of subcall function 00409CF6: MultiByteToWideChar.KERNEL32(00000001,00000000,?,000000FF,00000000,00000000,?,00000000), ref: 00409D9C
Part of subcall function 00409CF6: MultiByteToWideChar.KERNEL32(00000001,00000000,?,000000FF,?,00000000,?,00000001), ref: 00409DCB
Part of subcall function 00409CF6: CreateFileA.KERNEL32(00000000,80000000,00000000,00000000,00000003,00000080,00000000), ref: 00409DF1

Strings

WTHelperGetProvSignerFromChain, xrefs: 00409C77
WTHelperGetProvCertFromChain, xrefs: 00409C96
WTHelperProvDataFromStateData, xrefs: 00409C5F
WinVerifyTrust, xrefs: 00409B90
<, xrefs: 00409C38

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: AddressProc$ByteCharMultiWide$H_prolog$CreateFileLibraryLoad
String ID: <$WTHelperGetProvCertFromChain$WTHelperGetProvSignerFromChain$WTHelperProvDataFromStateData$WinVerifyTrust
API String ID: 3749893794-2103055557
Opcode ID: c5c0d6533726a04102a9b23130ce83cb7d8e6289a8ada864f646cc54a339605b
Instruction ID: bcd986192346ffdc428793df080cb70ad7b685c49c60d69ecb89292fa5f7fcc1
Opcode Fuzzy Hash: c5c0d6533726a04102a9b23130ce83cb7d8e6289a8ada864f646cc54a339605b
Instruction Fuzzy Hash: 0B5115B1D04218AEDB01DFA5DC85AEEBBB8FF08354F60412AF414B7292C7799E448B64

Uniqueness

Uniqueness Score: -1.00%

Function 00410768 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 137windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00411052: wsprintfA.USER32 ref: 00411064
Part of subcall function 00411052: CharNextA.USER32(?,Title), ref: 0041108E
Part of subcall function 00411052: CharNextA.USER32(00000000), ref: 00411091

SetWindowTextA.USER32(?,?), ref: 004107E0
GetDlgItem.USER32(?,00004E21), ref: 0041085D
GetWindowPlacement.USER32(00000000,?), ref: 00410871
DestroyWindow.USER32(00000000), ref: 00410888
GetDlgItem.USER32(?,000003ED), ref: 00410894
EndDialog.USER32(?,000000FD), ref: 004108B9
SendMessageA.USER32(00000000,00000146,00000000,00000000), ref: 004108F1
EndDialog.USER32(?,00000001), ref: 0041090B

Part of subcall function 00410B0B: GetWindowRect.USER32(00410919,?), ref: 00410B1B
Part of subcall function 00410B0B: GetParent.USER32(00410919), ref: 00410B30
Part of subcall function 00410B0B: GetSystemMetrics.USER32(00000000), ref: 00410B3B
Part of subcall function 00410B0B: GetSystemMetrics.USER32(00000001), ref: 00410B4C
Part of subcall function 00410B0B: MoveWindow.USER32(00410919,?,?,?,?,00000000,?,?,?,00410919,?), ref: 00410B84

Strings

Description, xrefs: 0041080C
Title, xrefs: 0041077E, 00410786, 004107B6, 004108CA
CANCEL, xrefs: 00410838
,, xrefs: 00410868

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: Window$CharDialogItemMetricsNextSystem$DestroyMessageMoveParentPlacementRectSendTextwsprintf
String ID: ,$CANCEL$Description$Title
API String ID: 3210215166-3913340754
Opcode ID: d3259cb76fb1d02c1798ea420f7a752d81d2e579bbfb8de50868e6d14f3e3cf2
Instruction ID: 8d9602453b0b63764edcac48bb1b6d6812f4e9e9f725ce4d8122e2141b72368d
Opcode Fuzzy Hash: d3259cb76fb1d02c1798ea420f7a752d81d2e579bbfb8de50868e6d14f3e3cf2
Instruction Fuzzy Hash: 2E41DA75A00250BFE7116BA5EC41FEB37ADEB86714F014036FA00E61A1E7BC99C18B6D

Uniqueness

Uniqueness Score: -1.00%

Function 00416767 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 86libraryloaderCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0041676C
LoadLibraryA.KERNEL32(Msi.DLL,00000001,?,?,?,?,?,?,?,?,00000000), ref: 0041677A
GetProcAddress.KERNEL32(00000000,MsiOpenDatabaseA), ref: 004167A3
GetProcAddress.KERNEL32(00000000,MsiGetSummaryInformationA), ref: 004167C2
GetProcAddress.KERNEL32(00000000,MsiCloseHandle), ref: 004167CC
GetProcAddress.KERNEL32(00000000,MsiSummaryInfoGetPropertyA), ref: 004167F4

Strings

MsiOpenDatabaseA, xrefs: 0041679D
H, xrefs: 004167ED
MsiGetSummaryInformationA, xrefs: 004167BC
Msi.DLL, xrefs: 00416775
MsiSummaryInfoGetPropertyA, xrefs: 004167E7
MsiCloseHandle, xrefs: 004167C4

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: AddressProc$H_prologLibraryLoad
String ID: H$Msi.DLL$MsiCloseHandle$MsiGetSummaryInformationA$MsiOpenDatabaseA$MsiSummaryInfoGetPropertyA
API String ID: 1497772292-2739935362
Opcode ID: 2f651fb38727d762c3b640cd8dba67f64d0a3f33deadb3e47f3eba0e194ffca7
Instruction ID: c8f092e18bceee43ae4e7dc7b184fc045c5df2a948df3a5b6d09f448fbc923ff
Opcode Fuzzy Hash: 2f651fb38727d762c3b640cd8dba67f64d0a3f33deadb3e47f3eba0e194ffca7
Instruction Fuzzy Hash: 02219F3190221ABADF11ABE9CC05FEFBFB8EF48740F11406AE504B1195D778DA41CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00411EC6 Relevance: 19.6, APIs: 2, Strings: 9, Instructions: 324timeCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00411ECB

Part of subcall function 0041146F: __EH_prolog.LIBCMT ref: 00411474

GetLocalTime.KERNEL32(?), ref: 00411F44

Part of subcall function 00403BC0: __EH_prolog.LIBCMT ref: 00403BC5
Part of subcall function 00403BC0: GetLastError.KERNEL32(004364B4,00000001,004364BC,?,00402B1E,?,?,00000000,?,00000000,00429A4C,FFFFFFFF,00000001,?,00000000), ref: 00403BEE
Part of subcall function 00403BC0: SetLastError.KERNEL32(?,00000000,00000000,00000000,?,00402B1E,?,?,00000000,?,00000000,00429A4C,FFFFFFFF,00000001,?,00000000), ref: 00403C43

Part of subcall function 00401CF2: __EH_prolog.LIBCMT ref: 00401CF7
Part of subcall function 00401CF2: GetLastError.KERNEL32(004364B4,00000004,?,0041EEC5,?,00000004,?,?,00000000,?,?,?,00000000,02151168,00000000,00000000), ref: 00401D1A
Part of subcall function 00401CF2: SysFreeString.OLEAUT32(?), ref: 00401D38
Part of subcall function 00401CF2: SetLastError.KERNEL32(?,00000001,?,0041EEC5,?,00000004,?,?,00000000,?,?,?,00000000,02151168,00000000,00000000), ref: 00401D58

Strings

AM_AFFILIATE, xrefs: 0041204A
AM_CONTENTID, xrefs: 004120E3
AM_TIMESTAMP, xrefs: 00411FB9
AM_INSTALLTIME=", xrefs: 00411FA1
AM_OTP, xrefs: 004120B0
%04d/%02d/%02d@%02d:%02d:%02d, xrefs: 00411F8A
AM_CURRENCY, xrefs: 00412017
AM_TRACKINGID, xrefs: 0041207D
AM_PRICE, xrefs: 00411FE6

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: ErrorH_prologLast$FreeLocalStringTime
String ID: AM_INSTALLTIME="$%04d/%02d/%02d@%02d:%02d:%02d$AM_AFFILIATE$AM_CONTENTID$AM_CURRENCY$AM_OTP$AM_PRICE$AM_TIMESTAMP$AM_TRACKINGID
API String ID: 1017348598-2762668861
Opcode ID: 960e46a9dc7e6e33f0bcf3d37b2d53b43d15717617e32126ecfa9569ba4acd88
Instruction ID: 0d79f04a64742c854f85855d8209aad0a7ec7cfab197170d65232ed9fb8364e3
Opcode Fuzzy Hash: 960e46a9dc7e6e33f0bcf3d37b2d53b43d15717617e32126ecfa9569ba4acd88
Instruction Fuzzy Hash: 11C154B1C0515CEADB11E7A5CD45BDEBBBCAF19308F04409AF809B3181EB785B489B76

Uniqueness

Uniqueness Score: -1.00%

Function 0041F28B Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 236fileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0041F290

Part of subcall function 004185A0: __EH_prolog.LIBCMT ref: 004185A5

GetFileAttributesA.KERNEL32(00000000,0000003B,?,02151168,00000000,00000000), ref: 0041F38B
GetTempPathA.KERNEL32(00000104,00000000,?,00000104,?,00000000), ref: 0041F3D5
GetTempFileNameA.KERNEL32(00000000,IS_,00000000,00000000,?,00000104), ref: 0041F417
GetModuleFileNameA.KERNEL32(?,00000104), ref: 0041F437

Part of subcall function 0040B6E0: __EH_prolog.LIBCMT ref: 0040B6E5
Part of subcall function 0040B6E0: GetLastError.KERNEL32(00436474,00000001,0043647C,?,0040AFA1,?,?,00000000,?,00000000,00429A4C,FFFFFFFF,00000001,?,00000000,00000001), ref: 0040B70E
Part of subcall function 0040B6E0: SetLastError.KERNEL32(?,00000000,00000000,00000000,?,0040AFA1,?,?,00000000,?,00000000,00429A4C,FFFFFFFF,00000001,?,00000000), ref: 0040B763

Part of subcall function 0040191F: GetLastError.KERNEL32(02151168,00000000,0041E21A,removeasmajorupgrade,00000000,00000000,00000001,?,?,00000000,reboot,00000000,00000000,00000000,runfromtemp,00000000), ref: 00401935
Part of subcall function 0040191F: SysFreeString.OLEAUT32(?), ref: 00401953
Part of subcall function 0040191F: SetLastError.KERNEL32(?,00000001,?,00000000), ref: 00401973

SysFreeString.OLEAUT32(?), ref: 0041F483
DeleteFileA.KERNEL32(00000000), ref: 0041F52C

Strings

|dC, xrefs: 0041F2D2
tdC, xrefs: 0041F2D7
IS_, xrefs: 0041F406
ISSetup.dll, xrefs: 0041F460

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: ErrorFileLast$H_prolog$FreeNameStringTemp$AttributesDeleteModulePath
String ID: ISSetup.dll$IS_$tdC$|dC
API String ID: 903564922-1606581975
Opcode ID: b920029b179334780e75f6fbc6b2676d59bd3e6b90dbb5bc2ff805ab3c6de96e
Instruction ID: a65717763d4b66b7593e0c0d6f96dc7f2a94b8980c342f2635d750f29b9be371
Opcode Fuzzy Hash: b920029b179334780e75f6fbc6b2676d59bd3e6b90dbb5bc2ff805ab3c6de96e
Instruction Fuzzy Hash: E7A18271C01259EFCF01EBA5C884ADDBBB9BF14304F5440AEE405B3292DB385A49CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00421A02 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 77stringCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00421A07
lstrcpyA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B}\Setup.INI,?), ref: 00421A2B
lstrcpyA.KERNEL32(?,0x0409), ref: 00421A36
lstrcpyA.KERNEL32(?,Languages,?), ref: 00421A53
wsprintfA.USER32 ref: 00421A66
lstrlenA.KERNEL32(?,?,?,00442430,?,?,?), ref: 00421AAA
VerLanguageNameA.KERNEL32(?,?,?), ref: 00421ACB

Strings

Languages, xrefs: 00421A4D
C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B}\Setup.INI, xrefs: 00421A25
0x0409, xrefs: 00421A30
%#04x, xrefs: 00421A60

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: lstrcpy$H_prologLanguageNamelstrlenwsprintf
String ID: %#04x$0x0409$C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B}\Setup.INI$Languages
API String ID: 4009380564-480087682
Opcode ID: 89e7def1cc253909c305adfd8685bc471602c5b9ad7831e71222790c310ab239
Instruction ID: efe459d2ee1a0a5bb05c94ddedc6aaf236c52ec94a0a20cbbb832f68767b1155
Opcode Fuzzy Hash: 89e7def1cc253909c305adfd8685bc471602c5b9ad7831e71222790c310ab239
Instruction Fuzzy Hash: 30215C72E01119BBCF01EFE0ED45BEDB778AF18304F50806BF911A6191D778AA48CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0040AB3B Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 191libraryloaderCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040AB40
GetProcAddress.KERNEL32(?,RunISMSISetup), ref: 0040AB5A
GetModuleFileNameA.KERNEL32(00000000,00000400,?,00000400,?,00000000,02151168,00000000), ref: 0040ABCE

Part of subcall function 0040191F: GetLastError.KERNEL32(02151168,00000000,0041E21A,removeasmajorupgrade,00000000,00000000,00000001,?,?,00000000,reboot,00000000,00000000,00000000,runfromtemp,00000000), ref: 00401935
Part of subcall function 0040191F: SysFreeString.OLEAUT32(?), ref: 00401953
Part of subcall function 0040191F: SetLastError.KERNEL32(?,00000001,?,00000000), ref: 00401973

Strings

ProductCode, xrefs: 0040ACD1
tdC, xrefs: 0040AB84
RunISMSISetup, xrefs: 0040AB51
4$D, xrefs: 0040AC03
setup.ini, xrefs: 0040ABE8, 0040AC0D
|dC, xrefs: 0040AB7F
Startup, xrefs: 0040ACD6

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: ErrorLast$AddressFileFreeH_prologModuleNameProcString
String ID: 4$D$ProductCode$RunISMSISetup$Startup$setup.ini$tdC$|dC
API String ID: 2162219923-1061493180
Opcode ID: 4ebda68ac808b7d463d11fe6e597bbea628e03cedd31aaa04ddf901241631caa
Instruction ID: e7c3e7625cfcb191eab71a37f070d79fea972b1d58ca764fe9aab2b69f523430
Opcode Fuzzy Hash: 4ebda68ac808b7d463d11fe6e597bbea628e03cedd31aaa04ddf901241631caa
Instruction Fuzzy Hash: 6A81A270D01149EEDB04EBA5C955BDEBB74AF14304F1080AEE509B32D2DB781F09CB69

Uniqueness

Uniqueness Score: -1.00%

Function 004302D6 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 177COMMON

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,00000100,00437228,00000001,00000000,00000000,74DEE860,00446CEC,?,?,?,0042AC67,?,?,?,00000000), ref: 00430318
LCMapStringA.KERNEL32(00000000,00000100,00437224,00000001,00000000,00000000,?,?,0042AC67,?,?,?,00000000,00000001), ref: 00430334
LCMapStringA.KERNEL32(?,?,?,0042AC67,?,?,74DEE860,00446CEC,?,?,?,0042AC67,?,?,?,00000000), ref: 0043037D
MultiByteToWideChar.KERNEL32(?,lD,?,0042AC67,00000000,00000000,74DEE860,00446CEC,?,?,?,0042AC67,?,?,?,00000000), ref: 004303B5
MultiByteToWideChar.KERNEL32(00000000,00000001,?,0042AC67,?,00000000,?,?,0042AC67,?), ref: 0043040D
LCMapStringW.KERNEL32(?,?,00000000,00000000,00000000,00000000,?,?,0042AC67,?), ref: 00430423
LCMapStringW.KERNEL32(?,?,?,00000000,?,?,?,?,0042AC67,?), ref: 00430456
LCMapStringW.KERNEL32(?,?,?,?,?,00000000,?,?,0042AC67,?), ref: 004304BE

Strings

lD, xrefs: 004303A6, 004303B1

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: String$ByteCharMultiWide
String ID: lD
API String ID: 352835431-1556624830
Opcode ID: 15148240ff874f905adc8f4693f494adc69a48beb72f8d7d9a7a7c510a0b7cd9
Instruction ID: 6e256766d49d2e70a394d71427fcc63910274e48857865b353ea10c3ed132248
Opcode Fuzzy Hash: 15148240ff874f905adc8f4693f494adc69a48beb72f8d7d9a7a7c510a0b7cd9
Instruction Fuzzy Hash: 17518F31500209FFDF229F54DC45A9F7FB4FB59B54F10922AF914A2261D33A8E10DB68

Uniqueness

Uniqueness Score: -1.00%

Function 0040F14C Relevance: 17.7, APIs: 4, Strings: 6, Instructions: 165COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040F151
CharNextA.USER32(?,?,?), ref: 0040F175
wsprintfA.USER32 ref: 0040F23E
CharNextA.USER32(00000000,?,?), ref: 0040F335

Strings

Languages, xrefs: 0040F1D0, 0040F1D6, 0040F282
key, xrefs: 0040F233
|dC, xrefs: 0040F198
count, xrefs: 0040F1B8
tdC, xrefs: 0040F19D
%s%d, xrefs: 0040F238

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: CharNext$H_prologwsprintf
String ID: %s%d$Languages$count$key$tdC$|dC
API String ID: 1310451597-395450139
Opcode ID: ce5c91c8d29a5833ce9770723932ab76c64a831b885768281e3542e6d29988e5
Instruction ID: c9576ae8c71d021be8c21733e53e21b96fcd66815fc44989bd1b0628bb37f4ef
Opcode Fuzzy Hash: ce5c91c8d29a5833ce9770723932ab76c64a831b885768281e3542e6d29988e5
Instruction Fuzzy Hash: FB615271D0025CEADB11DBA4CC51BDEB778AF18314F1040BAE509B72C2DB785B89CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0040EC6D Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 103registrystringCOMMON

Download Yara Rule

APIs

CharNextA.USER32(?,tempdisk1folder,?,00000000), ref: 0040EC8D
lstrcmpA.KERNEL32(00000000,%IS_T%,?,tempdisk1folder,?,00000000), ref: 0040EC9B
RegQueryValueExA.ADVAPI32(?,00000000,?,?,?,?,80000002,Software\Microsoft\Windows\CurrentVersion,000F003F,?,tempdisk1folder,?,00000000), ref: 0040ED0B
RegDeleteValueA.ADVAPI32(?,00000000,?,?,?,?,?,80000002,Software\Microsoft\Windows\CurrentVersion,000F003F,?,tempdisk1folder,?,00000000), ref: 0040ED24
RegCloseKey.ADVAPI32(?,?,?,?,?,80000002,Software\Microsoft\Windows\CurrentVersion,000F003F,?,tempdisk1folder,?,00000000), ref: 0040ED38
RegCloseKey.ADVAPI32(?,?,?,?,?,80000002,Software\Microsoft\Windows\CurrentVersion,000F003F,?,tempdisk1folder,?,00000000), ref: 0040ED48

Part of subcall function 0041C1B0: lstrlenA.KERNEL32(?,?,00000000,00000000,00406BEE,00000000,00000001,00000000,0000044F,00000000,?,?), ref: 0041C1BA
Part of subcall function 0041C1B0: lstrcpyA.KERNEL32(00000000,?,?,00000000,00000000,00406BEE,00000000,00000001,00000000,0000044F,00000000,?,?), ref: 0041C1D6
Part of subcall function 0041C1B0: lstrcpyA.KERNEL32(C:\Users\user\AppData\Local\Temp,?,?,00000000,00000000,00406BEE,00000000,00000001,00000000,0000044F,00000000,?,?), ref: 0041C1DE

Part of subcall function 0040F36B: __EH_prolog.LIBCMT ref: 0040F370

RegCloseKey.ADVAPI32(?,80000002,Software\Microsoft\Windows\CurrentVersion,000F003F,?,tempdisk1folder,?,00000000), ref: 0040ED7B

Strings

%IS_T%, xrefs: 0040EC95
Software\Microsoft\Windows\CurrentVersion, xrefs: 0040ECBB
tempdisk1folder, xrefs: 0040EC6D, 0040EC72, 0040EC7B

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: Close$Valuelstrcpy$CharDeleteH_prologNextQuerylstrcmplstrlen
String ID: %IS_T%$Software\Microsoft\Windows\CurrentVersion$tempdisk1folder
API String ID: 2302879836-2587550752
Opcode ID: e09d734024c7f58a9432d6aa39a75d5ad26672cda3ea65392ef9d2b2b8a95105
Instruction ID: 28c4b8f0c037b01678285ea8ef2dc077e56a535634d23eaa914cb641efa6de59
Opcode Fuzzy Hash: e09d734024c7f58a9432d6aa39a75d5ad26672cda3ea65392ef9d2b2b8a95105
Instruction Fuzzy Hash: 6331AB3190412AEFDB10DFA5CC86AEEBB78FF04344F10443BE516B62E1CB785A45CA98

Uniqueness

Uniqueness Score: -1.00%

Function 0040E6B6 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 81windowstringCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040E6BB

Part of subcall function 00406B7B: __EH_prolog.LIBCMT ref: 00406B80

lstrlenA.KERNEL32(?,00000452,?,EvalMarker.dat,?,?,?,00000000,00000000), ref: 0040E715
MessageBoxA.USER32(00000000,?,Evaluation,00000000), ref: 0040E748
MessageBoxA.USER32(00000000,This Setup was created with a BETA VERSION of InstallShield,Beta,00000000), ref: 0040E79C

Strings

BetaMarker.dat, xrefs: 0040E75F
This Setup was created with an EVALUATION VERSION of InstallShield, xrefs: 0040E71F, 0040E724, 0040E746
Evaluation, xrefs: 0040E741
EvalMarker.dat, xrefs: 0040E6C7
Beta, xrefs: 0040E795
This Setup was created with a BETA VERSION of InstallShield, xrefs: 0040E76D, 0040E772, 0040E79A

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: H_prologMessage$lstrlen
String ID: Beta$BetaMarker.dat$EvalMarker.dat$Evaluation$This Setup was created with a BETA VERSION of InstallShield$This Setup was created with an EVALUATION VERSION of InstallShield
API String ID: 462305206-698052042
Opcode ID: 0ad345bea54cc22e361a899b8be7b9ffc22e4646a86a914c0179659135432077
Instruction ID: 174bb80637deb6f7fa4484994e3b3dce9c50fb9d4f30f20d646532b5821cf6b7
Opcode Fuzzy Hash: 0ad345bea54cc22e361a899b8be7b9ffc22e4646a86a914c0179659135432077
Instruction Fuzzy Hash: CD21F735900611ABCB21A723AC46E6F7B74EB95369F10443FF402B31D2DB3C5951DA5D

Uniqueness

Uniqueness Score: -1.00%

Function 0042CC4B Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 170COMMON

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,00000100,00437228,00000001,00000000,00000000,02151168,00000002,00446CEC,?,?,?,00000000,02151168,00000000,00000000), ref: 0042CC8D
LCMapStringA.KERNEL32(00000000,00000100,00437224,00000001,00000000,00000000), ref: 0042CCA9
LCMapStringW.KERNEL32(00000000,02151168,00000000,?,?,?,02151168,00000002,00446CEC,?,?,?,00000000,02151168,00000000,00000000), ref: 0042CCF2
WideCharToMultiByte.KERNEL32(lD,00000220,00000000,?,00000000,00000000,00000000,00000000,02151168,00000002,00446CEC,?,?,?,00000000,02151168), ref: 0042CD25
WideCharToMultiByte.KERNEL32(?,00000220,?,?,?,?,00000000,00000000), ref: 0042CD7C
LCMapStringA.KERNEL32(?,00000000,?,?,00000000,00000000), ref: 0042CD98
LCMapStringA.KERNEL32(?,00000000,?,?,?,00000000), ref: 0042CDEE

Strings

lD, xrefs: 0042CD22

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: String$ByteCharMultiWide
String ID: lD
API String ID: 352835431-1556624830
Opcode ID: 10947a4315cbda0e18514c9823c4978a05e2c521beef97b5326c09aed9e2adea
Instruction ID: 376e36c80c75f2c16c76355f1e9c61357df4e1d8c537e338865f9a4f9a09e1d9
Opcode Fuzzy Hash: 10947a4315cbda0e18514c9823c4978a05e2c521beef97b5326c09aed9e2adea
Instruction Fuzzy Hash: BC517171A01229BBCF228F95EC85AEF7F75FF09790F514126F914A2260C3398851DBE9

Uniqueness

Uniqueness Score: -1.00%

Function 00424C7F Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 159stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00422B9D: LoadLibraryA.KERNEL32(wininet.dll,00000000,004087FF,?,00000000,?,00408A30,?,00000000,?,00000000,00000001,00000000), ref: 00422BB2
Part of subcall function 00422B9D: GetProcAddress.KERNEL32(00000000,InternetOpenA), ref: 00422BD2
Part of subcall function 00422B9D: GetProcAddress.KERNEL32(InternetOpenUrlA), ref: 00422BE4
Part of subcall function 00422B9D: GetProcAddress.KERNEL32(InternetConnectA), ref: 00422BF6
Part of subcall function 00422B9D: GetProcAddress.KERNEL32(InternetCrackUrlA), ref: 00422C08
Part of subcall function 00422B9D: GetProcAddress.KERNEL32(InternetCreateUrlA), ref: 00422C1A
Part of subcall function 00422B9D: GetProcAddress.KERNEL32(InternetCloseHandle), ref: 00422C2C
Part of subcall function 00422B9D: GetProcAddress.KERNEL32(InternetReadFile), ref: 00422C3E
Part of subcall function 00422B9D: GetProcAddress.KERNEL32(HttpQueryInfoA), ref: 00422C50
Part of subcall function 00422B9D: GetProcAddress.KERNEL32(FtpFindFirstFileA), ref: 00422C62
Part of subcall function 00422B9D: GetProcAddress.KERNEL32(InternetGetLastResponseInfoA), ref: 00422C74
Part of subcall function 00422B9D: GetProcAddress.KERNEL32(InternetSetOptionA), ref: 00422C86
Part of subcall function 00422B9D: GetProcAddress.KERNEL32(InternetGetConnectedState), ref: 00422C98
Part of subcall function 00422B9D: GetProcAddress.KERNEL32(InternetAutodial), ref: 00422CAA
Part of subcall function 00422B9D: GetProcAddress.KERNEL32(InternetErrorDlg), ref: 00422CBC
Part of subcall function 00422B9D: GetProcAddress.KERNEL32(HttpOpenRequestA), ref: 00422CCE
Part of subcall function 00422B9D: GetProcAddress.KERNEL32(HttpSendRequestA), ref: 00422CE0
Part of subcall function 00422B9D: GetProcAddress.KERNEL32(HttpSendRequestExA), ref: 00422CF2
Part of subcall function 00422B9D: GetProcAddress.KERNEL32(HttpEndRequestA), ref: 00422D04
Part of subcall function 00422B9D: GetProcAddress.KERNEL32(InternetQueryOptionA), ref: 00422D16
Part of subcall function 00422B9D: GetProcAddress.KERNEL32(InternetQueryDataAvailable), ref: 00422D28
Part of subcall function 00422B9D: GetProcAddress.KERNEL32(InternetCanonicalizeUrlA), ref: 00422D3A
Part of subcall function 00422B9D: GetProcAddress.KERNEL32(InternetGetCookieA), ref: 00422D4C

SetLastError.KERNEL32(00002EE6,?,00000000,00000001), ref: 00424CE8

Part of subcall function 00422F8E: SetLastError.KERNEL32(0000007F,00424EDF,?,00000000,00000000,0000003C,00000000,00000001,?,00424CB3,?,00000000,00000001), ref: 00422FA6

lstrcmpiA.KERNEL32(?,?), ref: 00424D6B
lstrlenA.KERNEL32(?,?,?,?,00000000,00000001), ref: 00424DB3
lstrcpyA.KERNEL32(00000000,?,?,?,?,00000000,00000001), ref: 00424DC7
lstrlenA.KERNEL32(?,?,00000000,00000001), ref: 00424DCC
lstrcpyA.KERNEL32(00000000,?), ref: 00424DE2
lstrcatA.KERNEL32(00000000,?), ref: 00424DEF

Part of subcall function 00422F12: SetLastError.KERNEL32(0000007F), ref: 00422F2D

Strings

<, xrefs: 00424C98
GET, xrefs: 00424E08

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: AddressProc$ErrorLast$lstrcpylstrlen$LibraryLoadlstrcatlstrcmpi
String ID: <$GET
API String ID: 4248792880-427699995
Opcode ID: c32312a18d096532504a5afd8db9bd4cb92938a4ea466f3586da94a484c2de63
Instruction ID: e5bf81f5f9c7f0e375d2428f5079ca003d3af87c6987d33dd811622813eec76d
Opcode Fuzzy Hash: c32312a18d096532504a5afd8db9bd4cb92938a4ea466f3586da94a484c2de63
Instruction Fuzzy Hash: D9519F31A00119BBDF11AF91EC05DEF7F79FF88340F95806AF904A6261DB398911DB68

Uniqueness

Uniqueness Score: -1.00%

Function 004126F3 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 129stringCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004126F8

Part of subcall function 004014FF: __EH_prolog.LIBCMT ref: 00401504
Part of subcall function 004014FF: SetLastError.KERNEL32(?,?,00000000,74DF2EE0,?,0041FD71,?,?,00000001,?,80000000,00000003,00000000,00000003,00000080,00000000), ref: 0040156A

Part of subcall function 004185A0: __EH_prolog.LIBCMT ref: 004185A5

Part of subcall function 004016F0: lstrlenW.KERNEL32(00436494,74DF34C0,74DF2EE0,00000000,00000000,?,0041FD7B,?,?,00000001,?,80000000,00000003,00000000,00000003,00000080), ref: 00401743
Part of subcall function 004016F0: WideCharToMultiByte.KERNEL32(00000000,00000000,00436494,000000FF,?,00000002,00000000,00000000,?,0041FD7B,?,?,00000001,?,80000000,00000003), ref: 0040176B

lstrcpyA.KERNEL32(?,00000000,0000002C,00000001,?,?,00000001,?,?,00000104), ref: 00412782
lstrcatA.KERNEL32(?,langpack.exe), ref: 004127A3
lstrcpyA.KERNEL32(?,00000000,?,?,00000001), ref: 004127DF
lstrcatA.KERNEL32(?,vjredist20-LP.exe), ref: 00412800

Strings

vjredist20-LP.exe, xrefs: 004127F4
langpack20.exe, xrefs: 00412797
langpack.exe, xrefs: 0041278A
vjredist-LP.exe, xrefs: 004127E7

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: H_prolog$lstrcatlstrcpy$ByteCharErrorLastMultiWidelstrlen
String ID: langpack.exe$langpack20.exe$vjredist-LP.exe$vjredist20-LP.exe
API String ID: 2742542527-1679877701
Opcode ID: dfccf15bcae58a16b87cf820757deec326fbbb829f4befe4f97f63145ba4e797
Instruction ID: c03bdd968159d096216765652edb841b77b8ff03bc41aeaf5de5c11247995220
Opcode Fuzzy Hash: dfccf15bcae58a16b87cf820757deec326fbbb829f4befe4f97f63145ba4e797
Instruction Fuzzy Hash: 68417D71D00219EBCF10EFE0CE95AEEB7B8BB08304F10416FE516A6281D6785A85CB68

Uniqueness

Uniqueness Score: -1.00%

Function 00413075 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 119registryCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0041307A
RegQueryValueExA.ADVAPI32(00000001,InstallerLocation,00000000,?,?,00000000,80000002,Software\Microsoft\Windows\CurrentVersion\Installer,00020019,DotNetDelayReboot,0043DDF0,?,00000010,1.1,00000000,00000000), ref: 004131C8
SetCurrentDirectoryA.KERNEL32(?), ref: 004131D5
RegCloseKey.ADVAPI32(00000001,Software\Microsoft\Windows\CurrentVersion\Installer,00020019,DotNetDelayReboot,0043DDF0,?,00000010,1.1,00000000,00000000), ref: 004131E4

Strings

Software\Microsoft\Windows\CurrentVersion\Installer, xrefs: 00413179
1.1, xrefs: 004130F0
DotNetDelayReboot, xrefs: 0041310F
InstallerLocation, xrefs: 004131BD
y, xrefs: 00413135

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: CloseCurrentDirectoryH_prologQueryValue
String ID: 1.1$DotNetDelayReboot$InstallerLocation$Software\Microsoft\Windows\CurrentVersion\Installer$y
API String ID: 455272628-1945290866
Opcode ID: 878855910c11b1544c15c98250b811ae8a34096ba8274cd72a5fc25f74179660
Instruction ID: 11ac3e5138769e8f1090a7277e45fbe3305010cb1e14b5202fde768caa64b3e8
Opcode Fuzzy Hash: 878855910c11b1544c15c98250b811ae8a34096ba8274cd72a5fc25f74179660
Instruction Fuzzy Hash: E2418071A00249BFEF11CF58D891AEE7BB4FB08305F10407BFA01A7251C7799A94CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00424B39 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 111stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0042311F: SetLastError.KERNEL32(0000007F,00424B50,00000000,00000000,?,00002F00,?,?,00424766,00000000,?,?,00000000,?,0041A519,00000001), ref: 00423137

GetLastError.KERNEL32(?,00002F00,?,?,00424766,00000000,?,?,00000000,?,0041A519,00000001,00000000,00000001), ref: 00424B6E
wsprintfA.USER32 ref: 00424BAB
lstrcatA.KERNEL32(004364BC,?,?,00002F00,?,?,00424766,00000000,?,?,00000000,?,0041A519,00000001,00000000,00000001), ref: 00424BC5
ResetEvent.KERNEL32(?,?,00002F00,?,?,00424766,00000000,?,?,00000000,?,0041A519,00000001,00000000,00000001,00000000), ref: 00424BD3
GetLastError.KERNEL32(?,00424766,00000000,?,?,00000000,?,0041A519,00000001,00000000,00000001,00000000,?,00411526,?,00000027), ref: 00424BFD

Part of subcall function 0042314C: SetLastError.KERNEL32(0000007F,00424B68,?,00000000,?,00002F00,?,?,00424766,00000000,?,?,00000000,?,0041A519,00000001), ref: 00423164

ResetEvent.KERNEL32(?,?,00002F00,?,?,00424766,00000000,?,?,00000000,?,0041A519,00000001,00000000,00000001,00000000), ref: 00424C4F

Strings

A, xrefs: 00424B56
Range: bytes=%d-, xrefs: 00424BA0
Range: bytes=%d-, xrefs: 00424B99

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: ErrorLast$EventReset$lstrcatwsprintf
String ID: A$Range: bytes=%d-$Range: bytes=%d-
API String ID: 4195990047-4039695729
Opcode ID: 39a0dbe9de1a7eaf4b3244032b1aab8701878bea00b110e44b4dd4bdf672082a
Instruction ID: 09b5bf4826b01f0cccc8fd67c626407b93c0eff6af646a9daecf2d2f54682e22
Opcode Fuzzy Hash: 39a0dbe9de1a7eaf4b3244032b1aab8701878bea00b110e44b4dd4bdf672082a
Instruction Fuzzy Hash: 9441A671201611EFD7219F69EC44F67BBE9EF45310F61866EF4AA832A0D735AC409B28

Uniqueness

Uniqueness Score: -1.00%

Function 0041AF5D Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 95COMMON

Download Yara Rule

APIs

GetDlgItemTextA.USER32(?,000003E8,?,00000064), ref: 0041AFA4
GetDlgItem.USER32(?,00000001), ref: 0041AFB3

Part of subcall function 0041AF1A: wsprintfA.USER32 ref: 0041AF38
Part of subcall function 0041AF1A: lstrcmpA.KERNEL32(?,?), ref: 0041AF49

EnableWindow.USER32(00000000,?), ref: 0041AFD3
EndDialog.USER32(?,00000002), ref: 0041AFE0
EndDialog.USER32(?,00000002), ref: 0041AFF6
GetDlgItem.USER32(?,00000001), ref: 0041B00F
EnableWindow.USER32(00000000,00000000), ref: 0041B068

Strings

Cancel, xrefs: 0041B028
Password, xrefs: 0041B04E

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: Item$DialogEnableWindow$Textlstrcmpwsprintf
String ID: Cancel$Password
API String ID: 2389365585-713941611
Opcode ID: f6544464789df71c6033baba51c7ad7fe1831004f0eb26f9919a20a7e1f74f14
Instruction ID: bfa5f413fb17d071a5f46a4c50abd9d321d0bd0d815be3b61d85d5e83ddf295d
Opcode Fuzzy Hash: f6544464789df71c6033baba51c7ad7fe1831004f0eb26f9919a20a7e1f74f14
Instruction Fuzzy Hash: 5D310B722112557BDB115F50DC06FEF3B69EB49740F004026FD05A62E2C7B8D992CB6D

Uniqueness

Uniqueness Score: -1.00%

Function 00408DFD Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00408E02
GetLastError.KERNEL32(?,00436F5C,00000000,?,004083E1), ref: 00408E2F
SetLastError.KERNEL32(?,?,00436F5C,00000000,?,004083E1), ref: 00408E69
SysStringLen.OLEAUT32(00000000), ref: 00408E77
SysAllocStringLen.OLEAUT32(00000000,00000000), ref: 00408E84
SetLastError.KERNEL32(00000000,?,00436F5C,00000000,?,004083E1), ref: 00408E96

Strings

@eC, xrefs: 00408E1D
HeC, xrefs: 00408E16
HeC, xrefs: 00408E98

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: ErrorLast$String$AllocH_prolog
String ID: @eC$HeC$HeC
API String ID: 1014970518-2250954990
Opcode ID: 96d443d9b383fd0f0197ca2dfd296a844ce707be455b6872f899f8485a0d7a4d
Instruction ID: 08d38075eaff4abbde2d6274fb32decf9952aeab011a607d772f4af9605d22ca
Opcode Fuzzy Hash: 96d443d9b383fd0f0197ca2dfd296a844ce707be455b6872f899f8485a0d7a4d
Instruction Fuzzy Hash: 59213371600602EFC720EF58E844A4AFBF4FF48719F12C4AEE4569B661C7B8E904CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00431BF8 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 50libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(user32.dll,?,00000000,00000000,0042FFBA,?,Microsoft Visual C++ Runtime Library,00012010,?,004374F0,?,00437540,?,?,?,Runtime Error!Program: ), ref: 00431C0A
GetProcAddress.KERNEL32(00000000,MessageBoxA), ref: 00431C22
GetProcAddress.KERNEL32(00000000,GetActiveWindow), ref: 00431C33
GetProcAddress.KERNEL32(00000000,GetLastActivePopup), ref: 00431C40

Strings

GetLastActivePopup, xrefs: 00431C35
GetActiveWindow, xrefs: 00431C2D
@uC, xrefs: 00431C66
MessageBoxA, xrefs: 00431C1C
user32.dll, xrefs: 00431C05

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: @uC$GetActiveWindow$GetLastActivePopup$MessageBoxA$user32.dll
API String ID: 2238633743-1671037227
Opcode ID: 8ec34cb2ca066ebb8bb96c2ad777df5e64e8d904378c65f0043e55f64c49521a
Instruction ID: 21eab27e6d0fbc1a81f9b046c308e3c963234c9d9a73d60ab7cc12cd4c47e425
Opcode Fuzzy Hash: 8ec34cb2ca066ebb8bb96c2ad777df5e64e8d904378c65f0043e55f64c49521a
Instruction Fuzzy Hash: CC014475744712AFDB11AFB59C849277EE8EA4E791B18343BA140C2232DF78C811DF68

Uniqueness

Uniqueness Score: -1.00%

Function 0041D960 Relevance: 15.1, APIs: 10, Instructions: 97windowCOMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,00000000), ref: 0041D96F
DefWindowProcA.USER32(?,00000002,?,?), ref: 0041D9A0
GetDC.USER32(?), ref: 0041D9BE
SelectPalette.GDI32(00000000,?,00000000), ref: 0041D9C8
RealizePalette.GDI32(00000000), ref: 0041D9CF
ReleaseDC.USER32(00000000,00000000), ref: 0041D9E2
GetDC.USER32(00000000), ref: 0041D9ED
ReleaseDC.USER32(00000000,00000000), ref: 0041DA09
BeginPaint.USER32(?,?), ref: 0041DA19
EndPaint.USER32(?,?), ref: 0041DA3C

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: PaintPaletteReleaseWindow$BeginLongProcRealizeSelect
String ID:
API String ID: 1992308970-0
Opcode ID: 0da43d5207372106877151cae9fbf2ffb43aa001c7fb7c11bf232281352f0581
Instruction ID: bfdc3f22ba41e9e1c8685eb7bff1e981e78ea3e0fdbf088c55b85e6da025c381
Opcode Fuzzy Hash: 0da43d5207372106877151cae9fbf2ffb43aa001c7fb7c11bf232281352f0581
Instruction Fuzzy Hash: C431B1B2800205BBCB22AFA5CC48EFF7BB9FF45740F05842AF90591160C739D8A1DB69

Uniqueness

Uniqueness Score: -1.00%

Function 0041240C Relevance: 15.1, APIs: 10, Instructions: 86stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004025BC: __EH_prolog.LIBCMT ref: 004025C1

lstrlenA.KERNEL32(00000000,?,00442430,00000000,00000104,00000000,00442430,00000104), ref: 0041246C
lstrlenA.KERNEL32(?), ref: 00412476
lstrlenA.KERNEL32(?), ref: 0041248B
lstrlenA.KERNEL32(?), ref: 00412492
lstrlenA.KERNEL32(?), ref: 00412499
lstrcatA.KERNEL32(?,0043DAC8), ref: 004124C6
lstrcatA.KERNEL32(?,?), ref: 004124CC
lstrcatA.KERNEL32(?,?), ref: 004124D7
lstrcatA.KERNEL32(?,00000000), ref: 004124E1
lstrcatA.KERNEL32(?,?), ref: 004124EC

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: lstrcatlstrlen$H_prolog
String ID:
API String ID: 1205604976-0
Opcode ID: f963466d844bf4471207eb7732be05a5ab68c4bc6b2dc4525a0ea6410a7068b8
Instruction ID: ea915357a62374a6a95c131a4529bea00cd78616248b9a70fdf1f109a28c8ef6
Opcode Fuzzy Hash: f963466d844bf4471207eb7732be05a5ab68c4bc6b2dc4525a0ea6410a7068b8
Instruction Fuzzy Hash: 2D219472A0021DBBDF219F61CD85AEF7FA9AB44350F04807BFA0496150D6B9D9A1CF94

Uniqueness

Uniqueness Score: -1.00%

Function 0040ED89 Relevance: 15.1, APIs: 8, Strings: 2, Instructions: 72stringCOMMON

Download Yara Rule

APIs

CharNextA.USER32 ref: 0040ED90
CharNextA.USER32 ref: 0040EDCE
CharNextA.USER32(00000000), ref: 0040EDD1

Part of subcall function 0041D453: __EH_prolog.LIBCMT ref: 0041D458

lstrcpyA.KERNEL32(?,00000000), ref: 0040EDE8
CharNextA.USER32 ref: 0040EDF4
CharNextA.USER32(00000000), ref: 0040EDF7
CharNextA.USER32 ref: 0040EE10
CharNextA.USER32(00000000), ref: 0040EE13

Strings

/uninst, xrefs: 0040EDC3
uninst, xrefs: 0040EDAC

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: CharNext$H_prologlstrcpy
String ID: /uninst$uninst
API String ID: 657457634-947040270
Opcode ID: a05118d561bc944db2f1da50549dd7d5aa8afbec9ff4090d27a816457bb8637f
Instruction ID: 2972e0ab8b37ab7594396d43717b7634baa6c8f9651d0474a8b37385abaa59e6
Opcode Fuzzy Hash: a05118d561bc944db2f1da50549dd7d5aa8afbec9ff4090d27a816457bb8637f
Instruction Fuzzy Hash: F31106B194411AAAC7289B1ADC49FFE2B69EF45344F14443FF006A62D0CB3C49839B5A

Uniqueness

Uniqueness Score: -1.00%

Function 00417117 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 277COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0041711C
wsprintfA.USER32 ref: 004171EE

Strings

UseDotNetUI, xrefs: 00417186
y, xrefs: 0041719F
1033, xrefs: 004173EF

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: H_prologwsprintf
String ID: 1033$UseDotNetUI$y
API String ID: 1529278910-1376376707
Opcode ID: ccd429ef1b61829d67e0ebd72d861fa61ae7a5d54f8bd66b2477628eea99efcd
Instruction ID: cac3ca5eb93155f9d7a9c716e82c3d0dda47a6cdb5e9a82197c00acc25662d01
Opcode Fuzzy Hash: ccd429ef1b61829d67e0ebd72d861fa61ae7a5d54f8bd66b2477628eea99efcd
Instruction Fuzzy Hash: E2B10471908249EFCF11DFA4CC91ADEBBB5AF05314F1080AFE815A7281DB385A84CB68

Uniqueness

Uniqueness Score: -1.00%

Function 0041D453 Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 224COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0041D458
wsprintfA.USER32 ref: 0041D54F

Part of subcall function 004014FF: __EH_prolog.LIBCMT ref: 00401504
Part of subcall function 004014FF: SetLastError.KERNEL32(?,?,00000000,74DF2EE0,?,0041FD71,?,?,00000001,?,80000000,00000003,00000000,00000003,00000080,00000000), ref: 0040156A

Part of subcall function 0040191F: GetLastError.KERNEL32(02151168,00000000,0041E21A,removeasmajorupgrade,00000000,00000000,00000001,?,?,00000000,reboot,00000000,00000000,00000000,runfromtemp,00000000), ref: 00401935
Part of subcall function 0040191F: SysFreeString.OLEAUT32(?), ref: 00401953
Part of subcall function 0040191F: SetLastError.KERNEL32(?,00000001,?,00000000), ref: 00401973

Strings

no_engine, xrefs: 0041D59B
%s%s, xrefs: 0041D543
%s, xrefs: 0041D574
auto, xrefs: 0041D5EE
%s"%s", xrefs: 0041D564

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: ErrorLast$H_prolog$FreeStringwsprintf
String ID: %s$ %s"%s"$ %s%s$auto$no_engine
API String ID: 596253847-2763530121
Opcode ID: 341c9457b32b4280d7b93e4715a7aca5bd9558db42e59976b9098523874ea40f
Instruction ID: f147aa08387fd41411ac16ccd33d434808ae542329e0ae0367a0f562add45bb1
Opcode Fuzzy Hash: 341c9457b32b4280d7b93e4715a7aca5bd9558db42e59976b9098523874ea40f
Instruction Fuzzy Hash: 1981F4B1D00249BAEF19DBA4CC51AEE7778AF15318F1080ABF545A71D2DB785F88CB24

Uniqueness

Uniqueness Score: -1.00%

Function 0041746C Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 162registryCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00417471

Part of subcall function 00401581: __EH_prolog.LIBCMT ref: 00401586
Part of subcall function 00401581: GetLastError.KERNEL32(02151168,00000000,00000000,?,0041E199,?,00000000,reboot,00000000,00000000,00000000,runfromtemp,00000000,00000001,00000001,00000000), ref: 004015AF
Part of subcall function 00401581: SetLastError.KERNEL32(?,00000000,?,0041E199,?,00000000,reboot,00000000,00000000,00000000,runfromtemp,00000000,00000001,00000001,00000000), ref: 004015DD

Part of subcall function 00417673: __EH_prolog.LIBCMT ref: 00417678
Part of subcall function 00417673: VariantChangeType.OLEAUT32(?,?,00000000,00000002), ref: 004176B8
Part of subcall function 00417673: VariantClear.OLEAUT32(?), ref: 0041787C

Part of subcall function 004016F0: lstrlenW.KERNEL32(00436494,74DF34C0,74DF2EE0,00000000,00000000,?,0041FD7B,?,?,00000001,?,80000000,00000003,00000000,00000003,00000080), ref: 00401743
Part of subcall function 004016F0: WideCharToMultiByte.KERNEL32(00000000,00000000,00436494,000000FF,?,00000002,00000000,00000000,?,0041FD7B,?,?,00000001,?,80000000,00000003), ref: 0040176B

RegOpenKeyExA.ADVAPI32(80000002,00000000,00000000,00020019,?,?,00000000,?,00000001,00000000), ref: 004174DB
RegQueryValueExA.ADVAPI32(?,Version,00000000,00000000,00000000,?,?), ref: 0041754A
RegCloseKey.ADVAPI32(00000000,?,00000000,?), ref: 0041765C

Part of subcall function 0040A6E5: RegCloseKey.ADVAPI32(?,00000000,00417945), ref: 0040A6F1

Part of subcall function 004014FF: __EH_prolog.LIBCMT ref: 00401504
Part of subcall function 004014FF: SetLastError.KERNEL32(?,?,00000000,74DF2EE0,?,0041FD71,?,?,00000001,?,80000000,00000003,00000000,00000003,00000080,00000000), ref: 0040156A

Part of subcall function 0040191F: GetLastError.KERNEL32(02151168,00000000,0041E21A,removeasmajorupgrade,00000000,00000000,00000001,?,?,00000000,reboot,00000000,00000000,00000000,runfromtemp,00000000), ref: 00401935
Part of subcall function 0040191F: SysFreeString.OLEAUT32(?), ref: 00401953
Part of subcall function 0040191F: SetLastError.KERNEL32(?,00000001,?,00000000), ref: 00401973

Strings

4$D, xrefs: 004175B5
|dC, xrefs: 0041748A
tdC, xrefs: 0041748F
Version, xrefs: 00417542

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: ErrorLast$H_prolog$CloseVariant$ByteChangeCharClearFreeMultiOpenQueryStringTypeValueWidelstrlen
String ID: 4$D$Version$tdC$|dC
API String ID: 2713112498-2054133192
Opcode ID: 4c65fccc77970071ee4fe3f7ea599cdd9ff6bc931580c4e9ec9bb3cfeedfe750
Instruction ID: 915e9142c7cb239fd9524e9a92c6e39ab87707ffe32ce7799bd3684a64c704a2
Opcode Fuzzy Hash: 4c65fccc77970071ee4fe3f7ea599cdd9ff6bc931580c4e9ec9bb3cfeedfe750
Instruction Fuzzy Hash: 1251CE71900209EFDB04DFA9C851BEEBBB9AF44304F10806EE509A7281DB786B49CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00424141 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 136stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0042430A: lstrlenA.KERNEL32(?,00000000,00424163,network.proxy.type,@B,?,00000000,?,004240E1,?,?,?,?,?,00000000), ref: 00424323

lstrcatA.KERNEL32(00000000,0043F074,0000003D,@B,00000001), ref: 00424222
lstrcatA.KERNEL32(?,0043F00C,786F7250,00000001,?), ref: 0042425B
lstrcatA.KERNEL32(?,0043DAC8,786F7250,00000001,?), ref: 0042427E
lstrcpynA.KERNEL32(00000000,@B,00000001,00000001,0000003D,@B,00000001), ref: 004242B3

Strings

"network.proxy.no_proxies_on", xrefs: 00424296
network.proxy.type, xrefs: 00424159
"network.proxy.autoconfig_url", xrefs: 004242FD
@B, xrefs: 00424153, 00424175, 004242EB, 004242F9, 00424209, 00424292, 004242AF, 0042422D, 00424156, 0042420C, 00424295, 004242FC

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: lstrcat$lstrcpynlstrlen
String ID: "network.proxy.autoconfig_url"$"network.proxy.no_proxies_on"$network.proxy.type$@B
API String ID: 4136844717-190983364
Opcode ID: e0c4ac43c4b46277f6b562b24e3fc7d256f9755b1ee729d5b2f877a454da777b
Instruction ID: 20023f5d623b393f4cb68cd24f7da78ca8b19f7854d705e1df1b5eeb00a89689
Opcode Fuzzy Hash: e0c4ac43c4b46277f6b562b24e3fc7d256f9755b1ee729d5b2f877a454da777b
Instruction Fuzzy Hash: 07515C75E0021DFADF11DF91DC40ADEBBB9FB48308F5050AAE940A2251D7799B48CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 0041B6B9 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0041B6BE

Part of subcall function 0041BA39: __EH_prolog.LIBCMT ref: 0041BA3E
Part of subcall function 0041BA39: GetLastError.KERNEL32(00000001,?,?,?,0041B6E2,?,00000001,?,?,?), ref: 0041BA6B
Part of subcall function 0041BA39: SetLastError.KERNEL32(00000000,?,?,?,0041B6E2,?,00000001,?,?,?), ref: 0041BAA5
Part of subcall function 0041BA39: SysStringLen.OLEAUT32(00000000), ref: 0041BAB3
Part of subcall function 0041BA39: SysAllocStringLen.OLEAUT32(00000000,00000000), ref: 0041BAC0
Part of subcall function 0041BA39: SetLastError.KERNEL32(00000000,?,?,?,0041B6E2,?,00000001,?,?,?), ref: 0041BAD2

wsprintfA.USER32 ref: 0041B73F
SysStringLen.OLEAUT32(?), ref: 0041B75A

Part of subcall function 0041B823: SysAllocStringLen.OLEAUT32(00000000,0041F03F), ref: 0041B84A

wsprintfA.USER32 ref: 0041B794
SysStringLen.OLEAUT32(?), ref: 0041B7AF
wsprintfA.USER32 ref: 0041B7CC
SysStringLen.OLEAUT32(?), ref: 0041B7E4

Strings

%d , xrefs: 0041B739, 0041B78E, 0041B7C6

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: String$ErrorLastwsprintf$AllocH_prolog
String ID: %d
API String ID: 3988536702-4214805362
Opcode ID: cab86b0701d023f160730affd2becc162d7c7750923996db2695c142bd69e5a8
Instruction ID: 375ffe97a8de69138e1c04830ba868a0b8a1022135d3c3a6a8137fa46a26c47a
Opcode Fuzzy Hash: cab86b0701d023f160730affd2becc162d7c7750923996db2695c142bd69e5a8
Instruction Fuzzy Hash: C1416F71D10119ABCF00EFA5DC50EEEB3B9FF88314F04442AF505A7180DB78AA44CB94

Uniqueness

Uniqueness Score: -1.00%

Function 004124F5 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 104windowstringCOMMON

Download Yara Rule

APIs

Part of subcall function 004204D4: wsprintfA.USER32 ref: 004204E6
Part of subcall function 004204D4: LoadStringA.USER32(?,?,?), ref: 00420511

wsprintfA.USER32 ref: 00412584
lstrcatA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004125CD
SendMessageA.USER32(00000000,00000401,00000000,00000001), ref: 004125E5
MessageBoxA.USER32(00000000,?,0000066E,00000024), ref: 004125F7
GetDlgItem.USER32(00000000,000003EA), ref: 0041260D
SendMessageA.USER32(00000000,0000000F,00000000,00000000), ref: 00412618
SendMessageA.USER32(00000000,00000401,00000000,00000000), ref: 00412620

Strings

1.1, xrefs: 0041250B

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: Message$Send$wsprintf$ItemLoadStringlstrcat
String ID: 1.1
API String ID: 4105038997-2150719395
Opcode ID: e658e4910b19a5c1e777deb51941b16261a3ebaae6e22e8a1ccb1ee607928032
Instruction ID: e4acebc9c418097169fe4d13fd225f0ce01c4f797424f5655351e1f41acc505d
Opcode Fuzzy Hash: e658e4910b19a5c1e777deb51941b16261a3ebaae6e22e8a1ccb1ee607928032
Instruction Fuzzy Hash: 23315BB2A0021CBFDB10DB98DD85ADEBBBDEB48304F0044B6F604E2251D675AF548F65

Uniqueness

Uniqueness Score: -1.00%

Function 00423266 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 101registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042341B: RegQueryValueA.ADVAPI32(80000000,.htm,?,00000000), ref: 00423447
Part of subcall function 0042341B: lstrcatA.KERNEL32(?,\shell\open\command,?,00000000), ref: 00423461
Part of subcall function 0042341B: RegQueryValueA.ADVAPI32(80000000,?,?,00000000), ref: 0042347D
Part of subcall function 0042341B: lstrlenA.KERNEL32(?,?,00000000), ref: 00423492
Part of subcall function 0042341B: CharLowerBuffA.USER32(?,00000000,?,00000000), ref: 004234A0
Part of subcall function 0042341B: lstrcpynA.KERNEL32(?,00000022,-0000000D,?,00000000), ref: 004234E0

RegOpenKeyA.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Internet Settings,00000000), ref: 0042329D
RegQueryValueExA.ADVAPI32(00000000,ProxyEnable,00000000,00000000,00000000,00000001), ref: 004232C7
RegQueryValueExA.ADVAPI32(00000000,AutoConfigURL,00000000,00000000,?,00000004), ref: 004232EC

Strings

Mozilla, xrefs: 00423371
Software\Microsoft\Windows\CurrentVersion\Internet Settings, xrefs: 00423293
Netscape, xrefs: 00423378
AutoConfigURL, xrefs: 004232E4
ProxyEnable, xrefs: 004232B8

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: QueryValue$BuffCharLowerOpenlstrcatlstrcpynlstrlen
String ID: AutoConfigURL$Mozilla$Netscape$ProxyEnable$Software\Microsoft\Windows\CurrentVersion\Internet Settings
API String ID: 1707546657-1830847130
Opcode ID: f5f14f72a4ec8829340d14d3faa90ff461394863ae8db8d4265612d790714b08
Instruction ID: 7a6f2478af135ae9a34d9cdf7373e2a56c0581671e217254cb856084546fd579
Opcode Fuzzy Hash: f5f14f72a4ec8829340d14d3faa90ff461394863ae8db8d4265612d790714b08
Instruction Fuzzy Hash: 3D316270B01229FADF10DF95D881AAEBA79EB04715F90806BF901A6240DB7C8F45DB69

Uniqueness

Uniqueness Score: -1.00%

Function 00415188 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 75stringregistryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.ADVAPI32(?,80000002,00000000,00000000,00000000,?,75A8EB20,80000002), ref: 004151D2
lstrcpyA.KERNEL32(?,00000000), ref: 004151FD
lstrcatA.KERNEL32(00000022," /%), ref: 00415215
lstrcatA.KERNEL32(00000022,00000000), ref: 00415233
lstrlenA.KERNEL32(00000022), ref: 0041523C
RegSetValueExA.ADVAPI32(?,80000002,00000000,00000001,00000022,00000001), ref: 00415254

Strings

", xrefs: 004151E2
" /%, xrefs: 0041520F

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: Valuelstrcat$Querylstrcpylstrlen
String ID: "$" /%
API String ID: 3753562477-2760458533
Opcode ID: b057cf4cf2c28fdd6ce877c5366f8ad59cfc0fd258069b04ed0efb3cd0318947
Instruction ID: 2e5d06eb1207e977dea86c9cefa3f1620da484600f571c4af460f35f49cd7ecf
Opcode Fuzzy Hash: b057cf4cf2c28fdd6ce877c5366f8ad59cfc0fd258069b04ed0efb3cd0318947
Instruction Fuzzy Hash: 0D21657694421DBBDF10DBA0CC49FDA777CEB58300F1045BAB605E3190DAB4AA848FA4

Uniqueness

Uniqueness Score: -1.00%

Function 00417EDD Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 74COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00417EE2
SysFreeString.OLEAUT32(?), ref: 00417F4A

Strings

.mst, xrefs: 00417F5D, 00417F6E
tdC, xrefs: 00417F01
|dC, xrefs: 00417F15
4$D, xrefs: 00417F0A
.mst", xrefs: 00417EEA, 00417F14
4$D, xrefs: 00417F69

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: FreeH_prologString
String ID: .mst$.mst"$4$D$4$D$tdC$|dC
API String ID: 2053926061-1066576936
Opcode ID: 0b2fd927f3906aa1ba47d863fc7fc3cbf77ad9938a83ce7fb4fe80413f01fa10
Instruction ID: 6be5e2ebd1017343dd79104aefd789f21ab5518799d5b762fa4aa5c4513a5e7b
Opcode Fuzzy Hash: 0b2fd927f3906aa1ba47d863fc7fc3cbf77ad9938a83ce7fb4fe80413f01fa10
Instruction Fuzzy Hash: 0221EB71A01109BBDF08EF99E8918EEB779EF58318F40802FF416A7261DB795A44CB58

Uniqueness

Uniqueness Score: -1.00%

Function 004247F1 Relevance: 13.7, APIs: 9, Instructions: 176COMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,00000000,?,?,?,00000000,00000000,000F4240,00000000,00000000,00000000,000003E8,00000000), ref: 0042485F
GetTickCount.KERNEL32 ref: 00424867
ResetEvent.KERNEL32(?), ref: 00424877
QueryPerformanceCounter.KERNEL32(?), ref: 004248CD
GetTickCount.KERNEL32 ref: 004248DB
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00424954
__allrem.LIBCMT ref: 00424972
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0042497C
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004249A2

Part of subcall function 00424A1A: GetTickCount.KERNEL32 ref: 00424A24
Part of subcall function 00424A1A: GetTickCount.KERNEL32 ref: 00424A75

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: CountTick$Unothrow_t@std@@@__ehfuncinfo$??2@$CounterPerformanceQuery$EventReset__allrem
String ID:
API String ID: 4096811595-0
Opcode ID: 0da5cc1cc80bbfc41651083552b9f29bf4a7cfaba8be55927174a7495424490e
Instruction ID: 21262dd447b2f7611e4046444e0be19227f51d49df166cc9555cd0b74b991195
Opcode Fuzzy Hash: 0da5cc1cc80bbfc41651083552b9f29bf4a7cfaba8be55927174a7495424490e
Instruction Fuzzy Hash: DF616C70F00755AFDB14DFA5D840BEEBBF6EF88314F40882EE55AA6240D7786940CB28

Uniqueness

Uniqueness Score: -1.00%

Function 00424507 Relevance: 13.6, APIs: 9, Instructions: 142stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004230BE: SetLastError.KERNEL32(0000007F,0042451C,?,0042445B,?,00000001,?,00411749,00000000,00000000,80400100,?,00000001,00000000,004114CD, fC), ref: 004230D6

lstrlenA.KERNEL32(00000000,?,00000000,?,00000001,?,00411749,00000000,00000000,80400100,?,00000001,00000000,004114CD, fC,80000000), ref: 0042456D
lstrcpyA.KERNEL32(00000000,00000000,?,00000001,?,00411749,00000000,00000000,80400100,?,00000001,00000000,004114CD, fC,80000000,00000001), ref: 0042457F
lstrlenA.KERNEL32(00000000,?,00000000,?,00000001,?,00411749,00000000,00000000,80400100,?,00000001,00000000,004114CD, fC,80000000), ref: 00424586
lstrlenA.KERNEL32(00000001,?,00000001,?,00411749,00000000,00000000,80400100,?,00000001,00000000,004114CD, fC,80000000,00000001,00000080), ref: 0042459C
GetLastError.KERNEL32(00000000,00000000,?,00000000,00000001,00000000), ref: 00424604

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: lstrlen$ErrorLast$lstrcpy
String ID:
API String ID: 2253992269-0
Opcode ID: 12ab8fb42d600d75f3380fdd5dda6c170927d4bad091db8cfb4316c3638e7385
Instruction ID: d07a77cdbab228363cb240115b62aae38f4709fa14c59cd4f469f0c165b21bfd
Opcode Fuzzy Hash: 12ab8fb42d600d75f3380fdd5dda6c170927d4bad091db8cfb4316c3638e7385
Instruction Fuzzy Hash: 2C41C0B1600356AFDB24DF74EC85BAB7BE9FF44314F50892BF55A87291D73898408B18

Uniqueness

Uniqueness Score: -1.00%

Function 0040121E Relevance: 13.6, APIs: 9, Instructions: 64windowmemoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000042,00000418,?,004011A9,00000000,?,00000000,?), ref: 00401226
GlobalLock.KERNEL32(00000000,?,00000000,00000000,?,004011A9,00000000,?,00000000,?), ref: 00401238
GetDC.USER32(00000000), ref: 0040126E
GetSystemPaletteEntries.GDI32(00000000,00000000,0000000A,00000004), ref: 00401285
GetSystemPaletteEntries.GDI32(00000000,000000F6,0000000A,000003DC), ref: 00401296
ReleaseDC.USER32(00000000,00000000), ref: 0040129B
CreatePalette.GDI32(00000000), ref: 004012AD
GlobalUnlock.KERNEL32(00000000,?,004011A9,00000000,?,00000000,?), ref: 004012B6
GlobalFree.KERNEL32(00000000), ref: 004012BD

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: Global$Palette$EntriesSystem$AllocCreateFreeLockReleaseUnlock
String ID:
API String ID: 685945034-0
Opcode ID: 8bc9eec6ebd7b93aff05518640aae4a61e4253bea5089f996bf9147cee307aea
Instruction ID: c462dd88e171b84da3c6110138fd989195606c93d1de056d12346dcf62724be3
Opcode Fuzzy Hash: 8bc9eec6ebd7b93aff05518640aae4a61e4253bea5089f996bf9147cee307aea
Instruction Fuzzy Hash: 201138361483417FE3219B60DC89FAB7BACDF55705F0680A9F64A973E1D5659404C335

Uniqueness

Uniqueness Score: -1.00%

Function 0041DA5C Relevance: 13.6, APIs: 9, Instructions: 63windowCOMMON

Download Yara Rule

APIs

SelectPalette.GDI32(?,?,00000000), ref: 0041DA8B
RealizePalette.GDI32(?), ref: 0041DA91
CreateCompatibleDC.GDI32(?), ref: 0041DA98
GetObjectA.GDI32(?,00000018,?), ref: 0041DAAA
SelectObject.GDI32(?,?), ref: 0041DAB6
BitBlt.GDI32(?,00000000,00000000,00000000,?,?,00000000,00000000,00CC0020), ref: 0041DACF
DeleteDC.GDI32(?), ref: 0041DAD8
SelectPalette.GDI32(?,?,00000000), ref: 0041DAE8
DrawIcon.USER32(?,00000000,00000000,?), ref: 0041DAF4

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: PaletteSelect$Object$CompatibleCreateDeleteDrawIconRealize
String ID:
API String ID: 2931627916-0
Opcode ID: 10b9373117f3e31c9d064284bb2fc54fd32d88a4981a117cbdbf22356883f881
Instruction ID: b139a7e2da0c0b36c65c4fabf49beb446df36b4ba5f869a5b15d015831f18801
Opcode Fuzzy Hash: 10b9373117f3e31c9d064284bb2fc54fd32d88a4981a117cbdbf22356883f881
Instruction Fuzzy Hash: 3B11047280121AFBCF22DFA1ED49CDF7F39FF09791B119026FA06A1121C6718960DBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00417B2E Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 202COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00417B33

Part of subcall function 004025BC: __EH_prolog.LIBCMT ref: 004025C1

Strings

J#Version, xrefs: 00417B72
|dC, xrefs: 00417CA2
SOFTWARE\Microsoft\Visual JSharp Setup\Redist, xrefs: 00417C51, 00417C5C, 00417CFF
1033, xrefs: 00417D2D
4$D, xrefs: 00417C97
tdC, xrefs: 00417C8C

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: H_prolog
String ID: 1033$4$D$J#Version$SOFTWARE\Microsoft\Visual JSharp Setup\Redist$tdC$|dC
API String ID: 3519838083-1452648423
Opcode ID: 2ecc820b7afe85ecbf23ecfd505d300de37fd4a2729dc08c3442fee0f1619cfc
Instruction ID: 507f60a1c8d1acf04fc414fd3ee7bb813defc09193c539cdf6c4bfb40f5e78bf
Opcode Fuzzy Hash: 2ecc820b7afe85ecbf23ecfd505d300de37fd4a2729dc08c3442fee0f1619cfc
Instruction Fuzzy Hash: 9771C271904149AFDF15DBE5C891EEEBB78EF58304F10416FE106B3281EB785A88CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0041EDDD Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 128memoryCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0041EDE2
SysAllocString.OLEAUT32(?), ref: 0041EEDC
SysStringLen.OLEAUT32(00000000), ref: 0041EEEF
SysFreeString.OLEAUT32(00000000), ref: 0041EEFA
SysFreeString.OLEAUT32(00000000), ref: 0041EF31

Strings

4$D, xrefs: 0041EE78
4$D, xrefs: 0041EE51

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: String$Free$AllocH_prolog
String ID: 4$D$4$D
API String ID: 1127608971-2087057052
Opcode ID: c2642d2fae8399ab63b718946cf69e794050db0791af315661d9020be6dc7fa7
Instruction ID: 3d2b11f786ca787b4de176111387608abff097190d59b0ab0c5b8c65f7e5023d
Opcode Fuzzy Hash: c2642d2fae8399ab63b718946cf69e794050db0791af315661d9020be6dc7fa7
Instruction Fuzzy Hash: 3741A275E0121AABCF14DFA5C585BEEBBB4EF05314F10802EEC56A7281D7389E46CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0041F108 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 121stringCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0041F10D
GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0043E954,?,00000000,00000000,?,00000001,?,02151168,00000104,00000000), ref: 0041F1B0
lstrcpyA.KERNEL32(C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B}\Setup.INI,?,?,0043E954,?,00000000,00000000,?,00000001,?,02151168,00000104,00000000), ref: 0041F200
lstrcmpiA.KERNEL32(00000000,0043D268), ref: 0041F250

Strings

CloneSetupExe, xrefs: 0041F232
C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B}\Setup.INI, xrefs: 0041F1E1, 0041F1E7, 0041F1FA, 0041F1FF, 0041F20C, 0041F20D
Startup, xrefs: 0041F237

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: FileH_prologModuleNamelstrcmpilstrcpy
String ID: C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B}\Setup.INI$CloneSetupExe$Startup
API String ID: 2980300312-689127531
Opcode ID: bd2d9b8e35c9d7189b1ab8260c62c3d03d8f9119637ea8d4dfc8428d6a48e61f
Instruction ID: a89940b1fbeadb2c987a7f51e3fe31fa5ffc74693225845d64b9db5208ac2148
Opcode Fuzzy Hash: bd2d9b8e35c9d7189b1ab8260c62c3d03d8f9119637ea8d4dfc8428d6a48e61f
Instruction Fuzzy Hash: 9E41E571901118ABDB15E7A5DC45FDEBBB8AF08314F1440ABF505721A2CB385F89CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0042FFE9 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

GetStringTypeW.KERNEL32(00000001,00437228,00000001,?,74DEE860,00446CEC,?,?,0042AC67,?,?,?,00000000,00000001), ref: 00430028
GetStringTypeA.KERNEL32(00000000,00000001,00437224,00000001,?,?,0042AC67,?,?,?,00000000,00000001), ref: 00430042
GetStringTypeA.KERNEL32(?,?,?,?,0042AC67,74DEE860,00446CEC,?,?,0042AC67,?,?,?,00000000,00000001), ref: 00430076
MultiByteToWideChar.KERNEL32(?,lD,?,?,00000000,00000000,74DEE860,00446CEC,?,?,0042AC67,?,?,?,00000000,00000001), ref: 004300AE
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,?,?,?,?,?,0042AC67,?), ref: 00430104
GetStringTypeW.KERNEL32(?,?,00000000,0042AC67,?,?,?,?,?,?,0042AC67,?), ref: 00430116

Strings

lD, xrefs: 0043009F, 004300AA

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: StringType$ByteCharMultiWide
String ID: lD
API String ID: 3852931651-1556624830
Opcode ID: 51d3e40623a425d674136ab744249708f43883cb35fda918782cca90f1336849
Instruction ID: 2dfb28a19e66197c57772416c2a478a3bc5ca65be8ea0a82ba3d8694f6c095c5
Opcode Fuzzy Hash: 51d3e40623a425d674136ab744249708f43883cb35fda918782cca90f1336849
Instruction Fuzzy Hash: 90419E72600219BFCF219F94DC86EAF3FB9FB09750F105626F911D2261C3398950CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0040729E Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 107stringCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004072A3

Part of subcall function 00407511: __EH_prolog.LIBCMT ref: 00407516

lstrlenA.KERNEL32(-000000AC,74DF0440,00000000), ref: 004073AD

Part of subcall function 004073CA: __EH_prolog.LIBCMT ref: 004073CF

lstrcpyA.KERNEL32(00000000,?,00000001,0000044F,?,00000000,74DF0440,00000000), ref: 0040732D
lstrcpyA.KERNEL32(00000000,?), ref: 00407353
lstrcpyA.KERNEL32(000000AC,00000000), ref: 00407373

Strings

dC, xrefs: 00407349
dC, xrefs: 00407323

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: H_prologlstrcpy$lstrlen
String ID: dC$dC
API String ID: 2247916824-1756646014
Opcode ID: 113a2c55f5c0c5f70213bf6f720e7aafed291e686b1e43b1f67bd22b7e8e065b
Instruction ID: 15d896c2d643a637115fc5ca65932bb7dcc3cdfe0e286399d3d3042cbd1b60ea
Opcode Fuzzy Hash: 113a2c55f5c0c5f70213bf6f720e7aafed291e686b1e43b1f67bd22b7e8e065b
Instruction Fuzzy Hash: 1B316472E00209AFDB11DBE8D841AEEB7B8AF08314F11857AE501F7291DB78AD05CB55

Uniqueness

Uniqueness Score: -1.00%

Function 0042FE96 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 100fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?), ref: 0042FF03
GetStdHandle.KERNEL32(000000F4,004374F0,00000000,00000000,00000000,?), ref: 0042FFD9
WriteFile.KERNEL32(00000000), ref: 0042FFE0

Strings

<program name unknown>, xrefs: 0042FF13
..., xrefs: 0042FF55
Runtime Error!Program: , xrefs: 0042FF69
Microsoft Visual C++ Runtime Library, xrefs: 0042FFAF

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: File$HandleModuleNameWrite
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
API String ID: 3784150691-4022980321
Opcode ID: 3b9472befc7386072387c046e42ec49b18069bc2f128433625e7c111241535b4
Instruction ID: c66a6413e8c4cfd58a430854b9b472ed05ac98c63e705f5e7f23127cc8217d76
Opcode Fuzzy Hash: 3b9472befc7386072387c046e42ec49b18069bc2f128433625e7c111241535b4
Instruction Fuzzy Hash: 2231D472B042286FDF20E660ED46F9A737CEF45354FE2007BF444D6151E678EA44CA59

Uniqueness

Uniqueness Score: -1.00%

Function 00421EBD Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 92registryCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00421EC2

Part of subcall function 00407585: __EH_prolog.LIBCMT ref: 0040758A
Part of subcall function 00407585: lstrcmpA.KERNEL32(?,00442430,?,?,00442430,?,?,?,Languages,00000000,?,0041CF62,Languages,count,00000000,?), ref: 004075B9

RegQueryValueExA.ADVAPI32(00000000,CSDVersion,00000000,?,00421DB7,?,80000002,System\CurrentControlSet\Control\Windows,00020019,00000000,00000000,?,00000104,00000000,00000000,?), ref: 00421F96
RegCloseKey.ADVAPI32(00000000), ref: 00421FA9

Part of subcall function 00420EF7: lstrcpyA.KERNEL32(?,00000000,?,00000000), ref: 00420F26
Part of subcall function 00420EF7: lstrcpyA.KERNEL32(?,?,?,00000000), ref: 00420F32

RegCloseKey.ADVAPI32(00000000,80000002,System\CurrentControlSet\Control\Windows,00020019,00000000,00000000,?,00000104,00000000,00000000,?,00000104,00000000,00000104,0041DD97), ref: 00421FBB

Strings

1.20.1827.0, xrefs: 00421F0E
System\CurrentControlSet\Control\Windows, xrefs: 00421F5B
CSDVersion, xrefs: 00421F84

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: CloseH_prologlstrcpy$QueryValuelstrcmp
String ID: 1.20.1827.0$CSDVersion$System\CurrentControlSet\Control\Windows
API String ID: 3027755910-2233653695
Opcode ID: 55c32de6158b0dfee1fa1e3cb8f14c770759b425f614ba7b1d958469c5aeb9b4
Instruction ID: 53d3e99c72cce47337b56cc7db271bd34d9af66ccb15d960aa7c6acd180265d4
Opcode Fuzzy Hash: 55c32de6158b0dfee1fa1e3cb8f14c770759b425f614ba7b1d958469c5aeb9b4
Instruction Fuzzy Hash: C8319E76A00128BFDF10EF51ED85AEE7BB8EB18354F51843BF915A6150C7388A44CB98

Uniqueness

Uniqueness Score: -1.00%

Function 004028AD Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004028B2
GetLastError.KERNEL32(74DEDFA0,?,00000000,?,00402197,?,00000000,?,00000001,?,0041D5AB,no_engine,?,00000001,?,?), ref: 004028DB
SetLastError.KERNEL32(00000001,00000000,?,00000000,?,00402197,?,00000000,?,00000001,?,0041D5AB,no_engine,?,00000001,?), ref: 0040290E
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,?,00000000,?,00402197,?,00000000,?,00000001,?,0041D5AB), ref: 0040292E
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,?,00000000,00000000,?,00000000,?,00402197,?,00000000,?,00000001), ref: 00402957
SetLastError.KERNEL32(?,?,00000000,?,00402197,?,00000000,?,00000001,?,0041D5AB,no_engine,?,00000001,?,?), ref: 00402965

Strings

0$D, xrefs: 0040291D

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: ErrorLast$ByteCharMultiWide$H_prolog
String ID: 0$D
API String ID: 2853668335-1534285997
Opcode ID: d0fc4a93c592226fc3f1cda8eb5a2f13d66bde67c84b61f82c90581a773f54d0
Instruction ID: 35c42428d3c5931a0ce8c331020286a555cf0713168e4d2f4fb5c040b0f60850
Opcode Fuzzy Hash: d0fc4a93c592226fc3f1cda8eb5a2f13d66bde67c84b61f82c90581a773f54d0
Instruction Fuzzy Hash: DB218BB5A00209FFCB109F59C98485ABBF9FF18304B01C56EF48997361C774E914CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 00418BA1 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00418BA6
GetLastError.KERNEL32(74DEDFA0,?,00000000,?,00418302,?,00000000,?,00000001,?,00414D5F,%IS_T%,?,00000001), ref: 00418BCF
SetLastError.KERNEL32(00000001,00000000,?,00000000,?,00418302,?,00000000,?,00000001,?,00414D5F,%IS_T%,?,00000001), ref: 00418C02
MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,00000000,?,00000000,?,00418302,?,00000000,?,00000001,?,00414D5F), ref: 00418C22
MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,?,00000003,00000000,?,00000000,?,00418302,?,00000000,?,00000001), ref: 00418C4B
SetLastError.KERNEL32(?,?,00000000,?,00418302,?,00000000,?,00000001,?,00414D5F,%IS_T%,?,00000001), ref: 00418C59

Strings

0$D, xrefs: 00418C11

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: ErrorLast$ByteCharMultiWide$H_prolog
String ID: 0$D
API String ID: 2853668335-1534285997
Opcode ID: 4640fc2359e376f618746b9ca91367ff6a5321ae4325cdbf764773f47810edcd
Instruction ID: 8ce4367c654559b5483e07eef8a6285b0690aff92648e1c4ad7e8c6ef91b2923
Opcode Fuzzy Hash: 4640fc2359e376f618746b9ca91367ff6a5321ae4325cdbf764773f47810edcd
Instruction Fuzzy Hash: 932169B560020AEFCB109F59D88489ABBF9FF58304B51C56EF58997221C775ED10CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 004110C4 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 56stringCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004110C9
lstrcpyA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B}\Setup.INI,Title), ref: 004110E8
lstrcatA.KERNEL32(?,.ini,?,C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B},?,Title), ref: 00411110

Strings

C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B}\Setup.INI, xrefs: 004110E2
Title, xrefs: 004110D4
C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B}, xrefs: 004110F9
.ini, xrefs: 0041110A

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: H_prologlstrcatlstrcpy
String ID: .ini$C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B}$C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B}\Setup.INI$Title
API String ID: 1260663600-3078348444
Opcode ID: bbf77ae7327c6b490c295908a09642af9129728c44eac269e7e38518952072c5
Instruction ID: 8c7d1b0b7a8bd9e9939fb0d6b9951b288bd2ec76323bc4c530e61154c1077396
Opcode Fuzzy Hash: bbf77ae7327c6b490c295908a09642af9129728c44eac269e7e38518952072c5
Instruction Fuzzy Hash: B511BB31D0021AABCF19EFA4DD06ADDB778AB08314F10816BF621B21D1D7785B49CB18

Uniqueness

Uniqueness Score: -1.00%

Function 0042FB6F Relevance: 12.1, APIs: 8, Instructions: 132COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(?,00000000,?,?,?,?,00429A02), ref: 0042FB8A
GetEnvironmentStrings.KERNEL32(?,00000000,?,?,?,?,00429A02), ref: 0042FB9E
GetEnvironmentStringsW.KERNEL32(?,00000000,?,?,?,?,00429A02), ref: 0042FBCA
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,?,00000000,?,?,?,?,00429A02), ref: 0042FC02
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,?,?,00429A02), ref: 0042FC24
FreeEnvironmentStringsW.KERNEL32(00000000,?,00000000,?,?,?,?,00429A02), ref: 0042FC3D
GetEnvironmentStrings.KERNEL32(?,00000000,?,?,?,?,00429A02), ref: 0042FC50
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 0042FC8E

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: EnvironmentStrings$ByteCharFreeMultiWide
String ID:
API String ID: 1823725401-0
Opcode ID: ae4d662e5c75eee8dc112f59d349ea7feae464c48c879cdc3f6fb283f5ab0f3a
Instruction ID: 954bca5228a5187615d53452eb4e7d76622d962b70fbdac5bcf230e3523cde91
Opcode Fuzzy Hash: ae4d662e5c75eee8dc112f59d349ea7feae464c48c879cdc3f6fb283f5ab0f3a
Instruction Fuzzy Hash: E531D47270823A6FDB207F76BC8483FBAACF649354BD5053BF952C3201D6295C49826D

Uniqueness

Uniqueness Score: -1.00%

Function 0040C523 Relevance: 12.1, APIs: 8, Instructions: 61memoryfileCOMMON

Download Yara Rule

APIs

GetFileSize.KERNEL32(?,00000000,00000000,?,00000000,?,0040BC04,000000FF,?,?,00000000,000000FF,?,0043647C,?,00000000), ref: 0040C531
GetProcessHeap.KERNEL32(00000008,00000001,?,0040BC04,000000FF,?,?,00000000,000000FF,?), ref: 0040C550
HeapAlloc.KERNEL32(00000000,?,0040BC04,000000FF,?,?,00000000,000000FF,?), ref: 0040C553
ReadFile.KERNEL32(?,00000000,00000000,00000000,00000000,?,0040BC04,000000FF,?,?,00000000,000000FF,?), ref: 0040C571
GetProcessHeap.KERNEL32(00000000,00000000,00000000,00000000,?,0040BC04,000000FF,?,?,00000000,000000FF,?), ref: 0040C58F
HeapFree.KERNEL32(00000000,?,0040BC04,000000FF,?,?,00000000,000000FF,?), ref: 0040C592
GetProcessHeap.KERNEL32(00000000,00000000,?,0040BC04,000000FF,?,?,00000000,000000FF,?), ref: 0040C59E
HeapFree.KERNEL32(00000000,?,0040BC04,000000FF,?,?,00000000,000000FF,?), ref: 0040C5A1

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: Heap$Process$FileFree$AllocReadSize
String ID:
API String ID: 2832363368-0
Opcode ID: 6ed61d71266a004e6a533ff474d82ab097a5b7f351ba9305b5ab28a5985825ab
Instruction ID: 06fa46f43ff267aabce37f56437d11471b99db133dfde0e74e39182567da5c46
Opcode Fuzzy Hash: 6ed61d71266a004e6a533ff474d82ab097a5b7f351ba9305b5ab28a5985825ab
Instruction Fuzzy Hash: 5F118275604215BFDB10AFA5DC8CF6B3BACEF89765F018166F908CB190CA78A800CB74

Uniqueness

Uniqueness Score: -1.00%

Function 0040A943 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 155libraryloaderCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040A948
GetProcAddress.KERNEL32(?,RunISMSISetup), ref: 0040A9A1
GetModuleFileNameA.KERNEL32(00000000,00000400,?,00000400,?,00000000), ref: 0040AA0F

Part of subcall function 004014FF: __EH_prolog.LIBCMT ref: 00401504
Part of subcall function 004014FF: SetLastError.KERNEL32(?,?,00000000,74DF2EE0,?,0041FD71,?,?,00000001,?,80000000,00000003,00000000,00000003,00000080,00000000), ref: 0040156A

Strings

RunISMSISetup, xrefs: 0040A998
4$D, xrefs: 0040AA45
setup.exe, xrefs: 0040AA2C, 0040AA50

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: H_prolog$AddressErrorFileLastModuleNameProc
String ID: 4$D$RunISMSISetup$setup.exe
API String ID: 1604914643-1466735366
Opcode ID: 52817e1dcd90709053b4d1cb4811d67c0b9c9ceb00c7aecf14031e4dce73537e
Instruction ID: 5469a2c063578844b4b7d05540d3649eb9990aca4bb756e0676d97dd3d26f3db
Opcode Fuzzy Hash: 52817e1dcd90709053b4d1cb4811d67c0b9c9ceb00c7aecf14031e4dce73537e
Instruction Fuzzy Hash: 7A519F70A00208EFCB10DFA5C849AEEBBB8AF48304F14856EE555B72D1DB789A44CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0040AEF4 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 147COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040AEF9

Part of subcall function 0040B64D: __EH_prolog.LIBCMT ref: 0040B652
Part of subcall function 0040B64D: GetLastError.KERNEL32(00436474,?,0043647C,?,0040AF26,?,00000000,00000001,?,00000000), ref: 0040B67A
Part of subcall function 0040B64D: SetLastError.KERNEL32(?,?,00000000,00000000,?,0043647C,?,0040AF26,?,00000000,00000001,?,00000000), ref: 0040B6C7

Part of subcall function 0040191F: GetLastError.KERNEL32(02151168,00000000,0041E21A,removeasmajorupgrade,00000000,00000000,00000001,?,?,00000000,reboot,00000000,00000000,00000000,runfromtemp,00000000), ref: 00401935
Part of subcall function 0040191F: SysFreeString.OLEAUT32(?), ref: 00401953
Part of subcall function 0040191F: SetLastError.KERNEL32(?,00000001,?,00000000), ref: 00401973

Strings

4$D, xrefs: 0040AF55
|dC, xrefs: 0040AF0D
\, xrefs: 0040AF3A
4$D, xrefs: 0040AF8A
tdC, xrefs: 0040AF12

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: ErrorLast$H_prolog$FreeString
String ID: 4$D$4$D$\$tdC$|dC
API String ID: 3800368667-3375390684
Opcode ID: 681bf7a4699b099a9ba24561477914b92e92791bfef7f50c30ddbd32f969715c
Instruction ID: 72ed7d0abf4185fd2adb02b117cad9902d2359448163417ff8d85423e648fa1e
Opcode Fuzzy Hash: 681bf7a4699b099a9ba24561477914b92e92791bfef7f50c30ddbd32f969715c
Instruction Fuzzy Hash: 52516071D0024DDADB14EBA5C955BEEB7B8EF14304F10406FA516B72C1DB782B09CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 004178F9 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 127registryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004178FE
RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00020019,?,00000000), ref: 0041792F
RegCloseKey.ADVAPI32(?), ref: 00417A6E

Part of subcall function 0040A6E5: RegCloseKey.ADVAPI32(?,00000000,00417945), ref: 0040A6F1

Part of subcall function 00401581: __EH_prolog.LIBCMT ref: 00401586
Part of subcall function 00401581: GetLastError.KERNEL32(02151168,00000000,00000000,?,0041E199,?,00000000,reboot,00000000,00000000,00000000,runfromtemp,00000000,00000001,00000001,00000000), ref: 004015AF
Part of subcall function 00401581: SetLastError.KERNEL32(?,00000000,?,0041E199,?,00000000,reboot,00000000,00000000,00000000,runfromtemp,00000000,00000001,00000001,00000000), ref: 004015DD

Strings

tdC, xrefs: 0041795D
|dC, xrefs: 00417958
4$D, xrefs: 00417999

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: CloseErrorH_prologLast$Open
String ID: 4$D$tdC$|dC
API String ID: 1699883992-1127127110
Opcode ID: a046054a197f43adba35a4815cbb1052e58c48584add6fee8fdc69c4cef8c754
Instruction ID: 30eb84feb063182825c7715b8afb4b4ae9bf25d19793e49d79c854faf04d273f
Opcode Fuzzy Hash: a046054a197f43adba35a4815cbb1052e58c48584add6fee8fdc69c4cef8c754
Instruction Fuzzy Hash: 3E414EB1900209EFDF04DF95C8919EEBB78FF14308F04846EF919A7292DB389A48CB55

Uniqueness

Uniqueness Score: -1.00%

Function 0041DE26 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 100COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0041DE2B

Part of subcall function 00406B7B: __EH_prolog.LIBCMT ref: 00406B80

Part of subcall function 0040B6E0: __EH_prolog.LIBCMT ref: 0040B6E5
Part of subcall function 0040B6E0: GetLastError.KERNEL32(00436474,00000001,0043647C,?,0040AFA1,?,?,00000000,?,00000000,00429A4C,FFFFFFFF,00000001,?,00000000,00000001), ref: 0040B70E
Part of subcall function 0040B6E0: SetLastError.KERNEL32(?,00000000,00000000,00000000,?,0040AFA1,?,?,00000000,?,00000000,00429A4C,FFFFFFFF,00000001,?,00000000), ref: 0040B763

Strings

tdC, xrefs: 0041DED6
tdC, xrefs: 0041DE73
|dC, xrefs: 0041DEB7, 0041DF16, 0041DEBB
|dC, xrefs: 0041DE98
tdC, xrefs: 0041DE9D

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: H_prolog$ErrorLast
String ID: tdC$tdC$tdC$|dC$|dC
API String ID: 2901101390-1609286963
Opcode ID: 14cf50cbe9fbdfbb06725dd5b89182b7b4ecd8cc3ee4765400ea9209bd76148b
Instruction ID: 81149633c312d71a6d523f27f206155d4b3ea56b161d4a27ddd2ea792c71970b
Opcode Fuzzy Hash: 14cf50cbe9fbdfbb06725dd5b89182b7b4ecd8cc3ee4765400ea9209bd76148b
Instruction Fuzzy Hash: A84150B1D00259EFCB04DFA5C855AEEBB75FF18308F10802EE405B7292DB785A04CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040A7BD Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 97COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040A7C2

Part of subcall function 00401581: __EH_prolog.LIBCMT ref: 00401586
Part of subcall function 00401581: GetLastError.KERNEL32(02151168,00000000,00000000,?,0041E199,?,00000000,reboot,00000000,00000000,00000000,runfromtemp,00000000,00000001,00000001,00000000), ref: 004015AF
Part of subcall function 00401581: SetLastError.KERNEL32(?,00000000,?,0041E199,?,00000000,reboot,00000000,00000000,00000000,runfromtemp,00000000,00000001,00000001,00000000), ref: 004015DD

Part of subcall function 004016F0: lstrlenW.KERNEL32(00436494,74DF34C0,74DF2EE0,00000000,00000000,?,0041FD7B,?,?,00000001,?,80000000,00000003,00000000,00000003,00000080), ref: 00401743
Part of subcall function 004016F0: WideCharToMultiByte.KERNEL32(00000000,00000000,00436494,000000FF,?,00000002,00000000,00000000,?,0041FD7B,?,?,00000001,?,80000000,00000003), ref: 0040176B

GetModuleFileNameA.KERNEL32(00000000,00000400,?,00000400,?,00000000,0043647C,00436474,00000000), ref: 0040A827

Part of subcall function 00409F70: __EH_prolog.LIBCMT ref: 00409F75
Part of subcall function 00409F70: GetLastError.KERNEL32(00000000,00000104), ref: 00409FA1
Part of subcall function 00409F70: SetLastError.KERNEL32(00000000,?,00000000,?,00000001), ref: 00409FD6

Strings

4$D, xrefs: 0040A84A
ISSetup.dll, xrefs: 0040A839, 0040A856
|dC, xrefs: 0040A7D7
tdC, xrefs: 0040A7DC

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: ErrorLast$H_prolog$ByteCharFileModuleMultiNameWidelstrlen
String ID: 4$D$ISSetup.dll$tdC$|dC
API String ID: 1377904173-3982560847
Opcode ID: e33a34e795a993dc4a2c9c0d4ff0ad44d9566bb5622669de869f7a9bff5afe72
Instruction ID: 72f95f6b3470e6e326bf45d4a50237000afdec11536a84549f82656cade482dd
Opcode Fuzzy Hash: e33a34e795a993dc4a2c9c0d4ff0ad44d9566bb5622669de869f7a9bff5afe72
Instruction Fuzzy Hash: 8F4153B1D00148EFDB05DBA5C991BEDBBB8AF14308F1041AEE505B7292DB781F09CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00407D27 Relevance: 10.6, APIs: 3, Strings: 4, Instructions: 79stringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00407D47
lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,00000000), ref: 00407D66
wsprintfA.USER32 ref: 00407DDF

Strings

http://, xrefs: 00407DA0, 00407DD4
ftp://, xrefs: 00407D88
https://, xrefs: 00407DBA
%s%s, xrefs: 00407DD9

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: wsprintf$lstrlen
String ID: %s%s$ftp://$http://$https://
API String ID: 217384638-620530764
Opcode ID: 1d27c8a30fe3cb042a64f26a4621e5244e74c451bc0ba57fc56c30c1d454b868
Instruction ID: 11b26a3366618960e7597735bbb43597218ab23b532569e2a67bcd970b0218b4
Opcode Fuzzy Hash: 1d27c8a30fe3cb042a64f26a4621e5244e74c451bc0ba57fc56c30c1d454b868
Instruction Fuzzy Hash: 68210576D083497EEB12ABB8AC41BAFBB689F06310F1451B7F540BA183D578E510876E

Uniqueness

Uniqueness Score: -1.00%

Function 00425322 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 78COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeA.VERSION(?,?,?,0042383B,?,?,00000000), ref: 00425332
GetFileVersionInfoA.VERSION(?,?,00000000,00000000,?,?,?,0042383B,?,?,00000000), ref: 00425352
VerQueryValueA.VERSION(?,0043E0A4,?,00000000,?,?,00000000,00000000,?,?,?,0042383B,?,?,00000000), ref: 0042536B
VerQueryValueA.VERSION(?,\VarFileInfo\Translation,;8B,00000000,80000000,00000104,?,0043E0A4,?,00000000,?,?,00000000,00000000,?,?), ref: 0042539D

Strings

\VarFileInfo\Translation, xrefs: 00425393
;8B, xrefs: 0042538F, 004253C5, 00425392

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: FileInfoQueryValueVersion$Size
String ID: ;8B$\VarFileInfo\Translation
API String ID: 2099394744-2474229566
Opcode ID: e2bfd9d930719eaa7355a92019f66b36226eb29f950d43cacc131ba6fe053ae3
Instruction ID: f621c51fa27129c0ca50ea07b130469e8b52a29b758b88675467a5f42f3e331b
Opcode Fuzzy Hash: e2bfd9d930719eaa7355a92019f66b36226eb29f950d43cacc131ba6fe053ae3
Instruction Fuzzy Hash: E921BE72A00228BFDF00DEA5D881DAE7BBCEF44344BA050A7ED10DB255E7B5DA41CB64

Uniqueness

Uniqueness Score: -1.00%

Function 004015F6 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 75stringCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004015FB
lstrlenA.KERNEL32(00000000,00000000,00000000,74DF34C0,?,00000000,?,00401562,00000000,00000000,?,00000001,?,00000000,74DF2EE0), ref: 0040164A
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,?,00000001,?,00000000,?,00401562,00000000,00000000,?,00000001,?,00000000), ref: 00401685
SetLastError.KERNEL32(?,?,?,00000001,?,00000000,?,00401562,00000000,00000000,?,00000001,?,00000000,74DF2EE0), ref: 0040169D

Strings

0$D, xrefs: 00401630
tdC, xrefs: 00401616

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: ByteCharErrorH_prologLastMultiWidelstrlen
String ID: 0$D$tdC
API String ID: 1667447809-2527954409
Opcode ID: bc0108f74ecfecfc79bb99c7100a9102e36a0186952a04f803b1ca797cb915e8
Instruction ID: 90e0b1833ff1ff125f4cca04b2274588b78c41ae85dbb2fc197d915d6a7df2ce
Opcode Fuzzy Hash: bc0108f74ecfecfc79bb99c7100a9102e36a0186952a04f803b1ca797cb915e8
Instruction Fuzzy Hash: B821A171900115EFDB109F59EC449AFBBA8EF85354B15893BF804E72A1C77A8D41CB5C

Uniqueness

Uniqueness Score: -1.00%

Function 004278CD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75COMMON

Download Yara Rule

APIs

InterlockedIncrement.KERNEL32(00446CEC), ref: 004278F1
InterlockedDecrement.KERNEL32(00446CEC), ref: 00427908
MultiByteToWideChar.KERNEL32(00000009,00000000,000000FF,00000000,00000000,?,00000000,?,?,00402A08,00000000,?,00000000,00000104,?,0041E59F), ref: 0042792E

Strings

lD, xrefs: 004278EB

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: Interlocked$ByteCharDecrementIncrementMultiWide
String ID: lD
API String ID: 817727928-1556624830
Opcode ID: 87a474f62ae5de2d509f1388050731aac4f75d86b095b6a67f88992d93f7cb1c
Instruction ID: 77de77086d347a09c1c4be11e0c323968ce6e3e891a120dd52aa4b33a1640cd0
Opcode Fuzzy Hash: 87a474f62ae5de2d509f1388050731aac4f75d86b095b6a67f88992d93f7cb1c
Instruction Fuzzy Hash: D7213770208330BBEB219B15BC84BAA3BA4EB02765F60412BF445161E1C73888C3D69D

Uniqueness

Uniqueness Score: -1.00%

Function 00410F5E Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 70COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00410F63
wsprintfA.USER32 ref: 00410F92

Part of subcall function 00402375: __EH_prolog.LIBCMT ref: 0040237A

Part of subcall function 004025BC: __EH_prolog.LIBCMT ref: 004025C1

Strings

Languages, xrefs: 00410FC6
key, xrefs: 00410F81
C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B}\Setup.INI, xrefs: 00410FA7
%s%d, xrefs: 00410F8C

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: H_prolog$wsprintf
String ID: %s%d$C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B}\Setup.INI$Languages$key
API String ID: 172397338-1642330314
Opcode ID: 093310dbbcb14e6c2dcfdea61b30b74860a39b49dd39a9e4f354ad7f78410b22
Instruction ID: 0f26e5f9bf1e8cdd5bad43cd7ce6beebc21fa9e84b106f7b50a838006eb980a9
Opcode Fuzzy Hash: 093310dbbcb14e6c2dcfdea61b30b74860a39b49dd39a9e4f354ad7f78410b22
Instruction Fuzzy Hash: 9A216670A10228ABCB10EF95D946BDDBB78FF08714F50026BF511631D1DBB86A49CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0040EBBB Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 57stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(?,removeonly), ref: 0040EBC1

Strings

reboot, xrefs: 0040EC03
runas, xrefs: 0040EBD7
removeasmajorupgrade, xrefs: 0040EC19
removeonly, xrefs: 0040EBBB
/removeonly, xrefs: 0040EBCD
runfromtemp, xrefs: 0040EBEC

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: lstrcmpi
String ID: /removeonly$reboot$removeasmajorupgrade$removeonly$runas$runfromtemp
API String ID: 1586166983-1284956059
Opcode ID: b9b1040e5e30a7e2c32ba6666677d5cc71fa64dbe8527700e7bf23a8b22c734d
Instruction ID: 786907aee1aa1e6c5b5e57d787b9815f1d9bcec55dde2208094da776e92e73f1
Opcode Fuzzy Hash: b9b1040e5e30a7e2c32ba6666677d5cc71fa64dbe8527700e7bf23a8b22c734d
Instruction Fuzzy Hash: 2701DFB1B4521779E224AA16BC83F7F63289F41BA9F20023FF516F15C1DE7C8851901E

Uniqueness

Uniqueness Score: -1.00%

Function 004080BC Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49filestringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,74DEE010,?,00000000,?,?,00408CEF,?,00010000,00408590), ref: 004080D6
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,00000002,00000000,00000000,?,00408CEF,?,00010000,00408590), ref: 004080FC
DeleteFileA.KERNEL32(?,?,00000002,00000000,00000000,?,00408CEF,?,00010000,00408590), ref: 00408103
GetLastError.KERNEL32(?,?,00000002,00000000,00000000,?,00408CEF,?,00010000,00408590), ref: 00408113
GetLastError.KERNEL32(?,?,00000002,00000000,00000000,?,00408CEF,?,00010000,00408590), ref: 00408115

Strings

d, xrefs: 0040811A

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: ErrorLast$ByteCharDeleteFileMultiWidelstrlen
String ID: d
API String ID: 1873936967-2564639436
Opcode ID: f185bdcff51d5a22ca8e5daa3f2f775b80633fb92f3c91be4af5ed2bdb2be6b7
Instruction ID: 3ac308d99220e1c456be83856c369cd3a799b45554aa84c48f8638fb3443b4fb
Opcode Fuzzy Hash: f185bdcff51d5a22ca8e5daa3f2f775b80633fb92f3c91be4af5ed2bdb2be6b7
Instruction Fuzzy Hash: 2A01F971604226BFD7109BA5DD49FAF7BACEF01369B135479F400E3150CB789D058AB9

Uniqueness

Uniqueness Score: -1.00%

Function 00420B32 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 45stringCOMMON

Download Yara Rule

APIs

CharNextA.USER32(LA,00000104,02151168), ref: 00420B65
lstrcpyA.KERNEL32(00000000,00000000), ref: 00420B75
CharNextA.USER32(00000000), ref: 00420B87
CharPrevA.USER32(00000000,00000000), ref: 00420B96
lstrcpyA.KERNEL32(LA,?), ref: 00420BAF

Strings

LA, xrefs: 00420B3B, 00420BAC, 00420B63

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: Char$Nextlstrcpy$Prev
String ID: LA
API String ID: 1912086007-1267665893
Opcode ID: 045fe4ce9a1ba7391bd345a92bd7ca2522ed5c2781937a0c8cc5fbad31690546
Instruction ID: fc9c40a25d704d706dd4f7629c81c13a4bbc1ffbc1ce8f68bbc8de9fb3225ec5
Opcode Fuzzy Hash: 045fe4ce9a1ba7391bd345a92bd7ca2522ed5c2781937a0c8cc5fbad31690546
Instruction Fuzzy Hash: CE01D4B2D0016C7ADB3297A4DC00BEB7FACAB45304F4540F2D700A3152C778AE868FA8

Uniqueness

Uniqueness Score: -1.00%

Function 00407DF6 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00407DFB
GetLastError.KERNEL32(00000008,00000000,?,00407CE4,00407BB8,00000000,00000400,?,00407BB8,?,?,00000004), ref: 00407E27
SysAllocString.OLEAUT32(?), ref: 00407E36
SetLastError.KERNEL32(?,?,00407CE4,00407BB8,00000000,00000400,?,00407BB8,?,?,00000004), ref: 00407E65

Strings

HeC, xrefs: 00407E0E
@eC, xrefs: 00407E15

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: ErrorLast$AllocH_prologString
String ID: @eC$HeC
API String ID: 1734030179-948665774
Opcode ID: 9860af10867dcda9f5d5f141f317ae8e169059de5ba870d7a755d6ebf6df92ee
Instruction ID: 505d873fccafccf1ef644f0157ca09ac5ed9b86bb30496de9f5f4c33618646cb
Opcode Fuzzy Hash: 9860af10867dcda9f5d5f141f317ae8e169059de5ba870d7a755d6ebf6df92ee
Instruction Fuzzy Hash: C0113571500712EFD7219F54E804B4ABBF0EF08719F11C46EE8869B651C7B9E908CB68

Uniqueness

Uniqueness Score: -1.00%

Function 004205A8 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 31stringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 004205C0

Part of subcall function 00420A03: lstrcpyA.KERNEL32(?,?,74DE8B60,?,00000000), ref: 00420A29
Part of subcall function 00420A03: CharNextA.USER32(00000000), ref: 00420A42
Part of subcall function 00420A03: lstrcpyA.KERNEL32(?,?), ref: 00420A5F
Part of subcall function 00420A03: lstrcpyA.KERNEL32(?,00000000), ref: 00420A65

Part of subcall function 00420C44: lstrlenA.KERNEL32(?,?,?,00401E26,?,C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B},?,?,?,00000104), ref: 00420C4C
Part of subcall function 00420C44: lstrcpynA.KERNEL32(?,?,-00000001,?,00401E26,?,C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B},?,?,?,00000104), ref: 00420C6A
Part of subcall function 00420C44: lstrcatA.KERNEL32(?,?,?,?,00401E26,?,C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B},?,?,?,00000104), ref: 00420C8A

lstrcatA.KERNEL32(?,.ini,?,?,?,C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B}\Setup.INI,?,?), ref: 004205F8
lstrcpyA.KERNEL32(00000000,?), ref: 0042060B

Strings

C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B}\Setup.INI, xrefs: 004205D3
%#04x, xrefs: 004205BA
.ini, xrefs: 004205F0

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: lstrcpy$lstrcat$CharNextlstrcpynlstrlenwsprintf
String ID: %#04x$.ini$C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B}\Setup.INI
API String ID: 2174921493-821759000
Opcode ID: 60ab812ac84c0e32396451c4eca3fe3075e0867027b23eccb61a07b4b3bbd6b2
Instruction ID: 17346589410f4758362aeb0a904512c5b94d8083d02fe998157b749a3edc4356
Opcode Fuzzy Hash: 60ab812ac84c0e32396451c4eca3fe3075e0867027b23eccb61a07b4b3bbd6b2
Instruction Fuzzy Hash: 4BF01DB150010EBFCF05EF90ED45EE97BBDEB44305F508032B904A5062D7749A98CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0043099A Relevance: 9.1, APIs: 6, Instructions: 143COMMON

Download Yara Rule

APIs

GetStringTypeW.KERNEL32(00000001,00437228,00000001,?,02151168,00000002,00446CEC,?,?,?,00000000,02151168), ref: 004309D9
GetStringTypeA.KERNEL32(00000000,00000001,00437224,00000001,?), ref: 004309F3
GetStringTypeW.KERNEL32(00000100,02151168,00000000,?,02151168,00000002,00446CEC,?,?,?,00000000,02151168), ref: 00430A1A
WideCharToMultiByte.KERNEL32(?,00000220,02151168,00000000,00000000,00000000,00000000,00000000,02151168,00000002,00446CEC,?,?,?,00000000,02151168), ref: 00430A4D
WideCharToMultiByte.KERNEL32(?,00000220,?,?,00000000,00000000,00000000,00000000), ref: 00430AB6
GetStringTypeA.KERNEL32(?,00000100,?,?), ref: 00430B21

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: StringType$ByteCharMultiWide
String ID:
API String ID: 3852931651-0
Opcode ID: c142119b0c5d8fbec1678ec456252fbe2b5d000244e8a30368e8e95a52d0dbcc
Instruction ID: bb977cda055dc6ee0bfbd05bc0ecfcae35ec2f06559dca1e6ea7f24b4071cc36
Opcode Fuzzy Hash: c142119b0c5d8fbec1678ec456252fbe2b5d000244e8a30368e8e95a52d0dbcc
Instruction Fuzzy Hash: D151A071900209EFCF219F95DC86E9FBFB8FF49754F20861AF614A2290D3359951CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 0041D6F3 Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 95COMMON

Download Yara Rule

APIs

Part of subcall function 00407585: __EH_prolog.LIBCMT ref: 0040758A
Part of subcall function 00407585: lstrcmpA.KERNEL32(?,00442430,?,?,00442430,?,?,?,Languages,00000000,?,0041CF62,Languages,count,00000000,?), ref: 004075B9

wsprintfA.USER32 ref: 0041D750
CharNextA.USER32(?), ref: 0041D763
CharNextA.USER32(00000000), ref: 0041D766

Part of subcall function 004025BC: __EH_prolog.LIBCMT ref: 004025C1

Part of subcall function 0041D1E0: __EH_prolog.LIBCMT ref: 0041D1E5
Part of subcall function 0041D1E0: LoadCursorA.USER32(00000000,00007F02), ref: 0041D21C
Part of subcall function 0041D1E0: SetCursor.USER32(00000000), ref: 0041D229
Part of subcall function 0041D1E0: wsprintfA.USER32 ref: 0041D2B9

Part of subcall function 00420C44: lstrlenA.KERNEL32(?,?,?,00401E26,?,C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B},?,?,?,00000104), ref: 00420C4C
Part of subcall function 00420C44: lstrcpynA.KERNEL32(?,?,-00000001,?,00401E26,?,C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B},?,?,?,00000104), ref: 00420C6A
Part of subcall function 00420C44: lstrcatA.KERNEL32(?,?,?,?,00401E26,?,C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B},?,?,?,00000104), ref: 00420C8A

Part of subcall function 00420DE9: GetFileAttributesA.KERNELBASE(00000000,0041DDB5,00000000,00000000,?,?,?,00000000,00000000,?,?,00000001,00000000,?,00000001,Startup), ref: 00420DED

Part of subcall function 00420C44: lstrcpyA.KERNEL32(?,?,?,00401E26,?,C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B},?,?,?,00000104), ref: 00420C76

Strings

%#x, xrefs: 0041D74A
C:\Users\user\AppData\Local\Temp, xrefs: 0041D7CC, 0041D7EC
C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B}, xrefs: 0041D7B0

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: H_prolog$CharCursorNextwsprintf$AttributesFileLoadlstrcatlstrcmplstrcpylstrcpynlstrlen
String ID: %#x$C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B}
API String ID: 4126524183-756487976
Opcode ID: 0cb5d737acab697d67a10950d689d6c227ca4c3f1c9384bbe8d1e0cbc49a3590
Instruction ID: 7da18a3e8adfa8e193d45f941af13b5a077b012634ff202e07a6cf1d817d279e
Opcode Fuzzy Hash: 0cb5d737acab697d67a10950d689d6c227ca4c3f1c9384bbe8d1e0cbc49a3590
Instruction Fuzzy Hash: BD3195F1A0011D7ADF149B61DC42FEB77ACEB44304F10447AFA05E7181DA78AE858AAC

Uniqueness

Uniqueness Score: -1.00%

Function 00409189 Relevance: 9.1, APIs: 6, Instructions: 86COMMON

Download Yara Rule

APIs

EndDialog.USER32(?,00000001), ref: 004091BA
GetDlgItem.USER32(?,00000001), ref: 0040921A
GetDlgItem.USER32(?,00000066), ref: 00409221
ShowWindow.USER32(00000000,00000000), ref: 00409235
ShowWindow.USER32(00000000,00000000), ref: 00409251

Part of subcall function 00421166: GetCurrentProcess.KERNEL32(?,?,?,?,?,?,0041C3E9), ref: 00421175
Part of subcall function 00421166: OpenProcessToken.ADVAPI32(00000000,00000028,0041C3E9,?,?,?,?,?,?,0041C3E9), ref: 00421182
Part of subcall function 00421166: LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00421199
Part of subcall function 00421166: AdjustTokenPrivileges.ADVAPI32(0041C3E9,00000000,?,00000000,00000000,00000000), ref: 004211C4
Part of subcall function 00421166: ExitWindowsEx.USER32(00000002,0000FFFF), ref: 004211D2

DeleteObject.GDI32 ref: 0040927B

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: ItemProcessShowTokenWindow$AdjustCurrentDeleteDialogExitLookupObjectOpenPrivilegePrivilegesValueWindows
String ID:
API String ID: 1933714880-0
Opcode ID: 672247a03d4ebfacf6cc10e97014d6af154a0c63a9249e122bcc0415880271a5
Instruction ID: b142e691367f89e488b478012f3ec4235128c75460e85cd2a82529c740bf4a03
Opcode Fuzzy Hash: 672247a03d4ebfacf6cc10e97014d6af154a0c63a9249e122bcc0415880271a5
Instruction Fuzzy Hash: 6C2107317002157BDA106F65EC8AE6B37A8EF59B04F40443BF701BA1E2C6F99851876C

Uniqueness

Uniqueness Score: -1.00%

Function 00410B0B Relevance: 9.1, APIs: 6, Instructions: 59COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(00410919,?), ref: 00410B1B
GetParent.USER32(00410919), ref: 00410B30
GetSystemMetrics.USER32(00000000), ref: 00410B3B
GetSystemMetrics.USER32(00000001), ref: 00410B4C
GetClientRect.USER32(00000000,?), ref: 00410B59
MoveWindow.USER32(00410919,?,?,?,?,00000000,?,?,?,00410919,?), ref: 00410B84

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: MetricsRectSystemWindow$ClientMoveParent
String ID:
API String ID: 3434607708-0
Opcode ID: 468d95c5925bb418c74766d55cf567f44aec7bac54c0cea67428dc73f243e786
Instruction ID: 2911655df3d0a66cd981b666592f3edc073b29428b2798e2874497ae3011301a
Opcode Fuzzy Hash: 468d95c5925bb418c74766d55cf567f44aec7bac54c0cea67428dc73f243e786
Instruction Fuzzy Hash: 9D115A32A0021ABFDB008FFCDD8DDAEBF79EB40305F094664F904E2194D770A9448A64

Uniqueness

Uniqueness Score: -1.00%

Function 00420D5C Relevance: 9.1, APIs: 6, Instructions: 56stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00429A4C,74DE83C0,000000FF,?,00000000,?,00416A5F,?,?,00442430,?,00000400,?,000000FE,?,00000104), ref: 00420D73
lstrcpyA.KERNEL32(00000000,00429A4C,?,00000000,?,00416A5F,?,?,00442430,?,00000400,?,000000FE,?,00000104,?), ref: 00420D85
lstrcatA.KERNEL32(00000000,0043E0A4,?,00000000,?,00416A5F,?,?,00442430,?,00000400,?,000000FE,?,00000104,?), ref: 00420D91
lstrlenA.KERNEL32(00000000,?,00000000,?,00416A5F,?,?,00442430,?,00000400,?,000000FE,?,00000104,?,-000008AC), ref: 00420D9A
CreateDirectoryA.KERNEL32(00000000,00000000,?,00000000,?,00416A5F,?,?,00442430,?,00000400,?,000000FE,?,00000104,?), ref: 00420DAF
GetLastError.KERNEL32(?,00000000,?,00416A5F,?,?,00442430,?,00000400,?,000000FE,?,00000104,?,-000008AC,00000000), ref: 00420DB9

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: lstrlen$CreateDirectoryErrorLastlstrcatlstrcpy
String ID:
API String ID: 4043630017-0
Opcode ID: 21802e1bcdc757ae9fc422a86aa7f1571aeb3d101ec68be43346d4037484f25e
Instruction ID: 6d8abc99ff93acc60c0f74b04fdc1afc02b49222f223614543c84c999230e13a
Opcode Fuzzy Hash: 21802e1bcdc757ae9fc422a86aa7f1571aeb3d101ec68be43346d4037484f25e
Instruction Fuzzy Hash: B101493621A721AFD7226B90BC48B2F7BD8DF87321F11401BF14191182C7B9580186AF

Uniqueness

Uniqueness Score: -1.00%

Function 0041BA39 Relevance: 9.1, APIs: 6, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0041BA3E
GetLastError.KERNEL32(00000001,?,?,?,0041B6E2,?,00000001,?,?,?), ref: 0041BA6B
SetLastError.KERNEL32(00000000,?,?,?,0041B6E2,?,00000001,?,?,?), ref: 0041BAA5
SysStringLen.OLEAUT32(00000000), ref: 0041BAB3
SysAllocStringLen.OLEAUT32(00000000,00000000), ref: 0041BAC0
SetLastError.KERNEL32(00000000,?,?,?,0041B6E2,?,00000001,?,?,?), ref: 0041BAD2

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: ErrorLast$String$AllocH_prolog
String ID:
API String ID: 1014970518-0
Opcode ID: 02349038e0248f81f9850bcd68301e9875752bd1af64555bd7ed594b4e77b43a
Instruction ID: c8c0ec784381d80476765268c1a82fad59fa4afd811a59e3881547c8d4ab54c6
Opcode Fuzzy Hash: 02349038e0248f81f9850bcd68301e9875752bd1af64555bd7ed594b4e77b43a
Instruction Fuzzy Hash: C7212272600606AFC720DF58D844A4AFBF4FF48715F12C86EE4569B621C3B8E904CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00407E83 Relevance: 9.1, APIs: 6, Instructions: 52COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00000000,00407C76,00000000,?), ref: 00407E9C
SysFreeString.OLEAUT32(?), ref: 00407EAA
SetLastError.KERNEL32(?,?,?,?,00000000,00407C76,00000000,?), ref: 00407EBD
GetLastError.KERNEL32(?,?,?,00000000,00407C76,00000000,?), ref: 00407ED5
SysFreeString.OLEAUT32(?), ref: 00407EF6
SetLastError.KERNEL32(?,?,?,?,00000000,00407C76,00000000,?), ref: 00407F0A

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: ErrorLast$FreeString
String ID:
API String ID: 2425351278-0
Opcode ID: 7ec59d5cb897c50ec5341046084f1e619d9c2691664c5f7d92382c363d2a431b
Instruction ID: bf3a62cfde020e86e6ec2c0683035c1bca93d10a721b7a1d14eba3e0fc960767
Opcode Fuzzy Hash: 7ec59d5cb897c50ec5341046084f1e619d9c2691664c5f7d92382c363d2a431b
Instruction Fuzzy Hash: E7112A36200616EFCB109F68EC48C55BBF0FF09719712C669F896CB221D736E918CB44

Uniqueness

Uniqueness Score: -1.00%

Function 00407F15 Relevance: 9.1, APIs: 6, Instructions: 52COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000200,?,?,0041B389,00000001,00000000), ref: 00407F2E
SysFreeString.OLEAUT32(?), ref: 00407F3C
SetLastError.KERNEL32(?,?,00000200,?,?,0041B389,00000001,00000000), ref: 00407F4F
GetLastError.KERNEL32(?,00000200,?,?,0041B389,00000001,00000000), ref: 00407F67
SysFreeString.OLEAUT32(?), ref: 00407F88
SetLastError.KERNEL32(?,?,00000200,?,?,0041B389,00000001,00000000), ref: 00407F9C

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: ErrorLast$FreeString
String ID:
API String ID: 2425351278-0
Opcode ID: 544fb55807be1d4f7ff2eb79f1eb08916074bff76f0e37956f5526ef125e7ca3
Instruction ID: 4c010b5ec47eb650691e7cbce53803d11c658a128558f141b6d8ff1f5a4492af
Opcode Fuzzy Hash: 544fb55807be1d4f7ff2eb79f1eb08916074bff76f0e37956f5526ef125e7ca3
Instruction Fuzzy Hash: BD112A36200616EFCB109F68EC48C55BBF0FF09319712C669F896CB221D736E918CB44

Uniqueness

Uniqueness Score: -1.00%

Function 0041DAFF Relevance: 9.0, APIs: 6, Instructions: 50windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 0041DB05
GetWindowLongA.USER32(?,00000000), ref: 0041DB16
DeleteObject.GDI32(00000000), ref: 0041DB3E
DestroyIcon.USER32(00000000,?,?,?,0041DA4A,?), ref: 0041DB46
DeleteObject.GDI32(?), ref: 0041DB5F
SetWindowLongA.USER32(0041DA4A,00000000,00000000), ref: 0041DB6B

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: Window$DeleteLongObject$DestroyIcon
String ID:
API String ID: 2866036538-0
Opcode ID: 34218faf1131265d2a575cf13c417be10a9a3bcbf13b50dec662e835af9b5794
Instruction ID: 64cc36e7a549c7de2ec729b6d598f00981ed5428458227402d1b7dfef89d356b
Opcode Fuzzy Hash: 34218faf1131265d2a575cf13c417be10a9a3bcbf13b50dec662e835af9b5794
Instruction Fuzzy Hash: 34018872908215EFC6309F65EC84CD7BBB8EB45365713942EF557D2110C736B880CA29

Uniqueness

Uniqueness Score: -1.00%

Function 0040F36B Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 263stringCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040F370

Part of subcall function 00406B7B: __EH_prolog.LIBCMT ref: 00406B80

lstrcpyA.KERNEL32(?,00000000,00000452,?,?,00000000,0040136B,?,?,00000000,0040E610,0040E7B3,?,?,?,?), ref: 0040F3DD

Strings

%s%s%s%s%s%s%s%s, xrefs: 0040F66D
C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B}, xrefs: 0040F3C7

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: H_prolog$lstrcpy
String ID: %s%s%s%s%s%s%s%s$C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B}
API String ID: 2120869262-3983708343
Opcode ID: 63c5f20e94b9d1ed82c092feab0272bd15a25399b3aba9ac85e0310c7ac77c68
Instruction ID: 5bc63f0fc7e58f00a2237b75c7206668be3fe3500b237511ec600da4cbbf99af
Opcode Fuzzy Hash: 63c5f20e94b9d1ed82c092feab0272bd15a25399b3aba9ac85e0310c7ac77c68
Instruction Fuzzy Hash: 9F91F872A01128BFDF50D6A5CC51ADEBBB9AB4C350F4040F6E609F7182DE359B888F65

Uniqueness

Uniqueness Score: -1.00%

Function 004019C0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 241COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004019C5
GetModuleFileNameA.KERNEL32(00000000,00000000,00000104,?,00000104,?,00000000,?,00000000), ref: 00401A66

Strings

C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B}, xrefs: 004019D9, 004019E6, 00401AAD, 00401AF0, 00401B07, 00401BAB

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: FileH_prologModuleName
String ID: C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B}
API String ID: 2929834794-2458444898
Opcode ID: 85659f76986839cc19cb2529002957013a77ce4cc37e86242dc7927cfc3d1150
Instruction ID: a9872503b87f22a4afeece365c58c6d1c0811d4ab93cd579e274217fe19619fa
Opcode Fuzzy Hash: 85659f76986839cc19cb2529002957013a77ce4cc37e86242dc7927cfc3d1150
Instruction Fuzzy Hash: F691B771D01258AADB11D7A1CC45FDEB7BCAF05308F5440AEE509B31D2DB789B44CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0041288B Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 123stringCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00412890
GetVersionExA.KERNEL32(?,?,?,00000104), ref: 004128B2

Part of subcall function 004014FF: __EH_prolog.LIBCMT ref: 00401504
Part of subcall function 004014FF: SetLastError.KERNEL32(?,?,00000000,74DF2EE0,?,0041FD71,?,?,00000001,?,80000000,00000003,00000000,00000003,00000080,00000000), ref: 0040156A

Part of subcall function 004185A0: __EH_prolog.LIBCMT ref: 004185A5

Part of subcall function 004016F0: lstrlenW.KERNEL32(00436494,74DF34C0,74DF2EE0,00000000,00000000,?,0041FD7B,?,?,00000001,?,80000000,00000003,00000000,00000003,00000080), ref: 00401743
Part of subcall function 004016F0: WideCharToMultiByte.KERNEL32(00000000,00000000,00436494,000000FF,?,00000002,00000000,00000000,?,0041FD7B,?,?,00000001,?,80000000,00000003), ref: 0040176B

lstrcpyA.KERNEL32(?,00000000,0000002C,00000001,?,?,00000001), ref: 0041295E
lstrcatA.KERNEL32(?,dotnetfxsp1.exe), ref: 00412970

Strings

dotnetfxsp1.exe, xrefs: 0041296A, 00412A06

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: H_prolog$ByteCharErrorLastMultiVersionWidelstrcatlstrcpylstrlen
String ID: dotnetfxsp1.exe
API String ID: 2708201615-1849113985
Opcode ID: 177be66545c3fca2d5dfa8e49ea1aae7e3f4583ed6d8874d8ced13f2f86eae92
Instruction ID: 739676ba5ed1f77cb66fc824805e47128d5bde303f0b1ef52af2996cbbdebe29
Opcode Fuzzy Hash: 177be66545c3fca2d5dfa8e49ea1aae7e3f4583ed6d8874d8ced13f2f86eae92
Instruction Fuzzy Hash: B5418D71E0025AEBCF14DFA4DD91AEEB7B8AF04304F10406FE516B6291DBB85B85CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0041DCB3 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 118COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0041DCB8

Part of subcall function 004025BC: __EH_prolog.LIBCMT ref: 004025C1

ShellExecuteA.SHELL32(00000000,open,00000000,00000000,00000000,00000001), ref: 0041DDFA

Strings

ClickOncePackage, xrefs: 0041DCF9
Startup, xrefs: 0041DCFE
open, xrefs: 0041DDF4

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: H_prolog$ExecuteShell
String ID: ClickOncePackage$Startup$open
API String ID: 1920959041-1966403724
Opcode ID: 8729b1542ab4831d11203e3b283423c92e6e8c63494dc20efa03f49775a611af
Instruction ID: 1d108af3b27e267198b06034ec2c73cd3f6be0ddbcde9c8b5e450ca35287a515
Opcode Fuzzy Hash: 8729b1542ab4831d11203e3b283423c92e6e8c63494dc20efa03f49775a611af
Instruction Fuzzy Hash: EA417471940258BEDB15E7A5CC55EEEBB78AF54304F0001AEB106B31D2EB785B48C669

Uniqueness

Uniqueness Score: -1.00%

Function 0042B797 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 115COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 0042B7B6
GetEnvironmentVariableA.KERNEL32(__MSVCRT_HEAP_SELECT,?,00001090), ref: 0042B7EB
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 0042B84B

Strings

__GLOBAL_HEAP_SELECTED, xrefs: 0042B825
__MSVCRT_HEAP_SELECT, xrefs: 0042B7E6

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: EnvironmentFileModuleNameVariableVersion
String ID: __GLOBAL_HEAP_SELECTED$__MSVCRT_HEAP_SELECT
API String ID: 1385375860-4131005785
Opcode ID: 5187c70c506e1bfd0bf0f18d7f64de3fc90d4d7022a5ecb6ba38b791a839a45e
Instruction ID: ba78cb86c58021098da1c40bc6c3a56d8cdcf8f7884d49530d802708ecaef4a3
Opcode Fuzzy Hash: 5187c70c506e1bfd0bf0f18d7f64de3fc90d4d7022a5ecb6ba38b791a839a45e
Instruction Fuzzy Hash: 5F31F371B052786DEB35A6707C81BDA376CDF02344FA444DBD289C6252E7388E898B99

Uniqueness

Uniqueness Score: -1.00%

Function 00409A97 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78libraryloaderCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00409A9C
GetProcAddress.KERNEL32(00000000,WinVerifyTrust), ref: 00409ABB
MultiByteToWideChar.KERNEL32(00000001,00000000,00000000,000000FF,00000000,00000000,?,?,?,?,?,?,?,?,00000000,?), ref: 00409AFD
MultiByteToWideChar.KERNEL32(00000001,00000000,00000000,000000FF,00000000,00000000,?,?,?,?,?,?,?,?,00000000,?), ref: 00409B19

Strings

WinVerifyTrust, xrefs: 00409AB5

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: ByteCharMultiWide$AddressH_prologProc
String ID: WinVerifyTrust
API String ID: 2363843230-2766335691
Opcode ID: 638718353162dcc4b499f5c88208080de11a68bd1ead9100a1e5a4b5ed214393
Instruction ID: c189ad78521ce07b2b92ece1b2c25c97fe0731010b6abae6322945d6d0bf3fae
Opcode Fuzzy Hash: 638718353162dcc4b499f5c88208080de11a68bd1ead9100a1e5a4b5ed214393
Instruction Fuzzy Hash: 0A21A472E00218BACF00AFD99C45EDFBBBCEB88314F10412BF914F7291D67849008BA9

Uniqueness

Uniqueness Score: -1.00%

Function 00403D72 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 75stringCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00403D77
lstrlenA.KERNEL32(00000000,00000000,00000000,02151168,?,00000000,?,00402A1E,00000000,00000000,?,00000001,?,00000000,00000104), ref: 00403DC6
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,?,00000001,?,00000000,?,00402A1E,00000000,00000000,?,00000001,?,00000000), ref: 00403E01
SetLastError.KERNEL32(?,?,?,00000001,?,00000000,?,00402A1E,00000000,00000000,?,00000001,?,00000000,00000104), ref: 00403E19

Strings

0$D, xrefs: 00403DAC

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: ByteCharErrorH_prologLastMultiWidelstrlen
String ID: 0$D
API String ID: 1667447809-1534285997
Opcode ID: 40bceae378692cd2918325617282b5f113c12ce3a906f7a94a595915904a5e98
Instruction ID: 0f6da80c701c266824f318e9b10f223622a0fa6a893e48e5cf5ac048bea69104
Opcode Fuzzy Hash: 40bceae378692cd2918325617282b5f113c12ce3a906f7a94a595915904a5e98
Instruction Fuzzy Hash: 1721ACB1900216EFDB109F59E8449AFBFA8EF85355F11813BF805A7291C7788E448B98

Uniqueness

Uniqueness Score: -1.00%

Function 00417A80 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 67registryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RegQueryValueExA.ADVAPI32(?,Install,00000000,00000001,?,00000000,?,00000000,00020019,0043647C,00436474,00000000,?,?,00417A12,?), ref: 00417AE1
RegQueryValueExA.ADVAPI32(?,0043E5B4,00000000,00000001,00000000,00000004,?,?,00417A12,?,00000000,?,00000001,?), ref: 00417B00
RegCloseKey.ADVAPI32(?,?,?,00417A12,?,00000000,?,00000001,?), ref: 00417B0A
RegCloseKey.ADVAPI32(?,?,00000000,00020019,0043647C,00436474,00000000,?,?,00417A12,?,00000000,?,00000001,?,00000000), ref: 00417B1C

Strings

Install, xrefs: 00417AD3

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: CloseQueryValue
String ID: Install
API String ID: 3356406503-3765929189
Opcode ID: 720ebbb5fc3a20fc521b7e37378a5cf1acc2ef5d38a743896db3b249c3febb9e
Instruction ID: b3e747399b6460390273406db0a0956b0911d8322f810dc62643d4c071040ca7
Opcode Fuzzy Hash: 720ebbb5fc3a20fc521b7e37378a5cf1acc2ef5d38a743896db3b249c3febb9e
Instruction Fuzzy Hash: 052124B550524ABFDB108F54DC809DA7BB8FF08398B11442AF905A7250D375AE648BA4

Uniqueness

Uniqueness Score: -1.00%

Function 004203E2 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 45windowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32(00001300,00000000,QlA,00000000,QlA,00000000,00000000,00000000), ref: 004203FE
wsprintfA.USER32 ref: 00420433

Part of subcall function 00420305: __EH_prolog.LIBCMT ref: 0042030A

LocalFree.KERNEL32(?), ref: 0042044B

Strings

%s %s, xrefs: 0042042D
QlA, xrefs: 004203EF, 004203F5, 004203F3

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: FormatFreeH_prologLocalMessagewsprintf
String ID: %s %s$QlA
API String ID: 1200432034-2695060340
Opcode ID: d3bf13ce68bcee8848851e644495ccf0dcd9b16c63630d46b0baf3e5a4595b73
Instruction ID: 2989dba7e03fe6a3ab524e83a61caa3fa2152887f7e42b4c1faa6200b6f752e4
Opcode Fuzzy Hash: d3bf13ce68bcee8848851e644495ccf0dcd9b16c63630d46b0baf3e5a4595b73
Instruction Fuzzy Hash: 1701F9B260010DBFEF115F94EC45FEA7B7CFB04344F108476BB05A5051D671DA458A64

Uniqueness

Uniqueness Score: -1.00%

Function 00410E40 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 44COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00410E45

Part of subcall function 00402375: __EH_prolog.LIBCMT ref: 0040237A

Part of subcall function 004025BC: __EH_prolog.LIBCMT ref: 004025C1

Strings

Languages, xrefs: 00410E78
C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B}\Setup.INI, xrefs: 00410E58
C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B}, xrefs: 00410E4D
default, xrefs: 00410E73

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: H_prolog
String ID: C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B}$C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B}\Setup.INI$Languages$default
API String ID: 3519838083-1633815757
Opcode ID: ae8932c439fa258d6883d4560f637c08ccf1a698080d08d4234206ac63d8efd3
Instruction ID: e3294a2c9dd3d0c07646a27b82075c5c43605500d8ece5756996ff250fdbc942
Opcode Fuzzy Hash: ae8932c439fa258d6883d4560f637c08ccf1a698080d08d4234206ac63d8efd3
Instruction Fuzzy Hash: E10148B1A10228EACB14EBA6ED16FDDB734AB18718F50416BF811731D1D7BC6B09CA4C

Uniqueness

Uniqueness Score: -1.00%

Function 00431907 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 39COMMON

Download Yara Rule

APIs

InterlockedIncrement.KERNEL32(00446CEC), ref: 00431913
InterlockedDecrement.KERNEL32(00446CEC), ref: 0043192A

Part of subcall function 0042B6F4: InitializeCriticalSection.KERNEL32(00000000,00000000,?,?,00430238,00000009,00000000,00000000,00000001,0042AA98,00000001,00000074,?,?,00000000,00000001), ref: 0042B731
Part of subcall function 0042B6F4: EnterCriticalSection.KERNEL32(?,?,?,00430238,00000009,00000000,00000000,00000001,0042AA98,00000001,00000074,?,?,00000000,00000001), ref: 0042B74C

InterlockedDecrement.KERNEL32(00446CEC), ref: 0043195A

Strings

KB, xrefs: 0043193A
lD, xrefs: 0043190C

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: Interlocked$CriticalDecrementSection$EnterIncrementInitialize
String ID: KB$lD
API String ID: 2038102319-1466586194
Opcode ID: a2feea1fcf6b82f045b579d01b8f2bc19a321038b8ab77b7c377d106ff542835
Instruction ID: b7d9e10585bd1947adfb6877e6c9bf6be61f04795092fe332b26641715f9086f
Opcode Fuzzy Hash: a2feea1fcf6b82f045b579d01b8f2bc19a321038b8ab77b7c377d106ff542835
Instruction Fuzzy Hash: E6F0B47210021ABFEB006F95AC91ADF3B6CEF85324F05403BF60515161CBB58952CAA9

Uniqueness

Uniqueness Score: -1.00%

Function 00408D39 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00408D3E
GetLastError.KERNEL32(?,00000000,?,00408BE1,00000000,?,?,?,00408204,?,?), ref: 00408D6A
SetLastError.KERNEL32(?,?,00000000,?,00408BE1,00000000,?,?,?,00408204,?,?), ref: 00408DA0

Strings

HeC, xrefs: 00408D51
@eC, xrefs: 00408D58

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: ErrorLast$H_prolog
String ID: @eC$HeC
API String ID: 2881783280-948665774
Opcode ID: 1e581aca5f9a9e7cf9f0bf1273ac3e8aae2f8d515ebbddac4cfc9478cc1b0f09
Instruction ID: b18decdc25764eafb30bde723e839410cda8c2020d90a964900d58732d13c838
Opcode Fuzzy Hash: 1e581aca5f9a9e7cf9f0bf1273ac3e8aae2f8d515ebbddac4cfc9478cc1b0f09
Instruction Fuzzy Hash: A9012571500712EFD720DF58E504B4ABBF4EF08719F21C96EE49697681C7B9E908CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0042FCA1 Relevance: 7.6, APIs: 5, Instructions: 150COMMON

Download Yara Rule

APIs

GetStartupInfoA.KERNEL32(?), ref: 0042FCFF
GetFileType.KERNEL32(?,?,00000000), ref: 0042FDAA
GetStdHandle.KERNEL32(-000000F6,?,00000000), ref: 0042FE0D
GetFileType.KERNEL32(00000000,?,00000000), ref: 0042FE1B
SetHandleCount.KERNEL32 ref: 0042FE52

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: FileHandleType$CountInfoStartup
String ID:
API String ID: 1710529072-0
Opcode ID: 784c9ff0263ae8d7e7ada8a42080ca85df0fe7c21a0a4e3709f49b7416ee696c
Instruction ID: ee44ac3a8b4400f6b601ea60163ea4c75a83431a0d4ec37232462d1bccaf59a5
Opcode Fuzzy Hash: 784c9ff0263ae8d7e7ada8a42080ca85df0fe7c21a0a4e3709f49b7416ee696c
Instruction Fuzzy Hash: 7F512971710A218FDB118B28E88466A77F0BB02328FE5477EC593D72E2D7389809C759

Uniqueness

Uniqueness Score: -1.00%

Function 004093FA Relevance: 7.6, APIs: 5, Instructions: 116timeCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?), ref: 0040948B
DosDateTimeToFileTime.KERNEL32(?,?,?), ref: 004094CF
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 004094E2
SetFileTime.KERNEL32(?,?,00000000,?), ref: 004094F7
SetFileAttributesA.KERNEL32(?,00000000), ref: 00409529

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: FileTime$AttributesDateErrorLastLocal
String ID:
API String ID: 1921563805-0
Opcode ID: 4a634dc8d8200a2bfff174705ee2784c15ab788d2e7364240804ffaa8df084a7
Instruction ID: be73eb300083b788b16b4bb06a543a77a6080fe3ac7a8ec845417e1b093ff3c6
Opcode Fuzzy Hash: 4a634dc8d8200a2bfff174705ee2784c15ab788d2e7364240804ffaa8df084a7
Instruction Fuzzy Hash: 5531AF72908019BFDB209FE4DC859EB736CEB04724F504676F225E21C2E738AD468B29

Uniqueness

Uniqueness Score: -1.00%

Function 0042163D Relevance: 7.6, APIs: 5, Instructions: 50stringCOMMON

Download Yara Rule

APIs

VerLanguageNameA.KERNEL32(00003CFF,?,00000103,?,?,00000000), ref: 0042165B
VerLanguageNameA.KERNEL32(?,?,00000103,00003CFF,?,00000103,?,?,00000000), ref: 00421685
lstrcmpiA.KERNEL32(?,?), ref: 00421698
VerLanguageNameA.KERNEL32(?,?,00000103,?,00000000), ref: 004216B5
lstrcpyA.KERNEL32(?,?,?,00000000), ref: 004216C4

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: LanguageName$lstrcmpilstrcpy
String ID:
API String ID: 422536988-0
Opcode ID: af257d1973c34de17716ce2726355c8016663678f71da93bad66c01332b185cd
Instruction ID: 2930783f34361460ead381aaa481ec0afe07ebdf8004496fbe12bfc5e642ce7c
Opcode Fuzzy Hash: af257d1973c34de17716ce2726355c8016663678f71da93bad66c01332b185cd
Instruction Fuzzy Hash: CC01A7B66001387BE7109A91ED85EFB33ADDF54305F404176FB85E2040E678DB848764

Uniqueness

Uniqueness Score: -1.00%

Function 0041C119 Relevance: 7.5, APIs: 5, Instructions: 49stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 0041C155
lstrcpyA.KERNEL32(00000000,00000000,?,00000000), ref: 0041C165
GetModuleFileNameA.KERNEL32(?,00000000,00000400,?,?,00000000), ref: 0041C17B
lstrlenA.KERNEL32(00000000,?,00000000), ref: 0041C188
lstrcpyA.KERNEL32(00000000,00000000,?,00000000), ref: 0041C1A0

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: lstrcpylstrlen$FileModuleName
String ID:
API String ID: 271103609-0
Opcode ID: b93de50fa602d8b89bfee2c1b81d21b96d073493dc18ed65aa9c9327cc04485c
Instruction ID: fe841caf96f34a4cd0aada8319139791f1d3855e57f30174e27d7f0f746d4353
Opcode Fuzzy Hash: b93de50fa602d8b89bfee2c1b81d21b96d073493dc18ed65aa9c9327cc04485c
Instruction Fuzzy Hash: 6701F5B29401197FDF11AB64CC45FEA7B7DEB04344F0140B6A704F2151D674AE4A8FA8

Uniqueness

Uniqueness Score: -1.00%

Function 00420A75 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 49stringCOMMON

Download Yara Rule

APIs

lstrcpyA.KERNEL32(?,00000000,?,?,00000000), ref: 00420A91
CharNextA.USER32(00000000), ref: 00420AC0
lstrcpyA.KERNEL32(?,?), ref: 00420AD5
lstrcpyA.KERNEL32(4$D,00000000), ref: 00420ADB

Strings

4$D, xrefs: 00420AD8

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: lstrcpy$CharNext
String ID: 4$D
API String ID: 3801418090-1551560817
Opcode ID: 07ef36a4fc20854510155239082e9d284b7510dc95f8e4a6de8db8dbd4b66ce9
Instruction ID: 6bf1e3aa4498b657ff4f6109d4790b9359835d93f9115038ffc92b83cbaf1900
Opcode Fuzzy Hash: 07ef36a4fc20854510155239082e9d284b7510dc95f8e4a6de8db8dbd4b66ce9
Instruction Fuzzy Hash: 0101A27760022AAADB1096A0AC45FAF3BACEB84364F54047BF704E6081EA7499458B68

Uniqueness

Uniqueness Score: -1.00%

Function 00401447 Relevance: 7.5, APIs: 5, Instructions: 46fileCOMMON

Download Yara Rule

APIs

GetFileSize.KERNEL32(?,00000000,00000000,00000000,?,?,00401437,00000000,00000000,?,80000000,00000003,00000000,00000003,00000080,00000000), ref: 00401453
CreateFileMappingA.KERNEL32(?,00000000,00000004,00000000,00000000,00000000), ref: 00401465
MapViewOfFile.KERNEL32(00000000,00000002,00000000,00000000,00000000,00000000,?,?,00401437,00000000,00000000,?,80000000,00000003,00000000,00000003), ref: 00401478
UnmapViewOfFile.KERNEL32(00000000,?,?,00000000), ref: 00401496
CloseHandle.KERNEL32(00000000,?,?,00401437,00000000,00000000,?,80000000,00000003,00000000,00000003,00000080,00000000,?,?,00000000), ref: 0040149D

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: File$View$CloseCreateHandleMappingSizeUnmap
String ID:
API String ID: 1558290345-0
Opcode ID: 37ac0700f71ab78683fe4b84505168e1d7def99c2dd6037b05ea73d33cc7ba3c
Instruction ID: 10c67e85033d133ee12dac3b3d0f2828abd9d42882e0620f1471597b672e91e3
Opcode Fuzzy Hash: 37ac0700f71ab78683fe4b84505168e1d7def99c2dd6037b05ea73d33cc7ba3c
Instruction Fuzzy Hash: 35F04F32602234BBD7212BA69C4DCAF7E6DDF467A1B028075FA0992171D6B54D00D7E4

Uniqueness

Uniqueness Score: -1.00%

Function 0041B0F2 Relevance: 7.5, APIs: 5, Instructions: 39COMMON

Download Yara Rule

APIs

GetDC.USER32(0041B07A), ref: 0041B0FA
GetDeviceCaps.GDI32(00000000,0000005A), ref: 0041B107
MulDiv.KERNEL32(?,00000000), ref: 0041B111
ReleaseDC.USER32(0041B07A,00000000), ref: 0041B11F
CreateFontA.GDI32(00000000,00000000,00000000,00000000,?,00000000,0041B098,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 0041B13D

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: CapsCreateDeviceFontRelease
String ID:
API String ID: 2367478762-0
Opcode ID: 81145336934569a7f480b35a4449b0bba64fe847b0e95930daf0ab45c70387a9
Instruction ID: d14109cea702917e66065c074a7bb5077062d34f87a55eff81ac71814f3284b2
Opcode Fuzzy Hash: 81145336934569a7f480b35a4449b0bba64fe847b0e95930daf0ab45c70387a9
Instruction Fuzzy Hash: 7FF0B2B2100109BFEB021FA1EC09CBF7F7DEB5A652B018021FE05C5060C6328D21ABB9

Uniqueness

Uniqueness Score: -1.00%

Function 0042AA73 Relevance: 7.5, APIs: 5, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000103,7FFFFFFF,0042AC09,00427693,00000000,?,?,00000000,00000001), ref: 0042AA75
TlsGetValue.KERNEL32(?,?,00000000,00000001), ref: 0042AA83
SetLastError.KERNEL32(00000000,?,?,00000000,00000001), ref: 0042AACF

Part of subcall function 00430182: HeapAlloc.KERNEL32(00000008,?,00000000,00000000,00000001,0042AA98,00000001,00000074,?,?,00000000,00000001), ref: 00430278

TlsSetValue.KERNEL32(00000000,?,?,00000000,00000001), ref: 0042AAA7
GetCurrentThreadId.KERNEL32 ref: 0042AAB8

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: ErrorLastValue$AllocCurrentHeapThread
String ID:
API String ID: 2020098873-0
Opcode ID: f6de9683ed071c8c7b1bd0952ad1cee2b1817d89e6cc6979e7fabdf4835980af
Instruction ID: 3a6c3b8941b050bc3c902884966bb7dc6c4211c2f799f5fec3cf624d928bc608
Opcode Fuzzy Hash: f6de9683ed071c8c7b1bd0952ad1cee2b1817d89e6cc6979e7fabdf4835980af
Instruction Fuzzy Hash: E8F0F631B002227BDB316B28BD0951A3A65AF417B5B06523BF855D52A1CB288800CA99

Uniqueness

Uniqueness Score: -1.00%

Function 0040EB11 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 38COMMON

Download Yara Rule

APIs

CharNextA.USER32 ref: 0040EB18
CharNextA.USER32(00000000), ref: 0040EB31
CharNextA.USER32(00000000), ref: 0040EB40

Strings

/m2, xrefs: 0040EB34
/m1, xrefs: 0040EB43

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: CharNext
String ID: /m1$/m2
API String ID: 3213498283-2289526375
Opcode ID: f7eeaa2db2a6c190066a7749766c0b58f86238068ce0c9c0c172c0af68887725
Instruction ID: 726c3cc17ac29258ade38a1d8a4e1e2504343e08ecc36d1a3d9f41a578d6f083
Opcode Fuzzy Hash: f7eeaa2db2a6c190066a7749766c0b58f86238068ce0c9c0c172c0af68887725
Instruction Fuzzy Hash: 72F0B471A04144BAC7149B6AEC96E7E7B2CF704364F20413BF412A21D0C67CAD02C619

Uniqueness

Uniqueness Score: -1.00%

Function 00411052 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00411064

Part of subcall function 004110C4: __EH_prolog.LIBCMT ref: 004110C9
Part of subcall function 004110C4: lstrcpyA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B}\Setup.INI,Title), ref: 004110E8

CharNextA.USER32(?,Title), ref: 0041108E
CharNextA.USER32(00000000), ref: 00411091

Part of subcall function 004110C4: lstrcatA.KERNEL32(?,.ini,?,C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B},?,Title), ref: 00411110

Strings

Title, xrefs: 00411086
%#04x, xrefs: 0041105E

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: CharNext$H_prologlstrcatlstrcpywsprintf
String ID: %#04x$Title
API String ID: 1153994949-2030030561
Opcode ID: a15f2477cd7c9000c9f451d47f609fc75a6bb85b3222b8fbfb76426c67039a1f
Instruction ID: 8955f4d97d892ed15f7d52c1b025593f1afb0255e4184ca7e68cf309b2ac2d5e
Opcode Fuzzy Hash: a15f2477cd7c9000c9f451d47f609fc75a6bb85b3222b8fbfb76426c67039a1f
Instruction Fuzzy Hash: CEF01772C0014EBBCF01AFA5DC05DEF3FADEB08254F044462BE08A6061E635DA619BA5

Uniqueness

Uniqueness Score: -1.00%

Function 0041925E Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 292COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00419263

Strings

I64, xrefs: 0041933C
%*.*f, xrefs: 004194F3

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: H_prolog
String ID: %*.*f$I64
API String ID: 3519838083-2444075078
Opcode ID: e5f2d5259a72ff05754a6dc908123c3aa71ea7f075799564023b54b49a1eea38
Instruction ID: 9dc92e70c460dadd06695dec2bc2e92cdbf7148b12749be97ca41d04b51ab8de
Opcode Fuzzy Hash: e5f2d5259a72ff05754a6dc908123c3aa71ea7f075799564023b54b49a1eea38
Instruction Fuzzy Hash: ED91057690421AABDB259F6DC9687FE77A1FB05314F54802BEC51A6280E33C8EC2C75D

Uniqueness

Uniqueness Score: -1.00%

Function 00418DC0 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 292COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00418DC5

Strings

I64, xrefs: 00418E9E
%*.*f, xrefs: 00419055

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: H_prolog
String ID: %*.*f$I64
API String ID: 3519838083-2444075078
Opcode ID: c805b6f149d39ccb9f6906405d6eedeb50280329cd698c088f3a833f364abbc0
Instruction ID: 0ee33df66d58c63e75d4dbc47e034da981dbb05af7b4aaefebdfc4a6032364ba
Opcode Fuzzy Hash: c805b6f149d39ccb9f6906405d6eedeb50280329cd698c088f3a833f364abbc0
Instruction Fuzzy Hash: 2A91C2769002169BDB249E68C8587FF7BA1FB08314F54812FE945E6380DB7C9EC2CA5D

Uniqueness

Uniqueness Score: -1.00%

Function 0040B22B Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 209stringCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040B230
lstrcpynA.KERNEL32(00429A4C,?,?,00000001,00000001,00000000,00000000,?,?,00000000,?,00000000,00000000,00000000,00000001,00000000), ref: 0040B469

Part of subcall function 0040C181: __EH_prolog.LIBCMT ref: 0040C186

lstrcpynA.KERNEL32(00429A4C,00000000,?,00000001,00000000,?,?,00000000,00000000,00000000,00000104,00000000), ref: 0040B489

Strings

0$D, xrefs: 0040B2C4

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: H_prologlstrcpyn
String ID: 0$D
API String ID: 588646068-1534285997
Opcode ID: 4d7271972a632b5ddb6469e247ace36ffef89c1a008344fd7db82f14121d3963
Instruction ID: 7a5477a34e1b1aa21e74964007552056c3557626f3e0ece7ae0e30277c087f24
Opcode Fuzzy Hash: 4d7271972a632b5ddb6469e247ace36ffef89c1a008344fd7db82f14121d3963
Instruction Fuzzy Hash: 0F817971800299EECF11EFA5D8819EEBB78EF15304F14406FF94172292D7385A09DBAD

Uniqueness

Uniqueness Score: -1.00%

Function 00402A71 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 147COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00402A76

Part of subcall function 00403B2D: __EH_prolog.LIBCMT ref: 00403B32
Part of subcall function 00403B2D: GetLastError.KERNEL32(?,00000104,00000000,?,00402244,?,00000000,02151168,00000000), ref: 00403B5A
Part of subcall function 00403B2D: SetLastError.KERNEL32(?,?,00000000,00000000,?,00000104,00000000,?,00402244,?,00000000,02151168,00000000), ref: 00403BA7

Part of subcall function 00401CF2: __EH_prolog.LIBCMT ref: 00401CF7
Part of subcall function 00401CF2: GetLastError.KERNEL32(004364B4,00000004,?,0041EEC5,?,00000004,?,?,00000000,?,?,?,00000000,02151168,00000000,00000000), ref: 00401D1A
Part of subcall function 00401CF2: SysFreeString.OLEAUT32(?), ref: 00401D38
Part of subcall function 00401CF2: SetLastError.KERNEL32(?,00000001,?,0041EEC5,?,00000004,?,?,00000000,?,?,?,00000000,02151168,00000000,00000000), ref: 00401D58

Strings

4$D, xrefs: 00402B07
\, xrefs: 00402AB7
4$D, xrefs: 00402AD2

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: ErrorLast$H_prolog$FreeString
String ID: 4$D$4$D$\
API String ID: 3800368667-1539703004
Opcode ID: 040c5766f923e0120bd998ce2e32f38caa2780a78423c7bc32168fa0d3021c6c
Instruction ID: b8b3814bf570c0965e00d68d671c00f0a4faa50f6e2a83c11ca2b75bf5c32b46
Opcode Fuzzy Hash: 040c5766f923e0120bd998ce2e32f38caa2780a78423c7bc32168fa0d3021c6c
Instruction Fuzzy Hash: B851A371D00259DADB14EF95CA45BEEBBB8AF14304F10416FE506B32C1DBB86B09CB68

Uniqueness

Uniqueness Score: -1.00%

Function 0040B94E Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 117COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040B953

Part of subcall function 00401581: __EH_prolog.LIBCMT ref: 00401586
Part of subcall function 00401581: GetLastError.KERNEL32(02151168,00000000,00000000,?,0041E199,?,00000000,reboot,00000000,00000000,00000000,runfromtemp,00000000,00000001,00000001,00000000), ref: 004015AF
Part of subcall function 00401581: SetLastError.KERNEL32(?,00000000,?,0041E199,?,00000000,reboot,00000000,00000000,00000000,runfromtemp,00000000,00000001,00000001,00000000), ref: 004015DD

Strings

|dC, xrefs: 0040B9D2
tdC, xrefs: 0040BA6C
tdC, xrefs: 0040B974

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: ErrorH_prologLast
String ID: tdC$tdC$|dC
API String ID: 1057991267-1874717632
Opcode ID: 6ed591fcc86966773b3a72b19c7dd1d1799adccd8649264a9a237712fe1df6d5
Instruction ID: f2de83a830c4f13f2092d6d668ca1ae0dccb1c54b0801bc0378efb031f2e1e7a
Opcode Fuzzy Hash: 6ed591fcc86966773b3a72b19c7dd1d1799adccd8649264a9a237712fe1df6d5
Instruction Fuzzy Hash: F7414671A00209EADB11EF95C891BEEB7B8EB54304F10803FE545B72C2DB785A49CB6D

Uniqueness

Uniqueness Score: -1.00%

Function 0041130F Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 113COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00411314

Part of subcall function 0041A34A: __EH_prolog.LIBCMT ref: 0041A34F

Part of subcall function 0041A471: __EH_prolog.LIBCMT ref: 0041A476

Part of subcall function 00401CF2: __EH_prolog.LIBCMT ref: 00401CF7
Part of subcall function 00401CF2: GetLastError.KERNEL32(004364B4,00000004,?,0041EEC5,?,00000004,?,?,00000000,?,?,?,00000000,02151168,00000000,00000000), ref: 00401D1A
Part of subcall function 00401CF2: SysFreeString.OLEAUT32(?), ref: 00401D38
Part of subcall function 00401CF2: SetLastError.KERNEL32(?,00000001,?,0041EEC5,?,00000004,?,?,00000000,?,?,?,00000000,02151168,00000000,00000000), ref: 00401D58

Part of subcall function 00403B2D: __EH_prolog.LIBCMT ref: 00403B32
Part of subcall function 00403B2D: GetLastError.KERNEL32(?,00000104,00000000,?,00402244,?,00000000,02151168,00000000), ref: 00403B5A
Part of subcall function 00403B2D: SetLastError.KERNEL32(?,?,00000000,00000000,?,00000104,00000000,?,00402244,?,00000000,02151168,00000000), ref: 00403BA7

Strings

AM_CONTENTID, xrefs: 0041133D
00000000000000000000000000000000, xrefs: 0041139B
AM_OTP, xrefs: 0041137B

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: H_prolog$ErrorLast$FreeString
String ID: 00000000000000000000000000000000$AM_CONTENTID$AM_OTP
API String ID: 3733137895-721395337
Opcode ID: 31e00cd2026df33e966b58b41e68f0bd2afb53edc81280a69cb5b8c231e1fe2b
Instruction ID: 93c13301d94347d212549fada689c718d3e3add5b553d89df72a42f6842736e1
Opcode Fuzzy Hash: 31e00cd2026df33e966b58b41e68f0bd2afb53edc81280a69cb5b8c231e1fe2b
Instruction Fuzzy Hash: A84182B1D0021DBADF04EFA4D846BED7BB8AF14318F50406EB945A7282DB789B488759

Uniqueness

Uniqueness Score: -1.00%

Function 004073CA Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 111COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004073CF

Strings

dC, xrefs: 00407451
dC, xrefs: 00407488
dC, xrefs: 00407442

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: H_prolog
String ID: dC$dC$dC
API String ID: 3519838083-370627719
Opcode ID: b3ce187dbcd11f4a484e5abed9657f9652ac780df004dc46175e77e09a4c5d69
Instruction ID: b3924989d12abf93bcd6ffe6c6e1df6d96f759b574748724039df0cf7925216c
Opcode Fuzzy Hash: b3ce187dbcd11f4a484e5abed9657f9652ac780df004dc46175e77e09a4c5d69
Instruction Fuzzy Hash: 3A414B71E05149AFCB05EFA9D591AEDBBB4AF18314F10806AF415B7281D738AF04CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0041B57B Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 109stringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0041B63B
lstrcatA.KERNEL32(00000000,00000000), ref: 0041B677
wsprintfA.USER32 ref: 0041B699

Part of subcall function 0041B897: __EH_prolog.LIBCMT ref: 0041B89C
Part of subcall function 0041B897: GetLastError.KERNEL32(02151168,00000000,?,0041E420,00000001,?,00000000,removeasmajorupgrade,00000000,00000000,00000001,?,?,00000000,reboot,00000000), ref: 0041B8C8
Part of subcall function 0041B897: SetLastError.KERNEL32(?,?,0041E420,00000001,?,00000000,removeasmajorupgrade,00000000,00000000,00000001,?,?,00000000,reboot,00000000,00000000), ref: 0041B8FE

Strings

%01d.%01d %s%s, xrefs: 0041B635

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: ErrorLastwsprintf$H_prologlstrcat
String ID: %01d.%01d %s%s
API String ID: 3897922275-3724692234
Opcode ID: 34c8e85b157fe533ec23f503281f70eecab1d54adff8521a9352914fc67d5537
Instruction ID: e1db373e9c788793741c830f1ec58a8de57455c7186b63247f01b17fcc536ea8
Opcode Fuzzy Hash: 34c8e85b157fe533ec23f503281f70eecab1d54adff8521a9352914fc67d5537
Instruction Fuzzy Hash: 3A31DCF7A001197BDB14DA54DC91FDB73ADEB84304F4080B6F709E7182DA74DA598BA8

Uniqueness

Uniqueness Score: -1.00%

Function 00417FC1 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00417FC6

Part of subcall function 00402838: __EH_prolog.LIBCMT ref: 0040283D
Part of subcall function 00402838: GetLastError.KERNEL32(02151168,00000000,00000000,?,0041E413,?,00000000,removeasmajorupgrade,00000000,00000000,00000001,?,?,00000000,reboot,00000000), ref: 00402866
Part of subcall function 00402838: SetLastError.KERNEL32(?,00000000,?,0041E413,?,00000000,removeasmajorupgrade,00000000,00000000,00000001,?,?,00000000,reboot,00000000,00000000), ref: 00402894

Part of subcall function 00402D6A: lstrlenW.KERNEL32(004364D8,02151168,00000104,00000000,004364BC,?,0041E536,tempdisk1folder,?,00000000,00000000,?,00000001,?,00000000,removeasmajorupgrade), ref: 00402DBD
Part of subcall function 00402D6A: WideCharToMultiByte.KERNEL32(00000000,00000000,004364D8,000000FF,?,00000002,00000000,00000000,?,0041E536,tempdisk1folder,?,00000000,00000000,?,00000001), ref: 00402DE5

GetModuleFileNameA.KERNEL32(00000000,00000000,00000400,|dC,00000400,?,00000000,?,00000003,ISSetup.dll,?,00000000,00000000), ref: 0041802F

Part of subcall function 004022FB: __EH_prolog.LIBCMT ref: 00402300
Part of subcall function 004022FB: GetLastError.KERNEL32(74DE8B60,00000104), ref: 0040232C
Part of subcall function 004022FB: SetLastError.KERNEL32(00000000,?,00000000,?,00000001), ref: 00402361

Part of subcall function 00402A71: __EH_prolog.LIBCMT ref: 00402A76

Part of subcall function 00401CF2: __EH_prolog.LIBCMT ref: 00401CF7
Part of subcall function 00401CF2: GetLastError.KERNEL32(004364B4,00000004,?,0041EEC5,?,00000004,?,?,00000000,?,?,?,00000000,02151168,00000000,00000000), ref: 00401D1A
Part of subcall function 00401CF2: SysFreeString.OLEAUT32(?), ref: 00401D38
Part of subcall function 00401CF2: SetLastError.KERNEL32(?,00000001,?,0041EEC5,?,00000004,?,?,00000000,?,?,?,00000000,02151168,00000000,00000000), ref: 00401D58

Part of subcall function 004029BB: __EH_prolog.LIBCMT ref: 004029C0
Part of subcall function 004029BB: SetLastError.KERNEL32(?,?,00000000,00000104,?,0041E59F,02151168,?,00000001,?,00000000,C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B},?,00000000), ref: 00402A26

Part of subcall function 0041883F: __EH_prolog.LIBCMT ref: 00418844

Strings

|dC, xrefs: 0041800C, 00418035, 00418010
ISSetup.dll, xrefs: 00417FD8, 0041806C

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: ErrorH_prologLast$ByteCharFileFreeModuleMultiNameStringWidelstrlen
String ID: ISSetup.dll$|dC
API String ID: 771115330-3065460551
Opcode ID: 383e00c1c51ac8c583d4d07a0ef533164735223dee3b521453e732b379319dfc
Instruction ID: 26c74837e0bbd655014cc5c3807d536f14c8d551d592da042ec83e4a1be0aabb
Opcode Fuzzy Hash: 383e00c1c51ac8c583d4d07a0ef533164735223dee3b521453e732b379319dfc
Instruction Fuzzy Hash: 0D317071801208FEDB01EBE5D996ADEBB7CAF14308F10806EB516B31C2DB785B49C764

Uniqueness

Uniqueness Score: -1.00%

Function 004290D8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 91COMMON

Download Yara Rule

APIs

InterlockedIncrement.KERNEL32(00446CEC), ref: 0042914A
InterlockedDecrement.KERNEL32(00446CEC), ref: 00429159
InterlockedDecrement.KERNEL32(00446CEC), ref: 004291BC

Strings

lD, xrefs: 00429144

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: Interlocked$Decrement$Increment
String ID: lD
API String ID: 2574743344-1556624830
Opcode ID: 64daa6ed29ca0b330afe13f5fb3a6a28a006ddb9de1849b8c511c00b6128acb5
Instruction ID: 5faf6da3bfbdbb9b64d7b9d5fd7312a6099396ea2e16aacfa9bd5dfdfc821796
Opcode Fuzzy Hash: 64daa6ed29ca0b330afe13f5fb3a6a28a006ddb9de1849b8c511c00b6128acb5
Instruction Fuzzy Hash: C331D475600227ABEB24AF16E8492FA7764FB01711F90C01BFC4A46284D778CDD2CB9D

Uniqueness

Uniqueness Score: -1.00%

Function 0041167D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89fileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00411682

Part of subcall function 00411C69: InterlockedDecrement.KERNEL32(?), ref: 00411C7A
Part of subcall function 00411C69: CloseHandle.KERNEL32(?,?,?,?,00411691,?,00000001,00000000,004114CD, fC,80000000,00000001,00000080,00000003,00000000,00000000), ref: 00411CA2

CreateFileA.KERNEL32(00000000,?,?,?,?,00000000,?,?,00000001,00000000,004114CD, fC,80000000,00000001,00000080,00000003), ref: 004116DF
GetLastError.KERNEL32(00000000,00000000,80400100,?,00000001,00000000,004114CD, fC,80000000,00000001,00000080,00000003,00000000,00000000,?,00000000), ref: 004116ED

Strings

toys::file, xrefs: 00411715

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: CloseCreateDecrementErrorFileH_prologHandleInterlockedLast
String ID: toys::file
API String ID: 1883868898-314977804
Opcode ID: 948577bfb73e4645a423e7faab58c135343c4e3e08297271fcafa3e406cd693f
Instruction ID: c53540afc9ed22950d76bcc64ed983805cbffcc013254ddb641ad57e22b9b62c
Opcode Fuzzy Hash: 948577bfb73e4645a423e7faab58c135343c4e3e08297271fcafa3e406cd693f
Instruction Fuzzy Hash: E621D571600204AFCB10AF75DD81AEE3BA5EB84358F10452FF666933E1DB3D88409628

Uniqueness

Uniqueness Score: -1.00%

Function 0040B7F0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 87COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040B7F5

Part of subcall function 0040B64D: __EH_prolog.LIBCMT ref: 0040B652
Part of subcall function 0040B64D: GetLastError.KERNEL32(00436474,?,0043647C,?,0040AF26,?,00000000,00000001,?,00000000), ref: 0040B67A
Part of subcall function 0040B64D: SetLastError.KERNEL32(?,?,00000000,00000000,?,0043647C,?,0040AF26,?,00000000,00000001,?,00000000), ref: 0040B6C7

Part of subcall function 00401581: __EH_prolog.LIBCMT ref: 00401586
Part of subcall function 00401581: GetLastError.KERNEL32(02151168,00000000,00000000,?,0041E199,?,00000000,reboot,00000000,00000000,00000000,runfromtemp,00000000,00000001,00000001,00000000), ref: 004015AF
Part of subcall function 00401581: SetLastError.KERNEL32(?,00000000,?,0041E199,?,00000000,reboot,00000000,00000000,00000000,runfromtemp,00000000,00000001,00000001,00000000), ref: 004015DD

Part of subcall function 0040AEF4: __EH_prolog.LIBCMT ref: 0040AEF9

Part of subcall function 0040191F: GetLastError.KERNEL32(02151168,00000000,0041E21A,removeasmajorupgrade,00000000,00000000,00000001,?,?,00000000,reboot,00000000,00000000,00000000,runfromtemp,00000000), ref: 00401935
Part of subcall function 0040191F: SysFreeString.OLEAUT32(?), ref: 00401953
Part of subcall function 0040191F: SetLastError.KERNEL32(?,00000001,?,00000000), ref: 00401973

Strings

tdC, xrefs: 0040B80E
|dC, xrefs: 0040B809
., xrefs: 0040B84E

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: ErrorLast$H_prolog$FreeString
String ID: .$tdC$|dC
API String ID: 3800368667-3655904522
Opcode ID: 0680a02813b63740f45960c3912e504f4380c5dc9ab59c91849d385ab84cbffa
Instruction ID: 4579f4b9ac5ceffa1359283ff1489a8541986bcdaf05fd725d0c8c53f2b97962
Opcode Fuzzy Hash: 0680a02813b63740f45960c3912e504f4380c5dc9ab59c91849d385ab84cbffa
Instruction Fuzzy Hash: B2311CB1D00219EEDB11EFA5C891BDDBBB8EF14308F10406AE505772D2DB781A49CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0041D02C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 57COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0041D031

Part of subcall function 004204D4: wsprintfA.USER32 ref: 004204E6
Part of subcall function 004204D4: LoadStringA.USER32(?,?,?), ref: 00420511

wsprintfA.USER32 ref: 0041D09A

Part of subcall function 0041CE57: SetWindowTextA.USER32(?,00000000), ref: 0041CE61

Part of subcall function 00420C44: lstrlenA.KERNEL32(?,?,?,00401E26,?,C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B},?,?,?,00000104), ref: 00420C4C
Part of subcall function 00420C44: lstrcpynA.KERNEL32(?,?,-00000001,?,00401E26,?,C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B},?,?,?,00000104), ref: 00420C6A
Part of subcall function 00420C44: lstrcatA.KERNEL32(?,?,?,?,00401E26,?,C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B},?,?,?,00000104), ref: 00420C8A

Strings

%s: %s, xrefs: 0041D094
C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B}, xrefs: 0041D0B5

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: wsprintf$H_prologLoadStringTextWindowlstrcatlstrcpynlstrlen
String ID: %s: %s$C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B}
API String ID: 530167989-3035542176
Opcode ID: 9fd2345c91f7da2d8b087f3c9634c81b68a3f66033605af7d1ebf2ff0a5e57ef
Instruction ID: 1c11aa0a19b035e54d766519d9142c99ff3e648fe3bd8f29f17f6887ece2d285
Opcode Fuzzy Hash: 9fd2345c91f7da2d8b087f3c9634c81b68a3f66033605af7d1ebf2ff0a5e57ef
Instruction Fuzzy Hash: AD118172A00219ABDB11EBA5DC06BDEBB74BF44308F1045BAF314B50E2DB785658CA44

Uniqueness

Uniqueness Score: -1.00%

Function 00404192 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 53COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00404197

Strings

oA, xrefs: 0040419E, 004041D8, 004041BC, 004041E8
, xrefs: 0040419C
dC, xrefs: 004041AA

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: H_prolog
String ID: $oA$dC
API String ID: 3519838083-3678287390
Opcode ID: b8d1de7b39d502a5fea03c3c0f997cfb9280fea52be152c5e8bdc30944dd3162
Instruction ID: 5c32757f56bae3ec4d7ed42ee0345f51c339ba7efbb631dbfeb82d68b4161c84
Opcode Fuzzy Hash: b8d1de7b39d502a5fea03c3c0f997cfb9280fea52be152c5e8bdc30944dd3162
Instruction Fuzzy Hash: D1015EB4700201BBDF18EB16DC15B6F366AEBD4718F00412EF912AB2D1CB389E10C66C

Uniqueness

Uniqueness Score: -1.00%

Function 0040B6E0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040B6E5
GetLastError.KERNEL32(00436474,00000001,0043647C,?,0040AFA1,?,?,00000000,?,00000000,00429A4C,FFFFFFFF,00000001,?,00000000,00000001), ref: 0040B70E
SetLastError.KERNEL32(?,00000000,00000000,00000000,?,0040AFA1,?,?,00000000,?,00000000,00429A4C,FFFFFFFF,00000001,?,00000000), ref: 0040B763

Strings

4$D, xrefs: 0040B73C

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: ErrorLast$H_prolog
String ID: 4$D
API String ID: 2881783280-1551560817
Opcode ID: 76422ffe8749950f18bb7bdb6faf9cc1dd2f72abcff6babc5bfff87a57867a8a
Instruction ID: 054553cc0b7834e48527a3ff469fc29d116ef18375bd7a797fea3973b71837a1
Opcode Fuzzy Hash: 76422ffe8749950f18bb7bdb6faf9cc1dd2f72abcff6babc5bfff87a57867a8a
Instruction Fuzzy Hash: 681166B5600346EFCB109F69C88484AFBF4FF58308B40896EF48A97362C774E904CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0041A721 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 53COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0041A726

Part of subcall function 0040B64D: __EH_prolog.LIBCMT ref: 0040B652
Part of subcall function 0040B64D: GetLastError.KERNEL32(00436474,?,0043647C,?,0040AF26,?,00000000,00000001,?,00000000), ref: 0040B67A
Part of subcall function 0040B64D: SetLastError.KERNEL32(?,?,00000000,00000000,?,0043647C,?,0040AF26,?,00000000,00000001,?,00000000), ref: 0040B6C7

Part of subcall function 0041A9B1: __EH_prolog.LIBCMT ref: 0041A9B6
Part of subcall function 0041A9B1: GetLastError.KERNEL32(00436474,00000001,0043647C,?,0041A777,00000000,00000001,00000000,00000000,?,00000000,ISSCRIPTCMDLINE,75BF8400,00000000), ref: 0041A9DF
Part of subcall function 0041A9B1: SetLastError.KERNEL32(?,?,00000000,00000000,?,0041A777,00000000,00000001,00000000,00000000,?,00000000,ISSCRIPTCMDLINE,75BF8400,00000000), ref: 0041AA20

Part of subcall function 0040191F: GetLastError.KERNEL32(02151168,00000000,0041E21A,removeasmajorupgrade,00000000,00000000,00000001,?,?,00000000,reboot,00000000,00000000,00000000,runfromtemp,00000000), ref: 00401935
Part of subcall function 0040191F: SysFreeString.OLEAUT32(?), ref: 00401953
Part of subcall function 0040191F: SetLastError.KERNEL32(?,00000001,?,00000000), ref: 00401973

Strings

tdC, xrefs: 0041A73F
ISSCRIPTCMDLINE, xrefs: 0041A734
|dC, xrefs: 0041A737

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: ErrorLast$H_prolog$FreeString
String ID: ISSCRIPTCMDLINE$tdC$|dC
API String ID: 3800368667-2132639760
Opcode ID: a86d8de9aac48f3c3da932222f5022924f3b49b92ca101e287530b99df217056
Instruction ID: 01e98d7f17d14cfdcc11c0dd75cdd4187933f228aef3468b66c43898667479ac
Opcode Fuzzy Hash: a86d8de9aac48f3c3da932222f5022924f3b49b92ca101e287530b99df217056
Instruction Fuzzy Hash: B3118CB1900258ABCB01EF95D855BEEBF75FF58318F10402EF55567281CB781A48CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00403BC0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00403BC5
GetLastError.KERNEL32(004364B4,00000001,004364BC,?,00402B1E,?,?,00000000,?,00000000,00429A4C,FFFFFFFF,00000001,?,00000000), ref: 00403BEE
SetLastError.KERNEL32(?,00000000,00000000,00000000,?,00402B1E,?,?,00000000,?,00000000,00429A4C,FFFFFFFF,00000001,?,00000000), ref: 00403C43

Strings

4$D, xrefs: 00403C1C

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: ErrorLast$H_prolog
String ID: 4$D
API String ID: 2881783280-1551560817
Opcode ID: ae63ab7ccd92dd40fdcf4dadff417ae1b0d1c6a74fe29ab42d5dc89b3f45813a
Instruction ID: 017f495f9e04111e67d33887e3b123316ffc806a158f13b39b759f5269e5c7dd
Opcode Fuzzy Hash: ae63ab7ccd92dd40fdcf4dadff417ae1b0d1c6a74fe29ab42d5dc89b3f45813a
Instruction Fuzzy Hash: 87116675600346EFCB109F69C88484AFBF4FF58308B40892EE49A97352C7B4EA04CF98

Uniqueness

Uniqueness Score: -1.00%

Function 0041DF69 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 51COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0041DF6E

Part of subcall function 0040B6E0: __EH_prolog.LIBCMT ref: 0040B6E5
Part of subcall function 0040B6E0: GetLastError.KERNEL32(00436474,00000001,0043647C,?,0040AFA1,?,?,00000000,?,00000000,00429A4C,FFFFFFFF,00000001,?,00000000,00000001), ref: 0040B70E
Part of subcall function 0040B6E0: SetLastError.KERNEL32(?,00000000,00000000,00000000,?,0040AFA1,?,?,00000000,?,00000000,00429A4C,FFFFFFFF,00000001,?,00000000), ref: 0040B763

Part of subcall function 0041DE26: __EH_prolog.LIBCMT ref: 0041DE2B

Part of subcall function 0040191F: GetLastError.KERNEL32(02151168,00000000,0041E21A,removeasmajorupgrade,00000000,00000000,00000001,?,?,00000000,reboot,00000000,00000000,00000000,runfromtemp,00000000), ref: 00401935
Part of subcall function 0040191F: SysFreeString.OLEAUT32(?), ref: 00401953
Part of subcall function 0040191F: SetLastError.KERNEL32(?,00000001,?,00000000), ref: 00401973

Strings

Languages, xrefs: 0041DF76
|dC, xrefs: 0041DF9C, 0041DFA1
tdC, xrefs: 0041DF90

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: ErrorLast$H_prolog$FreeString
String ID: Languages$tdC$|dC
API String ID: 3800368667-909386891
Opcode ID: 7b8623b531656a9ea72553682d182146eebf3c60ac7d07da386a1cc9c995a1f4
Instruction ID: 11e2ddd478bae13379fe777a8e159d9b0e3bc9e6fed7d5707785ff5ff9285866
Opcode Fuzzy Hash: 7b8623b531656a9ea72553682d182146eebf3c60ac7d07da386a1cc9c995a1f4
Instruction Fuzzy Hash: 4511A371D0011CBBCB14DFD5D8058DEBB79EB54364F00812BF406A7241D7389A48CB68

Uniqueness

Uniqueness Score: -1.00%

Function 0041F6D8 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0041F6DD
GetLastError.KERNEL32(004364B4,00000004,004364BC,?,0041EE68,?,?,?,00000000,02151168,00000000,00000000), ref: 0041F706
SetLastError.KERNEL32(?,00000000,?,00000000,?,0041EE68,?,?,?,00000000,02151168,00000000,00000000), ref: 0041F754

Strings

4$D, xrefs: 0041F739

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: ErrorLast$H_prolog
String ID: 4$D
API String ID: 2881783280-1551560817
Opcode ID: 17c510685c05f2bc7d9874f8d72322ae9dd72c00b3c2e87cbf0aba8049d848d4
Instruction ID: cb83227ed186edf97dfee6b4e652b8230f0f2e99ed51684faf11d40f557dca69
Opcode Fuzzy Hash: 17c510685c05f2bc7d9874f8d72322ae9dd72c00b3c2e87cbf0aba8049d848d4
Instruction Fuzzy Hash: C711487560060AEFCB20DF59D58088AFBF1FF58704B41856EE48AA7352C774E915CF98

Uniqueness

Uniqueness Score: -1.00%

Function 0040C433 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 49COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?), ref: 0040C478

Strings

\tdC, xrefs: 0040C461
tdC, xrefs: 0040C49C
tdC, xrefs: 0040C48E

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: FreeString
String ID: \tdC$tdC$tdC
API String ID: 3341692771-1217256054
Opcode ID: 770246b674da0e1fb6c082cc0b5596ae195158226ca40d67aeb5cdd290dd5ab3
Instruction ID: 9830fe05bd3d1e266ff27d9d9ac45268f2d93fa5b8b17f955c1b29a7d9d68ac1
Opcode Fuzzy Hash: 770246b674da0e1fb6c082cc0b5596ae195158226ca40d67aeb5cdd290dd5ab3
Instruction Fuzzy Hash: 37019635200602EBC7249F19C451BB6B3E8FF91710F15822EA852AB681D778E909CB6D

Uniqueness

Uniqueness Score: -1.00%

Function 00428125 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

InterlockedIncrement.KERNEL32(00446CEC), ref: 0042814F
InterlockedDecrement.KERNEL32(00446CEC), ref: 00428164

Strings

lD, xrefs: 00428148

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: Interlocked$DecrementIncrement
String ID: lD
API String ID: 2172605799-1556624830
Opcode ID: b9db1bb1a418d014aab24315f455aa1b58dcd3352b36d0c416253ba6f7f1496a
Instruction ID: 33b7a8edb92dd2830899d11c5e5d8e5d8efd13bc234504caa70ea88d86b20432
Opcode Fuzzy Hash: b9db1bb1a418d014aab24315f455aa1b58dcd3352b36d0c416253ba6f7f1496a
Instruction Fuzzy Hash: 4AF0AF763062326BE720AF15FC82AAEA765EFC2311F95443FF104451D4CFA89893866E

Uniqueness

Uniqueness Score: -1.00%

Function 0042D7CA Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

InterlockedIncrement.KERNEL32(00446CEC), ref: 0042D7F0
InterlockedDecrement.KERNEL32(00446CEC), ref: 0042D805

Strings

lD, xrefs: 0042D7E9

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: Interlocked$DecrementIncrement
String ID: lD
API String ID: 2172605799-1556624830
Opcode ID: 983099bc19af77cbe3b2f52fbe8274774664a7afb60b7172b48b17f1d79c3297
Instruction ID: de8f5417f2266793152f8c6de053fb566ad7f8f9802312b4371a35e6c0335179
Opcode Fuzzy Hash: 983099bc19af77cbe3b2f52fbe8274774664a7afb60b7172b48b17f1d79c3297
Instruction Fuzzy Hash: 2CF0C272B052726BE710BF55BCC294BA3A8FBC2721F95543FF01485151CB68C881C65E

Uniqueness

Uniqueness Score: -1.00%

Function 0042AC16 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

InterlockedIncrement.KERNEL32(00446CEC), ref: 0042AC3C
InterlockedDecrement.KERNEL32(00446CEC), ref: 0042AC51

Strings

lD, xrefs: 0042AC35

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: Interlocked$DecrementIncrement
String ID: lD
API String ID: 2172605799-1556624830
Opcode ID: e9c6298ca2fabadf242d8605f871c5f470aff24c4f3f688e5b4fe92b43decaf3
Instruction ID: a514365d1f96c74d9378113446de06c06e981c42c091e8d0588b64f16002765b
Opcode Fuzzy Hash: e9c6298ca2fabadf242d8605f871c5f470aff24c4f3f688e5b4fe92b43decaf3
Instruction Fuzzy Hash: 52F0C2323056316FE720AF6BBDC594B6769FB82321F95443FF90185190CBA898928A5F

Uniqueness

Uniqueness Score: -1.00%

Function 00410ED5 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 42COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00410EDA

Part of subcall function 00402375: __EH_prolog.LIBCMT ref: 0040237A

Part of subcall function 00407585: __EH_prolog.LIBCMT ref: 0040758A
Part of subcall function 00407585: lstrcmpA.KERNEL32(?,00442430,?,?,00442430,?,?,?,Languages,00000000,?,0041CF62,Languages,count,00000000,?), ref: 004075B9

Strings

Languages, xrefs: 00410F12
C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B}\Setup.INI, xrefs: 00410EF0
count, xrefs: 00410F0D

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: H_prolog$lstrcmp
String ID: C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B}\Setup.INI$Languages$count
API String ID: 4174983478-1146931302
Opcode ID: 18654295c2ee57c546b92a50332e07a299e44b9228fbfc32bff12dea66ff40e4
Instruction ID: e8eac9a3eb0035e59857f9b3c19899a4df6bd68f7da1325ef7aaa792b4525e1a
Opcode Fuzzy Hash: 18654295c2ee57c546b92a50332e07a299e44b9228fbfc32bff12dea66ff40e4
Instruction Fuzzy Hash: 89017172E00214ABCB14EFA9D952ADDB774EB08718F20816FF422761D0D7BC1B09CB58

Uniqueness

Uniqueness Score: -1.00%

Function 004022FB Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00402300
GetLastError.KERNEL32(74DE8B60,00000104), ref: 0040232C
SetLastError.KERNEL32(00000000,?,00000000,?,00000001), ref: 00402361

Strings

4$D, xrefs: 0040231A

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: ErrorLast$H_prolog
String ID: 4$D
API String ID: 2881783280-1551560817
Opcode ID: 2d52adde5ef6855f84fa84f089f8033af787f9de70878a7ead3987dfa0d2a82e
Instruction ID: 64b4ad9014e8e33a25ce99f6e47c3214811f0f95deecb8ec2bb9e480ad09f0be
Opcode Fuzzy Hash: 2d52adde5ef6855f84fa84f089f8033af787f9de70878a7ead3987dfa0d2a82e
Instruction Fuzzy Hash: 2A018431500204EBDB15EB79D589BDEBBB8EF04318F00812EF442B32D1DBB89A45C704

Uniqueness

Uniqueness Score: -1.00%

Function 00409F70 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00409F75
GetLastError.KERNEL32(00000000,00000104), ref: 00409FA1
SetLastError.KERNEL32(00000000,?,00000000,?,00000001), ref: 00409FD6

Strings

4$D, xrefs: 00409F8F

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: ErrorLast$H_prolog
String ID: 4$D
API String ID: 2881783280-1551560817
Opcode ID: 811ffdb286fd3ee7270a4490d9c56a7e75a01af70de3e97d43fec4d696ce0743
Instruction ID: c43059bb1622d51ee0e29faa8e638a24c42349e9c952408bb39c33eb8369e161
Opcode Fuzzy Hash: 811ffdb286fd3ee7270a4490d9c56a7e75a01af70de3e97d43fec4d696ce0743
Instruction Fuzzy Hash: E7018431900105EFDB15EB69C445BEEB7B9EF04318F00853EF011A32E2DB789945CB14

Uniqueness

Uniqueness Score: -1.00%

Function 0040A71D Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 39libraryCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040A722

Part of subcall function 0040B64D: __EH_prolog.LIBCMT ref: 0040B652
Part of subcall function 0040B64D: GetLastError.KERNEL32(00436474,?,0043647C,?,0040AF26,?,00000000,00000001,?,00000000), ref: 0040B67A
Part of subcall function 0040B64D: SetLastError.KERNEL32(?,?,00000000,00000000,?,0043647C,?,0040AF26,?,00000000,00000001,?,00000000), ref: 0040B6C7

Part of subcall function 004016F0: lstrlenW.KERNEL32(00436494,74DF34C0,74DF2EE0,00000000,00000000,?,0041FD7B,?,?,00000001,?,80000000,00000003,00000000,00000003,00000080), ref: 00401743
Part of subcall function 004016F0: WideCharToMultiByte.KERNEL32(00000000,00000000,00436494,000000FF,?,00000002,00000000,00000000,?,0041FD7B,?,?,00000001,?,80000000,00000003), ref: 0040176B

LoadLibraryA.KERNEL32(00000000,?,00000000,?,00000003,?,0041463A,?,00000000,?,00000001,00000000,00442430,00000000,00000032,?), ref: 0040A753
GetLastError.KERNEL32(?,0041463A,?,00000000,?,00000001,00000000,00442430,00000000,00000032,?,00000032), ref: 0040A764

Part of subcall function 0042045D: wsprintfA.USER32 ref: 00420493
Part of subcall function 0042045D: wvsprintfA.USER32(?,?,?), ref: 004204AE

Strings

tdC, xrefs: 0040A73B

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: ErrorLast$H_prolog$ByteCharLibraryLoadMultiWidelstrlenwsprintfwvsprintf
String ID: tdC
API String ID: 2622529241-1123919639
Opcode ID: 1da230f500b13cb9d0eafeb243384e275b9dc7725386b78fe33fa38bf48891c5
Instruction ID: 6ceec37feba07e11262af58f70fe5320cfac878023a3e2ef0face7ca4c30ad31
Opcode Fuzzy Hash: 1da230f500b13cb9d0eafeb243384e275b9dc7725386b78fe33fa38bf48891c5
Instruction Fuzzy Hash: 1A01D670D00210BFC710AF55D80556EBFF9EF99350F01852FF88593352CBB889008A6D

Uniqueness

Uniqueness Score: -1.00%

Function 0043085A Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

InterlockedIncrement.KERNEL32(00446CEC), ref: 00430866
InterlockedDecrement.KERNEL32(00446CEC), ref: 0043087D

Part of subcall function 0042B6F4: InitializeCriticalSection.KERNEL32(00000000,00000000,?,?,00430238,00000009,00000000,00000000,00000001,0042AA98,00000001,00000074,?,?,00000000,00000001), ref: 0042B731
Part of subcall function 0042B6F4: EnterCriticalSection.KERNEL32(?,?,?,00430238,00000009,00000000,00000000,00000001,0042AA98,00000001,00000074,?,?,00000000,00000001), ref: 0042B74C

InterlockedDecrement.KERNEL32(00446CEC), ref: 004308A9

Strings

lD, xrefs: 0043085F

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: Interlocked$CriticalDecrementSection$EnterIncrementInitialize
String ID: lD
API String ID: 2038102319-1556624830
Opcode ID: 68ba9b5a12dc7f8731d66c210015807dd9605c721ff381a7e79ad423de870320
Instruction ID: e6937f914d2ce01282821c95dad02547b844a18c1158ab8b6cc82b595c82b59a
Opcode Fuzzy Hash: 68ba9b5a12dc7f8731d66c210015807dd9605c721ff381a7e79ad423de870320
Instruction Fuzzy Hash: 8BF0E9321011197FF7147B56FCD19CA376CEF85335F11803BF504491518BB989428AED

Uniqueness

Uniqueness Score: -1.00%

Function 0040191F Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(02151168,00000000,0041E21A,removeasmajorupgrade,00000000,00000000,00000001,?,?,00000000,reboot,00000000,00000000,00000000,runfromtemp,00000000), ref: 00401935
SysFreeString.OLEAUT32(?), ref: 00401953
SetLastError.KERNEL32(?,00000001,?,00000000), ref: 00401973

Strings

|dC, xrefs: 00401948

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: ErrorLast$FreeString
String ID: |dC
API String ID: 2425351278-1290729135
Opcode ID: 3dc7c23a122f8b060085a4f6ce35bf8e4d2f208c1c6abf2db7b429784c217759
Instruction ID: 8d885547d4e277207572a3df1b448b3ee5c326aa4fa73ddfa905da5b5123ec0d
Opcode Fuzzy Hash: 3dc7c23a122f8b060085a4f6ce35bf8e4d2f208c1c6abf2db7b429784c217759
Instruction Fuzzy Hash: A2F06D363005119FCB189F2CEC09999B7E1EB89B10316867DE486C72A5DF35E815CB44

Uniqueness

Uniqueness Score: -1.00%

Function 00426B50 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 35COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00426B55

Strings

0$D, xrefs: 00426B68
0$D, xrefs: 00426B5E
string too long, xrefs: 00426B5D

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: H_prolog
String ID: 0$D$0$D$string too long
API String ID: 3519838083-3605364338
Opcode ID: 84d5a7617be799898a290f4d0d7d06c229e51341c8a71fa7352e1bd59999d1d8
Instruction ID: 480b5ba95fbcd6d2858fdf43ed7542b83172aa2780e8285809aa9aa2076c40a5
Opcode Fuzzy Hash: 84d5a7617be799898a290f4d0d7d06c229e51341c8a71fa7352e1bd59999d1d8
Instruction Fuzzy Hash: 47F06276700255AFDB009B45DC41BAEBBA8EF84344F00806FF111A7242C7B85A04C7A8

Uniqueness

Uniqueness Score: -1.00%

Function 00407585 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34stringCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040758A

Part of subcall function 004025BC: __EH_prolog.LIBCMT ref: 004025C1

lstrcmpA.KERNEL32(?,00442430,?,?,00442430,?,?,?,Languages,00000000,?,0041CF62,Languages,count,00000000,?), ref: 004075B9

Strings

Languages, xrefs: 00407591
0$D, xrefs: 00407593

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: H_prolog$lstrcmp
String ID: 0$D$Languages
API String ID: 4174983478-4147398553
Opcode ID: d1b974d1f7c8c5aa4771bfd2a55a39c624c78176810b12dc50600d0cbbbbd559
Instruction ID: 63335590797c48ada9e57502c80fda3333a096813036ea657472c9d98f0e5d36
Opcode Fuzzy Hash: d1b974d1f7c8c5aa4771bfd2a55a39c624c78176810b12dc50600d0cbbbbd559
Instruction Fuzzy Hash: 36F09031504119FBDF119F05ED06ADF3F25EF01369F00802BF800666A1CB799D20DB69

Uniqueness

Uniqueness Score: -1.00%

Function 0042D954 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KERNEL32,00428A81), ref: 0042D959
GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 0042D969

Strings

IsProcessorFeaturePresent, xrefs: 0042D963
KERNEL32, xrefs: 0042D954

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: IsProcessorFeaturePresent$KERNEL32
API String ID: 1646373207-3105848591
Opcode ID: 923737e30eeaa3c07186a637071c3e12a4bc623acb502d1e0e8d581adb3536ed
Instruction ID: c3308eda263db30da73ae20e61aecdb5fe021712c90e291a2216c4ec01b33ac1
Opcode Fuzzy Hash: 923737e30eeaa3c07186a637071c3e12a4bc623acb502d1e0e8d581adb3536ed
Instruction Fuzzy Hash: 9BC08CE0B8931272FF202BB26C09F3B24086B0CB03F61A5A3B482D12C4CF9CC040A02D

Uniqueness

Uniqueness Score: -1.00%

Function 004252DE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 8libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32,GetNativeSystemInfo), ref: 004252ED
GetProcAddress.KERNEL32(00000000), ref: 004252F4

Strings

GetNativeSystemInfo, xrefs: 004252E3
kernel32, xrefs: 004252E8

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetNativeSystemInfo$kernel32
API String ID: 1646373207-3846845290
Opcode ID: fd095a6aca9233ce9c5df15db53d2860de404038e764935d4f805f22bfb50747
Instruction ID: bf2de26b0701b6648f4074f8884ef2a22305f60ec258e9e4ae7caf26b5cef8eb
Opcode Fuzzy Hash: fd095a6aca9233ce9c5df15db53d2860de404038e764935d4f805f22bfb50747
Instruction Fuzzy Hash: 99C09BB4E42702FFCA001BE0FD0D9193A54E70D7037617173BC0295165CA7811049E1D

Uniqueness

Uniqueness Score: -1.00%

Function 0042528F Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 8libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32,IsWow64Process), ref: 0042529E
GetProcAddress.KERNEL32(00000000), ref: 004252A5

Strings

IsWow64Process, xrefs: 00425294
kernel32, xrefs: 00425299

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: IsWow64Process$kernel32
API String ID: 1646373207-3789238822
Opcode ID: 1d0c03785477faac14073efc9edc9892b3d18d4c108fabbbc0bfcc1396a76841
Instruction ID: 202c0f2d1e2768d904ca74bd4d83b4d9cbfe88f6db40aee63f2f209134879dea
Opcode Fuzzy Hash: 1d0c03785477faac14073efc9edc9892b3d18d4c108fabbbc0bfcc1396a76841
Instruction Fuzzy Hash: 14C09BB4A41702FBCA002B71BC0D9193A64B70D702731A473FC0295166C67D00045F1D

Uniqueness

Uniqueness Score: -1.00%

Function 00425300 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 8libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32,Wow64EnableWow64FsRedirection), ref: 0042530F
GetProcAddress.KERNEL32(00000000), ref: 00425316

Strings

Wow64EnableWow64FsRedirection, xrefs: 00425305
kernel32, xrefs: 0042530A

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Wow64EnableWow64FsRedirection$kernel32
API String ID: 1646373207-1260278450
Opcode ID: 402f5aecd2ca6dd8b1252c1d03154cab07cf3f8b8aff99d361c30c9f73eaf482
Instruction ID: 612529ffd4d4f7c17c290ef84a29b6ec0173e2ed03e15d3d6c6f3f8d944d9cff
Opcode Fuzzy Hash: 402f5aecd2ca6dd8b1252c1d03154cab07cf3f8b8aff99d361c30c9f73eaf482
Instruction Fuzzy Hash: D1C092B5A42702BBCA00ABA0FC0DD193A64B70DB02BA2B173BC02D1169EBB840059A1D

Uniqueness

Uniqueness Score: -1.00%

Function 00429D9A Relevance: 6.5, APIs: 5, Instructions: 278COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70814f33e739492fd64ba40272af18263ef337cd86059a24fec695d3914b1ca3
Instruction ID: 1c7b8ddc71023e9b8c90a90e4c5902e8ee2b56eaf68496bac26a8d72ed78efd7
Opcode Fuzzy Hash: 70814f33e739492fd64ba40272af18263ef337cd86059a24fec695d3914b1ca3
Instruction Fuzzy Hash: B191E471F00134ABDB21EF65FD80ADF7B74EB05364FA50127F854A6291D7398D4086AE

Uniqueness

Uniqueness Score: -1.00%

Function 0042C483 Relevance: 6.4, APIs: 5, Instructions: 102memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(00000000,00002020,0043FA20,0043FA20,?,?,0042C94F,00000000,00000010,00000000,00000009,00000009,?,00427B63,00000010,00000000), ref: 0042C4A4
VirtualAlloc.KERNEL32(00000000,00400000,00002000,00000004,?,?,0042C94F,00000000,00000010,00000000,00000009,00000009,?,00427B63,00000010,00000000), ref: 0042C4C8
VirtualAlloc.KERNEL32(00000000,00010000,00001000,00000004,?,?,0042C94F,00000000,00000010,00000000,00000009,00000009,?,00427B63,00000010,00000000), ref: 0042C4E2
VirtualFree.KERNEL32(00000000,00000000,00008000,?,?,0042C94F,00000000,00000010,00000000,00000009,00000009,?,00427B63,00000010,00000000,?), ref: 0042C5A3
HeapFree.KERNEL32(00000000,00000000,?,?,0042C94F,00000000,00000010,00000000,00000009,00000009,?,00427B63,00000010,00000000,?,00000000), ref: 0042C5BA

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: AllocVirtual$FreeHeap
String ID:
API String ID: 714016831-0
Opcode ID: 30e39069d949263d94a5f66e36f5b0b7a38e878573757fc5dd5872fd976f742d
Instruction ID: ee1b3c54b2808ba3490cb5eb93ad39d3edbbe942f70b5233751a04efc888ad09
Opcode Fuzzy Hash: 30e39069d949263d94a5f66e36f5b0b7a38e878573757fc5dd5872fd976f742d
Instruction Fuzzy Hash: 6B310471B40B21BFD3309F24EC84B2AB7E0FB49754F51853AE45A976A0D778E8848B4C

Uniqueness

Uniqueness Score: -1.00%

Function 00425527 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 199stringCOMMON

Download Yara Rule

APIs

lstrcmpA.KERNEL32(00000000,GIF87a), ref: 0042556B
lstrcmpA.KERNEL32(00000000,GIF89a), ref: 00425583

Strings

GIF89a, xrefs: 0042557D
GIF87a, xrefs: 00425565

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: lstrcmp
String ID: GIF87a$GIF89a
API String ID: 1534048567-2918331024
Opcode ID: 5bf677234300149bf5828593bf1fdca3faaf2ca6bce714a1e11ebeff92f8fc77
Instruction ID: 57b00ca87a5adec84497a59ffa52e227a89bd0966873714414d9eae2cc1467eb
Opcode Fuzzy Hash: 5bf677234300149bf5828593bf1fdca3faaf2ca6bce714a1e11ebeff92f8fc77
Instruction Fuzzy Hash: 2B612471740311EBDB208F64E886FA6B7F9EF19314FA0441BE885CB242E779D944CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00430662 Relevance: 6.1, APIs: 4, Instructions: 135fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,00000000,00000000,004311E3,00000000,00001000), ref: 00430729

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 6498533bca044fcca7b9c8b8f8b2f28bd0f140bd4e53080b15a82ff8b927e462
Instruction ID: a585615aa7a08f983875dc244ce0f7f9524b7196afe8a43ab26e0d10c46bbb94
Opcode Fuzzy Hash: 6498533bca044fcca7b9c8b8f8b2f28bd0f140bd4e53080b15a82ff8b927e462
Instruction Fuzzy Hash: 1451C371A00208EFCF11CF68C895A9E7BF4FF49340F2192AAE8159B251D774EA50CF69

Uniqueness

Uniqueness Score: -1.00%

Function 0040A2F6 Relevance: 6.1, APIs: 4, Instructions: 118windowCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040A2FB
GetWindowDC.USER32(00000000,?,?,00000000,00000000), ref: 0040A3DB
CreateDIBitmap.GDI32(00000000,?,00000004,?,?,00000000), ref: 0040A3F6
ReleaseDC.USER32(00000000,?), ref: 0040A41D

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: BitmapCreateH_prologReleaseWindow
String ID:
API String ID: 245086582-0
Opcode ID: 712f8de820aa39faa1311a4694aee3d60b4aa3b7f0a953502c72654b15749b36
Instruction ID: db53c73f9a3c86c6fe7f273ed2f51316e6f60ab2e075e1245cb031e3ae36ffd3
Opcode Fuzzy Hash: 712f8de820aa39faa1311a4694aee3d60b4aa3b7f0a953502c72654b15749b36
Instruction Fuzzy Hash: 42418D71E00219AFDB14DFA5EC45EEEBBB5FF48304F50412EE515A72A1D7749940CB18

Uniqueness

Uniqueness Score: -1.00%

Function 00430BE0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 103COMMON

Download Yara Rule

APIs

Part of subcall function 0042B6F4: InitializeCriticalSection.KERNEL32(00000000,00000000,?,?,00430238,00000009,00000000,00000000,00000001,0042AA98,00000001,00000074,?,?,00000000,00000001), ref: 0042B731
Part of subcall function 0042B6F4: EnterCriticalSection.KERNEL32(?,?,?,00430238,00000009,00000000,00000000,00000001,0042AA98,00000001,00000074,?,?,00000000,00000001), ref: 0042B74C

InitializeCriticalSection.KERNEL32(00000068,00000100,00000080,?,00000000,74DE8B60,74DE8B60,004310D1,74DE8B61,00000000,00000000), ref: 00430C33
EnterCriticalSection.KERNEL32(00000068,00000100,00000080,?,00000000,74DE8B60,74DE8B60,004310D1,74DE8B61,00000000,00000000), ref: 00430C48
LeaveCriticalSection.KERNEL32(00000068,?,00000000,74DE8B60,74DE8B60,004310D1,74DE8B61,00000000,00000000), ref: 00430C55

Strings

, xrefs: 00430C89

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: CriticalSection$EnterInitialize$Leave
String ID:
API String ID: 713024617-3916222277
Opcode ID: a746f9aad21e1b93bf3779f615aaf64e851f54062ea786b680d720c8cd6d924d
Instruction ID: dbc98160174bc5c675ba3fa0ba283314c9f3c21965fec7e147a8a7042a38ca9c
Opcode Fuzzy Hash: a746f9aad21e1b93bf3779f615aaf64e851f54062ea786b680d720c8cd6d924d
Instruction Fuzzy Hash: 333135722053119FE7189F24EC8475B77D0FB48328F25AB2EE566472C2D7B89844875A

Uniqueness

Uniqueness Score: -1.00%

Function 004165C2 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 99stringCOMMON

Download Yara Rule

APIs

lstrcpyA.KERNEL32(00000000,00000000,?,?,00000000), ref: 0041660C
wsprintfA.USER32 ref: 00416651

Strings

%s /g %s /g %s, xrefs: 00416645
%s /g %s /g %s /s, xrefs: 0041663E

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: lstrcpywsprintf
String ID: %s /g %s /g %s$%s /g %s /g %s /s
API String ID: 2408954437-3131057161
Opcode ID: 4f6ea7f0b3696adb0e31b5a8e5a885fa49ef19ff5ca5135497f480ea208c0035
Instruction ID: 744069436c7f98587977085d2460b5d0e7cb2709a266d1323026b94dd38c9327
Opcode Fuzzy Hash: 4f6ea7f0b3696adb0e31b5a8e5a885fa49ef19ff5ca5135497f480ea208c0035
Instruction Fuzzy Hash: 4A314B72A0052C7FEF108B64DC54BDF77A9AB04305F0044BAF205A6092DBB9DED88F89

Uniqueness

Uniqueness Score: -1.00%

Function 00420EF7 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 82stringCOMMON

Download Yara Rule

APIs

lstrcpyA.KERNEL32(?,00000000,?,00000000), ref: 00420F26
lstrcpyA.KERNEL32(?,?,?,00000000), ref: 00420F32

Part of subcall function 00420FD2: lstrlenA.KERNEL32(?,74DE83C0,00420F40,?,?,00000000), ref: 00420FDC

Strings

%u.%u.%u.%u, xrefs: 00420F51, 00420F69, 00420FA1
0$D, xrefs: 00420F8B, 00420F8E

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: lstrcpy$lstrlen
String ID: %u.%u.%u.%u$0$D
API String ID: 367037083-1272127632
Opcode ID: 9022adface7a6266d3e55cbfcda7aa9ebba735dca3813f91d46ebc4f6e01c41b
Instruction ID: 6a7bc95ed7267c5e7a85ab924ddf36f101ac6c0f2a5a3c6036b30b8560466cd4
Opcode Fuzzy Hash: 9022adface7a6266d3e55cbfcda7aa9ebba735dca3813f91d46ebc4f6e01c41b
Instruction Fuzzy Hash: 4F2157B2D0112CAACF20DF95ED81DDEBBFCAF48314F5141A7E105E3151E6B8E6858BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00408FE6 Relevance: 6.1, APIs: 4, Instructions: 77COMMON

Download Yara Rule

APIs

Part of subcall function 0040909D: GetVersionExA.KERNEL32(?), ref: 004090C0

CompareStringW.KERNEL32(00000400,00000000,?,00000000,?,00000000,?,?,00000000,?,00408F71,?,?,00000000,?,?), ref: 00409008
WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000000,?,00000002,00000000,00000000,?,00000002,00000000,00000000,?,?,00000000), ref: 0040907B
CompareStringA.KERNEL32(00000400,00000001,00000000,00000000,00000000,00000000,?,00000002,00000000,00000000,?,?,00000000,?,00408F71,?), ref: 0040908D

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: CompareString$ByteCharMultiVersionWide
String ID:
API String ID: 3684582312-0
Opcode ID: 4cfd3dba82b321e39871898294e3c542a77867faa45e89201b5493c5d29487fb
Instruction ID: 2abdd894a310d57f598ad255ca2f294460efb839b687c4f5e0ad376775b314d0
Opcode Fuzzy Hash: 4cfd3dba82b321e39871898294e3c542a77867faa45e89201b5493c5d29487fb
Instruction Fuzzy Hash: 762158B2100219FFEB119F94CC82DEB7F6CEF05258B01882AFA1596251D371EE24CBB5

Uniqueness

Uniqueness Score: -1.00%

Function 00402102 Relevance: 6.1, APIs: 4, Instructions: 65COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00402107
GetLastError.KERNEL32(00000000,00000000,00000001,?,0041D5AB,no_engine,?,00000001,?,?,00000001,?,?,004070FA,0043D25C,000010B4), ref: 00402130
SetLastError.KERNEL32(00000001,00000000,?,0041D5AB,no_engine,?,00000001,?,?,00000001,?,?,004070FA,0043D25C,000010B4,00000001), ref: 00402167
SetLastError.KERNEL32(?,?,0041D5AB,no_engine,?,00000001,?,?,00000001,?,?,004070FA,0043D25C,000010B4,00000001), ref: 0040219F

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: ErrorLast$H_prolog
String ID:
API String ID: 2881783280-0
Opcode ID: bbfaf7d2687e273b86c589186779cfef789d1fd3591f54a3a6dd476ac6a4601a
Instruction ID: 14de44800a59b28a1584812e0da4d085b5d2d317e221c1412b255b5320c329aa
Opcode Fuzzy Hash: bbfaf7d2687e273b86c589186779cfef789d1fd3591f54a3a6dd476ac6a4601a
Instruction Fuzzy Hash: 81219775A00205EFCB21DF59C88499AFBF4FF18304B11816EE589AB3A1C7B4E905CF98

Uniqueness

Uniqueness Score: -1.00%

Function 0041826D Relevance: 6.1, APIs: 4, Instructions: 65COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00418272
GetLastError.KERNEL32(75A901C0,74DF0440,00000000,?,00414D5F,%IS_T%,?,00000001), ref: 0041829B
SetLastError.KERNEL32(00000001,00000000,?,00414D5F,%IS_T%,?,00000001), ref: 004182D2
SetLastError.KERNEL32(?,?,00414D5F,%IS_T%,?,00000001), ref: 0041830A

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: ErrorLast$H_prolog
String ID:
API String ID: 2881783280-0
Opcode ID: abb4788328ce9d9699396c5d295e03959c8a2e1ae35968847e65c4187c9220c3
Instruction ID: 588e8b37104d563d5679561de0fe2c1beb854dd5e03a80cf43466b5538424394
Opcode Fuzzy Hash: abb4788328ce9d9699396c5d295e03959c8a2e1ae35968847e65c4187c9220c3
Instruction Fuzzy Hash: 01218671600605EFCB22DF59C88099AFBF0FF18704B15816EE48A87321CB75E944CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0041BBFF Relevance: 6.1, APIs: 4, Instructions: 64COMMON

Download Yara Rule

APIs

SysStringLen.OLEAUT32(?), ref: 0041BC19
SysStringLen.OLEAUT32(?), ref: 0041BC50
SysStringLen.OLEAUT32(?), ref: 0041BC62
WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000001,?,00000000,00000000,?,00000000,?,?,0041BB3F,00000000,00000200,0041B337), ref: 0041BC78

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: String$ByteCharMultiWide
String ID:
API String ID: 352835431-0
Opcode ID: cd3ba63b37b0af94ee2219495997b0b8caee0c99691e800faba0dcc7bfc976b3
Instruction ID: 0398a51538b87496479aa5a0dd243ebc095ac6b1165f8c56965192b3cf82f71d
Opcode Fuzzy Hash: cd3ba63b37b0af94ee2219495997b0b8caee0c99691e800faba0dcc7bfc976b3
Instruction Fuzzy Hash: 37114C72204706AF8720DF65DD84C67B3EDEB557053518C2EF556D3650EB24FC848AA8

Uniqueness

Uniqueness Score: -1.00%

Function 00408BF7 Relevance: 6.1, APIs: 4, Instructions: 62sleepfileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00408BFC

Part of subcall function 00408EAB: SysFreeString.OLEAUT32(?), ref: 00408EC0
Part of subcall function 00408EAB: SysStringLen.OLEAUT32(?), ref: 00408EC9
Part of subcall function 00408EAB: SysAllocStringLen.OLEAUT32(?,00000000), ref: 00408ED3

Part of subcall function 00407FDF: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,?,?,00000000,00000000,?,00000104,0041F19B,0043E954,?,00000000,00000000,?), ref: 00408042

CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000002,00000080,00000000,?,?,00436F5C,?,00000000,?,004083EB), ref: 00408C47
CloseHandle.KERNEL32(00000000,?,00436F5C,?,00000000,?,004083EB), ref: 00408C5F
Sleep.KERNEL32(000001F4,?,00436F5C,?,00000000,?,004083EB), ref: 00408C77

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: String$AllocByteCharCloseCreateFileFreeH_prologHandleMultiSleepWide
String ID:
API String ID: 1308190005-0
Opcode ID: ac155f8cc794227f2e9369b5323de75d106a1b2a47a25ab4ae3cc29d018f4607
Instruction ID: c7abba8a32960deb5518ed27afe6c2488d55a9b140ab8d5c52f931172d050d70
Opcode Fuzzy Hash: ac155f8cc794227f2e9369b5323de75d106a1b2a47a25ab4ae3cc29d018f4607
Instruction Fuzzy Hash: 7611E9712043029BE220AF24DD45B1BB3E5EB81735F104B3EF5F1A22D0CBB89845CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00410649 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 57stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00443D50,00444778,?,00000000,?,?,00410622,?,?,00410561,?), ref: 00410656
lstrcmpiA.KERNEL32(00443D50,ALL), ref: 00410666

Strings

ALL, xrefs: 00410660
P=D, xrefs: 0041064F

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: lstrcmpilstrlen
String ID: ALL$P=D
API String ID: 3649823140-3258713346
Opcode ID: ad0cadb3e5dd7a5cc27155814cfc00559bab1aa8ff86b6713d67369dcc42cd00
Instruction ID: 4b0b38d2bf01378b1730c242b9a4c8f57f5a7c1393d47cbf16bef386d24e7f6e
Opcode Fuzzy Hash: ad0cadb3e5dd7a5cc27155814cfc00559bab1aa8ff86b6713d67369dcc42cd00
Instruction Fuzzy Hash: FF012B75B022157AE724AA62BC46FDF372CCF82365F14003BF50992140E698AD90C1BD

Uniqueness

Uniqueness Score: -1.00%

Function 0041D35D Relevance: 6.1, APIs: 4, Instructions: 55stringCOMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 0041D369

Part of subcall function 004204D4: wsprintfA.USER32 ref: 004204E6
Part of subcall function 004204D4: LoadStringA.USER32(?,?,?), ref: 00420511

lstrlenA.KERNEL32(?), ref: 0041D39E
wsprintfA.USER32 ref: 0041D3FA
SetWindowTextA.USER32(00000000,?), ref: 0041D40D

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: Windowwsprintf$LoadStringTextlstrlen
String ID:
API String ID: 1776808806-0
Opcode ID: 7165188b1306f381bdf482e3370129f3cc4fca916d6673119c2e381f652176b3
Instruction ID: bcc52a87aa781956a2e73669831e6f5fc7911737b3a62418e5ac246b74c44ecd
Opcode Fuzzy Hash: 7165188b1306f381bdf482e3370129f3cc4fca916d6673119c2e381f652176b3
Instruction Fuzzy Hash: 8911517290011DABDB14AB60EC06BDE77BCEF04311F40807BFA04D5052EF38DA858B98

Uniqueness

Uniqueness Score: -1.00%

Function 0042436C Relevance: 6.0, APIs: 4, Instructions: 50windowCOMMON

Download Yara Rule

APIs

MsgWaitForMultipleObjects.USER32(00000002,?,00000000,?,000000FF), ref: 00424399
PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 004243A9
TranslateMessage.USER32(?), ref: 004243B7
DispatchMessageA.USER32(?), ref: 004243C1

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: Message$DispatchMultipleObjectsPeekTranslateWait
String ID:
API String ID: 2231909638-0
Opcode ID: de34859dbd7f3cfd7beec900d6b9960fc6c4d9117b193b9fd23c0c7d297f6478
Instruction ID: b905669623c10c42e94303256f9b3177a55484f6ff8006b7e1e9bcd8566323c9
Opcode Fuzzy Hash: de34859dbd7f3cfd7beec900d6b9960fc6c4d9117b193b9fd23c0c7d297f6478
Instruction Fuzzy Hash: 7E0129B2A00219BFDB00CFD4EC84EEABBBCEB48754F214066BA01E6140D271DD458B24

Uniqueness

Uniqueness Score: -1.00%

Function 00401CF2 Relevance: 6.0, APIs: 4, Instructions: 45COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00401CF7
GetLastError.KERNEL32(004364B4,00000004,?,0041EEC5,?,00000004,?,?,00000000,?,?,?,00000000,02151168,00000000,00000000), ref: 00401D1A
SysFreeString.OLEAUT32(?), ref: 00401D38
SetLastError.KERNEL32(?,00000001,?,0041EEC5,?,00000004,?,?,00000000,?,?,?,00000000,02151168,00000000,00000000), ref: 00401D58

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: ErrorLast$FreeH_prologString
String ID:
API String ID: 1156525562-0
Opcode ID: 180e200757eab0ff33b211dd0670d14b830092e83d946018d586892c8f5dc3ef
Instruction ID: ffc87c42d37fe55504c46a64b52cd0c4da1099e436faa950781d5ae6a99a0997
Opcode Fuzzy Hash: 180e200757eab0ff33b211dd0670d14b830092e83d946018d586892c8f5dc3ef
Instruction Fuzzy Hash: 7801B176700511EFCB14DF2CE809A99B7F0FF48314B06827EE846D3261DB75A900CB84

Uniqueness

Uniqueness Score: -1.00%

Function 00426E4C Relevance: 6.0, APIs: 4, Instructions: 43COMMONLIBRARYCODE

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(004455E8,00000001), ref: 00426E74
InitializeCriticalSection.KERNEL32(004455D0,?,00000000,00000000,00404FF1,74DE8B60,?,00000000,?,?,?,0040239B,?,?,?,004020AC), ref: 00426E7F
EnterCriticalSection.KERNEL32(004455D0,?,00000000,00000000,00404FF1,74DE8B60,?,00000000,?,?,?,0040239B,?,?,?,004020AC), ref: 00426EBE

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: CriticalSection$EnterExchangeInitializeInterlocked
String ID:
API String ID: 3643093385-0
Opcode ID: 2857b5e909cd5ea6b79d47a16b202e794f9505a71ceb9dde63e5df80ee13d933
Instruction ID: 26af49e9a09af73912847b9c2229f6dc567d801912bad5f3fc8cbbfaa61a9c9d
Opcode Fuzzy Hash: 2857b5e909cd5ea6b79d47a16b202e794f9505a71ceb9dde63e5df80ee13d933
Instruction Fuzzy Hash: 83F03C79344A20BBEE11AB55FC89A273659EB91792BB74037F50190166E7784C80C61D

Uniqueness

Uniqueness Score: -1.00%

Function 0041F821 Relevance: 6.0, APIs: 4, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0041F826
GetLastError.KERNEL32(02151168,?,?,0041F7E9,?,?,00000001,?,?,?,0041F69F), ref: 0041F852
SysAllocStringLen.OLEAUT32(00000000,?), ref: 0041F864
SetLastError.KERNEL32(?,?,?,0041F7E9,?,?,00000001,?,?,?,0041F69F), ref: 0041F893

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: ErrorLast$AllocH_prologString
String ID:
API String ID: 1734030179-0
Opcode ID: 79f8a06f28986156334ad6d190af9ac436d102c688c661ed4d6531d37d20912b
Instruction ID: cea489fb9345b73f17879bd3c75e9bc8af1a7bca5dd798616b559de51db4f9ba
Opcode Fuzzy Hash: 79f8a06f28986156334ad6d190af9ac436d102c688c661ed4d6531d37d20912b
Instruction Fuzzy Hash: 16113971500702EFC7209F54D805B8ABBF0FF08718F11C52EE85697651C7B9E904CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0041B91C Relevance: 6.0, APIs: 4, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0041B921
GetLastError.KERNEL32(?,00000200,?,0041B360,0043E648,00000001,?,?,00000000), ref: 0041B94D
SysAllocString.OLEAUT32(?), ref: 0041B95C
SetLastError.KERNEL32(?,?,00000200,?,0041B360,0043E648,00000001,?,?,00000000), ref: 0041B98B

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: ErrorLast$AllocH_prologString
String ID:
API String ID: 1734030179-0
Opcode ID: 5846c43158c367ff81bce4dea7e4c9fcfc9ce2904c2be5d297f910aff867c1c6
Instruction ID: e6424c2f61f28950464f1b6063dd38448cc756230ea3bd2fde5ed641ef407bfe
Opcode Fuzzy Hash: 5846c43158c367ff81bce4dea7e4c9fcfc9ce2904c2be5d297f910aff867c1c6
Instruction Fuzzy Hash: 3C113571500602EFC7209F58D408B8ABBF0FF08719F11C46EE89A8B651C7B9E908CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0041BB44 Relevance: 6.0, APIs: 4, Instructions: 40memorystringCOMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?), ref: 0041BB52
lstrlenA.KERNEL32(00000000,?,0041BB24,?), ref: 0041BB65
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,?,00000001,?,0041BB24,?), ref: 0041BB8C
SysAllocString.OLEAUT32(00000000), ref: 0041BB96

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: String$AllocByteCharFreeMultiWidelstrlen
String ID:
API String ID: 90228818-0
Opcode ID: 3d1b36e3d7569f0d34c8189476fd68d371b48294c77919301a832a8765984a70
Instruction ID: ca9c5eb8848c49eba21dd1138a1cf53a5e621d6ef67f61765854b7d9d9dcb6e6
Opcode Fuzzy Hash: 3d1b36e3d7569f0d34c8189476fd68d371b48294c77919301a832a8765984a70
Instruction Fuzzy Hash: 75F0D132900215FBCB205F11CC09B8BBF78EB41360F12817AF815962A0E7B06A54CB94

Uniqueness

Uniqueness Score: -1.00%

Function 0040FB45 Relevance: 6.0, APIs: 4, Instructions: 39windowCOMMON

Download Yara Rule

APIs

PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 0040FB6F
IsDialogMessageA.USER32(?,?,?,?,?,?,?,?,?,?,?,0040FB04), ref: 0040FB83
TranslateMessage.USER32(?), ref: 0040FB91
DispatchMessageA.USER32(?), ref: 0040FB9B

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: Message$DialogDispatchPeekTranslate
String ID:
API String ID: 1266772231-0
Opcode ID: 25de9364cfcc375252cc91a8c0f26ee3e6d9033dbb800a7197b8aa3e9f389591
Instruction ID: c4502c58c8f6b501f51e89b15ab792c1f725ef83d87db668a9041faee3f776c7
Opcode Fuzzy Hash: 25de9364cfcc375252cc91a8c0f26ee3e6d9033dbb800a7197b8aa3e9f389591
Instruction Fuzzy Hash: A0F01D71D00216EBCF319FA0EC48A9B7BBCEB15B52B104032E401E2455D23CA949CFAC

Uniqueness

Uniqueness Score: -1.00%

Function 0040EB4D Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 39stringCOMMON

Download Yara Rule

APIs

CharNextA.USER32 ref: 0040EB6B
lstrcpyA.KERNEL32(?,00000000), ref: 0040EB7C

Part of subcall function 0041D453: __EH_prolog.LIBCMT ref: 0041D458

Strings

noscript_uninst, xrefs: 0040EB4D
/noscript_uninst, xrefs: 0040EB60

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: CharH_prologNextlstrcpy
String ID: /noscript_uninst$noscript_uninst
API String ID: 1285412839-1242889402
Opcode ID: 4a02eda4d0dbfdd5e52aeeb5e713eb4b71335bbede09ee158a20f46846ecbcae
Instruction ID: a4eaa06bb3591553f949fee5de2196c995f3d58511591c4b85db78a016db7933
Opcode Fuzzy Hash: 4a02eda4d0dbfdd5e52aeeb5e713eb4b71335bbede09ee158a20f46846ecbcae
Instruction Fuzzy Hash: ACF02272604205BBC700EB15E886AEEB368BB00318F10813FF513A61D1CB3CA9418709

Uniqueness

Uniqueness Score: -1.00%

Function 0041DC44 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 35stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004025BC: __EH_prolog.LIBCMT ref: 004025C1

lstrlenA.KERNEL32(00000000,Startup,ClickOncePackage,00442430,00000000,00000400,?), ref: 0041DC96

Strings

, xrefs: 0041DCA1
ClickOncePackage, xrefs: 0041DC7A
Startup, xrefs: 0041DC7F

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: H_prologlstrlen
String ID: $ClickOncePackage$Startup
API String ID: 2133942097-1644928050
Opcode ID: 62e3751cd7c930cc6be17cafdf65a1c014f862611bea0f1f3e87a0b62f67a65d
Instruction ID: 30735423618fb98a6e38fcbac7eb955405329a0e958cea763030a143afec424c
Opcode Fuzzy Hash: 62e3751cd7c930cc6be17cafdf65a1c014f862611bea0f1f3e87a0b62f67a65d
Instruction Fuzzy Hash: 80F0E9B2F402153DEB219665DC05BA7B7A86B44708F1445FAB305F10C1FAF89946898C

Uniqueness

Uniqueness Score: -1.00%

Function 0040FAEC Relevance: 6.0, APIs: 4, Instructions: 34windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(00000001), ref: 0040FAF5

Part of subcall function 0040FB45: PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 0040FB6F
Part of subcall function 0040FB45: IsDialogMessageA.USER32(?,?,?,?,?,?,?,?,?,?,?,0040FB04), ref: 0040FB83
Part of subcall function 0040FB45: TranslateMessage.USER32(?), ref: 0040FB91
Part of subcall function 0040FB45: DispatchMessageA.USER32(?), ref: 0040FB9B

GetDlgItem.USER32(000003EA), ref: 0040FB0F
SendMessageA.USER32(00000000,00000408,00000000,00000000), ref: 0040FB27
SendMessageA.USER32(00000000,00000402,00000000,00000000), ref: 0040FB3F

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: Message$Send$DialogDispatchItemPeekTranslateWindow
String ID:
API String ID: 4202329498-0
Opcode ID: d50909e43e6baf72a1412151e17c42189f3c02de730690e997ed52f520103189
Instruction ID: 25288ef9b3d485c8a4e7b402ac7ef09711044d5596d1d2b747e16acede36be46
Opcode Fuzzy Hash: d50909e43e6baf72a1412151e17c42189f3c02de730690e997ed52f520103189
Instruction Fuzzy Hash: C5E0E5B12402017FEA111B51EDD5C3B767CDB81B56B10403AF700F60D0C670AC069A39

Uniqueness

Uniqueness Score: -1.00%

Function 0040FA8D Relevance: 6.0, APIs: 4, Instructions: 34windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(00407941), ref: 0040FA93
GetDlgItem.USER32(000003EA), ref: 0040FAAD
SendMessageA.USER32(00000000,00000408,00000000,00000000), ref: 0040FAC3

Part of subcall function 0040FB45: PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 0040FB6F
Part of subcall function 0040FB45: IsDialogMessageA.USER32(?,?,?,?,?,?,?,?,?,?,?,0040FB04), ref: 0040FB83
Part of subcall function 0040FB45: TranslateMessage.USER32(?), ref: 0040FB91
Part of subcall function 0040FB45: DispatchMessageA.USER32(?), ref: 0040FB9B

SendMessageA.USER32(00000000,00000402,?,00000000), ref: 0040FADE

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: Message$Send$DialogDispatchItemPeekTranslateWindow
String ID:
API String ID: 4202329498-0
Opcode ID: 3a7e481f912c793286b1e409df507cfbce23668c69145b1cdeeb1b386f3f999a
Instruction ID: 9e1549f67bd6d20a5332210e18cca3653c353abc4bbe85abc36f63ad4e0fb3fa
Opcode Fuzzy Hash: 3a7e481f912c793286b1e409df507cfbce23668c69145b1cdeeb1b386f3f999a
Instruction Fuzzy Hash: 84F0A0717003017FEF219F61AC84E2BBAA8EB85B93F00403AF704A61E0C7B09C059A69

Uniqueness

Uniqueness Score: -1.00%

Function 0042140B Relevance: 6.0, APIs: 4, Instructions: 32windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,00000031,00000000,00000000), ref: 00421421
GetObjectA.GDI32(00000000,0000003C,?), ref: 0042142A

Part of subcall function 00421361: GetLocaleInfoA.KERNEL32(00421438,00001004,?,00000014,?,?,?,?,?,?,?,?,?,?,?,00421438), ref: 00421388
Part of subcall function 00421361: TranslateCharsetInfo.GDI32(00000000,?,00000002), ref: 004213A3

CreateFontIndirectA.GDI32(?), ref: 00421440
SendMessageA.USER32(?,00000030,00000000,00000000), ref: 00421453

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: InfoMessageSend$CharsetCreateFontIndirectLocaleObjectTranslate
String ID:
API String ID: 2681337867-0
Opcode ID: 3296ee74aff333fb2fbdece5d5064c753ee34e1af09dec7d46e8821e79868191
Instruction ID: 2cd974987f2bb59bfca8839f5bbab01deeac62559f4801a9f05b597525fecca6
Opcode Fuzzy Hash: 3296ee74aff333fb2fbdece5d5064c753ee34e1af09dec7d46e8821e79868191
Instruction Fuzzy Hash: 1CF0FE72940318BBEF19ABA0EC06FDD3B7CEB14740F104015BE01BA1E1DAB0A504CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00420AEB Relevance: 6.0, APIs: 4, Instructions: 32COMMON

Download Yara Rule

APIs

CharNextA.USER32(?,74DE8B60,?,00000000,00420C84,?,?,00401E26,?,C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B},?,?,?,00000104), ref: 00420B00
CharPrevA.USER32(?,?,74DE8B60,?,00000000,00420C84,?,?,00401E26,?,C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B},?,?,?,00000104), ref: 00420B09
CharNextA.USER32(00000000,?,?,00401E26,?,C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B},?,?,?,00000104), ref: 00420B21
CharNextA.USER32(00000000,?,00401E26,?,C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B},?,?,?,00000104), ref: 00420B27

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: Char$Next$Prev
String ID:
API String ID: 589700163-0
Opcode ID: bc324221232ffaeab3f04fbffe6ccaaedfa7a161a79b876a8a3d84f2783d9780
Instruction ID: 46eca1015ca403ac8b3a862df8199efadd31930a4e2e5f69491256412e7a8d9f
Opcode Fuzzy Hash: bc324221232ffaeab3f04fbffe6ccaaedfa7a161a79b876a8a3d84f2783d9780
Instruction Fuzzy Hash: 7DF030A1A042A56EE7226379AC44F676EDC4F5A311F5900A6F54093253CAA89C408779

Uniqueness

Uniqueness Score: -1.00%

Function 00420C44 Relevance: 6.0, APIs: 4, Instructions: 32stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,?,?,00401E26,?,C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B},?,?,?,00000104), ref: 00420C4C
lstrcpynA.KERNEL32(?,?,-00000001,?,00401E26,?,C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B},?,?,?,00000104), ref: 00420C6A
lstrcpyA.KERNEL32(?,?,?,00401E26,?,C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B},?,?,?,00000104), ref: 00420C76
lstrcatA.KERNEL32(?,?,?,?,00401E26,?,C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B},?,?,?,00000104), ref: 00420C8A

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: lstrcatlstrcpylstrcpynlstrlen
String ID:
API String ID: 3428934214-0
Opcode ID: d0319fb712a28eef34bad9ec4846ee57ef2e60192c101117446fd63eb9971ead
Instruction ID: 71d5164942fc1dd6b0471d6091e1f8a585502c44351141c2ac27dcb8e8f1c2bf
Opcode Fuzzy Hash: d0319fb712a28eef34bad9ec4846ee57ef2e60192c101117446fd63eb9971ead
Instruction Fuzzy Hash: 83F05E71504129BBDF256F91EC08A9B3FADEF02361F918166F94585033C7768891DB98

Uniqueness

Uniqueness Score: -1.00%

Function 0040EA5E Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 29stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(?,hide_progress), ref: 0040EA6A
lstrcmpiA.KERNEL32(?,hide_splash), ref: 0040EA80

Strings

hide_splash, xrefs: 0040EA7A
hide_progress, xrefs: 0040EA64

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: lstrcmpi
String ID: hide_progress$hide_splash
API String ID: 1586166983-450596345
Opcode ID: e852e9279c6e01cb776c7204e7a356563172446163bd561fdc6dd875d4d82e2a
Instruction ID: c8a618ee38ae060b948807758c0e9bcc274a113c37ec209dd0ed359291aabf4b
Opcode Fuzzy Hash: e852e9279c6e01cb776c7204e7a356563172446163bd561fdc6dd875d4d82e2a
Instruction Fuzzy Hash: 0BF02731B00252E6C720CB19D8C2BAD7B60AB14754F10413BEA11B61D2C7BC8606A6A8

Uniqueness

Uniqueness Score: -1.00%

Function 0041C1B0 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 28stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,?,00000000,00000000,00406BEE,00000000,00000001,00000000,0000044F,00000000,?,?), ref: 0041C1BA
lstrcpyA.KERNEL32(00000000,?,?,00000000,00000000,00406BEE,00000000,00000001,00000000,0000044F,00000000,?,?), ref: 0041C1D6
lstrcpyA.KERNEL32(C:\Users\user\AppData\Local\Temp,?,?,00000000,00000000,00406BEE,00000000,00000001,00000000,0000044F,00000000,?,?), ref: 0041C1DE

Part of subcall function 0041C1FE: lstrcpyA.KERNEL32(00002F19,?,?,74DE83C0,00000000), ref: 0041C229

Strings

C:\Users\user\AppData\Local\Temp, xrefs: 0041C1D9

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: lstrcpy$lstrlen
String ID: C:\Users\user\AppData\Local\Temp
API String ID: 367037083-47812868
Opcode ID: d7730a731d9526bd9789e99a049cd819bae5059f909ad318936f82de2b6dc3c7
Instruction ID: 3fb9ed081154d308a89699993afe6f8398f0ec9f026054be5e95f8e449cf2a21
Opcode Fuzzy Hash: d7730a731d9526bd9789e99a049cd819bae5059f909ad318936f82de2b6dc3c7
Instruction Fuzzy Hash: 5BE0D8B1A042017EE21073B69CC9EABEB9CDBC43A5B11442FF10583101CA785C458BB8

Uniqueness

Uniqueness Score: -1.00%

Function 0040F91F Relevance: 6.0, APIs: 4, Instructions: 15timeCOMMON

Download Yara Rule

APIs

IsWindow.USER32(00420292), ref: 0040F925
KillTimer.USER32(000003E9,?), ref: 0040F93B
DestroyWindow.USER32 ref: 0040F94D
DestroyWindow.USER32 ref: 0040F955

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: Window$Destroy$KillTimer
String ID:
API String ID: 2681078358-0
Opcode ID: 47301a1ddda9636c9b9c3e70a1a0dddafd9843c27aacc3392a6e31a51428e75b
Instruction ID: a5e2e049b036be5add2f60f0361dcb7f02dc17732727839bb0a81fc5a49d980e
Opcode Fuzzy Hash: 47301a1ddda9636c9b9c3e70a1a0dddafd9843c27aacc3392a6e31a51428e75b
Instruction Fuzzy Hash: 9BD09EB9900121BFCF112F11FD089457F35EB01B63B219037A904921B1C6319D12EFAC

Uniqueness

Uniqueness Score: -1.00%

Function 00403843 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00403848

Strings

dC, xrefs: 004038C9
0$D, xrefs: 0040398E

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: H_prolog
String ID: 0$D$dC
API String ID: 3519838083-1428845458
Opcode ID: f663bbd3b1082a1f262f303d71e814ebb71d9990f8bd4059b3b656301c1e8459
Instruction ID: c5eae3aa936bd71ccebb84c918639b60676541ff291686e1c04dde043f256b9e
Opcode Fuzzy Hash: f663bbd3b1082a1f262f303d71e814ebb71d9990f8bd4059b3b656301c1e8459
Instruction Fuzzy Hash: 0441A0B1A00159AFCF11EF9AC8818EEBBB9BF45314B14407FF511B7291C7789A05CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 0042EB80 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 124COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,00000000), ref: 0042EB94

Strings

, xrefs: 0042EBB9
, xrefs: 0042EBDD

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: Info
String ID: $
API String ID: 1807457897-3032137957
Opcode ID: 0a821ed1029430c8e803b1065f39b960cbbdda599631f8ea96a840a7420dd173
Instruction ID: 13ba7e7621bd8eb60eac51b0e2e96a6d293e88608451efaab0844ff600e5c5be
Opcode Fuzzy Hash: 0a821ed1029430c8e803b1065f39b960cbbdda599631f8ea96a840a7420dd173
Instruction Fuzzy Hash: 8A41AE312046B81FEF219752ED9ABF73F98EB02704F4400E6E546DB293C2794D04CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 0041146F Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 119COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00411474

Part of subcall function 004115D9: __EH_prolog.LIBCMT ref: 004115DE

Part of subcall function 00403B2D: __EH_prolog.LIBCMT ref: 00403B32
Part of subcall function 00403B2D: GetLastError.KERNEL32(?,00000104,00000000,?,00402244,?,00000000,02151168,00000000), ref: 00403B5A
Part of subcall function 00403B2D: SetLastError.KERNEL32(?,?,00000000,00000000,?,00000104,00000000,?,00402244,?,00000000,02151168,00000000), ref: 00403BA7

Part of subcall function 0041167D: __EH_prolog.LIBCMT ref: 00411682
Part of subcall function 0041167D: CreateFileA.KERNEL32(00000000,?,?,?,?,00000000,?,?,00000001,00000000,004114CD, fC,80000000,00000001,00000080,00000003), ref: 004116DF
Part of subcall function 0041167D: GetLastError.KERNEL32(00000000,00000000,80400100,?,00000001,00000000,004114CD, fC,80000000,00000001,00000080,00000003,00000000,00000000,?,00000000), ref: 004116ED

Part of subcall function 00401CF2: __EH_prolog.LIBCMT ref: 00401CF7
Part of subcall function 00401CF2: GetLastError.KERNEL32(004364B4,00000004,?,0041EEC5,?,00000004,?,?,00000000,?,?,?,00000000,02151168,00000000,00000000), ref: 00401D1A
Part of subcall function 00401CF2: SysFreeString.OLEAUT32(?), ref: 00401D38
Part of subcall function 00401CF2: SetLastError.KERNEL32(?,00000001,?,0041EEC5,?,00000004,?,?,00000000,?,?,?,00000000,02151168,00000000,00000000), ref: 00401D58

Strings

fC, xrefs: 004114B8, 004114C0
This program cannot be run in DOS mode., xrefs: 00411544

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: ErrorH_prologLast$CreateFileFreeString
String ID: fC$This program cannot be run in DOS mode.
API String ID: 1070212021-3696150559
Opcode ID: cff6414fa7595023bb902432e2a898c3d2ec9f020d58db1d2d93e8181ea4e6fd
Instruction ID: 5bc57370119887a7d1eb519d78be6849c93cf69bc9b82bb7813341162c59db84
Opcode Fuzzy Hash: cff6414fa7595023bb902432e2a898c3d2ec9f020d58db1d2d93e8181ea4e6fd
Instruction Fuzzy Hash: EF419D71C05188FEEB15DBA5C892FDDBB78AB14308F10816EB612731D2DB785B48CB29

Uniqueness

Uniqueness Score: -1.00%

Function 004036C9 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 97COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004036CE

Strings

, xrefs: 004036DA
dC, xrefs: 00403714

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: H_prolog
String ID: $dC
API String ID: 3519838083-4089390767
Opcode ID: 0b7bf2d79cac2c61fea6ea1195c98bf55fcd174d2535651c05b4b2dc10e276ea
Instruction ID: 0e5cb677093919f96c51313ac13462ce53f02901885fa5f5b983c394e4ac032c
Opcode Fuzzy Hash: 0b7bf2d79cac2c61fea6ea1195c98bf55fcd174d2535651c05b4b2dc10e276ea
Instruction Fuzzy Hash: 09315476901158AACF05FBE5DD519DEB7B8AF58304F4040AFF515B3281DA389B08CB68

Uniqueness

Uniqueness Score: -1.00%

Function 00404095 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 86COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040409A

Strings

oA, xrefs: 004040E0, 00404147
oA, xrefs: 00404173, 00404113

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: H_prolog
String ID: oA$oA
API String ID: 3519838083-3252803861
Opcode ID: 31c94be06539338a22e3c3ba8affeae435d6bc2194014d2322fc57a0b69f6eb8
Instruction ID: 6ff21e8dd4e4ee463439e084901f84ae0f6843b6775f2f5d89caf7ca4d44a8e8
Opcode Fuzzy Hash: 31c94be06539338a22e3c3ba8affeae435d6bc2194014d2322fc57a0b69f6eb8
Instruction Fuzzy Hash: 51318FB5900269ABCF01EF99DC41AEDB778FF99354F04406BF9217B291D7389A40CB68

Uniqueness

Uniqueness Score: -1.00%

Function 0040B0D2 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 70COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040B0D7

Part of subcall function 0040B64D: __EH_prolog.LIBCMT ref: 0040B652
Part of subcall function 0040B64D: GetLastError.KERNEL32(00436474,?,0043647C,?,0040AF26,?,00000000,00000001,?,00000000), ref: 0040B67A
Part of subcall function 0040B64D: SetLastError.KERNEL32(?,?,00000000,00000000,?,0043647C,?,0040AF26,?,00000000,00000001,?,00000000), ref: 0040B6C7

Part of subcall function 0040B7F0: __EH_prolog.LIBCMT ref: 0040B7F5

Part of subcall function 0040191F: GetLastError.KERNEL32(02151168,00000000,0041E21A,removeasmajorupgrade,00000000,00000000,00000001,?,?,00000000,reboot,00000000,00000000,00000000,runfromtemp,00000000), ref: 00401935
Part of subcall function 0040191F: SysFreeString.OLEAUT32(?), ref: 00401953
Part of subcall function 0040191F: SetLastError.KERNEL32(?,00000001,?,00000000), ref: 00401973

Strings

|dC, xrefs: 0040B124
tdC, xrefs: 0040B0F4

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: ErrorLast$H_prolog$FreeString
String ID: tdC$|dC
API String ID: 3800368667-2508346183
Opcode ID: 12e441cdc41f269c281bfe20690e5af504177eaca990f023f0aca30622f8319e
Instruction ID: 7b199473f5d1b95373972fb1bcb67e27d69753214de2684444ed625af78a104d
Opcode Fuzzy Hash: 12e441cdc41f269c281bfe20690e5af504177eaca990f023f0aca30622f8319e
Instruction Fuzzy Hash: 6021807180024DFADB01EB95D855BDDBB78EF14318F1080AEB44577282DB785B88CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0042445B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?), ref: 004244D2
SetEvent.KERNEL32(00000046), ref: 004244E4

Strings

d, xrefs: 0042446F

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: Event
String ID: d
API String ID: 4201588131-2564639436
Opcode ID: 9cfa73652d1c49bc069a7d4368438f8c1e96c0ef9c56376d5661386b0769ed75
Instruction ID: dee9326ae1135eeb6f333d7cc8903640207381a442cf6d0da2459b2cfeafab07
Opcode Fuzzy Hash: 9cfa73652d1c49bc069a7d4368438f8c1e96c0ef9c56376d5661386b0769ed75
Instruction Fuzzy Hash: 14218B30600610DFCB24EF10E44496ABBF0FF48311B148A1FEA4B8B360C739E950CB95

Uniqueness

Uniqueness Score: -1.00%

Function 0041A7C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0041A7C5

Part of subcall function 0041AA5B: __EH_prolog.LIBCMT ref: 0041AA60
Part of subcall function 0041AA5B: GetLastError.KERNEL32(00436474,00000001,0043647C,?,0041A7F9,00000001,?,?,00000000,?,00000000,00000000), ref: 0041AA89
Part of subcall function 0041AA5B: SetLastError.KERNEL32(?,?,?,00000000,?,0041A7F9,00000001,?,?,00000000,?,00000000,00000000), ref: 0041AAC6

Part of subcall function 0040B64D: __EH_prolog.LIBCMT ref: 0040B652
Part of subcall function 0040B64D: GetLastError.KERNEL32(00436474,?,0043647C,?,0040AF26,?,00000000,00000001,?,00000000), ref: 0040B67A
Part of subcall function 0040B64D: SetLastError.KERNEL32(?,?,00000000,00000000,?,0043647C,?,0040AF26,?,00000000,00000001,?,00000000), ref: 0040B6C7

Part of subcall function 0040191F: GetLastError.KERNEL32(02151168,00000000,0041E21A,removeasmajorupgrade,00000000,00000000,00000001,?,?,00000000,reboot,00000000,00000000,00000000,runfromtemp,00000000), ref: 00401935
Part of subcall function 0040191F: SysFreeString.OLEAUT32(?), ref: 00401953
Part of subcall function 0040191F: SetLastError.KERNEL32(?,00000001,?,00000000), ref: 00401973

Strings

|dC, xrefs: 0041A7DD
tdC, xrefs: 0041A7E2

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: ErrorLast$H_prolog$FreeString
String ID: tdC$|dC
API String ID: 3800368667-2508346183
Opcode ID: 472adc4613dbfcf98fdc9a57b51cf872335f79b3b242de0fb8bb6ae10cd1ee8b
Instruction ID: cba529d305814b313a75e1f15e9f0031bd61ac04eb5562c03d9d9d66f7cdb09c
Opcode Fuzzy Hash: 472adc4613dbfcf98fdc9a57b51cf872335f79b3b242de0fb8bb6ae10cd1ee8b
Instruction Fuzzy Hash: 551152B1A00119BFDB04EF99D891BEDBBB4EF48714F00412EF556A7281D7745A44CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00415C68 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00415C6D

Part of subcall function 0040B64D: __EH_prolog.LIBCMT ref: 0040B652
Part of subcall function 0040B64D: GetLastError.KERNEL32(00436474,?,0043647C,?,0040AF26,?,00000000,00000001,?,00000000), ref: 0040B67A
Part of subcall function 0040B64D: SetLastError.KERNEL32(?,?,00000000,00000000,?,0043647C,?,0040AF26,?,00000000,00000001,?,00000000), ref: 0040B6C7

Part of subcall function 00403B2D: __EH_prolog.LIBCMT ref: 00403B32
Part of subcall function 00403B2D: GetLastError.KERNEL32(?,00000104,00000000,?,00402244,?,00000000,02151168,00000000), ref: 00403B5A
Part of subcall function 00403B2D: SetLastError.KERNEL32(?,?,00000000,00000000,?,00000104,00000000,?,00402244,?,00000000,02151168,00000000), ref: 00403BA7

Part of subcall function 0040191F: GetLastError.KERNEL32(02151168,00000000,0041E21A,removeasmajorupgrade,00000000,00000000,00000001,?,?,00000000,reboot,00000000,00000000,00000000,runfromtemp,00000000), ref: 00401935
Part of subcall function 0040191F: SysFreeString.OLEAUT32(?), ref: 00401953
Part of subcall function 0040191F: SetLastError.KERNEL32(?,00000001,?,00000000), ref: 00401973

Part of subcall function 00401CF2: __EH_prolog.LIBCMT ref: 00401CF7
Part of subcall function 00401CF2: GetLastError.KERNEL32(004364B4,00000004,?,0041EEC5,?,00000004,?,?,00000000,?,?,?,00000000,02151168,00000000,00000000), ref: 00401D1A
Part of subcall function 00401CF2: SysFreeString.OLEAUT32(?), ref: 00401D38
Part of subcall function 00401CF2: SetLastError.KERNEL32(?,00000001,?,0041EEC5,?,00000004,?,?,00000000,?,?,?,00000000,02151168,00000000,00000000), ref: 00401D58

Strings

tdC, xrefs: 00415C83
|dC, xrefs: 00415C7E

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: ErrorLast$H_prolog$FreeString
String ID: tdC$|dC
API String ID: 3800368667-2508346183
Opcode ID: 558595eb1f607aaee781d05ce8f0efcb10b5d91bc51e9d152eff9e3cb44fc93c
Instruction ID: a042ba52413c6653b53802d263d0cf90c75a5959a7471727fc2be3bcc9c0c15d
Opcode Fuzzy Hash: 558595eb1f607aaee781d05ce8f0efcb10b5d91bc51e9d152eff9e3cb44fc93c
Instruction Fuzzy Hash: A2118FB0900248EFD700DF55C841B9CBBB8FF58318F10816EE585A7292C7B99B09C758

Uniqueness

Uniqueness Score: -1.00%

Function 0041A262 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0041A267

Part of subcall function 0040B64D: __EH_prolog.LIBCMT ref: 0040B652
Part of subcall function 0040B64D: GetLastError.KERNEL32(00436474,?,0043647C,?,0040AF26,?,00000000,00000001,?,00000000), ref: 0040B67A
Part of subcall function 0040B64D: SetLastError.KERNEL32(?,?,00000000,00000000,?,0043647C,?,0040AF26,?,00000000,00000001,?,00000000), ref: 0040B6C7

Part of subcall function 0040191F: GetLastError.KERNEL32(02151168,00000000,0041E21A,removeasmajorupgrade,00000000,00000000,00000001,?,?,00000000,reboot,00000000,00000000,00000000,runfromtemp,00000000), ref: 00401935
Part of subcall function 0040191F: SysFreeString.OLEAUT32(?), ref: 00401953
Part of subcall function 0040191F: SetLastError.KERNEL32(?,00000001,?,00000000), ref: 00401973

Strings

|dC, xrefs: 0041A275
tdC, xrefs: 0041A27D

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: ErrorLast$H_prolog$FreeString
String ID: tdC$|dC
API String ID: 3800368667-2508346183
Opcode ID: 9de5100f2397164b26d5d029ef38f587b1ee8eae89a87a7ca1dbdb3a237b1a9e
Instruction ID: e182853330e281fa921cad20f8be88d2e6346f11047db1867ff033400ea9236c
Opcode Fuzzy Hash: 9de5100f2397164b26d5d029ef38f587b1ee8eae89a87a7ca1dbdb3a237b1a9e
Instruction Fuzzy Hash: 47012D71E00119ABCB04EF99D891BEEBBB5FF49314F10412EF556A3281D7785A44CB94

Uniqueness

Uniqueness Score: -1.00%

Function 0040AE3F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040AE44

Part of subcall function 0040B64D: __EH_prolog.LIBCMT ref: 0040B652
Part of subcall function 0040B64D: GetLastError.KERNEL32(00436474,?,0043647C,?,0040AF26,?,00000000,00000001,?,00000000), ref: 0040B67A
Part of subcall function 0040B64D: SetLastError.KERNEL32(?,?,00000000,00000000,?,0043647C,?,0040AF26,?,00000000,00000001,?,00000000), ref: 0040B6C7

Part of subcall function 0040BA9A: __EH_prolog.LIBCMT ref: 0040BA9F

Part of subcall function 0040191F: GetLastError.KERNEL32(02151168,00000000,0041E21A,removeasmajorupgrade,00000000,00000000,00000001,?,?,00000000,reboot,00000000,00000000,00000000,runfromtemp,00000000), ref: 00401935
Part of subcall function 0040191F: SysFreeString.OLEAUT32(?), ref: 00401953
Part of subcall function 0040191F: SetLastError.KERNEL32(?,00000001,?,00000000), ref: 00401973

Strings

|dC, xrefs: 0040AE55
tdC, xrefs: 0040AE5A

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: ErrorLast$H_prolog$FreeString
String ID: tdC$|dC
API String ID: 3800368667-2508346183
Opcode ID: 57f6262c381c9f2e7c992350a1435b10f020baa24db037c19cf79438882468c1
Instruction ID: 22676a08bf88cdf449713e86d3113fc6fe97e914ee0090294b2b2e90e2e2c1d4
Opcode Fuzzy Hash: 57f6262c381c9f2e7c992350a1435b10f020baa24db037c19cf79438882468c1
Instruction Fuzzy Hash: 120180B1E10208ABDB04EF96D852BADBBB4EB54318F10852FF551B7291CB791A04CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00420999 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

GetDriveTypeA.KERNEL32(0000044F,00000000,?,?,00406D71,00000003,00000000,0000044F,?,00000000,00000000,00406C10,?,00000400,00000000,00000000), ref: 004209C8

Part of subcall function 0042093B: CreateFileA.KERNELBASE(?,C0000000,00000000,00000000,00000002,00000080,00000000,?,?), ref: 00420971

Strings

:, xrefs: 004209A3
\, xrefs: 004209A7

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: CreateDriveFileType
String ID: :$\
API String ID: 3443067566-1166558509
Opcode ID: 117338bb25be7c60541edc00c7e00a969321b4f881a40084fbf4d8556babc1ac
Instruction ID: 8d76c40d582edbda5c93b50a51ebe3aa5d633811f6f88c3c50b0681745e1af0b
Opcode Fuzzy Hash: 117338bb25be7c60541edc00c7e00a969321b4f881a40084fbf4d8556babc1ac
Instruction Fuzzy Hash: B6014C211093D69DEB028F7868446CB3FE85F12314F84855FE8E5C7243C268D545D3A5

Uniqueness

Uniqueness Score: -1.00%

Function 004014FF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00401504
SetLastError.KERNEL32(?,?,00000000,74DF2EE0,?,0041FD71,?,?,00000001,?,80000000,00000003,00000000,00000003,00000080,00000000), ref: 0040156A

Strings

tdC, xrefs: 0040151C

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: ErrorH_prologLast
String ID: tdC
API String ID: 1057991267-1123919639
Opcode ID: 9d06591a953dcc7f500b30523958f3122be2a8849f42bb75246968820dd21d47
Instruction ID: d4af67f8dc7764b3658b3d71a76f38b10349cb27429a5bc3892a5fbcfb7487f7
Opcode Fuzzy Hash: 9d06591a953dcc7f500b30523958f3122be2a8849f42bb75246968820dd21d47
Instruction Fuzzy Hash: CD015E71A10224FFDB159F18D804B9E7BA4EF48754F10C12FF8466B2A1C7B9C940CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0041834C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00418351
SetLastError.KERNEL32(?,?,00000000,?,?,00000000,?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 004183B2

Strings

tdC, xrefs: 0041836B

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: ErrorH_prologLast
String ID: tdC
API String ID: 1057991267-1123919639
Opcode ID: cc95a13b85deabe8b484693a4dc3fe6e93518c4881bd53c41e0e0790658e5ce4
Instruction ID: 2f23559317f839ab5a6707a1ee6c52fdf6a402d762335ad3fff78f9984a21864
Opcode Fuzzy Hash: cc95a13b85deabe8b484693a4dc3fe6e93518c4881bd53c41e0e0790658e5ce4
Instruction Fuzzy Hash: BF01B171A00114AFCB10EF98C841BCDB7F8BB19704F40806BF455A7251C779EA04CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 004183C9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004183CE
SetLastError.KERNEL32(?,?,00000000,?,?,00000000,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 0041842F

Strings

tdC, xrefs: 004183E8

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: ErrorH_prologLast
String ID: tdC
API String ID: 1057991267-1123919639
Opcode ID: 13545118e991915a191e7dcb664a5304a1e360b444a4104a347984a8e2264813
Instruction ID: 701694f4eefdf0509fa743e840166c77ac241e76f0208cdc6c682033d5b8ea43
Opcode Fuzzy Hash: 13545118e991915a191e7dcb664a5304a1e360b444a4104a347984a8e2264813
Instruction Fuzzy Hash: FB014F72A00118AFCB10EF98D845BDDBBB8FF19704F40856BF955A7251DB78D604CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 0041A939 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 40COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0041A93E

Part of subcall function 0040B64D: __EH_prolog.LIBCMT ref: 0040B652
Part of subcall function 0040B64D: GetLastError.KERNEL32(00436474,?,0043647C,?,0040AF26,?,00000000,00000001,?,00000000), ref: 0040B67A
Part of subcall function 0040B64D: SetLastError.KERNEL32(?,?,00000000,00000000,?,0043647C,?,0040AF26,?,00000000,00000001,?,00000000), ref: 0040B6C7

Part of subcall function 00403B2D: __EH_prolog.LIBCMT ref: 00403B32
Part of subcall function 00403B2D: GetLastError.KERNEL32(?,00000104,00000000,?,00402244,?,00000000,02151168,00000000), ref: 00403B5A
Part of subcall function 00403B2D: SetLastError.KERNEL32(?,?,00000000,00000000,?,00000104,00000000,?,00402244,?,00000000,02151168,00000000), ref: 00403BA7

Strings

tdC, xrefs: 0041A953
|dC, xrefs: 0041A94E

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: ErrorLast$H_prolog
String ID: tdC$|dC
API String ID: 2881783280-2508346183
Opcode ID: 263b45e33c08fbedf47fd16caeed62215be697befb0e1f4dc9e477ab3fb34d7a
Instruction ID: 0edc7260ceb2312f7bc4674e3df4cda40b2127530431ca00be17397fed7a48da
Opcode Fuzzy Hash: 263b45e33c08fbedf47fd16caeed62215be697befb0e1f4dc9e477ab3fb34d7a
Instruction Fuzzy Hash: 1A01A2B1A00300EFC310DF59C841B99BBB8FF59759F10862FE1856B282C3B9A901CB5C

Uniqueness

Uniqueness Score: -1.00%

Function 00401FDD Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39stringCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00401FE2

Part of subcall function 00402375: __EH_prolog.LIBCMT ref: 0040237A

Part of subcall function 004025BC: __EH_prolog.LIBCMT ref: 004025C1

lstrlenA.KERNEL32(?,?,00000000,00442430,?,00000400,0000000A,C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B}), ref: 0040201F

Strings

C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B}, xrefs: 00401FEA

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: H_prolog$lstrlen
String ID: C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B}
API String ID: 3243491680-2458444898
Opcode ID: fcc9302376ed615e3f06203a8d169f2937e8e301ad6cfab5676a110c70419744
Instruction ID: 67af6ce5f0d8ee3eb0e9c197428977594d579b92a2aa7334592d32d1a3883eba
Opcode Fuzzy Hash: fcc9302376ed615e3f06203a8d169f2937e8e301ad6cfab5676a110c70419744
Instruction Fuzzy Hash: 20015E71A00214EACB15EFA5D905BDEBB34EF18754F10C12BF911761D1D7B94A04CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00418A3F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00418A44

Part of subcall function 0040B64D: __EH_prolog.LIBCMT ref: 0040B652
Part of subcall function 0040B64D: GetLastError.KERNEL32(00436474,?,0043647C,?,0040AF26,?,00000000,00000001,?,00000000), ref: 0040B67A
Part of subcall function 0040B64D: SetLastError.KERNEL32(?,?,00000000,00000000,?,0043647C,?,0040AF26,?,00000000,00000001,?,00000000), ref: 0040B6C7

Part of subcall function 0040191F: GetLastError.KERNEL32(02151168,00000000,0041E21A,removeasmajorupgrade,00000000,00000000,00000001,?,?,00000000,reboot,00000000,00000000,00000000,runfromtemp,00000000), ref: 00401935
Part of subcall function 0040191F: SysFreeString.OLEAUT32(?), ref: 00401953
Part of subcall function 0040191F: SetLastError.KERNEL32(?,00000001,?,00000000), ref: 00401973

Strings

|dC, xrefs: 00418A78, 00418A7B
tdC, xrefs: 00418A63

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: ErrorLast$H_prolog$FreeString
String ID: tdC$|dC
API String ID: 3800368667-2508346183
Opcode ID: fef27b64c982a60b77faf457629fa501110ed1f6c9690ceb78a6f51dbbc2df8c
Instruction ID: 69e3924d612c7ef8779b48dcdf7b136d82b49f5f74da0cec4090a5d861999f35
Opcode Fuzzy Hash: fef27b64c982a60b77faf457629fa501110ed1f6c9690ceb78a6f51dbbc2df8c
Instruction Fuzzy Hash: 5BF01D72D00109DFCB04DF99C9519DEBBB8EF99318F10412BE451B2191D7745F05CB68

Uniqueness

Uniqueness Score: -1.00%

Function 0042045D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32COMMON

Download Yara Rule

APIs

Part of subcall function 004204D4: wsprintfA.USER32 ref: 004204E6
Part of subcall function 004204D4: LoadStringA.USER32(?,?,?), ref: 00420511

wsprintfA.USER32 ref: 00420493
wvsprintfA.USER32(?,?,?), ref: 004204AE

Part of subcall function 0042027C: __EH_prolog.LIBCMT ref: 00420281

Strings

%d: %s, xrefs: 0042048D

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: wsprintf$H_prologLoadStringwvsprintf
String ID: %d: %s
API String ID: 2226253583-204819183
Opcode ID: 4fc894be5b05215798529dd5ec7e1bd0f694879f3908cd3d13c7ea0eb2295e2b
Instruction ID: b21bb332237c11868d2d513a136e1dd9fa04a681cdbf1b0ff5784d441641571e
Opcode Fuzzy Hash: 4fc894be5b05215798529dd5ec7e1bd0f694879f3908cd3d13c7ea0eb2295e2b
Instruction Fuzzy Hash: 2EF0D07290021DBBDF11ABA4DC46FDA77BCAB08314F4081E6B705E6091EA75D7588FD4

Uniqueness

Uniqueness Score: -1.00%

Function 0040A8FA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,RunISMSISetup), ref: 0040A90A
GetLastError.KERNEL32 ref: 0040A914

Part of subcall function 004016F0: lstrlenW.KERNEL32(00436494,74DF34C0,74DF2EE0,00000000,00000000,?,0041FD7B,?,?,00000001,?,80000000,00000003,00000000,00000003,00000080), ref: 00401743
Part of subcall function 004016F0: WideCharToMultiByte.KERNEL32(00000000,00000000,00436494,000000FF,?,00000002,00000000,00000000,?,0041FD7B,?,?,00000001,?,80000000,00000003), ref: 0040176B

Part of subcall function 0042045D: wsprintfA.USER32 ref: 00420493
Part of subcall function 0042045D: wvsprintfA.USER32(?,?,?), ref: 004204AE

Strings

RunISMSISetup, xrefs: 0040A904

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: AddressByteCharErrorLastMultiProcWidelstrlenwsprintfwvsprintf
String ID: RunISMSISetup
API String ID: 834041595-1536503584
Opcode ID: ba5ed832308c704d68d47ecad04e6d25704d60e135ba702c82f079d91d6cc2d0
Instruction ID: 189dd3c9ebe406b227483d4e7afd61c4877c0a8b417075c182ddb418031b3845
Opcode Fuzzy Hash: ba5ed832308c704d68d47ecad04e6d25704d60e135ba702c82f079d91d6cc2d0
Instruction Fuzzy Hash: 3DE026723002013BEB406BA9FC09F1B66DDABE4751F06853BB100D21E2DEBAC450862D

Uniqueness

Uniqueness Score: -1.00%

Function 004292EC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32({mB,00000000,?,00436FFC,00000000,invalid string position,00426D7B,00000000,0043B530,?,invalid string position), ref: 0042931A

Strings

{mB, xrefs: 004292FF, 00429317
invalid string position, xrefs: 004292F5

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: ExceptionRaise
String ID: invalid string position${mB
API String ID: 3997070919-210406068
Opcode ID: 213c3d11ada611903d317cea82785d1ebbc25234b23a3883fce79447d404e764
Instruction ID: 89ad06c49c8ceb42e11442123743c1fee4f871a630eb713510b92808756806c9
Opcode Fuzzy Hash: 213c3d11ada611903d317cea82785d1ebbc25234b23a3883fce79447d404e764
Instruction Fuzzy Hash: A3E0C276D00118ABCF11DF99D8448DFBBB9FB49310F008066FA14A7250D675AA15DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00408BAE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 23COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00408BB3

Part of subcall function 00408D39: __EH_prolog.LIBCMT ref: 00408D3E
Part of subcall function 00408D39: GetLastError.KERNEL32(?,00000000,?,00408BE1,00000000,?,?,?,00408204,?,?), ref: 00408D6A
Part of subcall function 00408D39: SetLastError.KERNEL32(?,?,00000000,?,00408BE1,00000000,?,?,?,00408204,?,?), ref: 00408DA0

Strings

8eC, xrefs: 00408BCE
0eC, xrefs: 00408BD5

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: ErrorH_prologLast
String ID: 0eC$8eC
API String ID: 1057991267-2148713941
Opcode ID: b3aa60c2f6bc64c1c7e83af34da1d4dc78ff895105e20173d77323f9ec949c22
Instruction ID: f3aa5d847be860d488a9080714b721ef66f797669a23cb03341e87fc187a953d
Opcode Fuzzy Hash: b3aa60c2f6bc64c1c7e83af34da1d4dc78ff895105e20173d77323f9ec949c22
Instruction Fuzzy Hash: 8DE065B2610611BBC7149F4DA40174AFBF4EF85725F50C61F915597680C7F85905CB64

Uniqueness

Uniqueness Score: -1.00%

Function 0042BFE1 Relevance: 5.1, APIs: 4, Instructions: 53memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapReAlloc.KERNEL32(00000000,?,00000000,00000000,0042BDA9,00000000,00000000,00000000,00427B05,00000000,00000000,?,00000000,00000000,00000000), ref: 0042C009
HeapAlloc.KERNEL32(00000008,000041C4,00000000,00000000,0042BDA9,00000000,00000000,00000000,00427B05,00000000,00000000,?,00000000,00000000,00000000), ref: 0042C03D
VirtualAlloc.KERNEL32(00000000,00100000,00002000,00000004), ref: 0042C057
HeapFree.KERNEL32(00000000,?), ref: 0042C06E

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: AllocHeap$FreeVirtual
String ID:
API String ID: 3499195154-0
Opcode ID: fb2d45dc5e7a689f362c032790783421a09030d1a23f9c45e20f115d5fee699f
Instruction ID: b1c3c1f9c8a42d4823e600ca0c59d2bb66a223fb317fd7d2f77be42cdab14fc9
Opcode Fuzzy Hash: fb2d45dc5e7a689f362c032790783421a09030d1a23f9c45e20f115d5fee699f
Instruction Fuzzy Hash: 71118C34200311EFD7208F68ECC49267BB5FB873107528669F2A2C36B0CB71A815DF09

Uniqueness

Uniqueness Score: -1.00%

Function 00420A03 Relevance: 5.0, APIs: 4, Instructions: 49stringCOMMON

Download Yara Rule

APIs

lstrcpyA.KERNEL32(?,?,74DE8B60,?,00000000), ref: 00420A29
CharNextA.USER32(00000000), ref: 00420A42
lstrcpyA.KERNEL32(?,?), ref: 00420A5F
lstrcpyA.KERNEL32(?,00000000), ref: 00420A65

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: lstrcpy$CharNext
String ID:
API String ID: 3801418090-0
Opcode ID: 0c95d8e512be1591f39e4e4d5209e5fa10a167b12701b879d34eee1713077716
Instruction ID: b66b5ef3bd2c6a807e2a13699375af3b32bbff36333e851d1510f25ddf115b54
Opcode Fuzzy Hash: 0c95d8e512be1591f39e4e4d5209e5fa10a167b12701b879d34eee1713077716
Instruction Fuzzy Hash: 1E01D6767003296ADB119664AC40FAB3FEC9B40354F940067B704D2191DA78CD418BA8

Uniqueness

Uniqueness Score: -1.00%

Function 00420CA9 Relevance: 5.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

CharNextA.USER32(?,00000000,75BF3530,00420CA1,00000104,00420B1C,?,?,00401E26,?,C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B},?,?,?,00000104), ref: 00420CBB
CharNextA.USER32(?,00000000,75BF3530,00420CA1,00000104,00420B1C,?,?,00401E26,?,C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B},?,?,?,00000104), ref: 00420CD5
CharNextA.USER32(00000000,?,00401E26,?,C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B},?,?,?,00000104), ref: 00420CDD
CharNextA.USER32(00000000,?,00401E26,?,C:\Users\user\AppData\Local\Temp\{8929CE83-143A-4A6A-A32A-AA9D4E2B602B},?,?,?,00000104), ref: 00420CE2

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: CharNext
String ID:
API String ID: 3213498283-0
Opcode ID: aa0d378638837d90e1ed184b6c5803bc4aa9c99046c41d95c7bbb2196ab1612e
Instruction ID: 4a4bcce4f00baf5a8eb1816147accbe9e1ce02f4e722cdc25c13635c88f0fe02
Opcode Fuzzy Hash: aa0d378638837d90e1ed184b6c5803bc4aa9c99046c41d95c7bbb2196ab1612e
Instruction Fuzzy Hash: 6DF096E1A845A63CE72A022ABC847A75FC55B87310F950157D581D3257C7AC4C83876B

Uniqueness

Uniqueness Score: -1.00%

Function 004243DD Relevance: 5.0, APIs: 4, Instructions: 32COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 004243E7
GetLastError.KERNEL32 ref: 004243ED
SetLastError.KERNEL32(?), ref: 00424422
SetLastError.KERNEL32(00000000), ref: 0042442C

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 973423223f8db1b3dd126d3fa034a3253b6e9574ef644ac6be8210035cb1157b
Instruction ID: 8a6d3a59ea1779c3871547816bf13e752934ac025b526a14b63e7f670cde6a04
Opcode Fuzzy Hash: 973423223f8db1b3dd126d3fa034a3253b6e9574ef644ac6be8210035cb1157b
Instruction Fuzzy Hash: 7FF0823130063157DA217F15E80465FA654EFD1B11BA6842BDC0197251CB7D9843556D

Uniqueness

Uniqueness Score: -1.00%

Function 0042B6CB Relevance: 5.0, APIs: 4, Instructions: 12COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(?,0042AA12,?,004299DC), ref: 0042B6D8
InitializeCriticalSection.KERNEL32(?,0042AA12,?,004299DC), ref: 0042B6E0
InitializeCriticalSection.KERNEL32(?,0042AA12,?,004299DC), ref: 0042B6E8
InitializeCriticalSection.KERNEL32(?,0042AA12,?,004299DC), ref: 0042B6F0

Memory Dump Source

Source File: 00000001.00000002.1843354526.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1843323542.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843399289.0000000000436000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843428963.000000000043D000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843453462.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000441000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843485231.0000000000444000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.1843554992.0000000000447000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SweetIMSetup.jbxd

Similarity

API ID: CriticalInitializeSection
String ID:
API String ID: 32694325-0
Opcode ID: e6e2bee7fd24386475d66461fecf64163ab64661aee87027dfbd6cf9e340ad78
Instruction ID: ff29326827c866b612dfd583c42f224a55d16067aa91b5a305fe8cdc9d3ee7f4
Opcode Fuzzy Hash: e6e2bee7fd24386475d66461fecf64163ab64661aee87027dfbd6cf9e340ad78
Instruction Fuzzy Hash: B3C00231C00035ABCA1E3B66FE05C4A3FA6EB042A03096073E5085143087211C18DFD8

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: VistaCookiesCollector.exePID: 7288, Parent PID: 7204COMMON

Execution Graph

Execution Coverage:	2.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1589
Total number of Limit Nodes:	19

Executed Functions

Function 00404D18 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 13
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(mscoree.dll,00404E86,?,0040C2B0,00000008,00404EBD,?,00000001,00000000,004099E4,00000003), ref: 00404D1D
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00404D2D
ExitProcess.KERNEL32 ref: 00404D41

Strings

CorExitProcess, xrefs: 00404D27
mscoree.dll, xrefs: 00404D18

Memory Dump Source

Source File: 00000005.00000002.1791137495.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1791115649.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.1791161911.000000000040C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.1791182257.000000000040F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.1791201952.0000000000412000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_VistaCookiesCollector.jbxd

Similarity

API ID: AddressExitHandleModuleProcProcess
String ID: CorExitProcess$mscoree.dll
API String ID: 75539706-1276376045
Opcode ID: d1451536d844ab3e6f95523ea5f90e8eab4384d604387f1acd643b0b4664a1c1
Instruction ID: c2609e959d7727467e52d893d0eb9f533a6e50f6d1d8ac87e1503fb35feed663
Opcode Fuzzy Hash: d1451536d844ab3e6f95523ea5f90e8eab4384d604387f1acd643b0b4664a1c1
Instruction Fuzzy Hash: 6DD0C770640301EBD6102FF09E89E1B37559F40B05B1446397545F01E0CB7CC800DD19

Uniqueness

Uniqueness Score: -1.00%

Function 00401000 Relevance: 7.6, APIs: 5, Instructions: 101
filenetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetGetCookieW.WININET(000000FF,00000000,00000000,00000007), ref: 00401033
InternetGetCookieW.WININET(?,00000000,00000000,?), ref: 00401079
CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000002,00000080,00000000,?,?,?,?,?,?,0040C12C,00000000), ref: 0040109B
WriteFile.KERNEL32(00000000,00000000), ref: 004010C2
CloseHandle.KERNEL32(00000000), ref: 004010CB

Memory Dump Source

Source File: 00000005.00000002.1791137495.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1791115649.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.1791161911.000000000040C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.1791182257.000000000040F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.1791201952.0000000000412000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_VistaCookiesCollector.jbxd

Similarity

API ID: CookieFileInternet$CloseCreateHandleWrite
String ID:
API String ID: 553115592-0
Opcode ID: 6ee62c0f2943eba23ba155c943fddd5be51a5a8077478463c6cd02342a5ddbbe
Instruction ID: e5a7feb063e61cb7044b2f356cab2385135cecc8df017323776db1487c0f15b9
Opcode Fuzzy Hash: 6ee62c0f2943eba23ba155c943fddd5be51a5a8077478463c6cd02342a5ddbbe
Instruction Fuzzy Hash: 18319572A00209ABD710CB99DC85FABF7BDEB88714F10423AFA05A7390DA759D41C795

Uniqueness

Uniqueness Score: -1.00%

Function 004058E8 Relevance: 3.0, APIs: 2, Instructions: 26
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000,0040375E,00000001,?,0040C190,00000060), ref: 004058F9

Part of subcall function 0040641E: HeapAlloc.KERNEL32(00000000,00000140,00405921,000003F8,?,0040C190,00000060), ref: 0040642B

HeapDestroy.KERNEL32(?,0040C190,00000060), ref: 0040592C

Memory Dump Source

Source File: 00000005.00000002.1791137495.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1791115649.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.1791161911.000000000040C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.1791182257.000000000040F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.1791201952.0000000000412000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_VistaCookiesCollector.jbxd

Similarity

API ID: Heap$AllocCreateDestroy
String ID:
API String ID: 2236781399-0
Opcode ID: 2b472e1268dc517c59981013f770f439964f4455b6ac51ab9139bcd5af4ebc05
Instruction ID: adb947349ec5520b24d61e9897c2c8b5ef332eba80f7c443c28bf25e3c871fc0
Opcode Fuzzy Hash: 2b472e1268dc517c59981013f770f439964f4455b6ac51ab9139bcd5af4ebc05
Instruction Fuzzy Hash: 90E065B4A60701EFEB006F706C093272698EB44756F04843AB605E50F0EB388810DA08

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00404EDF Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 117
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000,00000000,00000000), ref: 00404F62
_strcat.LIBCMT ref: 00404F75
_strlen.LIBCMT ref: 00404F82
_strlen.LIBCMT ref: 00404F91
_strncpy.LIBCMT ref: 00404FA8
_strlen.LIBCMT ref: 00404FB1
_strlen.LIBCMT ref: 00404FBE
_strcat.LIBCMT ref: 00404FDC
_strlen.LIBCMT ref: 00405021
GetStdHandle.KERNEL32(000000F4,0040C638,00000000,?,00000000,00000000,00000000,00000000), ref: 0040502C
WriteFile.KERNEL32(00000000), ref: 00405033

Strings

..., xrefs: 00404FA2
Runtime Error!Program: , xrefs: 00404FD6
Microsoft Visual C++ Runtime Library, xrefs: 00405004
<program name unknown>, xrefs: 00404F6F

Memory Dump Source

Source File: 00000005.00000002.1791137495.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1791115649.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.1791161911.000000000040C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.1791182257.000000000040F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.1791201952.0000000000412000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_VistaCookiesCollector.jbxd

Similarity

API ID: _strlen$File_strcat$HandleModuleNameWrite_strncpy
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
API String ID: 3601721357-4022980321
Opcode ID: 4007586a13cea96346386d3b512d28e5d552a4b5a124febad4f4dd170e644e66
Instruction ID: 48791b4b6fccf7b57cddb9e4e462f4ad089f7744d0ebfecabf3e045950e892a5
Opcode Fuzzy Hash: 4007586a13cea96346386d3b512d28e5d552a4b5a124febad4f4dd170e644e66
Instruction Fuzzy Hash: 7E31D7B2500104AADB34BBB5EC86E9F7268EB89314F10493FF615F35D2DA3DA4448A6C

Uniqueness

Uniqueness Score: -1.00%

Function 0040989A Relevance: 22.9, APIs: 7, Strings: 6, Instructions: 150
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,0040D288,00000118,00407C0D,00000001,00000000,0040CED8,00000008,0040504F), ref: 0040991E
_strcat.LIBCMT ref: 00409934
_strlen.LIBCMT ref: 00409944
_strlen.LIBCMT ref: 00409955
_strncpy.LIBCMT ref: 0040996F
_strlen.LIBCMT ref: 00409978
_strcat.LIBCMT ref: 00409994

Strings

Unknown security failure detected!, xrefs: 004098E4
Program: , xrefs: 004099A5
..., xrefs: 00409969
Microsoft Visual C++ Runtime Library, xrefs: 004099CF
<program name unknown>, xrefs: 00409928
Buffer overrun detected!, xrefs: 004098FA, 00409992

Memory Dump Source

Source File: 00000005.00000002.1791137495.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1791115649.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.1791161911.000000000040C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.1791182257.000000000040F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.1791201952.0000000000412000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_VistaCookiesCollector.jbxd

Similarity

API ID: _strlen$_strcat$FileModuleName_strncpy
String ID: ...$<program name unknown>$Buffer overrun detected!$Microsoft Visual C++ Runtime Library$Program: $Unknown security failure detected!
API String ID: 3058806289-1673886896
Opcode ID: c9c294f2889ad1acf6be317bae555111953f9c7040bba73f8206813134af01b6
Instruction ID: a206ce52bf1f7da5c935dd3cc1c7b868177f1b7ca9d22687d2fd56eff6b21ebd
Opcode Fuzzy Hash: c9c294f2889ad1acf6be317bae555111953f9c7040bba73f8206813134af01b6
Instruction Fuzzy Hash: EC412AB29002546BDB106BA59C42BDF7768DB85324F14847BF5547B3C3C63DDE068A9C

Uniqueness

Uniqueness Score: -1.00%

Function 00404609 Relevance: 22.8, APIs: 8, Strings: 5, Instructions: 71
libraryloadermemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,74DF0A60,00000000,00403770,?,0040C190,00000060), ref: 00404621
GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00404639
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00404646
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00404653
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00404660
FlsAlloc.KERNEL32(004044C2,?,0040C190,00000060), ref: 0040469D
FlsSetValue.KERNEL32(00000000,?,0040C190,00000060), ref: 004046CA
GetCurrentThreadId.KERNEL32 ref: 004046DE

Part of subcall function 00404434: FlsFree.KERNEL32(00000002,004046F3,?,0040C190,00000060), ref: 0040443F
Part of subcall function 00404434: DeleteCriticalSection.KERNEL32(00000000,00000000,00000000,?,004046F3,?,0040C190,00000060), ref: 00404A0F
Part of subcall function 00404434: DeleteCriticalSection.KERNEL32(00000002,00000000,?,004046F3,?,0040C190,00000060), ref: 00404A39

Strings

FlsGetValue, xrefs: 0040463B
kernel32.dll, xrefs: 0040461C
FlsFree, xrefs: 00404655
FlsSetValue, xrefs: 00404648
FlsAlloc, xrefs: 00404633

Memory Dump Source

Source File: 00000005.00000002.1791137495.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1791115649.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.1791161911.000000000040C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.1791182257.000000000040F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.1791201952.0000000000412000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_VistaCookiesCollector.jbxd

Similarity

API ID: AddressProc$CriticalDeleteSection$AllocCurrentFreeHandleModuleThreadValue
String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$kernel32.dll
API String ID: 2635119114-282957996
Opcode ID: 6b01fef21df0aa31f6db9504e76d97caf3d49d0709238c16200abf26dad541e4
Instruction ID: af7d9ed28354a58f6d90a1357aeb3be42eba868cb7570bfe7ab0eb0857cc9e03
Opcode Fuzzy Hash: 6b01fef21df0aa31f6db9504e76d97caf3d49d0709238c16200abf26dad541e4
Instruction Fuzzy Hash: F7213DB0901612DEC720AFA6AE4561B7AE4AB87755310463FA504F3AE1EB7D8409CB5C

Uniqueness

Uniqueness Score: -1.00%

Function 004079CB Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 90
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(user32.dll,0040C688,?,?), ref: 004079E3
GetProcAddress.KERNEL32(00000000,MessageBoxA), ref: 004079FF
GetProcAddress.KERNEL32(00000000,GetActiveWindow), ref: 00407A10
GetProcAddress.KERNEL32(00000000,GetLastActivePopup), ref: 00407A1D
GetProcAddress.KERNEL32(00000000,GetUserObjectInformationA), ref: 00407A33
GetProcAddress.KERNEL32(00000000,GetProcessWindowStation), ref: 00407A44

Strings

GetActiveWindow, xrefs: 00407A0A
GetLastActivePopup, xrefs: 00407A12
user32.dll, xrefs: 004079DE
GetProcessWindowStation, xrefs: 00407A3E
GetUserObjectInformationA, xrefs: 00407A2D
MessageBoxA, xrefs: 004079F9

Memory Dump Source

Source File: 00000005.00000002.1791137495.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1791115649.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.1791161911.000000000040C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.1791182257.000000000040F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.1791201952.0000000000412000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_VistaCookiesCollector.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: GetActiveWindow$GetLastActivePopup$GetProcessWindowStation$GetUserObjectInformationA$MessageBoxA$user32.dll
API String ID: 2238633743-1612076079
Opcode ID: 8d967e6d5d3ea77e1b99d523427178ce235cf7ad7e0b157aa3f4cadde4028379
Instruction ID: 25ce550cc8c81a6bf61095fdddd8162f4a913b3c61faec792207559ca585254f
Opcode Fuzzy Hash: 8d967e6d5d3ea77e1b99d523427178ce235cf7ad7e0b157aa3f4cadde4028379
Instruction Fuzzy Hash: DE217831B44206AED7119FB49D88BAF3AA8A744740B14817BE501F11D1DBBCED40CF6E

Uniqueness

Uniqueness Score: -1.00%

Function 00406048 Relevance: 16.8, APIs: 11, Instructions: 309
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LCMapStringW.KERNEL32(00000000,00000100,0040C8C8,00000001,00000000,00000000,0040C8D0,0000003C,004071AC,00000100,?,00000100,?,00000100,00000000,00000001), ref: 0040606F
GetLastError.KERNEL32 ref: 00406081
MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,0040C8D0,0000003C,004071AC,00000100,?,00000100,?,00000100,00000000,00000001), ref: 00406108
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,00000000), ref: 00406189
LCMapStringW.KERNEL32(?,?,?,00000000,00000000,00000000), ref: 004061A3
LCMapStringW.KERNEL32(?,?,?,00000000,?,?), ref: 004061DE

Memory Dump Source

Source File: 00000005.00000002.1791137495.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1791115649.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.1791161911.000000000040C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.1791182257.000000000040F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.1791201952.0000000000412000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_VistaCookiesCollector.jbxd

Similarity

API ID: String$ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1775797328-0
Opcode ID: eda41d77c3ec3e3d6bd0e53f13eef0aabd6a40a47d126ff26a0a0c8ffeba36e2
Instruction ID: f43efbe1db1699ed184676c1af19036fa4fff88c67840055bed50d345954ccb9
Opcode Fuzzy Hash: eda41d77c3ec3e3d6bd0e53f13eef0aabd6a40a47d126ff26a0a0c8ffeba36e2
Instruction Fuzzy Hash: 9AB13872800119EFCF11AFA4DD859EE7BB5FF08314F11423AF916B62A0D7398961DB68

Uniqueness

Uniqueness Score: -1.00%

Function 0040A0C8 Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 235
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_strcat.LIBCMT ref: 0040A1AC
_strcat.LIBCMT ref: 0040A1C9
___shr_12.LIBCMT ref: 0040A292

Strings

?, xrefs: 0040A129
1#INF, xrefs: 0040A1A3
1#QNAN, xrefs: 0040A1C0
1#SNAN, xrefs: 0040A178
1#IND, xrefs: 0040A192

Memory Dump Source

Source File: 00000005.00000002.1791137495.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1791115649.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.1791161911.000000000040C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.1791182257.000000000040F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.1791201952.0000000000412000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_VistaCookiesCollector.jbxd

Similarity

API ID: _strcat$___shr_12
String ID: 1#IND$1#INF$1#QNAN$1#SNAN$?
API String ID: 1152255961-4131533671
Opcode ID: d5040f156efe3a8882a38f7dd3248287629fa64d05780d123f0f43086cb7a794
Instruction ID: 6b22bf3bd2014f22b719cc5878b5a75aafd4179cf78c29ae2b6b87ff5688801b
Opcode Fuzzy Hash: d5040f156efe3a8882a38f7dd3248287629fa64d05780d123f0f43086cb7a794
Instruction Fuzzy Hash: CE91B232C0439A8EDF11DBA8C8447EEBBB4AF15314F0445BBD851BB2C2D3789A15C76A

Uniqueness

Uniqueness Score: -1.00%

Function 00408D3F Relevance: 12.2, APIs: 8, Instructions: 177
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCPInfo.KERNEL32(?,?,0040D020,00000044,00408140,?,00000000,?,?,00000000,00000000,0040CEE8,0000001C,00407188,00000001,?), ref: 00408D88
GetCPInfo.KERNEL32(?,?), ref: 00408D9F
_strlen.LIBCMT ref: 00408DC3
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,00000000), ref: 00408DE4

Memory Dump Source

Source File: 00000005.00000002.1791137495.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1791115649.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.1791161911.000000000040C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.1791182257.000000000040F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.1791201952.0000000000412000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_VistaCookiesCollector.jbxd

Similarity

API ID: Info$ByteCharMultiWide_strlen
String ID:
API String ID: 1335377746-0
Opcode ID: 2a4af2ec0fec23230070bf0e600324260cc5e292eb2be5d0776db7c2ef432e60
Instruction ID: 98ded046f11d0e48a535a09fc71370aae2c8e2dc3e52fffd855e46eda7b29d9b
Opcode Fuzzy Hash: 2a4af2ec0fec23230070bf0e600324260cc5e292eb2be5d0776db7c2ef432e60
Instruction Fuzzy Hash: 50516A71900258EBCF209FA5ED849AFBBB9EF84714B20023EF455B62D1DB385941CB68

Uniqueness

Uniqueness Score: -1.00%

Function 00403690 Relevance: 12.1, APIs: 8, Instructions: 134
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExA.KERNEL32(?,0040C190,00000060), ref: 004036B0
GetModuleHandleA.KERNEL32(00000000,?,0040C190,00000060), ref: 00403703
_fast_error_exit.LIBCMT ref: 00403765
_fast_error_exit.LIBCMT ref: 00403776
GetCommandLineA.KERNEL32(?,0040C190,00000060), ref: 00403795
GetStartupInfoA.KERNEL32(?), ref: 004037E9
__wincmdln.LIBCMT ref: 004037EF
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 0040380C

Memory Dump Source

Source File: 00000005.00000002.1791137495.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1791115649.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.1791161911.000000000040C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.1791182257.000000000040F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.1791201952.0000000000412000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_VistaCookiesCollector.jbxd

Similarity

API ID: HandleModule_fast_error_exit$CommandInfoLineStartupVersion__wincmdln
String ID:
API String ID: 3897392166-0
Opcode ID: 9c956490cd0ef6cdeec4a1da72f907820a9421600ba069b3eb156e0b173a419d
Instruction ID: e9453c6a2f5d6823cc90b25b88a1497c071f8e020ad53a4fb91da1993a80149c
Opcode Fuzzy Hash: 9c956490cd0ef6cdeec4a1da72f907820a9421600ba069b3eb156e0b173a419d
Instruction Fuzzy Hash: F741E3F1D006109ACB21BF76984576E3AA8AF44715F10843FF514BB2D1EB7D8982CB5C

Uniqueness

Uniqueness Score: -1.00%

Function 00405526 Relevance: 12.1, APIs: 8, Instructions: 131
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetEnvironmentStringsW.KERNEL32(74DF0A60,00000000,?,?,?,?,004037A5,?,0040C190,00000060), ref: 00405542
GetLastError.KERNEL32(?,?,?,?,004037A5,?,0040C190,00000060), ref: 00405556
GetEnvironmentStringsW.KERNEL32(74DF0A60,00000000,?,?,?,?,004037A5,?,0040C190,00000060), ref: 00405578
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,74DF0A60,00000000,?,?,?,?,004037A5), ref: 004055AC
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,?,?,004037A5,?,0040C190,00000060), ref: 004055CE
FreeEnvironmentStringsW.KERNEL32(00000000,?,?,?,?,004037A5,?,0040C190,00000060), ref: 004055E7
GetEnvironmentStrings.KERNEL32(74DF0A60,00000000,?,?,?,?,004037A5,?,0040C190,00000060), ref: 004055FD
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 00405639

Memory Dump Source

Source File: 00000005.00000002.1791137495.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1791115649.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.1791161911.000000000040C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.1791182257.000000000040F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.1791201952.0000000000412000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_VistaCookiesCollector.jbxd

Similarity

API ID: EnvironmentStrings$ByteCharFreeMultiWide$ErrorLast
String ID:
API String ID: 883850110-0
Opcode ID: 1b62812d8c18c4acd52bb17ed3a719e16aff50a8c864b2ae8fdf9bc6dc10d3cf
Instruction ID: 1bfd60ad3e6b07029dc0b80febb03ae7efd657d13a2cda291ce096aee0de3c69
Opcode Fuzzy Hash: 1b62812d8c18c4acd52bb17ed3a719e16aff50a8c864b2ae8fdf9bc6dc10d3cf
Instruction Fuzzy Hash: BB3157B2505514BFD7202FB4ACC483BBB9DEA453887150A3FF545F3280E2398C848EAD

Uniqueness

Uniqueness Score: -1.00%

Function 00407FBD Relevance: 9.1, APIs: 6, Instructions: 145COMMONLIBRARYCODE

Download Yara Rule

APIs

GetStringTypeW.KERNEL32(00000001,0040C8C8,00000001,?,0040CEE8,0000001C,00407188,00000001,?,00000100,?,00000000), ref: 00407FE1
GetLastError.KERNEL32 ref: 00407FF3
MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,0040CEE8,0000001C,00407188,00000001,?,00000100,?,00000000), ref: 00408055
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,00000000), ref: 004080D3
GetStringTypeW.KERNEL32(?,?,00000000,?,?,00000000), ref: 004080E5

Memory Dump Source

Source File: 00000005.00000002.1791137495.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1791115649.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.1791161911.000000000040C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.1791182257.000000000040F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.1791201952.0000000000412000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_VistaCookiesCollector.jbxd

Similarity

API ID: ByteCharMultiStringTypeWide$ErrorLast
String ID:
API String ID: 3581945363-0
Opcode ID: 5eb667921d2ca199136c7c9365ffe6f67fb0b0b229ad9aaa6095b9b35e960bbd
Instruction ID: 7fdf1af5d7f6dac8fa598b9687eaa9e1332da84d49fdb60aab15f4b6ac560e40
Opcode Fuzzy Hash: 5eb667921d2ca199136c7c9365ffe6f67fb0b0b229ad9aaa6095b9b35e960bbd
Instruction Fuzzy Hash: DD419271800219EBCB219F64DE45A9F3B75EF48760F21423EF850BA2D0DB798D51CB99

Uniqueness

Uniqueness Score: -1.00%

Function 004076B0 Relevance: 7.7, APIs: 5, Instructions: 184COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C,?,?,?,?,?,00404BBD,?), ref: 00407763
InterlockedExchange.KERNEL32(004102C0,00000001), ref: 004077E1
InterlockedExchange.KERNEL32(004102C0,00000000), ref: 00407846
InterlockedExchange.KERNEL32(004102C0,00000001), ref: 0040786A
InterlockedExchange.KERNEL32(004102C0,00000000), ref: 004078CA

Memory Dump Source

Source File: 00000005.00000002.1791137495.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1791115649.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.1791161911.000000000040C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.1791182257.000000000040F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.1791201952.0000000000412000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_VistaCookiesCollector.jbxd

Similarity

API ID: ExchangeInterlocked$QueryVirtual
String ID:
API String ID: 2947987494-0
Opcode ID: df9009ab3260fa7afde9ba866049477676ed498d70e5e28cb3271675c4a18f10
Instruction ID: bf1234e5598a04d8764753305695c94a92d500e332b62daa89183cc5d9e5975b
Opcode Fuzzy Hash: df9009ab3260fa7afde9ba866049477676ed498d70e5e28cb3271675c4a18f10
Instruction Fuzzy Hash: 1751E632E486059BDB24AB28C9CC76A73A1AB41354F24C57BD402B72D1D7B9FC82C75E

Uniqueness

Uniqueness Score: -1.00%

Function 00405648 Relevance: 7.7, APIs: 5, Instructions: 172COMMON

Download Yara Rule

APIs

GetStartupInfoA.KERNEL32(?), ref: 004056A5
GetFileType.KERNEL32(?), ref: 0040574F
GetStdHandle.KERNEL32(-000000F6), ref: 004057D0

Memory Dump Source

Source File: 00000005.00000002.1791137495.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1791115649.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.1791161911.000000000040C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.1791182257.000000000040F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.1791201952.0000000000412000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_VistaCookiesCollector.jbxd

Similarity

API ID: FileHandleInfoStartupType
String ID:
API String ID: 2461013171-0
Opcode ID: a88f8367689266aa1a3c7dd8d10ecd5462545b0e669837fb7a83b374dae2b360
Instruction ID: f0a0bf461f02c66beb8165d9eaa4d4a50f14239633c4fff051fd597669cb6141
Opcode Fuzzy Hash: a88f8367689266aa1a3c7dd8d10ecd5462545b0e669837fb7a83b374dae2b360
Instruction Fuzzy Hash: BB51E335504B01CFC7108F28D8847673BE4EB51324F188A3ED5AAEB2E1E739D415DB19

Uniqueness

Uniqueness Score: -1.00%

Function 0040960C Relevance: 7.7, APIs: 5, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1791137495.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1791115649.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.1791161911.000000000040C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.1791182257.000000000040F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.1791201952.0000000000412000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_VistaCookiesCollector.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7499bc1b7c0ff0daa8f79ce073473e4c1681531e546d62d2628351a1a58da7d5
Instruction ID: 11f0b05556c6b4945deb17a8797988e9a32bc3b6c2b7ed5b152346591b5af7f7
Opcode Fuzzy Hash: 7499bc1b7c0ff0daa8f79ce073473e4c1681531e546d62d2628351a1a58da7d5
Instruction Fuzzy Hash: 2941B0B2C10126DBCF20AFA69C849AF7A78EB41314B11423BF915B72E2D73D4D41CA9D

Uniqueness

Uniqueness Score: -1.00%

Function 00408F19 Relevance: 7.6, APIs: 5, Instructions: 92memoryCOMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 00408F33
GetSystemInfo.KERNEL32(?,?,?,0000001C), ref: 00408F44
VirtualQuery.KERNEL32(?,?,0000001C,?,?,0000001C), ref: 00408F8A
VirtualAlloc.KERNEL32(?,?,00001000,00000004,?,?,0000001C), ref: 00408FC8
VirtualProtect.KERNEL32(?,?,00000002,?,?,?,0000001C), ref: 00408FEE

Memory Dump Source

Source File: 00000005.00000002.1791137495.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1791115649.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.1791161911.000000000040C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.1791182257.000000000040F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.1791201952.0000000000412000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_VistaCookiesCollector.jbxd

Similarity

API ID: Virtual$Query$AllocInfoProtectSystem
String ID:
API String ID: 4136887677-0
Opcode ID: 931880f09a7b8799672eeee32bec0488656731e09d14bde5189d27f21a135e06
Instruction ID: 7af54ca418a8577f784fc3a9b8d38b3b4a141d2c4f6365ff30f4cd84b1fad7f2
Opcode Fuzzy Hash: 931880f09a7b8799672eeee32bec0488656731e09d14bde5189d27f21a135e06
Instruction Fuzzy Hash: 3B319132D4021AEBDF10CBA4DE85AEEBB79EB44354F14417AE941F7281DB349A40DB98

Uniqueness

Uniqueness Score: -1.00%

Function 00404451 Relevance: 7.5, APIs: 5, Instructions: 37threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000,00407630,00404AC0,00000000,0040C288,00000008,00404B17,?,?,?,00403990,00000004,0040C1A0,0000000C,00404A17), ref: 00404453
FlsGetValue.KERNEL32(?,00403990,00000004,0040C1A0,0000000C,00404A17,00000000,?,004046F3,?,0040C190,00000060), ref: 00404461
FlsSetValue.KERNEL32(00000000,?,00403990,00000004,0040C1A0,0000000C,00404A17,00000000,?,004046F3,?,0040C190,00000060), ref: 00404488
GetCurrentThreadId.KERNEL32 ref: 004044A0
SetLastError.KERNEL32(00000000,?,00403990,00000004,0040C1A0,0000000C,00404A17,00000000,?,004046F3,?,0040C190,00000060), ref: 004044B7

Memory Dump Source

Source File: 00000005.00000002.1791137495.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1791115649.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.1791161911.000000000040C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.1791182257.000000000040F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.1791201952.0000000000412000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_VistaCookiesCollector.jbxd

Similarity

API ID: ErrorLastValue$CurrentThread
String ID:
API String ID: 526964173-0
Opcode ID: b498fd98db1836464a09ae74a34d580fd959ea9ba54de7835484102509639f8b
Instruction ID: a958845bf67c746e94c037588b4b02eddeecfebde4ba9dea18433d7c61a017f7
Opcode Fuzzy Hash: b498fd98db1836464a09ae74a34d580fd959ea9ba54de7835484102509639f8b
Instruction Fuzzy Hash: 6CF0C2B1501712DFD7301FA4AD097463AA4AB007A5B10463AFA52B6AD2DB7D8804879C

Uniqueness

Uniqueness Score: -1.00%

Function 00409834 Relevance: 7.5, APIs: 5, Instructions: 32timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040984F
GetCurrentProcessId.KERNEL32 ref: 0040985B
GetCurrentThreadId.KERNEL32 ref: 00409863
GetTickCount.KERNEL32 ref: 0040986B
QueryPerformanceCounter.KERNEL32(?), ref: 00409877

Memory Dump Source

Source File: 00000005.00000002.1791137495.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1791115649.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.1791161911.000000000040C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.1791182257.000000000040F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.1791201952.0000000000412000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_VistaCookiesCollector.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: efa59f98ff7119501ac51c70d9e67a40b5d290f8c160f088a4b5fd89ed3ff139
Instruction ID: 02dabd53c79f0e0a81b012631f59df793984f9b0e9e9ce028ca4bb8b10a91328
Opcode Fuzzy Hash: efa59f98ff7119501ac51c70d9e67a40b5d290f8c160f088a4b5fd89ed3ff139
Instruction Fuzzy Hash: 17F0FF72C00124DBDB20ABF4EE4859AB7B8FF192407458575D801FB251E6349900CF98

Uniqueness

Uniqueness Score: -1.00%

Function 004075A0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 29libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,0040CE48,00000010,004049D6,00000000,00000FA0,74DF0A60,00000000,0040460E,00403770,?,0040C190,00000060), ref: 004075C3
GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionAndSpinCount), ref: 004075D3

Strings

kernel32.dll, xrefs: 004075BE
InitializeCriticalSectionAndSpinCount, xrefs: 004075CD

Memory Dump Source

Source File: 00000005.00000002.1791137495.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1791115649.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.1791161911.000000000040C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.1791182257.000000000040F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.1791201952.0000000000412000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_VistaCookiesCollector.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: InitializeCriticalSectionAndSpinCount$kernel32.dll
API String ID: 1646373207-3733552308
Opcode ID: f5ed0be1a3047369d037fb3e1fde1f139ea0a76e91afbb22d3c9f06fd14ed7c5
Instruction ID: 203e7eca569bbd6ed868e4e9953cb6c75d134ac5bf1c6538d821a508107e0ead
Opcode Fuzzy Hash: f5ed0be1a3047369d037fb3e1fde1f139ea0a76e91afbb22d3c9f06fd14ed7c5
Instruction Fuzzy Hash: 90F09030A44605EBCF146FB49C897CA3AA4BB44314F50827AA411F11E0D77CE9459A1D

Uniqueness

Uniqueness Score: -1.00%

Function 0040601F Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 13libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KERNEL32,004038E2), ref: 00406024
GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 00406034

Strings

IsProcessorFeaturePresent, xrefs: 0040602E
KERNEL32, xrefs: 0040601F

Memory Dump Source

Source File: 00000005.00000002.1791137495.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1791115649.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.1791161911.000000000040C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.1791182257.000000000040F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.1791201952.0000000000412000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_VistaCookiesCollector.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: IsProcessorFeaturePresent$KERNEL32
API String ID: 1646373207-3105848591
Opcode ID: f587656f110363da11810522b5beaaa3d15f5bda615f8063ad4188aa4cfc5f19
Instruction ID: 5b7d9587e42d2cf9dd33b1b8e91cc260946d204f1a1661c68c96989c8c8a41fc
Opcode Fuzzy Hash: f587656f110363da11810522b5beaaa3d15f5bda615f8063ad4188aa4cfc5f19
Instruction Fuzzy Hash: 49C012A0380201E6EA302BE2AD89F1722484B00B02F244236A80BF01C0EA7CC600942D

Uniqueness

Uniqueness Score: -1.00%

Function 00404185 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 195COMMON

Download Yara Rule

APIs

Part of subcall function 00404060: _UnwindNestedFrames.LIBCMT ref: 00404083

InitializeCriticalSection.KERNEL32(004041AA,00000003), ref: 00407594

Strings

csm, xrefs: 0040421E
csm, xrefs: 004041AE
csm, xrefs: 00404252

Memory Dump Source

Source File: 00000005.00000002.1791137495.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1791115649.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.1791161911.000000000040C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.1791182257.000000000040F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.1791201952.0000000000412000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_VistaCookiesCollector.jbxd

Similarity

API ID: CriticalFramesInitializeNestedSectionUnwind
String ID: csm$csm$csm
API String ID: 2222982843-393685449
Opcode ID: bee5369a0ea08069eecdecf8817e2882068670c7453447436f2fe622aa13b981
Instruction ID: b8aadbcd0020964f6440c18cd8b1ee8fbd8776e5c812a45703f1f7bd4425f420
Opcode Fuzzy Hash: bee5369a0ea08069eecdecf8817e2882068670c7453447436f2fe622aa13b981
Instruction Fuzzy Hash: 937190B1A00209DFCF14EF95C881AAE77B5BF84315F1440AAFA14BB2D2C739D951CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00405251 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

___initmbctable.LIBCMT ref: 0040525E
_strlen.LIBCMT ref: 00405277
_strlen.LIBCMT ref: 004052B0
_strcat.LIBCMT ref: 004052CD

Memory Dump Source

Source File: 00000005.00000002.1791137495.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1791115649.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.1791161911.000000000040C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.1791182257.000000000040F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.1791201952.0000000000412000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_VistaCookiesCollector.jbxd

Similarity

API ID: _strlen$___initmbctable_strcat
String ID:
API String ID: 109824703-0
Opcode ID: 90967aa605f4e6f8f63d8f650d75b43aeb99eff316012a03af253b09e6850dc3
Instruction ID: 6eba22a2f67460ffd36e7a8ee9f3ca4ce05e733ea58928ed84a39a423c0345d1
Opcode Fuzzy Hash: 90967aa605f4e6f8f63d8f650d75b43aeb99eff316012a03af253b09e6850dc3
Instruction Fuzzy Hash: C91124B29089055AD7216F35BC0156B3B98EF02324764417FE590732E1DB3D1846DF8C

Uniqueness

Uniqueness Score: -1.00%

Function 00409AE7 Relevance: 6.0, APIs: 4, Instructions: 38COMMON

Download Yara Rule

APIs

___addl.LIBCMT ref: 00409AF6
___addl.LIBCMT ref: 00409B0A
___addl.LIBCMT ref: 00409B22
___addl.LIBCMT ref: 00409B3A

Memory Dump Source

Source File: 00000005.00000002.1791137495.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1791115649.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.1791161911.000000000040C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.1791182257.000000000040F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.1791201952.0000000000412000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_VistaCookiesCollector.jbxd

Similarity

API ID: ___addl
String ID:
API String ID: 2260456530-0
Opcode ID: a6d3fea94caffdbfbeec600a8d228e4f9831f0a4e76ee5ff08ec74ce47c2ef23
Instruction ID: f45adf0bcf02cf876cd21b519aee2ffaca28be1334e598c672f476833fa9aecc
Opcode Fuzzy Hash: a6d3fea94caffdbfbeec600a8d228e4f9831f0a4e76ee5ff08ec74ce47c2ef23
Instruction Fuzzy Hash: 37F04F76500106AFDA109A42EC01957B7B9FF84314B08443AFD5896172E732EC68CB52

Uniqueness

Uniqueness Score: -1.00%

Function 00405CBC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

__shift.LIBCMT ref: 00405CDF

Part of subcall function 00405C9F: _strlen.LIBCMT ref: 00405CA7

_strcat.LIBCMT ref: 00405D1C

Strings

e+000, xrefs: 00405D0E

Memory Dump Source

Source File: 00000005.00000002.1791137495.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1791115649.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.1791161911.000000000040C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.1791182257.000000000040F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.1791201952.0000000000412000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_VistaCookiesCollector.jbxd

Similarity

API ID: __shift_strcat_strlen
String ID: e+000
API String ID: 208078240-1027065040
Opcode ID: c1c98124c0f99fd6e6a30ec725cc13b08b8514032dacf38be5e4f61e373e1ea2
Instruction ID: 2ff7f9cc5d3d03df526acbee499e9ac8987a9be90bdc81caf83370e077f4feb5
Opcode Fuzzy Hash: c1c98124c0f99fd6e6a30ec725cc13b08b8514032dacf38be5e4f61e373e1ea2
Instruction Fuzzy Hash: A821C3362087944FD72A5E389C943A63BD09F02358F1C84BFE085DA2D2D67DC985CB55

Uniqueness

Uniqueness Score: -1.00%

Function 00405484 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

___initmbctable.LIBCMT ref: 00405496
GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\AppData\Local\Temp\{A81A974F-8A22-43E6-9243-5198FF758DA1}\VistaCookiesCollector.exe,00000104,74DF0A60,00000000,?,?,?,?,004037AF,?,0040C190,00000060), ref: 004054AE

Strings

C:\Users\user\AppData\Local\Temp\{A81A974F-8A22-43E6-9243-5198FF758DA1}\VistaCookiesCollector.exe, xrefs: 004054A0, 004054A5

Memory Dump Source

Source File: 00000005.00000002.1791137495.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1791115649.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.1791161911.000000000040C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.1791182257.000000000040F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.1791201952.0000000000412000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_VistaCookiesCollector.jbxd

Similarity

API ID: FileModuleName___initmbctable
String ID: C:\Users\user\AppData\Local\Temp\{A81A974F-8A22-43E6-9243-5198FF758DA1}\VistaCookiesCollector.exe
API String ID: 767393020-439077991
Opcode ID: 383d1cd94c64c2905cd51488bdcef44c5a300afd0e2e74a96abd786d926571ba
Instruction ID: 12db10d1739c1ce9a2eb1c697f3fa6b03e7167528f25e80479e9fc4fd325dec1
Opcode Fuzzy Hash: 383d1cd94c64c2905cd51488bdcef44c5a300afd0e2e74a96abd786d926571ba
Instruction Fuzzy Hash: C311EB72A04608ABD711DBA9EC415DF7BA8EB85360F10017FF905F3291D6B89E40CF98

Uniqueness

Uniqueness Score: -1.00%

Function 004067A9 Relevance: 5.1, APIs: 4, Instructions: 57memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapReAlloc.KERNEL32(00000000,00000050,00000000,00406D9A,00000000,?,00000000), ref: 004067D0
HeapAlloc.KERNEL32(00000008,000041C4,00000000,00000000,00406D9A,00000000,?,00000000), ref: 00406809
VirtualAlloc.KERNEL32(00000000,00100000,00002000,00000004), ref: 00406827
HeapFree.KERNEL32(00000000,?), ref: 0040683E

Memory Dump Source

Source File: 00000005.00000002.1791137495.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1791115649.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.1791161911.000000000040C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.1791182257.000000000040F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.1791201952.0000000000412000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_VistaCookiesCollector.jbxd

Similarity

API ID: AllocHeap$FreeVirtual
String ID:
API String ID: 3499195154-0
Opcode ID: 61b92e8b457bdb883c0454994ea8a933c70806de892cf2ba588443b70bb7c510
Instruction ID: bb5112fb84cc6387e033f6faaa2c997ccf0f61fea12e7994c21ab49bfeb29561
Opcode Fuzzy Hash: 61b92e8b457bdb883c0454994ea8a933c70806de892cf2ba588443b70bb7c510
Instruction Fuzzy Hash: 93116A71240200DFD7219F58ED85AA27BBAFB913547258A3AF252E65F0D3329852CB08

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: SweetIM.exePID: 7388, Parent PID: 7204COMMON

Execution Graph

Execution Coverage:	4.3%
Dynamic/Decrypted Code Coverage:	51.3%
Signature Coverage:	6.9%
Total number of Nodes:	1834
Total number of Limit Nodes:	71

Executed Functions

Function 007B66A0 Relevance: 42.2, APIs: 21, Strings: 3, Instructions: 166
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

??0CWinOsInfo@@QAE@XZ.MGCOMMON ref: 007B66C5

Part of subcall function 007CC530: GetVersionExW.KERNEL32(?,?,?,?,007B66CA), ref: 007CC550

?IsVistaOrLater@CWinOsInfo@@QBE_NXZ.MGCOMMON ref: 007B66DD
InitializeSecurityDescriptor.ADVAPI32 ref: 007B672C
SetSecurityDescriptorDacl.ADVAPI32(00000001,00000001,00000000,00000000), ref: 007B6743
ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(S:(ML;;NW;;;LW),00000001,?,00000000), ref: 007B676E
GetSecurityDescriptorSacl.ADVAPI32(?,?,?,?), ref: 007B6790
SetSecurityDescriptorSacl.ADVAPI32(00000001,00000001,?,00000000), ref: 007B67AB
CreateMutexW.KERNEL32(0000000C,00000000,?), ref: 007B67C7
CreateMutexW.KERNEL32(00000000,00000000,?), ref: 007B67DF
GetLastError.KERNEL32 ref: 007B67E4
InitializeSecurityDescriptor.ADVAPI32 ref: 007B6813
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,00000000,00000000), ref: 007B6826
CreateMutexW.KERNEL32(0000000C,00000000,?), ref: 007B683F
GetLastError.KERNEL32 ref: 007B6844
GetLastError.KERNEL32 ref: 007B6852
wsprintfW.USER32 ref: 007B6866
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(?), ref: 007B687D
??0CErrException@@QAE@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z.MGCOMMON ref: 007B6887
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z.MSVCP71 ref: 007B68A4
_CxxThrowException.MSVCR71(dt},007DC070), ref: 007B68B4
??1CWinOsInfo@@UAE@XZ.MGCOMMON ref: 007B68C8

Strings

S:(ML;;NW;;;LW), xrefs: 007B6759
CMutex::Constructor, GetLastError=%d, xrefs: 007B6860
dt}, xrefs: 007B68AF, 007B68B3

Memory Dump Source

Source File: 00000007.00000002.1893726370.00000000007B1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000007.00000002.1893698679.00000000007B0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.1893761079.00000000007D7000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.1893806747.00000000007EC000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.1893827050.00000000007ED000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7b0000_SweetIM.jbxd

Similarity

API ID: DescriptorSecurity$CreateErrorG@std@@Info@@LastMutexU?$char_traits@V?$allocator@$??0?$basic_string@DaclG@2@@std@@InitializeSacl$ConvertExceptionException@@G@2@@std@@@Later@StringThrowV01@@V?$basic_string@VersionVistawsprintf
String ID: CMutex::Constructor, GetLastError=%d$S:(ML;;NW;;;LW)$dt}
API String ID: 3739819402-3072482169
Opcode ID: 078df22e3cbf30f20fbc72d1e5bb427c8e0e2cd5ca0d2644512501bde70c4007
Instruction ID: bf0f86bb798c574cc3598a901b08a108359ef6a6bc80b2b8dec8cf7e85c49407
Opcode Fuzzy Hash: 078df22e3cbf30f20fbc72d1e5bb427c8e0e2cd5ca0d2644512501bde70c4007
Instruction Fuzzy Hash: 5B514EB1509341EFD314DF64D884AABBBF9FB88704F448D2EF58982290E778D944CB56

Uniqueness

Uniqueness Score: -1.00%

Function 0081D66C Relevance: 33.4, APIs: 22, Instructions: 360
filenativesynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(00000000,0081DB46), ref: 0081D6A3

Part of subcall function 0080D11C: IsBadReadPtr.KERNEL32(00000000,00000000), ref: 0080D14C

SetLastError.KERNEL32(00000000,00000000,0081DB46), ref: 0081DB1B

Part of subcall function 0080D7FC: GetVersion.KERNEL32(0081DEE4), ref: 0080D80B
Part of subcall function 0080D7FC: GetVersionExW.KERNEL32(?,0081DEE4), ref: 0080D82D

GetCurrentProcessId.KERNEL32(00000000,0081DB46), ref: 0081D70B
CreateFileMappingA.KERNEL32(000000FF,00000000,00000004,00000000,000000F0,00000000), ref: 0081D7D9
MapViewOfFile.KERNEL32(?,000F001F,00000000,00000000,00000000,000000FF,00000000,00000004,00000000,000000F0,00000000), ref: 0081D7FF
UnmapViewOfFile.KERNEL32(00000000,?,000F001F,00000000,00000000,00000000,000000FF,00000000,00000004,00000000,000000F0,00000000), ref: 0081D82B
NtConnectPort.NTDLL(?,000000F0,?,?,?,00000000,?,00000104), ref: 0081D8A2
CloseHandle.KERNEL32(?), ref: 0081D8B0
CloseHandle.KERNEL32(?), ref: 0081D8C0
OpenProcess.KERNEL32(00100000,00000000,00000000), ref: 0081D8F8
OpenProcess.KERNEL32(00100040,00000000,?,00000000,?,00000000,00000000,00000000,0081DB46), ref: 0081D97F
GetCurrentProcess.KERNEL32(?,00000000,00000000,00000002,00100040,00000000,?,00000000,?,00000000,00000000,00000000,0081DB46), ref: 0081D99B
DuplicateHandle.KERNEL32(00000000,?,00000000,?,00000000,00000000,00000002,00100040,00000000,?,00000000,?,00000000,00000000,00000000,0081DB46), ref: 0081D9A9
WriteFile.KERNEL32(?,?,00000004,?,00000000,00000000,?,00000000,?,00000000,00000000,00000002,00100040,00000000,?,00000000), ref: 0081D9D1
WriteFile.KERNEL32(?,?,00000004,00000004,00000000,?,?,00000004,?,00000000,00000000,?,00000000,?,00000000,00000000), ref: 0081D9FE
WriteFile.KERNEL32(?,?,00000004,00000004,00000000,?,?,00000004,00000004,00000000,?,?,00000004,?,00000000,00000000), ref: 0081DA20
WriteFile.KERNEL32(?,?,00000004,00000004,00000000,?,?,00000004,00000004,00000000,?,?,00000004,00000004,00000000,?), ref: 0081DA42
WriteFile.KERNEL32(?,?,?,00000004,00000000,?,?,00000004,00000004,00000000,?,?,00000004,00000004,00000000,?), ref: 0081DA66
CloseHandle.KERNEL32(?,?,?,00000004,?,00000000,00000000,?,00000000,?,00000000,00000000,00000002,00100040,00000000,?), ref: 0081DA8B
ReleaseMutex.KERNEL32(?,00000000,?,00000000,00000000,00000000,0081DB46), ref: 0081DA94
CloseHandle.KERNEL32(?,?,00000000,?,00000000,00000000,00000000,0081DB46), ref: 0081DA9D
CloseHandle.KERNEL32(00000000,00000000,?,00000000,00000000,0081DB46), ref: 0081DB01

Memory Dump Source

Source File: 00000007.00000002.1893873243.0000000000801000.00000020.00000001.01000000.00000015.sdmp, Offset: 00800000, based on PE: true

Associated: 00000007.00000002.1893849837.0000000000800000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000007.00000002.1893902337.000000000081F000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000007.00000002.1893926350.0000000000822000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000007.00000002.1893956770.0000000000824000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_800000_SweetIM.jbxd

Similarity

API ID: File$Handle$CloseWrite$Process$CurrentErrorLastOpenVersionView$ConnectCreateDuplicateMappingMutexPortReadReleaseUnmap
String ID:
API String ID: 4145780775-0
Opcode ID: d64bda629a6cfe6a8a9a904c452e4d4da598288fd14db0cfa73752f9a7a24151
Instruction ID: aff6c5e994f270a3124a9b8be026fd7965444aa434f2835d88b4d48e7bda0ab4
Opcode Fuzzy Hash: d64bda629a6cfe6a8a9a904c452e4d4da598288fd14db0cfa73752f9a7a24151
Instruction Fuzzy Hash: 59E1EA71A043199BEB60DF68CC85BEEB7B8FF09300F5045A5E918E7281DB749A85CF61

Uniqueness

Uniqueness Score: -1.00%

Function 0081C98C Relevance: 28.7, APIs: 19, Instructions: 203
nativememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LocalAlloc.KERNEL32(00000040,00000200), ref: 0081C9A1
NtReplyWaitReceivePort.NTDLL(?,00000000,00000000,00000024), ref: 0081C9B7
NtAcceptConnectPort.NTDLL(?,00000000,00000024,00000000,00000000,00000000), ref: 0081CA02
LocalFree.KERNEL32(00000000), ref: 0081CA09
GetCurrentProcessId.KERNEL32 ref: 0081CA13
LocalAlloc.KERNEL32(00000040,00000018), ref: 0081CA23
NtAcceptConnectPort.NTDLL(?,00000000,00000024,00000001,00000000,?), ref: 0081CA5A
LocalAlloc.KERNEL32(00000040,?), ref: 0081CA9A
LocalFree.KERNEL32(00000000,00000040,?), ref: 0081CAD0
NtCompleteConnectPort.NTDLL(?), ref: 0081CADC
CloseHandle.KERNEL32(?), ref: 0081CAE6
SetEvent.KERNEL32(?,?,0000000C,?,?), ref: 0081CB1E
EnterCriticalSection.KERNEL32(?,?,0000000C,?,?), ref: 0081CB40
LeaveCriticalSection.KERNEL32(?,0081CB86,?,?,0000000C,?,?), ref: 0081CB79
LocalFree.KERNEL32(00000000), ref: 0081CBCF

Memory Dump Source

Source File: 00000007.00000002.1893873243.0000000000801000.00000020.00000001.01000000.00000015.sdmp, Offset: 00800000, based on PE: true

Associated: 00000007.00000002.1893849837.0000000000800000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000007.00000002.1893902337.000000000081F000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000007.00000002.1893926350.0000000000822000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000007.00000002.1893956770.0000000000824000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_800000_SweetIM.jbxd

Similarity

API ID: Local$Port$AllocConnectFree$AcceptCriticalSection$CloseCompleteCurrentEnterEventHandleLeaveProcessReceiveReplyWait
String ID:
API String ID: 3707044477-0
Opcode ID: 9a3f3410594572abb1af84cc06354a54a363eb9201eaf060b2f119b8e0367fb6
Instruction ID: 0305566091dacc56cdc72434077b7491f2bfc1aeac9646e126f90e4a02aa7f89
Opcode Fuzzy Hash: 9a3f3410594572abb1af84cc06354a54a363eb9201eaf060b2f119b8e0367fb6
Instruction Fuzzy Hash: 08713DB1640208AFDB50DF68CC86FAABBE8FF09710F108555F945DB292D774E980CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0081DC3A Relevance: 28.7, APIs: 19, Instructions: 160
synchronizationthreadnativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 0081DC56
NtConnectPort.NTDLL(?,?,?,00000000,00000000,00000000,00000000,?), ref: 0081DC9A
WaitForSingleObject.KERNEL32(?,00000064), ref: 0081DCA9
TerminateThread.KERNEL32(?,00000000,?,00000064), ref: 0081DCB7
CloseHandle.KERNEL32(?,?,00000000,?,00000064), ref: 0081DCC3
WaitForSingleObject.KERNEL32(?,00000064,?,?,00000000,?,00000064), ref: 0081DCD1
TerminateThread.KERNEL32(?,00000000,?,00000064,?,?,00000000,?,00000064), ref: 0081DCDF
CloseHandle.KERNEL32(?,?,00000000,?,00000064,?,?,00000000,?,00000064), ref: 0081DCEB
SetEvent.KERNEL32(?,?,?,00000000,?,00000064,?,?,00000000,?,00000064), ref: 0081DD1D
WaitForSingleObject.KERNEL32(?,00000064,?,?,?,00000000,?,00000064,?,?,00000000,?,00000064), ref: 0081DD30
TerminateThread.KERNEL32(?,00000000,?,00000064,?,?,?,00000000,?,00000064,?,?,00000000,?,00000064), ref: 0081DD43
CloseHandle.KERNEL32(?,?,00000000,?,00000064,?,?,?,00000000,?,00000064,?,?,00000000,?,00000064), ref: 0081DD54
CloseHandle.KERNEL32(?,?,?,00000000,?,00000064,?,?,?,00000000,?,00000064,?,?,00000000,?), ref: 0081DD66
LocalFree.KERNEL32(?,?,?,?,00000000,?,00000064,?,?,?,00000000,?,00000064,?,?,00000000), ref: 0081DD90
LocalFree.KERNEL32(?,?,?,?,00000000,?,00000064,?,?,?,00000000,?,00000064,?,?,00000000), ref: 0081DD9F
CloseHandle.KERNEL32(?,?,?,00000000,?,00000064,?,?,00000000,?,00000064), ref: 0081DDC4
CloseHandle.KERNEL32(?,?,?,?,00000000,?,00000064,?,?,00000000,?,00000064), ref: 0081DDD0
DeleteCriticalSection.KERNEL32(-0000001C,?,?,?,?,00000000,?,00000064,?,?,00000000,?,00000064), ref: 0081DDDC
LocalFree.KERNEL32(00000000,-0000001C,?,?,?,?,00000000,?,00000064,?,?,00000000,?,00000064), ref: 0081DDED

Memory Dump Source

Source File: 00000007.00000002.1893873243.0000000000801000.00000020.00000001.01000000.00000015.sdmp, Offset: 00800000, based on PE: true

Associated: 00000007.00000002.1893849837.0000000000800000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000007.00000002.1893902337.000000000081F000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000007.00000002.1893926350.0000000000822000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000007.00000002.1893956770.0000000000824000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_800000_SweetIM.jbxd

Similarity

API ID: CloseHandle$FreeLocalObjectSingleTerminateThreadWait$ConnectCriticalDeleteEventPortReleaseSectionSemaphore
String ID:
API String ID: 1523373319-0
Opcode ID: 9a8f7c37dd96c5949ce5b7f406ea1374f4c13f0faf7007db3f1acaaaf958e9ae
Instruction ID: b13709651a20c09196f4e8d4d54aa58541ece026f17b6a13c373ca27590b94a8
Opcode Fuzzy Hash: 9a8f7c37dd96c5949ce5b7f406ea1374f4c13f0faf7007db3f1acaaaf958e9ae
Instruction Fuzzy Hash: C551B775E006059FDB50EFACC885EAEB7B8FF09310F458451BA10EB3A2D679E9018F61

Uniqueness

Uniqueness Score: -1.00%

Function 0081CCDC Relevance: 21.2, APIs: 14, Instructions: 155threadmemorynativeCOMMON

Download Yara Rule

APIs

InitializeSecurityDescriptor.ADVAPI32(?,00000001), ref: 0081CD0D
SetSecurityDescriptorDacl.ADVAPI32(?,000000FF,00000000,00000000,?,00000001), ref: 0081CD1C
LocalAlloc.KERNEL32(00000040,00000018,?,000000FF,00000000,00000000,?,00000001), ref: 0081CD25
NtCreatePort.NTDLL(FFFFFFFF,00000000,00000104,0000012C,00000000), ref: 0081CD56
LocalFree.KERNEL32(00000000,00000000), ref: 0081CD63
EnterCriticalSection.KERNEL32(0082394C,00000000,00000000), ref: 0081CD8A
LocalAlloc.KERNEL32(00000040,00000048), ref: 0081CDC9
CreateSemaphoreA.KERNEL32(00000000,00000000,7FFFFFFF,00000000), ref: 0081CE19
CreateThread.KERNEL32(00000000,00000000,Function_0001C98C,00000000,00000000,?), ref: 0081CE3A
CreateThread.KERNEL32(00000000,00000000,Function_0001C668,?,00000000,00000000), ref: 0081CE5B
SetThreadPriority.KERNEL32(?,00000007,00000000,00000000,Function_0001C668,?,00000000,00000000,00000000,00000000,Function_0001C98C,00000000,00000000,?,00000040,00000048), ref: 0081CE72
SetThreadPriority.KERNEL32(00000007,00000001,?,00000007,00000000,00000000,Function_0001C668,?,00000000,00000000,00000000,00000000,Function_0001C98C,00000000,00000000,?), ref: 0081CE85
InitializeCriticalSection.KERNEL32(?,00000007,00000001,?,00000007,00000000,00000000,Function_0001C668,?,00000000,00000000,00000000,00000000,Function_0001C98C,00000000,00000000), ref: 0081CE96
LeaveCriticalSection.KERNEL32(0082394C,0081CEBA,?,00000007,00000000,00000000,Function_0001C668,?,00000000,00000000,00000000,00000000,Function_0001C98C,00000000,00000000,?), ref: 0081CEAD

Memory Dump Source

Source File: 00000007.00000002.1893873243.0000000000801000.00000020.00000001.01000000.00000015.sdmp, Offset: 00800000, based on PE: true

Associated: 00000007.00000002.1893849837.0000000000800000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000007.00000002.1893902337.000000000081F000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000007.00000002.1893926350.0000000000822000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000007.00000002.1893956770.0000000000824000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_800000_SweetIM.jbxd

Similarity

API ID: CreateThread$CriticalLocalSection$AllocDescriptorInitializePrioritySecurity$DaclEnterFreeLeavePortSemaphore
String ID:
API String ID: 553606569-0
Opcode ID: 9fdd953b7d56ac7af386ea97af5dfe921849c2c554c3b63b2af311ea27463f92
Instruction ID: 5d44165c69352a78832e009dfe3a6382a8fb59b77a18484569dcea5a17cbf34c
Opcode Fuzzy Hash: 9fdd953b7d56ac7af386ea97af5dfe921849c2c554c3b63b2af311ea27463f92
Instruction Fuzzy Hash: 14515B70A41304AFD750EF98DC82F9ABBA4FB4A710F108555F604AB3D6D7B4EA818B91

Uniqueness

Uniqueness Score: -1.00%

Function 0081D664 Relevance: 16.7, APIs: 11, Instructions: 219filenativeCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,0081DB46), ref: 0081D6A3

Part of subcall function 0080D11C: IsBadReadPtr.KERNEL32(00000000,00000000), ref: 0080D14C

SetLastError.KERNEL32(00000000,00000000,0081DB46), ref: 0081DB1B

Part of subcall function 0080D7FC: GetVersion.KERNEL32(0081DEE4), ref: 0080D80B
Part of subcall function 0080D7FC: GetVersionExW.KERNEL32(?,0081DEE4), ref: 0080D82D

GetCurrentProcessId.KERNEL32(00000000,0081DB46), ref: 0081D70B
CreateFileMappingA.KERNEL32(000000FF,00000000,00000004,00000000,000000F0,00000000), ref: 0081D7D9
MapViewOfFile.KERNEL32(?,000F001F,00000000,00000000,00000000,000000FF,00000000,00000004,00000000,000000F0,00000000), ref: 0081D7FF
UnmapViewOfFile.KERNEL32(00000000,?,000F001F,00000000,00000000,00000000,000000FF,00000000,00000004,00000000,000000F0,00000000), ref: 0081D82B
NtConnectPort.NTDLL(?,000000F0,?,?,?,00000000,?,00000104), ref: 0081D8A2
CloseHandle.KERNEL32(?), ref: 0081D8B0
CloseHandle.KERNEL32(?), ref: 0081D8C0
OpenProcess.KERNEL32(00100000,00000000,00000000), ref: 0081D8F8
OpenProcess.KERNEL32(00100040,00000000,?,00000000,?,00000000,00000000,00000000,0081DB46), ref: 0081D97F
GetCurrentProcess.KERNEL32(?,00000000,00000000,00000002,00100040,00000000,?,00000000,?,00000000,00000000,00000000,0081DB46), ref: 0081D99B
DuplicateHandle.KERNEL32(00000000,?,00000000,?,00000000,00000000,00000002,00100040,00000000,?,00000000,?,00000000,00000000,00000000,0081DB46), ref: 0081D9A9
WriteFile.KERNEL32(?,?,00000004,?,00000000,00000000,?,00000000,?,00000000,00000000,00000002,00100040,00000000,?,00000000), ref: 0081D9D1
WriteFile.KERNEL32(?,?,00000004,00000004,00000000,?,?,00000004,?,00000000,00000000,?,00000000,?,00000000,00000000), ref: 0081D9FE
WriteFile.KERNEL32(?,?,00000004,00000004,00000000,?,?,00000004,00000004,00000000,?,?,00000004,?,00000000,00000000), ref: 0081DA20
WriteFile.KERNEL32(?,?,00000004,00000004,00000000,?,?,00000004,00000004,00000000,?,?,00000004,00000004,00000000,?), ref: 0081DA42
CloseHandle.KERNEL32(00000000,00000000,?,00000000,00000000,0081DB46), ref: 0081DB01

Memory Dump Source

Source File: 00000007.00000002.1893873243.0000000000801000.00000020.00000001.01000000.00000015.sdmp, Offset: 00800000, based on PE: true

Associated: 00000007.00000002.1893849837.0000000000800000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000007.00000002.1893902337.000000000081F000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000007.00000002.1893926350.0000000000822000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000007.00000002.1893956770.0000000000824000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_800000_SweetIM.jbxd

Similarity

API ID: File$HandleProcessWrite$Close$CurrentErrorLastOpenVersionView$ConnectCreateDuplicateMappingPortReadUnmap
String ID:
API String ID: 2042162577-0
Opcode ID: 0db856f7c7e3b176d1fd5836d7ba900920b7d1d77492aa69ca3d58d91b52b134
Instruction ID: 314e396f6dc67ec4e3aa904bd35411b87e1d5ddd80a7807807bcf52f1c0326aa
Opcode Fuzzy Hash: 0db856f7c7e3b176d1fd5836d7ba900920b7d1d77492aa69ca3d58d91b52b134
Instruction Fuzzy Hash: 4B911770A042199BDB60EF68CC85BDEB7B8FF49300F5045A6E908E7291DB349A85CF61

Uniqueness

Uniqueness Score: -1.00%

Function 0081E143 Relevance: 16.7, APIs: 11, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028,?,00000000,0081E332), ref: 0081E184
OpenProcessToken.ADVAPI32(00000000,00000028,?,00000000,0081E332), ref: 0081E18A
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,00000000,?,00000000,0081E310,?,00000000,00000028,?,00000000,0081E332), ref: 0081E1B8
LocalAlloc.KERNEL32(00000040,00000000,?,TokenIntegrityLevel,00000000,00000000,?,00000000,0081E310,?,00000000,00000028,?,00000000,0081E332), ref: 0081E1CF
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,00000000,00000000,00000040,00000000,?,TokenIntegrityLevel,00000000,00000000,?,00000000,0081E310,?,00000000), ref: 0081E1E7
LookupPrivilegeValueA.ADVAPI32(00000000,00000000,?), ref: 0081E210
LookupPrivilegeValueA.ADVAPI32(00000000,00000000,?), ref: 0081E243
LookupPrivilegeValueA.ADVAPI32(00000000,00000000,?), ref: 0081E276
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,?,?,TokenIntegrityLevel,00000000,00000000), ref: 0081E2EE
LocalFree.KERNEL32(00000000,?,TokenIntegrityLevel,00000000,00000000,00000000,00000040,00000000,?,TokenIntegrityLevel,00000000,00000000,?,00000000,0081E310), ref: 0081E2F4
CloseHandle.KERNEL32(?,0081E317,00000000,?,00000000,0081E310,?,00000000,00000028,?,00000000,0081E332), ref: 0081E30A

Memory Dump Source

Source File: 00000007.00000002.1893873243.0000000000801000.00000020.00000001.01000000.00000015.sdmp, Offset: 00800000, based on PE: true

Associated: 00000007.00000002.1893849837.0000000000800000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000007.00000002.1893902337.000000000081F000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000007.00000002.1893926350.0000000000822000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000007.00000002.1893956770.0000000000824000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_800000_SweetIM.jbxd

Similarity

API ID: Token$LookupPrivilegeValue$InformationLocalProcess$AdjustAllocCloseCurrentFreeHandleOpenPrivileges
String ID:
API String ID: 4050356984-0
Opcode ID: 9aba3c8a5a1a8824745a540cbc888fd9656881b234d359c0e65e3eaaf8f9a7ea
Instruction ID: c13c829b2681a62bfa91c7c6cfc865791a47c7c3b798fd8697d0f9e971a68050
Opcode Fuzzy Hash: 9aba3c8a5a1a8824745a540cbc888fd9656881b234d359c0e65e3eaaf8f9a7ea
Instruction Fuzzy Hash: E3513C71A00209AFDB51DBA8CC96FEEBBBCFF08314F104565FA00EB281D775A9558B61

Uniqueness

Uniqueness Score: -1.00%

Function 0081E15C Relevance: 16.7, APIs: 11, Instructions: 162memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028,?,00000000,0081E332), ref: 0081E184
OpenProcessToken.ADVAPI32(00000000,00000028,?,00000000,0081E332), ref: 0081E18A
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,00000000,?,00000000,0081E310,?,00000000,00000028,?,00000000,0081E332), ref: 0081E1B8
LocalAlloc.KERNEL32(00000040,00000000,?,TokenIntegrityLevel,00000000,00000000,?,00000000,0081E310,?,00000000,00000028,?,00000000,0081E332), ref: 0081E1CF
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,00000000,00000000,00000040,00000000,?,TokenIntegrityLevel,00000000,00000000,?,00000000,0081E310,?,00000000), ref: 0081E1E7
LookupPrivilegeValueA.ADVAPI32(00000000,00000000,?), ref: 0081E210
LookupPrivilegeValueA.ADVAPI32(00000000,00000000,?), ref: 0081E243
LookupPrivilegeValueA.ADVAPI32(00000000,00000000,?), ref: 0081E276
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,?,?,TokenIntegrityLevel,00000000,00000000), ref: 0081E2EE
LocalFree.KERNEL32(00000000,?,TokenIntegrityLevel,00000000,00000000,00000000,00000040,00000000,?,TokenIntegrityLevel,00000000,00000000,?,00000000,0081E310), ref: 0081E2F4
CloseHandle.KERNEL32(?,0081E317,00000000,?,00000000,0081E310,?,00000000,00000028,?,00000000,0081E332), ref: 0081E30A

Memory Dump Source

Source File: 00000007.00000002.1893873243.0000000000801000.00000020.00000001.01000000.00000015.sdmp, Offset: 00800000, based on PE: true

Associated: 00000007.00000002.1893849837.0000000000800000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000007.00000002.1893902337.000000000081F000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000007.00000002.1893926350.0000000000822000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000007.00000002.1893956770.0000000000824000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_800000_SweetIM.jbxd

Similarity

API ID: Token$LookupPrivilegeValue$InformationLocalProcess$AdjustAllocCloseCurrentFreeHandleOpenPrivileges
String ID:
API String ID: 4050356984-0
Opcode ID: f6222e09f93ec1d4fc642946200208f765e4050cb6dc5c4bc90516c69d0630ad
Instruction ID: bd29b24f7dd9406d8135a6c0167aa61ef4ef1198fe4c48dcefff3d8debce6a0a
Opcode Fuzzy Hash: f6222e09f93ec1d4fc642946200208f765e4050cb6dc5c4bc90516c69d0630ad
Instruction Fuzzy Hash: 13511771A00209AFEB51DBA8CC92FEEB7BCFF48314F504465FA00E7281D775AA548B61

Uniqueness

Uniqueness Score: -1.00%

Function 004069C0 Relevance: 147.5, APIs: 73, Strings: 11, Instructions: 500
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?GetEnumSubKeysNames@@YAHAAVCRegKey@ATL@@AAV?$vector@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@V?$allocator@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@2@@std@@@Z.MGCOMMON(?,?,?,00000000,?,75A8E9B0), ref: 00406A01
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71 ref: 00406A60
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z.MSVCP71(?), ref: 00406A7D
?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ.MSVCP71 ref: 00406A90
RegOpenKeyExW.KERNEL32(?,00000000,00000000,00020019,?), ref: 00406AA7
RegCloseKey.ADVAPI32(?), ref: 00406AC0
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(KeyParent), ref: 00406B28
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z.MSVCP71(?,00409670), ref: 00406B4E
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71 ref: 00406B63
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(KeyName), ref: 00406B75
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z.MSVCP71(?,00409670), ref: 00406B9B
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71 ref: 00406BB0
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z.MSVCP71(?,00409670), ref: 00406BE8
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71 ref: 00406BFD
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(CheckIfRunning), ref: 00406C0F
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z.MSVCP71(?,00409670), ref: 00406C35
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71 ref: 00406C4A
?GetValuesFromRegistry@@YAHAAVCRegKey@ATL@@AAUtagREGISTRY_DATA@@@Z.MGCOMMON(?,?), ref: 00406C5A
??3@YAXPAX@Z.MSVCR71 ref: 00406CA3
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71 ref: 00406CEA
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(Type), ref: 00406D0A
?GetStringValue@@YAHAAVCRegKey@ATL@@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAV34@@Z.MGCOMMON(?), ref: 00406D15
??$?8GU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBG@Z.MSVCP71(00000002,Registry), ref: 00406D2B
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(Type), ref: 00406D44
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z.MSVCP71 ref: 00406D6A
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71 ref: 00406D7E
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(CheckIfRunning), ref: 00406D90
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z.MSVCP71(?,00409670), ref: 00406DB6
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71 ref: 00406DCA
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(KeyParent), ref: 00406DDC
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z.MSVCP71(?,00409670), ref: 00406E02
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71 ref: 00406E16
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(KeyName), ref: 00406E28
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z.MSVCP71(?,00409670), ref: 00406E4E
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71 ref: 00406E62
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(ValueName), ref: 00406E74
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z.MSVCP71(?,00409670), ref: 00406E9A
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71 ref: 00406EAE
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(FileName), ref: 00406EC0
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z.MSVCP71(?,00409670), ref: 00406EE6
??$?8GU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBG@Z.MSVCP71(?,File), ref: 00406F02
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(Type), ref: 00406F1B
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z.MSVCP71 ref: 00406F41
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71 ref: 00406F55
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(CheckIfRunning), ref: 00406F67
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z.MSVCP71(?,00409670), ref: 00406F8D
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71 ref: 00406FA1
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(FileWithPath), ref: 00406FB3
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z.MSVCP71(?,00409670), ref: 00406FD9
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71 ref: 00406FED
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(ShellFolderCode), ref: 00406FFF
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z.MSVCP71(?,00409670), ref: 00407025
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(ValueName), ref: 00406BC2

Part of subcall function 004060A0: ??$?MGU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@0@Z.MSVCP71(?,?,?,007B9DB0,7C3D2D65,00000000), ref: 004060D3
Part of subcall function 004060A0: ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71(?,007B9DB0,7C3D2D65,00000000), ref: 004060E4
Part of subcall function 004060A0: ??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71(?,?,00000000), ref: 0040612C

??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71 ref: 00407178
?GetValuesFromRegistry@@YAHAAVCRegKey@ATL@@AAUtagREGISTRY_DATA@@@Z.MGCOMMON(?,?), ref: 00407188
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71 ref: 004071B7
??3@YAXPAX@Z.MSVCR71 ref: 004071E0
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71 ref: 004071FC
RegCloseKey.KERNEL32(?), ref: 0040720B
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71 ref: 00407252
??3@YAXPAX@Z.MSVCR71 ref: 00407264

Strings

File, xrefs: 00406EFC
ValueName, xrefs: 00406BB6, 00406E68
Registry, xrefs: 00406D25
CheckIfRunning, xrefs: 00406C03, 00406D84, 00406F5B, 0040709A
FileWithPath, xrefs: 00406FA7, 004070E6
FileName, xrefs: 00406EB4
KeyName, xrefs: 00406B69, 00406E1C
ShellFolderCode, xrefs: 00406FF3, 00407132
ShellLink, xrefs: 0040703B
KeyParent, xrefs: 00406B14, 00406DD0
Type, xrefs: 00406CFE, 00406D38, 00406F0F, 0040704E

Memory Dump Source

Source File: 00000007.00000002.1892750434.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1892725646.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1892779763.0000000000409000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1892803659.000000000040D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1892825887.000000000040E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_SweetIM.jbxd

Similarity

API ID: V?$allocator@$G@std@@U?$char_traits@$G@2@@std@@$??0?$basic_string@$??1?$basic_string@$??4?$basic_string@V01@$V?$basic_string@$Key@$??3@G@1@@std@@$??$?8A@@@CloseFromG@2@@0@Registry@@UtagValues$??$??c_str@?$basic_string@EnumG@2@@0@0@G@2@@std@@@2@@std@@@KeysNames@@OpenStringV01@@V34@@V?$vector@Value@@
String ID: CheckIfRunning$File$FileName$FileWithPath$KeyName$KeyParent$Registry$ShellFolderCode$ShellLink$Type$ValueName
API String ID: 1253805253-3831455781
Opcode ID: a36e6ac2ff4439129e9d115eb1bb7f1b30a529e9073633a15b0ccd6b122fd821
Instruction ID: 5ddedad84dcf49cdd6f9395967791a853e1a68f6f41c73a7897fcb8fbcebf662
Opcode Fuzzy Hash: a36e6ac2ff4439129e9d115eb1bb7f1b30a529e9073633a15b0ccd6b122fd821
Instruction Fuzzy Hash: 10327E355083819FC764DF64C998B9FBBE4BF94304F04492DF58A632A2DB789908CB67

Uniqueness

Uniqueness Score: -1.00%

Function 100125E0 Relevance: 70.2, APIs: 37, Strings: 3, Instructions: 215
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ.MSVCP71(00000000,00000000,00000004), ref: 1001260C
_IsFileExist@4.MGCOMMON(00000000), ref: 10012613
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(Automatic update File not exists!), ref: 1001262A
??0CErrException@@QAE@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z.MGCOMMON ref: 10012633
??0CErrException@@QAE@ABV0@@Z.MGCOMMON(00000000), ref: 10012647
_CxxThrowException.MSVCR71(?,1002A55C), ref: 10012659
??0CXmlDocument@@QAE@XZ.MGXML_WRAPPER(?,1002A55C), ref: 10012661
?initFromFile@CXmlDocument@@QAEXABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z.MGXML_WRAPPER(00000004), ref: 10012677
?getDocumentRoot@CXmlDocument@@QAE?AVCXmlNode@@XZ.MGXML_WRAPPER(?), ref: 1001268B
?isNull@CXmlNode@@QAE_NXZ.MGXML_WRAPPER ref: 10012694
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(AutoUpdate analysis error. Could not obtain the AutoUpdate child.), ref: 100126AB
??0CErrMessageFormatException@@QAE@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z.MGCOMMON ref: 100126B4
??0CErrMessageFormatException@@QAE@ABV0@@Z.MGCOMMON(00000000), ref: 100126C5
_CxxThrowException.MSVCR71(?,100298A8), ref: 100126D7
?getNodeName@CXmlNode@@QBE?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@XZ.MGXML_WRAPPER(?), ref: 100126F0
?StringCmpi@@YAHABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@0@Z.MGCOMMON(00000000,10038464), ref: 10012702
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71 ref: 10012716
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(AutoUpdate analysis error. The AutoUpdate does not exists.), ref: 1001272D
??0CErrMessageFormatException@@QAE@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z.MGCOMMON ref: 10012736
??0CErrMessageFormatException@@QAE@ABV0@@Z.MGCOMMON(00000000), ref: 10012747
_CxxThrowException.MSVCR71(?,100298A8), ref: 10012759
?getFirstChild@CXmlNode@@QAE?AV1@XZ.MGXML_WRAPPER(?), ref: 10012770
?isNull@CXmlNode@@QAE_NXZ.MGXML_WRAPPER ref: 10012779
?getNodeName@CXmlNode@@QBE?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@XZ.MGXML_WRAPPER(?), ref: 10012791
?StringCmpi@@YAHABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@0@Z.MGCOMMON(00000000,10038480), ref: 1001279D
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71 ref: 100127B1
?getNodeName@CXmlNode@@QBE?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@XZ.MGXML_WRAPPER(?), ref: 100127D6
?StringCmpi@@YAHABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@0@Z.MGCOMMON(00000000,1003849C), ref: 100127E2
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71 ref: 100127F6
?getNodeName@CXmlNode@@QBE?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@XZ.MGXML_WRAPPER(?), ref: 10012815
?StringCmpi@@YAHABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@0@Z.MGCOMMON(00000000,100384B8), ref: 10012821
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71 ref: 10012832
?getNodeName@CXmlNode@@QBE?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@XZ.MGXML_WRAPPER(?), ref: 10012851
?StringCmpi@@YAHABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@0@Z.MGCOMMON(00000000,10038624), ref: 1001285D
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71 ref: 1001286E

Part of subcall function 10011D70: ?getFirstChild@CXmlNode@@QAE?AV1@XZ.MGXML_WRAPPER(00000000,004D13E0,007BD610,00000001), ref: 10011DA7
Part of subcall function 10011D70: ?isNull@CXmlNode@@QAE_NXZ.MGXML_WRAPPER ref: 10011DB3
Part of subcall function 10011D70: ?getNodeName@CXmlNode@@QBE?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@XZ.MGXML_WRAPPER(?), ref: 10011DCB
Part of subcall function 10011D70: ?StringCmpi@@YAHABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@0@Z.MGCOMMON(00000000,10038640), ref: 10011DE1
Part of subcall function 10011D70: ??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71 ref: 10011DF5
Part of subcall function 10011D70: ?getElementAttributes@CXmlNode@@QAE?AV?$list@VCXmlNode@@V?$allocator@VCXmlNode@@@std@@@std@@XZ.MGXML_WRAPPER(?), ref: 10011E0A
Part of subcall function 10011D70: ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(10026550), ref: 10011E1C
Part of subcall function 10011D70: ?getNodeName@CXmlNode@@QBE?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@XZ.MGXML_WRAPPER(?), ref: 10011E45
Part of subcall function 10011D70: ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71 ref: 10011E52
Part of subcall function 10011D70: ?getNodeValue@CXmlNode@@QBE?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@XZ.MGXML_WRAPPER(?), ref: 10011E65
Part of subcall function 10011D70: ??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z.MSVCP71(00000000), ref: 10011E73
Part of subcall function 10011D70: ??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71 ref: 10011E83
Part of subcall function 10011D70: ?StringCmpi@@YAHABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@0@Z.MGCOMMON(?,1003865C), ref: 10011E9C
Part of subcall function 10011D70: ?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ.MSVCP71 ref: 10011EA8
Part of subcall function 10011D70: _wtoi.MSVCR71 ref: 10011EAF
Part of subcall function 10011D70: ??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71 ref: 10011EE6
Part of subcall function 10011D70: ??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71 ref: 10011EF6

?getNextSibling@CXmlNode@@QAE?AV1@XZ.MGXML_WRAPPER(?), ref: 1001288E
??1CXmlDocument@@QAE@XZ.MGXML_WRAPPER ref: 100128AE

Strings

AutoUpdate analysis error. The AutoUpdate does not exists., xrefs: 10012728
AutoUpdate analysis error. Could not obtain the AutoUpdate child., xrefs: 100126A6
Automatic update File not exists!, xrefs: 10012625

Memory Dump Source

Source File: 00000007.00000002.1895242678.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1895219944.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1895275872.0000000010026000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1895304349.0000000010034000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1895371327.000000001003A000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_SweetIM.jbxd

Similarity

API ID: V?$allocator@$G@std@@U?$char_traits@$G@2@@std@@$V?$basic_string@$Node@@$?get$??1?$basic_string@$Node$Cmpi@@G@2@@std@@0@Name@String$Exception@@$??0?$basic_string@$Document@@FormatG@2@@std@@@Message$ExceptionNull@ThrowV0@@$?c_str@?$basic_string@Child@First$??4?$basic_string@?initAttributes@DocumentElementExist@4FileFile@FromNextNode@@@std@@@std@@Root@Sibling@V01@V01@@V?$list@Value@_wtoi
String ID: AutoUpdate analysis error. Could not obtain the AutoUpdate child.$AutoUpdate analysis error. The AutoUpdate does not exists.$Automatic update File not exists!
API String ID: 206636447-3293158408
Opcode ID: fb4758b8680c762aae276f584237ee1a287e833e049009aab8ae8d6a75bf118a
Instruction ID: 665509f1e99ad5e825d65eb00c2c580fd5dce2358717b81a18d97a7ead498175
Opcode Fuzzy Hash: fb4758b8680c762aae276f584237ee1a287e833e049009aab8ae8d6a75bf118a
Instruction Fuzzy Hash: BC918F72D01259DFDB04DBE4CD98BEEBBB8EF18300F208199E546A7180EB345B49DB61

Uniqueness

Uniqueness Score: -1.00%

Function 10016DA0 Relevance: 63.3, APIs: 32, Strings: 4, Instructions: 330
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(10026550,?,00000000), ref: 10016E35
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(10026550,?,00000000), ref: 10016E51
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(10026550,?,00000000), ref: 10016E7A
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(10026550,?,00000000), ref: 10016E8F
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(10026550,?,00000000), ref: 10016EA4

Part of subcall function 1001A4BE: malloc.MSVCR71 ref: 1001A4D7

??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(Could not load the configuration data.), ref: 10016F1E
??0CErrException@@QAE@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z.MGCOMMON ref: 10016F27
??0CErrException@@QAE@ABV0@@Z.MGCOMMON(00000000), ref: 10016F38
_CxxThrowException.MSVCR71(?,1002A55C), ref: 10016F4A
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(Could not create AutoUpdate Dispatcher. (2)), ref: 10016FA7
??0CErrException@@QAE@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z.MGCOMMON ref: 10016FB0
??0CErrException@@QAE@ABV0@@Z.MGCOMMON(00000000), ref: 10016FC1
_CxxThrowException.MSVCR71(?,1002A55C), ref: 10016FD3
??0CInternetAvailability@@QAE@XZ.MGCOMMUNICATION(00000004), ref: 10016FFE
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,00000004), ref: 10017020

Part of subcall function 100129E0: ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(10026550,00000000,00000000,00000004), ref: 10012A16
Part of subcall function 100129E0: ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(10026550), ref: 10012A46
Part of subcall function 100129E0: ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(10026550), ref: 10012A58
Part of subcall function 100129E0: ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(10026550), ref: 10012A6A
Part of subcall function 100129E0: ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(10026550), ref: 10012A7F
Part of subcall function 100129E0: ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(Main.ConfigFiles.AutoUpdateConfigFilePath), ref: 10012AAA
Part of subcall function 100129E0: ?getConfigManager@CConfigManager@@SAAAV1@XZ.MGCONFIG ref: 10012AB4
Part of subcall function 100129E0: ?getDefaultConfig@CConfigManager@@QAEAAVCConfig@@XZ.MGCONFIG ref: 10012ABC
Part of subcall function 100129E0: ?getPropertyAsStringEx@CConfig@@QAE?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@V23@@Z.MGCONFIG(?), ref: 10012ACC
Part of subcall function 100129E0: ??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z.MSVCP71(00000000), ref: 10012AD9
Part of subcall function 100129E0: ??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71 ref: 10012AE6

??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(Could not create Initialize Thread Event), ref: 10017066
??0CErrException@@QAE@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z.MGCOMMON ref: 1001706F
??0CErrException@@QAE@ABV0@@Z.MGCOMMON(00000000), ref: 10017080
_CxxThrowException.MSVCR71(?,1002A55C), ref: 10017092
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 1001709C
CloseHandle.KERNEL32(?), ref: 100170AD
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(Could not create Initialize Thread Event), ref: 100170F3
??0CErrException@@QAE@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z.MGCOMMON ref: 100170FC
??0CErrException@@QAE@ABV0@@Z.MGCOMMON(00000000), ref: 1001710A
_CxxThrowException.MSVCR71(?,1002A55C), ref: 10017119
CreateThread.KERNEL32(00000000,00000000,10015E80,00000000,00000000,?), ref: 1001712B
CloseHandle.KERNEL32(?), ref: 10017144
CloseHandle.KERNEL32(?), ref: 10017155
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(Could not create Initialize Thread), ref: 1001719B
??0CErrException@@QAE@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z.MGCOMMON ref: 100171A4
??0CErrException@@QAE@ABV0@@Z.MGCOMMON(00000000), ref: 100171B5
_CxxThrowException.MSVCR71(?,1002A55C), ref: 100171C7

Strings

Could not create AutoUpdate Dispatcher. (2), xrefs: 10016FA2
Could not create Initialize Thread, xrefs: 10017196
Could not load the configuration data., xrefs: 10016F19
Could not create Initialize Thread Event, xrefs: 10017061, 100170EE

Memory Dump Source

Source File: 00000007.00000002.1895242678.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1895219944.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1895275872.0000000010026000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1895304349.0000000010034000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1895371327.000000001003A000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_SweetIM.jbxd

Similarity

API ID: G@std@@U?$char_traits@V?$allocator@$G@2@@std@@$??0?$basic_string@$Exception@@$V?$basic_string@$ExceptionG@2@@std@@@ThrowV0@@$?getCloseConfigCreateHandle$Config@@EventManager@@$??1?$basic_string@??4?$basic_string@Availability@@Config@DefaultInternetManager@PropertyStringThreadV01@V01@@V23@@malloc
String ID: Could not create AutoUpdate Dispatcher. (2)$Could not create Initialize Thread$Could not create Initialize Thread Event$Could not load the configuration data.
API String ID: 365295989-3381815934
Opcode ID: 212a154d75e4b9aeffd35f7660bcb5a407cac1f18bc4006d5fef94fb1add48d5
Instruction ID: 7aeda80fe6c2e1fd859124a64d629cd1339fee68adbbc815f45a809285babf1b
Opcode Fuzzy Hash: 212a154d75e4b9aeffd35f7660bcb5a407cac1f18bc4006d5fef94fb1add48d5
Instruction Fuzzy Hash: 0CD19070900B44DFD720DFA9CC88A9ABBF5FF99300F60455DE18B8B651DBB1AA84CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00485060 Relevance: 58.0, APIs: 29, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

??0CCriticalSec@@QAE@XZ.MGCOMMON ref: 004850CF
??0CRegistrySupp@@QAE@PAUHKEY__@@@Z.MGCOMMON ref: 004850EC
?GetRegValue@CRegistrySupp@@QAEKPAGPBG11@Z.MGCOMMON(?,021E0000,021E0000,00000000), ref: 00485137
??0CRegistrySupp@@QAE@PAUHKEY__@@@Z.MGCOMMON(80000001), ref: 0048514D
?GetRegValue@CRegistrySupp@@QAEKPAGPBG11@Z.MGCOMMON(?,021E0000,021E0000,00000000), ref: 00485196
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(Could not find installation directory.,?,?,?,80000002), ref: 004851AA
??0CErrRuntimeException@@QAE@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z.MGCOMMON(?,?,?,80000002), ref: 004851B4
??0CErrRuntimeException@@QAE@ABV0@@Z.MGCOMMON(00000000), ref: 004851C7
_CxxThrowException.MSVCR71(?,004883F0), ref: 004851D7
??1CRegistrySupp@@QAE@XZ.MGCOMMON(?,004883F0), ref: 004851EB
wcslen.MSVCR71 ref: 004851FF
wcslen.MSVCR71 ref: 0048521B
wcslen.MSVCR71 ref: 0048522F
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z.MSVCP71(?), ref: 0048524B
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBG@Z.MSVCP71(0048732C), ref: 0048525B
?GetRegValue@CRegistrySupp@@QAEKPAGPBG11@Z.MGCOMMON(?,00610000,021E0000,00000000), ref: 004852AD
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(Could not find application data directory.), ref: 004852C5
??0CErrRuntimeException@@QAE@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z.MGCOMMON ref: 004852CF
??0CErrRuntimeException@@QAE@ABV0@@Z.MGCOMMON(00000000), ref: 004852E2
_CxxThrowException.MSVCR71(?,004883F0), ref: 004852F2
wcslen.MSVCR71 ref: 004852FF
wcslen.MSVCR71 ref: 0048531B
wcslen.MSVCR71 ref: 0048532F
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z.MSVCP71(?), ref: 0048534B
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBG@Z.MSVCP71(0048732C), ref: 0048535B
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z.MSVCP71 ref: 004853A8
?createConfig@CConfigManager@@QAEAAVCConfig@@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@0@Z.MGCONFIG ref: 004853B8
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71 ref: 004853CB
??1CRegistrySupp@@QAE@XZ.MGCOMMON ref: 004853E1

Strings

Could not find installation directory., xrefs: 004851A5
.xml, xrefs: 0048537E
{{, xrefs: 00485123, 004852AD
Could not find application data directory., xrefs: 004852C0

Memory Dump Source

Source File: 00000007.00000002.1892930100.0000000000481000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00480000, based on PE: true

Associated: 00000007.00000002.1892906598.0000000000480000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.1892951827.0000000000487000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.1892982403.000000000048B000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.1893010257.000000000048C000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_480000_SweetIM.jbxd

Similarity

API ID: G@std@@U?$char_traits@V?$allocator@$G@2@@std@@$RegistrySupp@@$wcslen$Exception@@Runtime$??0?$basic_string@G11@V?$basic_string@Value@$??4?$basic_string@?append@?$basic_string@ExceptionG@2@@std@@@ThrowV01@V0@@V12@Y__@@@$??1?$basic_string@?createConfigConfig@Config@@CriticalG@2@@std@@0@Manager@@Sec@@V01@@
String ID: .xml$Could not find application data directory.$Could not find installation directory.${{
API String ID: 2418492649-2215119730
Opcode ID: b98958f18ef48569b8f032b4eb3f466824fc16e0153f16dd7fb67cf89afd5f06
Instruction ID: 73659b63c9c545c7ba802ab0e466bc83113c62e2132d2d99e9d402c1281bade5
Opcode Fuzzy Hash: b98958f18ef48569b8f032b4eb3f466824fc16e0153f16dd7fb67cf89afd5f06
Instruction Fuzzy Hash: 69A1A7715083418FC724EF68DC58B9FB7E9EB94300F104D6EE99A83291DF759448CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 004811F0 Relevance: 42.1, APIs: 18, Strings: 6, Instructions: 104
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

??0CAutoLock@@QAE@ABVCLockable@@@Z.MGCOMMON ref: 0048122F
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(Can't replace the file name for a default Config object.,?,?,?,?,?,?), ref: 00481252
??0CErrIllegalArgumentException@@QAE@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z.MGCOMMON(?,?,?,?,?,?), ref: 0048125C
??0CErrIllegalArgumentException@@QAE@ABV0@@Z.MGCOMMON(00000000), ref: 0048126F
_CxxThrowException.MSVCR71(?,00487990), ref: 0048127F
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(Can't set an empty file name.,?,?,?,?,?,?), ref: 0048129D
??0CErrIllegalArgumentException@@QAE@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z.MGCOMMON(?,?,?,?,?,?), ref: 004812A7
??0CErrIllegalArgumentException@@QAE@ABV0@@Z.MGCOMMON(00000000), ref: 004812BA
_CxxThrowException.MSVCR71(?,00487990), ref: 004812CA
_IsFileExist@4.MGCOMMON(?), ref: 004812E8
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z.MSVCP71(?,?,?,?,?,?,?), ref: 00481307
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71 ref: 00481323
??0CErrFileException@@QAE@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@0HJ@Z.MGCOMMON ref: 00481338
??0CErrFileException@@QAE@ABV0@@Z.MGCOMMON(00000000), ref: 0048134B
_CxxThrowException.MSVCR71(?,00487980), ref: 0048135B
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z.MSVCP71(?), ref: 0048136B
??1CAutoLock@@QAE@XZ.MGCOMMON ref: 0048137D
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71 ref: 00481395

Strings

Can't replace the file name for a default Config object., xrefs: 0048124D
Can't set an empty file name., xrefs: 00481298
p,{, xrefs: 004812E8
p&{, xrefs: 0048126F, 004812BA
File does not exist, xrefs: 00481316
j{, xrefs: 0048137D

Memory Dump Source

Source File: 00000007.00000002.1892930100.0000000000481000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00480000, based on PE: true

Associated: 00000007.00000002.1892906598.0000000000480000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.1892951827.0000000000487000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.1892982403.000000000048B000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.1893010257.000000000048C000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_480000_SweetIM.jbxd

Similarity

API ID: G@std@@U?$char_traits@V?$allocator@$Exception@@G@2@@std@@$??0?$basic_string@ArgumentIllegal$ExceptionFileThrowV0@@V?$basic_string@$AutoG@2@@std@@@Lock@@V01@@$??1?$basic_string@??4?$basic_string@Exist@4G@2@@std@@0Lockable@@@V01@
String ID: j{$Can't replace the file name for a default Config object.$Can't set an empty file name.$File does not exist$p&{$p,{
API String ID: 2381368864-1580680342
Opcode ID: 2c4102cbfda6f0df37a33fc9c7ff79d634271ee6a2b4b42fdef84e633313d0f4
Instruction ID: 35cce47d07b2874cbcdfea014fe6ca61abf0b1b916b981195130c314bd215de0
Opcode Fuzzy Hash: 2c4102cbfda6f0df37a33fc9c7ff79d634271ee6a2b4b42fdef84e633313d0f4
Instruction Fuzzy Hash: BE41607110C381DFC324EF64D859B9EBBE4BB99700F108E5EF59A92291DB749408CB6B

Uniqueness

Uniqueness Score: -1.00%

Function 10018C20 Relevance: 40.4, APIs: 19, Strings: 4, Instructions: 165
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 1001A4BE: malloc.MSVCR71 ref: 1001A4D7

??0CCriticalSec@@QAE@XZ.MGCOMMON ref: 10018CCD
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(SweetIMAutoUpdateLogger,?,?,?,?,?,?,00000001), ref: 10018CF3
?getConfigManager@CConfigManager@@SAAAV1@XZ.MGCONFIG(?,?,?,?,?,?,00000001), ref: 10018D1B
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(SweetIMApplicationConfig), ref: 10018D30
?configExists@CConfigManager@@QAE_NV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z.MGCONFIG ref: 10018D38
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(Main.ConfigFiles.SweetIMAppConfigFilePath), ref: 10018D4F
?getDefaultConfig@CConfigManager@@QAEAAVCConfig@@XZ.MGCONFIG ref: 10018D5B
?getPropertyAsStringEx@CConfig@@QAE?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@V23@@Z.MGCONFIG(?), ref: 10018D6B
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z.MSVCP71(?), ref: 10018D81
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(SweetIMApplicationConfig), ref: 10018D98
?createConfig@CConfigManager@@QAEAAVCConfig@@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@0@Z.MGCONFIG ref: 10018DA4
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71 ref: 10018DB1
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(SweetIMApplicationConfig), ref: 10018DC4
?getConfig@CConfigManager@@QAEAAVCConfig@@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z.MGCONFIG ref: 10018DCC
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(Main.AutomaticUpdate.Manager.AgentKeepAliveSec), ref: 10018DF7
?getPropertyAsLong@CConfig@@QBEJV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@J@Z.MGCONFIG ref: 10018E00
?GetProcessVersion@CUpdateManager@@AAEXXZ.MGUPDATESUPPORT ref: 10018E38
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ.MSVCP71(?), ref: 10018E4A
?CreateIpcQueue@CIPC@@SGHPBDP6GX0PBXK1K@Z@Z.MGHOOKING(00000000), ref: 10018E51

Strings

Main.AutomaticUpdate.Manager.AgentKeepAliveSec, xrefs: 10018DF2
Main.ConfigFiles.SweetIMAppConfigFilePath, xrefs: 10018D4A
SweetIMAutoUpdateLogger, xrefs: 10018CE7
SweetIMApplicationConfig, xrefs: 10018D29, 10018D8F, 10018DBF

Memory Dump Source

Source File: 00000007.00000002.1895242678.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1895219944.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1895275872.0000000010026000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1895304349.0000000010034000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1895371327.000000001003A000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_SweetIM.jbxd

Similarity

API ID: U?$char_traits@V?$allocator@$G@std@@$G@2@@std@@$??0?$basic_string@$ConfigManager@@$?getConfig@@V?$basic_string@$Config@$G@2@@std@@@Property$??1?$basic_string@?c_str@?$basic_string@?config?createCreateCriticalD@2@@std@@D@std@@DefaultExists@G@2@@std@@0@Long@Manager@ProcessQueue@Sec@@StringUpdateV01@@V23@@Version@malloc
String ID: Main.AutomaticUpdate.Manager.AgentKeepAliveSec$Main.ConfigFiles.SweetIMAppConfigFilePath$SweetIMApplicationConfig$SweetIMAutoUpdateLogger
API String ID: 1710727422-1905216937
Opcode ID: 796a7376587e00b30ce555a8d687a5f490ab1b9c22814e4d39753cf5f36bce9e
Instruction ID: a34eb4c90df5ed4b1035c1601586ad28db2805f02d9957f8c2a219a218544a87
Opcode Fuzzy Hash: 796a7376587e00b30ce555a8d687a5f490ab1b9c22814e4d39753cf5f36bce9e
Instruction Fuzzy Hash: 2E614570901384EFDB10EFA9C98969EBFF1FB48300F60855EE44A97751CB74AA45CB92

Uniqueness

Uniqueness Score: -1.00%

Function 10008660 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 136
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

??0CHTTPClientAsyncHandler@@QAE@XZ.MGCOMMUNICATION(00000000,00000000,00000004), ref: 10008689
??0CCriticalSec@@QAE@XZ.MGCOMMON ref: 100086C5
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(Mozilla/4.0 (compatible; )), ref: 100086D7

Part of subcall function 1001A4BE: malloc.MSVCR71 ref: 1001A4D7

??0CHTTPClientAsync@@QAE@XZ.MGCOMMUNICATION ref: 100086FA
??0CErrRuntimeException@@QAE@XZ.MGCOMMON ref: 1000871D
_CxxThrowException.MSVCR71(?,1002A56C), ref: 1000872F
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z.MSVCP71(Mozilla/4.0 (compatible; ),?), ref: 10008757
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(getUserAgentString failed), ref: 1000876A
??0CErrRuntimeException@@QAE@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z.MGCOMMON ref: 10008773
??0CErrRuntimeException@@QAE@ABV0@@Z.MGCOMMON(00000000), ref: 10008784
_CxxThrowException.MSVCR71(?,1002A56C), ref: 10008796
?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ.MSVCP71(?), ref: 100087A2
wsprintfW.USER32 ref: 100087CA
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(?), ref: 100087DF
??0CErrRuntimeException@@QAE@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z.MGCOMMON ref: 100087E8
??0CErrRuntimeException@@QAE@ABV0@@Z.MGCOMMON(00000000), ref: 100087F6
_CxxThrowException.MSVCR71(?,1002A56C), ref: 10008805
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71(?,1002A56C), ref: 10008817

Strings

Mozilla/4.0 (compatible; ), xrefs: 100086CB, 10008752
getUserAgentString failed, xrefs: 10008765
Could not initialize the HTTP Client. Error: %d, xrefs: 100087C4

Memory Dump Source

Source File: 00000007.00000002.1895242678.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1895219944.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1895275872.0000000010026000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1895304349.0000000010034000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1895371327.000000001003A000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_SweetIM.jbxd

Similarity

API ID: G@std@@U?$char_traits@V?$allocator@$G@2@@std@@$Exception@@Runtime$??0?$basic_string@ExceptionThrow$ClientG@2@@std@@@V0@@V?$basic_string@$??1?$basic_string@??4?$basic_string@?c_str@?$basic_string@AsyncAsync@@CriticalHandler@@Sec@@V01@mallocwsprintf
String ID: Could not initialize the HTTP Client. Error: %d$Mozilla/4.0 (compatible; )$getUserAgentString failed
API String ID: 2670075552-1324670363
Opcode ID: 318e4ae3f3d460adcb29a55bbc4ac1d1f50849a7d1b7bb8b2e50efa1daba1895
Instruction ID: f6bf1c338eb8062604ebd5fc8c97962cd2bba830abcec6f7eba3b8211b7fcd92
Opcode Fuzzy Hash: 318e4ae3f3d460adcb29a55bbc4ac1d1f50849a7d1b7bb8b2e50efa1daba1895
Instruction Fuzzy Hash: 5C516A70800668DFDB10DFA8CD88A9EBBF8FF58300F60459EE14A93651D7B4AA45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 004079F0 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 184
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(SOFTWARE\SweetIM\Messenger,00000000,00000004,00000000), ref: 00407A2B
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z.MSVCP71(\Initialization), ref: 00407A40
?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ.MSVCP71 ref: 00407A4C
RegOpenKeyExW.KERNEL32(80000002,00000000,00000000,00020019,00000000), ref: 00407A65
RegCloseKey.ADVAPI32(0040D174), ref: 00407A7D
?GetEnumSubKeysNames@@YAHAAVCRegKey@ATL@@AAV?$vector@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@V?$allocator@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@2@@std@@@Z.MGCOMMON(0040D174,021E7960,Version,?,?), ref: 00407ACD
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71 ref: 00407B17
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z.MSVCP71(00000004), ref: 00407B2F
?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ.MSVCP71 ref: 00407B3B
RegOpenKeyExW.KERNEL32(0040D174,00000000,00000000,00020019,004059FD), ref: 00407B50
?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ.MSVCP71 ref: 00407B91
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(00000000), ref: 00407B9E
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71(?,?,?), ref: 00407BDA
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71 ref: 00407BF3
RegCloseKey.ADVAPI32(004059FD), ref: 00407BFE
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71 ref: 00407C28
RegCloseKey.ADVAPI32(0040D174), ref: 00407C40

Strings

\Initialization, xrefs: 00407A31
SOFTWARE\SweetIM\Messenger, xrefs: 00407A1C
Version, xrefs: 00407A9C

Memory Dump Source

Source File: 00000007.00000002.1892750434.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1892725646.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1892779763.0000000000409000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1892803659.000000000040D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1892825887.000000000040E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_SweetIM.jbxd

Similarity

API ID: V?$allocator@$G@std@@U?$char_traits@$G@2@@std@@$??0?$basic_string@??1?$basic_string@?c_str@?$basic_string@Close$OpenV01@V?$basic_string@$??4?$basic_string@EnumG@2@@std@@@2@@std@@@Key@KeysNames@@V01@@V?$vector@Y?$basic_string@
String ID: SOFTWARE\SweetIM\Messenger$Version$\Initialization
API String ID: 1518601177-3319925192
Opcode ID: ebd1fd0a70b3730ee852dd9e9d800f79e06b67747865985da6e5121716450bb9
Instruction ID: b01d7532aaa47d98b6d4e78e2884e1ce303e17adeff26ef0ed9fb7f8b51affb8
Opcode Fuzzy Hash: ebd1fd0a70b3730ee852dd9e9d800f79e06b67747865985da6e5121716450bb9
Instruction Fuzzy Hash: D7717E70D04209DFDB15CF94C984AEEFBB8BF58300F24416AE506B3291DB742A08CF65

Uniqueness

Uniqueness Score: -1.00%

Function 00402620 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 173
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00407C70: malloc.MSVCR71 ref: 00407C89

?MessageBoxInitError@@YAXH@Z.MGCOMMON(000002BC,?,000000FF,0040851E,00000000,0040851E), ref: 004026D4
?getConfigManager@CConfigManager@@SAAAV1@XZ.MGCONFIG(?,000000FF,0040851E,00000000,0040851E), ref: 004026EE
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(SweetIMApplicationConfig), ref: 00402703
?configExists@CConfigManager@@QAE_NV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z.MGCONFIG ref: 0040270B
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(Main.ConfigFiles.SweetIMAppConfigFilePath), ref: 00402722
?getDefaultConfig@CConfigManager@@QAEAAVCConfig@@XZ.MGCONFIG ref: 0040272E
?getPropertyAsStringEx@CConfig@@QAE?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@V23@@Z.MGCONFIG(?), ref: 0040273E
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z.MSVCP71(?), ref: 00402755
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(SweetIMApplicationConfig), ref: 0040276C
?createConfig@CConfigManager@@QAEAAVCConfig@@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@0@Z.MGCONFIG ref: 00402777
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71 ref: 00402784
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(SweetIMApplicationConfig), ref: 00402799
?getConfig@CConfigManager@@QAEAAVCConfig@@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z.MGCONFIG ref: 004027A1
??0CUpdateManager@@QAE@XZ.MGUPDATESUPPORT ref: 004027FA
??0CUpdateAgent@@QAE@XZ.MGUPDATESUPPORT ref: 00402847
?start@CUpdateAgent@@QAEXXZ.MGUPDATESUPPORT ref: 0040285C

Strings

-AutoStartIM, xrefs: 00402648
Main.ConfigFiles.SweetIMAppConfigFilePath, xrefs: 0040271D
SweetIMApplicationConfig, xrefs: 004026FC, 00402763, 00402794

Memory Dump Source

Source File: 00000007.00000002.1892750434.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1892725646.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1892779763.0000000000409000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1892803659.000000000040D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1892825887.000000000040E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_SweetIM.jbxd

Similarity

API ID: G@std@@U?$char_traits@V?$allocator@$G@2@@std@@$ConfigManager@@$??0?$basic_string@$?getConfig@@V?$basic_string@$Config@Update$Agent@@G@2@@std@@@$??1?$basic_string@?config?create?start@DefaultError@@Exists@G@2@@std@@0@InitManager@MessagePropertyStringV01@@V23@@malloc
String ID: -AutoStartIM$Main.ConfigFiles.SweetIMAppConfigFilePath$SweetIMApplicationConfig
API String ID: 73987785-1349467951
Opcode ID: b8bb54172af4aa5d44aa376920c366f74c3a5ee413738ae7c6f43d1cda2a6d9f
Instruction ID: 36eb3aab9d637a4fac9afe2c25d9bf8bd2b9dda645044c03068bfdc7c97f7acd
Opcode Fuzzy Hash: b8bb54172af4aa5d44aa376920c366f74c3a5ee413738ae7c6f43d1cda2a6d9f
Instruction Fuzzy Hash: 7D619F70A04385EFDB14DF69864965EBBF0BF48300F14867EE446673D1DBB85A04CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 00402490 Relevance: 31.6, APIs: 14, Strings: 4, Instructions: 124
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

??0CMutex@@QAE@PAG@Z.MGCOMMON(00000000,74DF0A60,?,00000000), ref: 004024B6
?init@CMutex@@QAEXPAG@Z.MGCOMMON(Local\{D564BB4E-74F6-4fd5-900A-313328F6DF9F},?,00000000), ref: 004024CF
?IsAnotherInstanceRunning@CMutex@@QAEHXZ.MGCOMMON(?,00000000), ref: 004024D8
??1CMutex@@UAE@XZ.MGCOMMON(?,00000000), ref: 004024EC
#17.COMCTL32(?,00000000), ref: 0040251D
CreateDialogParamW.USER32(?,DLG_MAIN,00000000,00401530,00000000), ref: 0040254D
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(SweetIMAppLogger), ref: 00402568
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 004025B2
IsDialogMessageW.USER32(00000000,?), ref: 004025C5
TranslateMessage.USER32(?), ref: 004025CF
DispatchMessageW.USER32(?), ref: 004025D9
KiUserCallbackDispatcher.NTDLL(?,00000000,00000000,00000000), ref: 004025E9
KiUserCallbackDispatcher.NTDLL(00000000), ref: 004025F0
??1CMutex@@UAE@XZ.MGCOMMON ref: 00402600

Strings

-AutoStartIM, xrefs: 00402526
DLG_MAIN, xrefs: 00402547
Local\{D564BB4E-74F6-4fd5-900A-313328F6DF9F}, xrefs: 004024C3
SweetIMAppLogger, xrefs: 00402563

Memory Dump Source

Source File: 00000007.00000002.1892750434.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1892725646.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1892779763.0000000000409000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1892803659.000000000040D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1892825887.000000000040E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_SweetIM.jbxd

Similarity

API ID: Mutex@@$Message$CallbackDialogDispatcherUser$??0?$basic_string@?init@AnotherCreateDispatchG@2@@std@@G@std@@InstanceParamRunning@TranslateU?$char_traits@V?$allocator@
String ID: -AutoStartIM$DLG_MAIN$Local\{D564BB4E-74F6-4fd5-900A-313328F6DF9F}$SweetIMAppLogger
API String ID: 3575969091-3177592150
Opcode ID: bb999c2487a112f79be8abefef08beeecc1f853b61d61bcd3c2e12e9c97ce0f1
Instruction ID: 68a02e7df998b29926512819b6c8b5b92c25132de0333f13bab9b808dd8f56a7
Opcode Fuzzy Hash: bb999c2487a112f79be8abefef08beeecc1f853b61d61bcd3c2e12e9c97ce0f1
Instruction Fuzzy Hash: 6B419171A00349EBDB10EFA4DE5DB9E7B74EB08710F104169E811B73D1DBB89904CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 0081C6E1 Relevance: 25.8, APIs: 17, Instructions: 260
synchronizationthreadmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 0081C67A
SetEvent.KERNEL32(?), ref: 0081C71C
LocalAlloc.KERNEL32(00000040,00000014), ref: 0081C77B
CreateEventA.KERNEL32(00000000,00000000,000000FF,00000000,00000040,00000014), ref: 0081C79F
CreateThread.KERNEL32(00000000,00000000,Function_0001C5C0,00000000,00000000,00000014), ref: 0081C7CC
SetThreadPriority.KERNEL32(00000000,00000000,00000000,00000000,Function_0001C5C0,00000000,00000000,00000014,00000000,00000000,000000FF,00000000,00000040,00000014), ref: 0081C7EB
CloseHandle.KERNEL32(00000014,00000000,00000000,Function_0001C5C0,00000000,00000000,00000014,00000000,00000000,000000FF,00000000,00000040,00000014), ref: 0081C804
LocalFree.KERNEL32(?,00000014,00000000,00000000,Function_0001C5C0,00000000,00000000,00000014,00000000,00000000,000000FF,00000000,00000040,00000014), ref: 0081C813
WaitForSingleObject.KERNEL32(?,000000FF), ref: 0081C842
GetTickCount.KERNEL32 ref: 0081C8AA
SetEvent.KERNEL32(?), ref: 0081C8D2
WaitForSingleObject.KERNEL32(?,00000064,?), ref: 0081C8E5
CloseHandle.KERNEL32(?,?,00000064,?), ref: 0081C8F7
CloseHandle.KERNEL32(?,?,?,00000064,?), ref: 0081C908
LocalFree.KERNEL32(?,?,?,?,00000064,?), ref: 0081C922

Memory Dump Source

Source File: 00000007.00000002.1893873243.0000000000801000.00000020.00000001.01000000.00000015.sdmp, Offset: 00800000, based on PE: true

Associated: 00000007.00000002.1893849837.0000000000800000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000007.00000002.1893902337.000000000081F000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000007.00000002.1893926350.0000000000822000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000007.00000002.1893956770.0000000000824000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_800000_SweetIM.jbxd

Similarity

API ID: CloseEventHandleLocalObjectSingleWait$CreateFreeThread$AllocCountPriorityTick
String ID:
API String ID: 3893984910-0
Opcode ID: d0b8e372e6ca71397fe2f1b0fe3face40313b27a828d0ef4383958f52e7f681e
Instruction ID: 9a5f088e852c098202acf27c41eb772aba2087715717d1318ba5d8aed7ca7ce0
Opcode Fuzzy Hash: d0b8e372e6ca71397fe2f1b0fe3face40313b27a828d0ef4383958f52e7f681e
Instruction Fuzzy Hash: 6BB1C278A00204AFDB50DF6CC985E9A7BE4FF09360F558154F949DB3A2D671EE80CB91

Uniqueness

Uniqueness Score: -1.00%

Function 004D2E80 Relevance: 22.7, APIs: 15, Instructions: 191COMMON

Download Yara Rule

APIs

fseek.MSVCR71 ref: 004D2EF8
ftell.MSVCR71 ref: 004D2EFB
fseek.MSVCR71 ref: 004D2F08

Part of subcall function 004D5670: ??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z.MSVCP71(00000000,00000000,004D4545,00000002,00000000,00000000,00000000,?), ref: 004D5690

Memory Dump Source

Source File: 00000007.00000002.1893401256.00000000004D1000.00000020.00000001.01000000.00000016.sdmp, Offset: 004D0000, based on PE: true

Associated: 00000007.00000002.1893380988.00000000004D0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000007.00000002.1893424199.00000000004D8000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000007.00000002.1893452688.00000000004DC000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000007.00000002.1893481133.00000000004DD000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4d0000_SweetIM.jbxd

Similarity

API ID: fseek$??4?$basic_string@D@2@@std@@D@std@@U?$char_traits@V01@V?$allocator@ftell
String ID:
API String ID: 3906491186-0
Opcode ID: a62bdf8e5cdd521dc41a9cc32aba431b7e61ace2223e762c286cb5e950c9df1b
Instruction ID: fddd446604d8fc5bbc2297098334d00c48c3c99c36b39499d076ece0fce9070f
Opcode Fuzzy Hash: a62bdf8e5cdd521dc41a9cc32aba431b7e61ace2223e762c286cb5e950c9df1b
Instruction Fuzzy Hash: BA512671644340ABD721DF28CC95B6BBBA4FB94B10F00452FF586873C1DB78A849C7A6

Uniqueness

Uniqueness Score: -1.00%

Function 7C383B6B Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 247fileCOMMON

Download Yara Rule

APIs

_errno.MSVCR71 ref: 7C383BF2
__doserrno.MSVCR71 ref: 7C383BFD
_errno.MSVCR71 ref: 7C383C7F
__doserrno.MSVCR71 ref: 7C383C8A
_errno.MSVCR71 ref: 7C383D0D
__doserrno.MSVCR71 ref: 7C383D18
CreateFileA.KERNEL32(80000000,80000000,?,0000000C,00000001,00000080,00000000), ref: 7C383D48
GetFileType.KERNEL32(00000000), ref: 7C383D55
CloseHandle.KERNEL32(00000000), ref: 7C383D60
GetLastError.KERNEL32 ref: 7C383D66
__doserrno.MSVCR71 ref: 7C383DDE

Strings

H, xrefs: 7C383DB5

Memory Dump Source

Source File: 00000007.00000002.1895440500.000000007C361000.00000020.00000001.01000000.00000011.sdmp, Offset: 7C360000, based on PE: true

Associated: 00000007.00000002.1895415267.000000007C360000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000007.00000002.1895478014.000000007C39A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000007.00000002.1895520568.000000007C3AB000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000007.00000002.1895544987.000000007C3AF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000007.00000002.1895571234.000000007C3B0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000007.00000002.1895592086.000000007C3B2000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7c360000_SweetIM.jbxd

Similarity

API ID: __doserrno$_errno$File$CloseCreateErrorHandleLastType
String ID: H
API String ID: 3590436335-2852464175
Opcode ID: a2a21fc4c36ca4ec2d352cb5b09c824a2983f7bd7813cc5460b716f1d2bce08a
Instruction ID: 53782da3112ad5cf3e9dff24693224bcb3b8d1c727e6f7d87e021f9c6c4915ae
Opcode Fuzzy Hash: a2a21fc4c36ca4ec2d352cb5b09c824a2983f7bd7813cc5460b716f1d2bce08a
Instruction Fuzzy Hash: D08154719492089AEB929F65C8403ED7BF8EF013D8F204269D992A73C0C37E5509CFB2

Uniqueness

Uniqueness Score: -1.00%

Function 00407E48 Relevance: 21.1, APIs: 14, Instructions: 147COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00409718,00000074), ref: 00407E60
__set_app_type.MSVCR71 ref: 00407EB9
__p__fmode.MSVCR71 ref: 00407ECE
__p__commode.MSVCR71 ref: 00407EDC
__setusermatherr.MSVCR71 ref: 00407F0D
_initterm.MSVCR71 ref: 00407F23
__getmainargs.MSVCR71 ref: 00407F50
_amsg_exit.MSVCR71 ref: 00407F62
_initterm.MSVCR71 ref: 00407F72
GetStartupInfoA.KERNEL32(?), ref: 00407FAC
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 00407FC5
exit.MSVCR71 ref: 00407FD8
_cexit.MSVCR71 ref: 00407FDE
_ismbblead.MSVCR71 ref: 00407FF9

Memory Dump Source

Source File: 00000007.00000002.1892750434.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1892725646.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1892779763.0000000000409000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1892803659.000000000040D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1892825887.000000000040E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_SweetIM.jbxd

Similarity

API ID: HandleModule_initterm$InfoStartup__getmainargs__p__commode__p__fmode__set_app_type__setusermatherr_amsg_exit_cexit_ismbbleadexit
String ID:
API String ID: 1338188474-0
Opcode ID: 33e52f31024134cf3c7928e6b618b13df7267f5973f2ea6db016f49251d88156
Instruction ID: 82e34cbe90dbb163feac3b9950c9676ff52a021aac122ad05f87830b939d3ac1
Opcode Fuzzy Hash: 33e52f31024134cf3c7928e6b618b13df7267f5973f2ea6db016f49251d88156
Instruction Fuzzy Hash: BB51C171D04215DFDB20AFA4D9896AE7BB4BB08314F20007FE441BA2D2CB385D46CB9D

Uniqueness

Uniqueness Score: -1.00%

Function 100168F0 Relevance: 21.1, APIs: 14, Instructions: 117threadsynchronizationCOMMON

Download Yara Rule

APIs

GetHandleInformation.KERNEL32(?,?), ref: 10016949
SetEvent.KERNEL32(?), ref: 1001695B
WaitForSingleObject.KERNEL32(?,00000064), ref: 10016967
GetExitCodeThread.KERNEL32(?,?), ref: 10016976
TerminateThread.KERNEL32(?,00000000), ref: 1001698B
CloseHandle.KERNEL32(?), ref: 10016995
CloseHandle.KERNEL32(?), ref: 100169A2
CloseHandle.KERNEL32(?), ref: 100169AF
CloseHandle.KERNEL32(?), ref: 100169EC
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71 ref: 10016A0C
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71 ref: 10016A1D
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71 ref: 10016A2E
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71 ref: 10016A3C
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71 ref: 10016A4A

Memory Dump Source

Source File: 00000007.00000002.1895242678.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1895219944.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1895275872.0000000010026000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1895304349.0000000010034000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1895371327.000000001003A000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_SweetIM.jbxd

Similarity

API ID: ??1?$basic_string@G@2@@std@@G@std@@HandleU?$char_traits@V?$allocator@$Close$Thread$CodeEventExitInformationObjectSingleTerminateWait
String ID:
API String ID: 2723236727-0
Opcode ID: cbba28162e01c1a3bfd3daf9f6a920410cb8ace00e1711041279e345884e7be7
Instruction ID: 6aa9c47fca13ef660a87f60c12e55ca05b4b757262fa21d3955a09d874b98abb
Opcode Fuzzy Hash: cbba28162e01c1a3bfd3daf9f6a920410cb8ace00e1711041279e345884e7be7
Instruction Fuzzy Hash: 334103B4100B408FD721CF69CC88A2ABBF9FF98704F644A0DE18A876A0C775E985CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00404AA0 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 117COMMON

Download Yara Rule

APIs

??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71(0040D174,00000000,00000001,000000FF,?,00404F33,00000001,-00000010,00000000,00000000,00000000,00000000,00408910,000000FF,?,0040542D), ref: 00404AD2
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71(?,00404F33,00000001,-00000010,00000000,00000000,00000000,00000000,00408910,000000FF,?,0040542D,00000000,00000001,00000001,004028B2), ref: 00404ADF
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(Type,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00404AFE

Part of subcall function 00406150: ??$?MGU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@0@Z.MSVCP71(?,-0000000C,?,00000000,00404CB0,0040D174), ref: 00406195
Part of subcall function 00406150: ??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z.MSVCP71(?,?,00000000,00404CB0,0040D174), ref: 004061C2
Part of subcall function 00406150: ??3@YAXPAX@Z.MSVCR71 ref: 004061EC
Part of subcall function 00406150: ??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71 ref: 00406210

??$?8GU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBG@Z.MSVCP71(?,Registry), ref: 00404B3B
??$?8GU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBG@Z.MSVCP71(?,File), ref: 00404B59

Part of subcall function 00404200: ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71(0040D174,7C3D2D65,00000003), ref: 0040422A
Part of subcall function 00404200: ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71 ref: 0040423D
Part of subcall function 00404200: ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71 ref: 0040424D
Part of subcall function 00404200: ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71 ref: 0040425A
Part of subcall function 00404200: ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71 ref: 00404267
Part of subcall function 00404200: ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71 ref: 00404274
Part of subcall function 00404200: ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(Type), ref: 0040428F
Part of subcall function 00404200: ??$?8GU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBG@Z.MSVCP71(?,Registry), ref: 004042C9
Part of subcall function 00404200: ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(KeyParent), ref: 004042EE
Part of subcall function 00404200: ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(KeyName), ref: 00404330

??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71 ref: 00404BC8
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71 ref: 00404BD5

Strings

File, xrefs: 00404B53
Registry, xrefs: 00404B35
ShellLink, xrefs: 00404B71
Type, xrefs: 00404AF3

Memory Dump Source

Source File: 00000007.00000002.1892750434.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1892725646.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1892779763.0000000000409000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1892803659.000000000040D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1892825887.000000000040E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_SweetIM.jbxd

Similarity

API ID: G@std@@U?$char_traits@V?$allocator@$G@2@@std@@$??0?$basic_string@$G@1@@std@@V?$basic_string@$??$?8??1?$basic_string@G@2@@0@$??$???3@??4?$basic_string@G@2@@0@0@V01@V01@@
String ID: File$Registry$ShellLink$Type
API String ID: 2243324655-1643845889
Opcode ID: 4c66b18ecf688f3a29788a6d2e43e62ad2183db8cdf2af6522cb8a057fedb4ae
Instruction ID: 55b217286641641cff775f9e88cefdfa5d801beda5f6e364de605b7be72638fd
Opcode Fuzzy Hash: 4c66b18ecf688f3a29788a6d2e43e62ad2183db8cdf2af6522cb8a057fedb4ae
Instruction Fuzzy Hash: FD4195B1C00208ABCF00DFA5DD41AEEBBB8EF85714F14416EE90577281D7785B09CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 100129E0 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 81COMMON

Download Yara Rule

APIs

??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(10026550,00000000,00000000,00000004), ref: 10012A16
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(10026550), ref: 10012A46
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(10026550), ref: 10012A58
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(10026550), ref: 10012A6A
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(10026550), ref: 10012A7F
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(Main.ConfigFiles.AutoUpdateConfigFilePath), ref: 10012AAA
?getConfigManager@CConfigManager@@SAAAV1@XZ.MGCONFIG ref: 10012AB4
?getDefaultConfig@CConfigManager@@QAEAAVCConfig@@XZ.MGCONFIG ref: 10012ABC
?getPropertyAsStringEx@CConfig@@QAE?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@V23@@Z.MGCONFIG(?), ref: 10012ACC
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z.MSVCP71(00000000), ref: 10012AD9
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71 ref: 10012AE6

Part of subcall function 100125E0: ?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ.MSVCP71(00000000,00000000,00000004), ref: 1001260C
Part of subcall function 100125E0: _IsFileExist@4.MGCOMMON(00000000), ref: 10012613
Part of subcall function 100125E0: ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(Automatic update File not exists!), ref: 1001262A
Part of subcall function 100125E0: ??0CErrException@@QAE@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z.MGCOMMON ref: 10012633
Part of subcall function 100125E0: ??0CErrException@@QAE@ABV0@@Z.MGCOMMON(00000000), ref: 10012647
Part of subcall function 100125E0: _CxxThrowException.MSVCR71(?,1002A55C), ref: 10012659
Part of subcall function 100125E0: ??0CXmlDocument@@QAE@XZ.MGXML_WRAPPER(?,1002A55C), ref: 10012661
Part of subcall function 100125E0: ?initFromFile@CXmlDocument@@QAEXABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z.MGXML_WRAPPER(00000004), ref: 10012677
Part of subcall function 100125E0: ?getDocumentRoot@CXmlDocument@@QAE?AVCXmlNode@@XZ.MGXML_WRAPPER(?), ref: 1001268B
Part of subcall function 100125E0: ?isNull@CXmlNode@@QAE_NXZ.MGXML_WRAPPER ref: 10012694
Part of subcall function 100125E0: ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(AutoUpdate analysis error. Could not obtain the AutoUpdate child.), ref: 100126AB
Part of subcall function 100125E0: ??0CErrMessageFormatException@@QAE@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z.MGCOMMON ref: 100126B4
Part of subcall function 100125E0: ??0CErrMessageFormatException@@QAE@ABV0@@Z.MGCOMMON(00000000), ref: 100126C5
Part of subcall function 100125E0: _CxxThrowException.MSVCR71(?,100298A8), ref: 100126D7
Part of subcall function 100125E0: ?getNodeName@CXmlNode@@QBE?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@XZ.MGXML_WRAPPER(?), ref: 100126F0
Part of subcall function 100125E0: ?StringCmpi@@YAHABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@0@Z.MGCOMMON(00000000,10038464), ref: 10012702
Part of subcall function 100125E0: ??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71 ref: 10012716
Part of subcall function 100125E0: ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(AutoUpdate analysis error. The AutoUpdate does not exists.), ref: 1001272D
Part of subcall function 100125E0: ??0CErrMessageFormatException@@QAE@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z.MGCOMMON ref: 10012736
Part of subcall function 100125E0: ??0CErrMessageFormatException@@QAE@ABV0@@Z.MGCOMMON(00000000), ref: 10012747

Strings

Main.ConfigFiles.AutoUpdateConfigFilePath, xrefs: 10012A8D

Memory Dump Source

Source File: 00000007.00000002.1895242678.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1895219944.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1895275872.0000000010026000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1895304349.0000000010034000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1895371327.000000001003A000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_SweetIM.jbxd

Similarity

API ID: G@std@@U?$char_traits@V?$allocator@$G@2@@std@@$??0?$basic_string@$V?$basic_string@$Exception@@$?get$FormatG@2@@std@@@Message$ConfigDocument@@Node@@V0@@$??1?$basic_string@Config@@ExceptionManager@@StringThrow$??4?$basic_string@?c_str@?$basic_string@?initCmpi@@Config@DefaultDocumentExist@4FileFile@FromG@2@@std@@0@Manager@Name@NodeNull@PropertyRoot@V01@V01@@V23@@
String ID: Main.ConfigFiles.AutoUpdateConfigFilePath
API String ID: 2173420003-3692971376
Opcode ID: 8404aec9da6f54be889763d612ec4f8c18601dda3b867efa9723f9ac71c68f90
Instruction ID: ba14ddfae378c9713296e42f00aa695484c55a70bba581e964768affbabcec27
Opcode Fuzzy Hash: 8404aec9da6f54be889763d612ec4f8c18601dda3b867efa9723f9ac71c68f90
Instruction Fuzzy Hash: 82313A708047A4DFE710DFA9CD88B9AFBF8FF58204F50454EE19A93690DB746605CB61

Uniqueness

Uniqueness Score: -1.00%

Function 10007760 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 117networkCOMMON

Download Yara Rule

APIs

?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ.MSVCP71(?,?,?,?,?,00000007,?,?,?,?,?,?,?,?,?,00000007), ref: 1000780E
InternetCrackUrlW.WININET(00000000,?,00000000,?), ref: 1000781C
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z.MSVCP71(?,?,?,?,?,?,00000007), ref: 10007831
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z.MSVCP71(?,?,?,?,?,?,00000007), ref: 1000783E
??_V@YAXPAX@Z.MSVCR71 ref: 1000785B
??_V@YAXPAX@Z.MSVCR71 ref: 10007864
??_V@YAXPAX@Z.MSVCR71 ref: 1000786D
??_V@YAXPAX@Z.MSVCR71 ref: 10007876
??_V@YAXPAX@Z.MSVCR71 ref: 1000787F
??_V@YAXPAX@Z.MSVCR71 ref: 10007888

Strings

<, xrefs: 100077A9

Memory Dump Source

Source File: 00000007.00000002.1895242678.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1895219944.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1895275872.0000000010026000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1895304349.0000000010034000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1895371327.000000001003A000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_SweetIM.jbxd

Similarity

API ID: G@2@@std@@G@std@@U?$char_traits@V?$allocator@$??4?$basic_string@V01@$?c_str@?$basic_string@CrackInternet
String ID: <
API String ID: 490602638-4251816714
Opcode ID: a21622a390815f8fa95896f3422368ca3bcdc41f904f9eb9b441b16ac1ce6712
Instruction ID: 0eb40c7ba6e51e1155f3fd0a0d5f5f98856c1591cb08dcc142d302eefe4562e9
Opcode Fuzzy Hash: a21622a390815f8fa95896f3422368ca3bcdc41f904f9eb9b441b16ac1ce6712
Instruction Fuzzy Hash: 8E412FB6D006189BCB10DF99D845AAEFBF9FF89610F10411AF905A7300D775E951CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 10016BB0 Relevance: 18.1, APIs: 12, Instructions: 114COMMON

Download Yara Rule

APIs

Part of subcall function 100105F0: ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z.MSVCP71(?,00000000,?,10016BEF,?,00000000), ref: 10010607

??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z.MSVCP71(00000000,?,00000000,00000000,00000004), ref: 10016BF7
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71(?,?,?,?,?,?,?,?,?,?,?,?,00000000,1001D2F4,000000FF), ref: 10016C03

Part of subcall function 10010310: ?getConfigManager@CConfigManager@@SAAAV1@XZ.MGCONFIG(?), ref: 10010346
Part of subcall function 10010310: ?getDefaultConfig@CConfigManager@@QAEAAVCConfig@@XZ.MGCONFIG ref: 10010350
Part of subcall function 10010310: ?getInstallDirectory@CConfig@@QAE?BV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@XZ.MGCONFIG ref: 10010354
Part of subcall function 10010310: ?getConfigManager@CConfigManager@@SAAAV1@XZ.MGCONFIG ref: 1001036A
Part of subcall function 10010310: ?getDefaultConfig@CConfigManager@@QAEAAVCConfig@@XZ.MGCONFIG ref: 1001036E
Part of subcall function 10010310: ?getDataDirectory@CConfig@@QAE?BV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@XZ.MGCONFIG ref: 10010372
Part of subcall function 10010310: ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z.MSVCP71(?), ref: 10010388
Part of subcall function 10010310: ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71($install_dir), ref: 1001039F
Part of subcall function 10010310: ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71($data_dir), ref: 100103B6
Part of subcall function 10010310: ?find@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIABV12@I@Z.MSVCP71(?,00000000), ref: 100103CF
Part of subcall function 10010310: ?replace@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@IIABV12@@Z.MSVCP71(00000000,?,?), ref: 100103F2
Part of subcall function 10010310: ?find@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIABV12@I@Z.MSVCP71(?,00000000), ref: 10010403
Part of subcall function 10010310: ?find@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIABV12@I@Z.MSVCP71(?,00000000), ref: 1001041E
Part of subcall function 10010310: ?replace@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@IIABV12@@Z.MSVCP71(00000000,?,?), ref: 1001043F
Part of subcall function 10010310: ?find@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIABV12@I@Z.MSVCP71(?,00000000), ref: 10010450
Part of subcall function 10010310: ?find@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGI@Z.MSVCP71(100283B4,00000000), ref: 1001046B

??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z.MSVCP71(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 10016C5B
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71(?,?,?,?,?,?,?,?,?,?,?,?,00000000,1001D2F4,000000FF), ref: 10016C67

Part of subcall function 10010590: ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z.MSVCP71(?,00000000,?), ref: 100105A4

??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z.MSVCP71(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,1001D2F4), ref: 10016C84
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71(?,?,?,?,?,?,?,?,?,?,?,?,00000000,1001D2F4,000000FF), ref: 10016C90

Part of subcall function 100105C0: ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z.MSVCP71(?,00000000,?), ref: 100105D4

??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z.MSVCP71(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,1001D2F4), ref: 10016CAD
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71(?,?,?,?,?,?,?,?,?,?,?,?,00000000,1001D2F4,000000FF), ref: 10016CB9
?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ.MSVCP71(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000,1001D2F4,000000FF), ref: 10016CDC
_IsDirExist@4.MGCOMMON(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000,1001D2F4,000000FF), ref: 10016CE3
?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ.MSVCP71(?,?,?,?,?,?,?,?,?,?,?,?,00000000,1001D2F4,000000FF), ref: 10016CEF
CreateDirectoryW.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000,1001D2F4), ref: 10016CF7

Memory Dump Source

Source File: 00000007.00000002.1895242678.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1895219944.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1895275872.0000000010026000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1895304349.0000000010034000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1895371327.000000001003A000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_SweetIM.jbxd

Similarity

API ID: G@2@@std@@G@std@@U?$char_traits@V?$allocator@$V01@@$??0?$basic_string@?getConfigV12@$?find@?$basic_string@$??1?$basic_string@??4?$basic_string@Config@@Manager@@V01@$?c_str@?$basic_string@?replace@?$basic_string@Config@DefaultDirectory@Manager@V12@@V?$basic_string@$CreateDataDirectoryExist@4Install
String ID:
API String ID: 1306238854-0
Opcode ID: f5c933c4ce7a388f10edfbf36ef989edc123a60806d880e2d3ab53c0ce0b9c38
Instruction ID: bb0bb8c3e1140962ca808ed11a23059cb00221ec746b6ea2d9b517be1cf844e9
Opcode Fuzzy Hash: f5c933c4ce7a388f10edfbf36ef989edc123a60806d880e2d3ab53c0ce0b9c38
Instruction Fuzzy Hash: 1A418875A01748EFDB04DFA4C994AAEBBB9FB48300F10495DF48A93390DB74AA09CB50

Uniqueness

Uniqueness Score: -1.00%

Function 10017950 Relevance: 18.1, APIs: 12, Instructions: 105COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000104), ref: 1001798C
GetModuleFileNameW.KERNEL32(00000000), ref: 10017993
GetFileVersionInfoSizeW.VERSION(?,?), ref: 100179A4
??0CErrException@@QAE@XZ.MGCOMMON ref: 100179D7
_CxxThrowException.MSVCR71(?,1002A55C), ref: 100179E9
GetFileVersionInfoW.VERSION(00000000,?,00000000,00000000), ref: 100179FB
??0CErrException@@QAE@XZ.MGCOMMON(00000000,?,00000000,00000000), ref: 10017A07
_CxxThrowException.MSVCR71(?,1002A55C), ref: 10017A16
VerQueryValueW.VERSION(00000000,100274DC,?,?,00000000,?,00000000,00000000), ref: 10017A29
??0CErrException@@QAE@XZ.MGCOMMON(00000000,100274DC,?,?,00000000,?,00000000,00000000), ref: 10017A35
_CxxThrowException.MSVCR71(?,1002A55C), ref: 10017A44
??_V@YAXPAX@Z.MSVCR71 ref: 10017A85

Memory Dump Source

Source File: 00000007.00000002.1895242678.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1895219944.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1895275872.0000000010026000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1895304349.0000000010034000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1895371327.000000001003A000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_SweetIM.jbxd

Similarity

API ID: ExceptionException@@FileThrow$InfoModuleVersion$HandleNameQuerySizeValue
String ID:
API String ID: 4155957286-0
Opcode ID: 59c2f6fd97f2d17152a11ae7db4d3ecf7be101aaadcef7f19e205c615a52de24
Instruction ID: 07ce6c2351d97802ad466a3a5781cfd83411cff5256376520ddbeb753fb392f9
Opcode Fuzzy Hash: 59c2f6fd97f2d17152a11ae7db4d3ecf7be101aaadcef7f19e205c615a52de24
Instruction Fuzzy Hash: 8B31A575D00619ABCB04DFA4CC45AEFB7B8FF4C600F504569E6099B201FB35EA85CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0081DF18 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 166libraryloadermemoryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(00000000,00000000,0081E0E4), ref: 0081DF58
GetProcAddress.KERNEL32(00000000,00000000), ref: 0081DF76
GetProcAddress.KERNEL32(00000000,00000000), ref: 0081DF94
GetProcAddress.KERNEL32(00000000,00000000), ref: 0081DFB3
AllocateAndInitializeSid.ADVAPI32(00822F8C,00000001,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,0081CEDD), ref: 0081E03F
LocalFree.KERNEL32(?), ref: 0081E0AC
FreeSid.ADVAPI32(0081CEDD), ref: 0081E0B5
LocalFree.KERNEL32(?,00822F8C,00000001,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,0081CEDD), ref: 0081E0BE
FreeLibrary.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,0081E0E4), ref: 0081E0C4

Strings

41#4%<fg{199, xrefs: 0081DF45

Memory Dump Source

Source File: 00000007.00000002.1893873243.0000000000801000.00000020.00000001.01000000.00000015.sdmp, Offset: 00800000, based on PE: true

Associated: 00000007.00000002.1893849837.0000000000800000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000007.00000002.1893902337.000000000081F000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000007.00000002.1893926350.0000000000822000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000007.00000002.1893956770.0000000000824000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_800000_SweetIM.jbxd

Similarity

API ID: Free$AddressProc$LibraryLocal$AllocateInitializeLoad
String ID: 41#4%<fg{199
API String ID: 3102391969-2975153987
Opcode ID: 7d59d9b90c15a1b669479cff1fcad62555de7d91f9c1347da1cb623cf477ceea
Instruction ID: 68ee285dd25fb112fb333895baa5a7876145c7fc4eda8f75b2a2b4e631c614a1
Opcode Fuzzy Hash: 7d59d9b90c15a1b669479cff1fcad62555de7d91f9c1347da1cb623cf477ceea
Instruction Fuzzy Hash: E851EE71A40609AAEB50EBA8CC46FEFB7BCFF08714F544525FA00E7281EB7499418B65

Uniqueness

Uniqueness Score: -1.00%

Function 00491F40 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 158registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000002,SOFTWARE\SweetIM\Messenger\Adapters,00000000,00020019,00000000,?,00000000,00000000), ref: 00491F8C

Part of subcall function 00491A80: RegQueryValueExW.KERNELBASE(?,00000000,00000000,?,?,?,00000000,00000000,00491FC0,Version,?,00000000,?,00000000,00000000), ref: 00491AAD

RegEnumKeyExW.KERNELBASE(00000000,000000FF,?,00000000,00000000,00000000,00000000,00000000,Version,?,00000000,?,00000000,00000000), ref: 00491FFA
RegOpenKeyExW.KERNELBASE(00000000,?,00000000,00020019,00491990,?,00000000,00000000), ref: 00492026
wcscpy.MSVCR71 ref: 004920A2
wcscpy.MSVCR71 ref: 004920AF
RegCloseKey.KERNELBASE(00000000,?,00000000,00000000), ref: 004920F6
RegCloseKey.ADVAPI32(00491990,?,?,?,00000000,00000000), ref: 00492106
RegCloseKey.ADVAPI32(00000000,Version,?,00000000,?,00000000,00000000), ref: 0049212F

Strings

Version, xrefs: 00491FAD
SOFTWARE\SweetIM\Messenger\Adapters, xrefs: 00491F73

Memory Dump Source

Source File: 00000007.00000002.1893049999.0000000000491000.00000020.00000001.01000000.00000012.sdmp, Offset: 00490000, based on PE: true

Associated: 00000007.00000002.1893029594.0000000000490000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000007.00000002.1893070082.0000000000494000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000007.00000002.1893089164.0000000000497000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000007.00000002.1893112207.0000000000498000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_490000_SweetIM.jbxd

Similarity

API ID: Close$Openwcscpy$EnumQueryValue
String ID: SOFTWARE\SweetIM\Messenger\Adapters$Version
API String ID: 4170070848-2368675537
Opcode ID: 0cbfeb033533018893ac5f1479a19da8515dcfd3ede9c902c88126a5f07a249e
Instruction ID: fc62425b275877d475b14c1eae6036de4c62b6f02b002c7c4f34e15ab587f0ca
Opcode Fuzzy Hash: 0cbfeb033533018893ac5f1479a19da8515dcfd3ede9c902c88126a5f07a249e
Instruction Fuzzy Hash: 71517072D00219ABDF11CF94CC85BEEBBB9FB98300F10447AE605B3241D7786A45CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 007B6F50 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 96stringregistryCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(?,localhost), ref: 007B6F8C
lstrcmpiW.KERNEL32(?,127.0.0.1), ref: 007B6F98
RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 007B6FA9

Strings

localhost, xrefs: 007B6F86
127.0.0.1, xrefs: 007B6F92

Memory Dump Source

Source File: 00000007.00000002.1893726370.00000000007B1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000007.00000002.1893698679.00000000007B0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.1893761079.00000000007D7000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.1893806747.00000000007EC000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.1893827050.00000000007ED000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7b0000_SweetIM.jbxd

Similarity

API ID: lstrcmpi$ConnectRegistry
String ID: 127.0.0.1$localhost
API String ID: 3700483673-2339935011
Opcode ID: 7a31c3fc650cd2d985baab7f4c147dac6c3e8b711cec5b12393d6ec90eeb2442
Instruction ID: 9b771e71fb46ff9d8a493f9fe45da2b08b51e94aef141e4121872d90f3497f14
Opcode Fuzzy Hash: 7a31c3fc650cd2d985baab7f4c147dac6c3e8b711cec5b12393d6ec90eeb2442
Instruction Fuzzy Hash: 0521D632609315ABC325CB29DC44F6BB7ECEB88B65F158A1FF544E3280D769EC40C6A4

Uniqueness

Uniqueness Score: -1.00%

Function 10018320 Relevance: 15.1, APIs: 10, Instructions: 144COMMON

Download Yara Rule

APIs

?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ.MSVCP71 ref: 1001835F
?DestroyIpcQueue@CIPC@@SGHPBD@Z.MGHOOKING(00000000), ref: 10018366
??0CAutoLock@@QAE@ABVCLockable@@@Z.MGCOMMON(?), ref: 1001838B
??3@YAXPAX@Z.MSVCR71 ref: 100183AD
??3@YAXPAX@Z.MSVCR71 ref: 100183E6
??1CAutoLock@@QAE@XZ.MGCOMMON(?,?,?,?,?,?,?,1001D57F,000000FF), ref: 1001840F
CloseHandle.KERNEL32(?), ref: 10018445
??3@YAXPAX@Z.MSVCR71 ref: 1001845B
??3@YAXPAX@Z.MSVCR71 ref: 10018473

Memory Dump Source

Source File: 00000007.00000002.1895242678.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1895219944.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1895275872.0000000010026000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1895304349.0000000010034000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1895371327.000000001003A000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_SweetIM.jbxd

Similarity

API ID: ??3@$AutoLock@@$?c_str@?$basic_string@CloseD@2@@std@@D@std@@DestroyHandleLockable@@@Queue@U?$char_traits@V?$allocator@
String ID:
API String ID: 619612619-0
Opcode ID: 3ed660e164e1e7e257531726dac411e7ccd3b127acdd363c16969633f5836939
Instruction ID: ee0f1fff2604525acecceebcd1f80474c5da34012e8c465fa0da749e95eb03c1
Opcode Fuzzy Hash: 3ed660e164e1e7e257531726dac411e7ccd3b127acdd363c16969633f5836939
Instruction Fuzzy Hash: 8C5149B5A00741DFC710CFA8C9C1A5AF7F5FF08600B60896EE55A9BA41D730FA85CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00407290 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 123registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(00000104,Run,00000000,00020019,?), ref: 004072FC
RegCloseKey.ADVAPI32(?), ref: 00407311
RegOpenKeyExW.KERNEL32(00000000,MOD,00000000,00020019,?,0040D174,?,004059FD,?,?,?,?,00000104,00408C28,000000FF,00407B87), ref: 00407358
RegCloseKey.ADVAPI32(?,?,004059FD,?,?,?,?,00000104,00408C28,000000FF,00407B87,00000104,?), ref: 00407369
RegCloseKey.ADVAPI32(00000000), ref: 004073BB
RegCloseKey.ADVAPI32(?), ref: 004073CE

Strings

MOD, xrefs: 0040734E
Run, xrefs: 004072ED

Memory Dump Source

Source File: 00000007.00000002.1892750434.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1892725646.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1892779763.0000000000409000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1892803659.000000000040D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1892825887.000000000040E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_SweetIM.jbxd

Similarity

API ID: Close$Open
String ID: MOD$Run
API String ID: 2976201327-1407684268
Opcode ID: a7a7ae38332bbc94ece10f71fb2ec82e7bcc7eab43c145b8d4e23c9cf14685f2
Instruction ID: d8ebc45ffe6d883bf91305716d9902575837cf9b9c5dca007cd2cbfb08c15c55
Opcode Fuzzy Hash: a7a7ae38332bbc94ece10f71fb2ec82e7bcc7eab43c145b8d4e23c9cf14685f2
Instruction Fuzzy Hash: 85413AB09183519FC210DF54C884A5FBBE8FB88B14F000E2EF595A3281D7B9E948CBD6

Uniqueness

Uniqueness Score: -1.00%

Function 00491490 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00001000,?,?,?,?,?,00493260,000000FF,?,00491898,?), ref: 004914FE
GetModuleFileNameW.KERNEL32(00000000,?,?,?,?,?,00493260,000000FF,?,00491898,?), ref: 00491505
GetLongPathNameW.KERNEL32(?,?,00001000), ref: 0049151E
wcscpy.MSVCR71 ref: 00491532
PathStripPathW.SHLWAPI(?), ref: 00491542
_wcsicmp.MSVCR71 ref: 00491554

Part of subcall function 004912D0: LoadLibraryW.KERNEL32(version.dll,?,?,?,?,?), ref: 004912D9
Part of subcall function 004912D0: GetProcAddress.KERNEL32(00000000,VerQueryValueW), ref: 004912F6
Part of subcall function 004912D0: GetProcAddress.KERNEL32(00000000,GetFileVersionInfoW), ref: 00491302
Part of subcall function 004912D0: GetProcAddress.KERNEL32(00000000,GetFileVersionInfoSizeW), ref: 0049130E
Part of subcall function 004912D0: ??2@YAPAXI@Z.MSVCR71 ref: 00491329
Part of subcall function 004912D0: FreeLibrary.KERNEL32(00000000,?,?,?,?,?), ref: 004913AA

Strings

YahooMessenger.exe, xrefs: 0049154E

Memory Dump Source

Source File: 00000007.00000002.1893049999.0000000000491000.00000020.00000001.01000000.00000012.sdmp, Offset: 00490000, based on PE: true

Associated: 00000007.00000002.1893029594.0000000000490000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000007.00000002.1893070082.0000000000494000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000007.00000002.1893089164.0000000000497000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000007.00000002.1893112207.0000000000498000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_490000_SweetIM.jbxd

Similarity

API ID: AddressPathProc$LibraryModuleName$??2@FileFreeHandleLoadLongStrip_wcsicmpwcscpy
String ID: YahooMessenger.exe
API String ID: 2511602858-3679893240
Opcode ID: ec4912cc0f9d941007627a7a2f664ce9d7b99ede2d888754c0747514a464bd88
Instruction ID: 0562474e3836edfb9428b0bba6907d84df803a4fecbd84a26679c5f0df8d44fd
Opcode Fuzzy Hash: ec4912cc0f9d941007627a7a2f664ce9d7b99ede2d888754c0747514a464bd88
Instruction Fuzzy Hash: FB31B272D00219ABDF10CB98CC49EEEB7B8EB4C711F0041BBE609E2150D7755A48CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 10007A00 Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

ObtainUserAgentString.URLMON(00000000,00000000,?), ref: 10007A45
??_V@YAXPAX@Z.MSVCR71 ref: 10007A56
ObtainUserAgentString.URLMON(00000000,00000000,?), ref: 10007A6F
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000004,?,1000874B,?), ref: 10007A81
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,?,?,?,1000874B,?), ref: 10007AA7
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z.MSVCP71(00000000,?,?,?,1000874B,?), ref: 10007AB5
??_V@YAXPAX@Z.MSVCR71 ref: 10007AC7
??_V@YAXPAX@Z.MSVCR71 ref: 10007AD4

Memory Dump Source

Source File: 00000007.00000002.1895242678.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1895219944.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1895275872.0000000010026000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1895304349.0000000010034000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1895371327.000000001003A000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_SweetIM.jbxd

Similarity

API ID: AgentByteCharMultiObtainStringUserWide$??4?$basic_string@G@2@@std@@G@std@@U?$char_traits@V01@V?$allocator@
String ID:
API String ID: 983251311-0
Opcode ID: a0da22129a3ef16a77b54caba914ea35f8b08bba8919fec88cc6f8014360c394
Instruction ID: 946ce798eca873834d174b4e99baa04dcac021bfb21973cb8b1fce34418b37c2
Opcode Fuzzy Hash: a0da22129a3ef16a77b54caba914ea35f8b08bba8919fec88cc6f8014360c394
Instruction Fuzzy Hash: 2A21D8B1E006057BE710DB548CC5FBFB6ACFB85694F100529F505A6241E778EE84C6F2

Uniqueness

Uniqueness Score: -1.00%

Function 004C39C0 Relevance: 12.1, APIs: 8, Instructions: 81threadCOMMON

Download Yara Rule

APIs

??0CHTTPClient@@QAE@XZ.MGCOMMUNICATION ref: 004C39E1
??2@YAPAXI@Z.MSVCR71 ref: 004C3A0F
CreateEventW.KERNEL32(00000000,00000000,00000000,00000000), ref: 004C3A2E
CreateEventW.KERNEL32(00000000,00000000,00000000,00000000), ref: 004C3A37
CreateEventW.KERNEL32(00000000,00000000,00000000,00000000), ref: 004C3A40
CreateEventW.KERNEL32(00000000,00000000,00000000,00000000), ref: 004C3A49
CreateEventW.KERNEL32(00000000,00000000,00000000,00000000), ref: 004C3A52
CreateThread.KERNEL32(00000000,00000000,?,?,00000000,?), ref: 004C3A65

Memory Dump Source

Source File: 00000007.00000002.1893316133.00000000004C1000.00000020.00000001.01000000.00000014.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000007.00000002.1893294302.00000000004C0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000007.00000002.1893337601.00000000004C5000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000007.00000002.1893360960.00000000004C9000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4c0000_SweetIM.jbxd

Similarity

API ID: Create$Event$??2@Client@@Thread
String ID:
API String ID: 130443547-0
Opcode ID: 9b56e89e2b4bde070876fe4fd80d800524a14cc33d1843884e815536a807ce8b
Instruction ID: aa563ebb09b3ecc51fc528ba661bfbb04081955ad99a32123546968b035a56ed
Opcode Fuzzy Hash: 9b56e89e2b4bde070876fe4fd80d800524a14cc33d1843884e815536a807ce8b
Instruction Fuzzy Hash: D921D1F5900754AFD3609F6A8DC5E27FAECFB48754B50492EF18AC2A10D779AC008F65

Uniqueness

Uniqueness Score: -1.00%

Function 0081CBE8 Relevance: 12.1, APIs: 8, Instructions: 81COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,00000000,00000000,00000002,00000000,0081CEDD), ref: 0081CC14
GetCurrentProcess.KERNEL32(00000000,?,00000000,00000000,00000002,00000000,0081CEDD), ref: 0081CC1A
GetCurrentProcess.KERNEL32(00000000,00000000,?,00000000,00000000,00000002,00000000,0081CEDD), ref: 0081CC20
DuplicateHandle.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000002,00000000,0081CEDD), ref: 0081CC26
CloseHandle.KERNEL32(?,?,00100000,00000000,00000000,00000000,?,00000000,00000000,00000002,00000000,0081CEDD), ref: 0081CC41
InitializeCriticalSection.KERNEL32(0082394C,00000000,00000000,00000000,?,00000000,00000000,00000002,00000000,0081CEDD), ref: 0081CC54
EnterCriticalSection.KERNEL32(0082394C,00000000,00000000,00000000,?,00000000,00000000,00000002,00000000,0081CEDD), ref: 0081CC69
LeaveCriticalSection.KERNEL32(0082394C,0081CCDC,0082394C,00000000,00000000,00000000,?,00000000,00000000,00000002,00000000,0081CEDD), ref: 0081CCCF

Part of subcall function 0081DF18: LoadLibraryA.KERNEL32(00000000,00000000,0081E0E4), ref: 0081DF58
Part of subcall function 0081DF18: GetProcAddress.KERNEL32(00000000,00000000), ref: 0081DF76
Part of subcall function 0081DF18: GetProcAddress.KERNEL32(00000000,00000000), ref: 0081DF94
Part of subcall function 0081DF18: GetProcAddress.KERNEL32(00000000,00000000), ref: 0081DFB3
Part of subcall function 0081DF18: AllocateAndInitializeSid.ADVAPI32(00822F8C,00000001,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,0081CEDD), ref: 0081E03F

Memory Dump Source

Source File: 00000007.00000002.1893873243.0000000000801000.00000020.00000001.01000000.00000015.sdmp, Offset: 00800000, based on PE: true

Associated: 00000007.00000002.1893849837.0000000000800000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000007.00000002.1893902337.000000000081F000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000007.00000002.1893926350.0000000000822000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000007.00000002.1893956770.0000000000824000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_800000_SweetIM.jbxd

Similarity

API ID: AddressCriticalCurrentProcProcessSection$HandleInitialize$AllocateCloseDuplicateEnterLeaveLibraryLoad
String ID:
API String ID: 1042864306-0
Opcode ID: b437ba946530c78c2cbc303aeaba849dd416d841200007c189ddd147e4f44305
Instruction ID: 1bf920f46808f942fe3367796c5b1a6156733685ccd97c33230839469c9f2b0e
Opcode Fuzzy Hash: b437ba946530c78c2cbc303aeaba849dd416d841200007c189ddd147e4f44305
Instruction Fuzzy Hash: 4121A330A817556FDB21EBA8DD92B9F7BACFF06710F404551F500E3382D6789E418AA2

Uniqueness

Uniqueness Score: -1.00%

Function 10013290 Relevance: 10.6, APIs: 7, Instructions: 101windowCOMMON

Download Yara Rule

APIs

Part of subcall function 10019080: ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(10026550,?,100132D1,?,00000000,?,00000000,00000000,1001CD75,000000FF,?,100139A2), ref: 1001909C

??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z.MSVCP71 ref: 100132E3
??0CSerialize@@QAE@H@Z.MGCOMMON ref: 100132F7

Part of subcall function 100190C0: ?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ.MSVCP71(?,?,10013310,00000000), ref: 100190CA
Part of subcall function 100190C0: ??6CSerialize@@QAEAAV0@H@Z.MGCOMMON(?,00000000,?,10013310,00000000), ref: 100190D9
Part of subcall function 100190C0: ??6CSerialize@@QAEAAV0@PAG@Z.MGCOMMON(?,10013310,00000000), ref: 100190E1
Part of subcall function 100190C0: ??6CSerialize@@QAEAAV0@H@Z.MGCOMMON(?,10013310,00000000), ref: 100190E9

?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ.MSVCP71(00000000), ref: 1001332C
?SendIpcMessage@CIPC@@SGHPBDPAXK1KKH@Z.MGHOOKING(00000000,1001CD75,?,?,0000141C,0000EA60,00000001), ref: 10013348
??0CSerialize@@QAE@PAEI@Z.MGCOMMON(?,?), ref: 10013370
??1CSerialize@@QAE@XZ.MGCOMMON(?), ref: 100133AE
??1CSerialize@@QAE@XZ.MGCOMMON ref: 100133BB

Memory Dump Source

Source File: 00000007.00000002.1895242678.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1895219944.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1895275872.0000000010026000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1895304349.0000000010034000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1895371327.000000001003A000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_SweetIM.jbxd

Similarity

API ID: Serialize@@$U?$char_traits@V?$allocator@$G@2@@std@@G@std@@$?c_str@?$basic_string@$??0?$basic_string@??4?$basic_string@D@2@@std@@D@std@@Message@SendV01@V01@@
String ID:
API String ID: 1857123629-0
Opcode ID: 55e70045a3e7a214cf920727bb1297f6ae035d6bca022b6c91cb23f92b917ad0
Instruction ID: d3465099d5e36c8653509168a1b6ee9cf4a3f2e74b82e95a312b3e7e53f270ba
Opcode Fuzzy Hash: 55e70045a3e7a214cf920727bb1297f6ae035d6bca022b6c91cb23f92b917ad0
Instruction Fuzzy Hash: 074149B5D00259DFDB05CF94C894AEEFBB4FF09310F14819AE816A7341DB746A49CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 7C384179 Relevance: 9.2, APIs: 6, Instructions: 168fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000003), ref: 7C3841F3
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,7C3A1F20,00000014,7C3823CC,?,00000302,?), ref: 7C3841FD
_errno.MSVCR71(?,?,?,?,?,?,?,?,?,7C3A1F20,00000014,7C3823CC,?,00000302,?), ref: 7C38420A
__doserrno.MSVCR71(?,?,?,?,?,?,?,?,?,7C3A1F20,00000014,7C3823CC,?,00000302,?), ref: 7C384215
ReadFile.KERNEL32(00000000,?,00000001,00000000,00000000,?,?,?,?,?,?,?,?,?,7C3A1F20,00000014), ref: 7C3842C6
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,7C3A1F20,00000014,7C3823CC,?,00000302,?), ref: 7C3842D0

Memory Dump Source

Source File: 00000007.00000002.1895440500.000000007C361000.00000020.00000001.01000000.00000011.sdmp, Offset: 7C360000, based on PE: true

Associated: 00000007.00000002.1895415267.000000007C360000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000007.00000002.1895478014.000000007C39A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000007.00000002.1895520568.000000007C3AB000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000007.00000002.1895544987.000000007C3AF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000007.00000002.1895571234.000000007C3B0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000007.00000002.1895592086.000000007C3B2000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7c360000_SweetIM.jbxd

Similarity

API ID: ErrorFileLastRead$__doserrno_errno
String ID:
API String ID: 1365963421-0
Opcode ID: d7632bddbd6b6b99cae0679282b49e8e1d01512aa0f7a7566580a2518647dbf0
Instruction ID: e2e66935f728a6156a880b0a9599a2aa2b748784deb0439fadee13e84845b191
Opcode Fuzzy Hash: d7632bddbd6b6b99cae0679282b49e8e1d01512aa0f7a7566580a2518647dbf0
Instruction Fuzzy Hash: AA612B306043859FEB12CF68C890B997BF8BF06344F504699E9A29B691D370D655CF21

Uniqueness

Uniqueness Score: -1.00%

Function 004D4490 Relevance: 9.1, APIs: 6, Instructions: 67fileCOMMON

Download Yara Rule

APIs

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z.MSVCP71(?,00000000), ref: 004D44B5
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z.MSVCP71 ref: 004D44CD
fopen.MSVCR71 ref: 004D44E7
fclose.MSVCR71 ref: 004D4507
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ.MSVCP71 ref: 004D451C

Part of subcall function 004D5670: ??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z.MSVCP71(00000000,00000000,004D4545,00000002,00000000,00000000,00000000,?), ref: 004D5690

??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ.MSVCP71 ref: 004D4551

Memory Dump Source

Source File: 00000007.00000002.1893401256.00000000004D1000.00000020.00000001.01000000.00000016.sdmp, Offset: 004D0000, based on PE: true

Associated: 00000007.00000002.1893380988.00000000004D0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000007.00000002.1893424199.00000000004D8000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000007.00000002.1893452688.00000000004DC000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000007.00000002.1893481133.00000000004DD000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4d0000_SweetIM.jbxd

Similarity

API ID: D@2@@std@@D@std@@U?$char_traits@V?$allocator@$??1?$basic_string@??4?$basic_string@V01@$??0?$basic_string@V01@@fclosefopen
String ID:
API String ID: 2113612512-0
Opcode ID: ae22a9b486c15a1d1a4aee44356e727485c69731c050926807f75131bd6b0900
Instruction ID: 7ea0f5b00ad9c166985fe19a852bd23a1581b81365782feea88e0fdf6b5449fa
Opcode Fuzzy Hash: ae22a9b486c15a1d1a4aee44356e727485c69731c050926807f75131bd6b0900
Instruction Fuzzy Hash: C021C232545610EFC3149F14DC55B6AB7A4FB89720F10472FF8A6533D0DB78A90ACBAA

Uniqueness

Uniqueness Score: -1.00%

Function 00404070 Relevance: 9.1, APIs: 6, Instructions: 62COMMON

Download Yara Rule

APIs

??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71(0040D174,00000000,00000000,?,?,00000000,004086D9,000000FF,?,00404E15,00408910,00000000), ref: 00404094
??A?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAGI@Z.MSVCP71(00000000,?,?,00000000,004086D9,000000FF,?,00404E15,00408910), ref: 004040A9
?erase@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@II@Z.MSVCP71(00000000,00000001,?,?,00000000,004086D9,000000FF,?,00404E15,00408910), ref: 004040BA
?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ.MSVCP71(?,?,?,?,00000000,004086D9,000000FF,?,00404E15,00408910), ref: 004040D4
_IsFileExist@4.MGCOMMON(00000000,?,?,?,?,00000000,004086D9,000000FF,?,00404E15,00408910), ref: 004040DB
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71(?,?,?,?,00000000,004086D9,000000FF,?,00404E15,00408910), ref: 00404119

Memory Dump Source

Source File: 00000007.00000002.1892750434.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1892725646.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1892779763.0000000000409000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1892803659.000000000040D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1892825887.000000000040E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_SweetIM.jbxd

Similarity

API ID: G@2@@std@@G@std@@U?$char_traits@V?$allocator@$??0?$basic_string@??1?$basic_string@?c_str@?$basic_string@?erase@?$basic_string@A?$basic_string@Exist@4FileV12@
String ID:
API String ID: 2307572581-0
Opcode ID: 9fd333abbe3005c63c91d4f24a791c46385ba88be7caf08d79c73c2063fa2383
Instruction ID: 06a89c6918b1145295d760ee36db5e22ef0cb3e17acc9b9e31a978afcf852bfd
Opcode Fuzzy Hash: 9fd333abbe3005c63c91d4f24a791c46385ba88be7caf08d79c73c2063fa2383
Instruction Fuzzy Hash: EB11D371900514EBCB109B55ED49A9EBB78EF85720F10422AF816B3281DBB91E41C6A9

Uniqueness

Uniqueness Score: -1.00%

Function 7C37421D Relevance: 9.1, APIs: 6, Instructions: 52COMMON

Download Yara Rule

APIs

_get_osfhandle.MSVCR71(?,00000000,?,7C3742F1,?,7C3A0C58,0000000C,7C371F51,?,?,?,?,00000001,7C36A2CA,7C3AB638), ref: 7C374224
_get_osfhandle.MSVCR71(00000002,00000000,?,7C3742F1,?,7C3A0C58,0000000C,7C371F51,?,?,?,?,00000001,7C36A2CA,7C3AB638), ref: 7C37423B
_get_osfhandle.MSVCR71(00000001,00000002,00000000,?,7C3742F1,?,7C3A0C58,0000000C,7C371F51,?,?,?,?,00000001,7C36A2CA,7C3AB638), ref: 7C374244
_get_osfhandle.MSVCR71(?,00000000,?,7C3742F1,?,7C3A0C58,0000000C,7C371F51,?,?,?,?,00000001,7C36A2CA,7C3AB638), ref: 7C374250
FindCloseChangeNotification.KERNEL32(00000000,00000000,?,7C3742F1,?,7C3A0C58,0000000C,7C371F51,?,?,?,?,00000001,7C36A2CA,7C3AB638), ref: 7C374257
GetLastError.KERNEL32(?,00000001,7C36A2CA,7C3AB638,?,?,?,?,?,?,7C39F1B0,00000010), ref: 7C374261

Memory Dump Source

Source File: 00000007.00000002.1895440500.000000007C361000.00000020.00000001.01000000.00000011.sdmp, Offset: 7C360000, based on PE: true

Associated: 00000007.00000002.1895415267.000000007C360000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000007.00000002.1895478014.000000007C39A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000007.00000002.1895520568.000000007C3AB000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000007.00000002.1895544987.000000007C3AF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000007.00000002.1895571234.000000007C3B0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000007.00000002.1895592086.000000007C3B2000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7c360000_SweetIM.jbxd

Similarity

API ID: _get_osfhandle$ChangeCloseErrorFindLastNotification
String ID:
API String ID: 17880858-0
Opcode ID: ab82c8a3c0854eab5f01a27a904e73376ee0a1a0beb1a4b33d44b47ccc6899a2
Instruction ID: beca39e0c25ed377f221001f3563660ad4cec8963341c804d13a3ded591bfeff
Opcode Fuzzy Hash: ab82c8a3c0854eab5f01a27a904e73376ee0a1a0beb1a4b33d44b47ccc6899a2
Instruction Fuzzy Hash: E3012B3360621015F7125A3968C8BEE27685FC23E5B31061DE4A6D76C0DE1EF4668D63

Uniqueness

Uniqueness Score: -1.00%

Function 007BC140 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71 ref: 007BC166
?GetCSIDLFromString@@YGHPBGPAH@Z.MGCOMMON ref: 007BC184

Part of subcall function 007BBF60: ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(CSIDL_PROGRAM_FILES), ref: 007BBFB5
Part of subcall function 007BBF60: ??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71 ref: 007BBFDC
Part of subcall function 007BBF60: ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(CSIDL_COMMON_STARTMENU), ref: 007BBFEB
Part of subcall function 007BBF60: ??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71(?), ref: 007BC012
Part of subcall function 007BBF60: ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(CSIDL_APPDATA), ref: 007BC021
Part of subcall function 007BBF60: ??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71(?), ref: 007BC048
Part of subcall function 007BBF60: ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(CSIDL_LOCAL_APPDATA), ref: 007BC057
Part of subcall function 007BBF60: ??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71(?), ref: 007BC07E
Part of subcall function 007BBF60: ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(?), ref: 007BC08D
Part of subcall function 007BBF60: ??$?MGU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@0@Z.MSVCP71(?,?,?), ref: 007BC0B9
Part of subcall function 007BBF60: ??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71(?), ref: 007BC0E2

SHGetFolderPathW.SHELL32(00000000,?,00000000,00000000,?), ref: 007BC19D
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z.MSVCP71(007D746C), ref: 007BC1B7
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z.MSVCP71(?), ref: 007BC1CC
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71 ref: 007BC1E6

Memory Dump Source

Source File: 00000007.00000002.1893726370.00000000007B1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000007.00000002.1893698679.00000000007B0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.1893761079.00000000007D7000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.1893806747.00000000007EC000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.1893827050.00000000007ED000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7b0000_SweetIM.jbxd

Similarity

API ID: G@std@@U?$char_traits@V?$allocator@$G@2@@std@@$??0?$basic_string@$??1?$basic_string@$??$???4?$basic_string@FolderFromG@1@@std@@G@2@@0@0@PathString@@V01@V01@@V?$basic_string@
String ID:
API String ID: 780196800-0
Opcode ID: 939aed4b488518b2a1bc0fca978b0e5ff3729247c9a8da6ca75d8ae38ebc54ae
Instruction ID: e2b21f819c7b7570ca21335fb6ace0c3cde21a832c7c26dbcec0a0feeea7f73a
Opcode Fuzzy Hash: 939aed4b488518b2a1bc0fca978b0e5ff3729247c9a8da6ca75d8ae38ebc54ae
Instruction Fuzzy Hash: 08110D71109385AFD324DB54DD48BAAB7B4FB84B15F00C91EF58996290E77CA504CB52

Uniqueness

Uniqueness Score: -1.00%

Function 004053B0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 142COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCR71 ref: 0040549F
??3@YAXPAX@Z.MSVCR71 ref: 004054B6
??3@YAXPAX@Z.MSVCR71 ref: 00405512

Strings

+), xrefs: 00405512

Memory Dump Source

Source File: 00000007.00000002.1892750434.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1892725646.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1892779763.0000000000409000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1892803659.000000000040D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1892825887.000000000040E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_SweetIM.jbxd

Similarity

API ID: ??3@
String ID: +)
API String ID: 613200358-3505648025
Opcode ID: 15371336ed0bd8bcabb954ac31869fc3e593e4ae6054e2735946d8bde57e428f
Instruction ID: 6fb7177d9e9ff2ae74989f38ae9cfc1efb7f46c3fed95d923ebf0c6aa249cca8
Opcode Fuzzy Hash: 15371336ed0bd8bcabb954ac31869fc3e593e4ae6054e2735946d8bde57e428f
Instruction Fuzzy Hash: 9B512EB6900604ABCB10DF59D9819DFB7B9FF48704F54852EF91AB7280D738BA04CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0080DCEC Relevance: 7.6, APIs: 5, Instructions: 96COMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(00000000,0080DDF1,?,00000000,?,0000000F), ref: 0080DD1A
CreateFileMappingA.KERNEL32(000000FF,00000000,00000004,00000000,?,?), ref: 0080DDCF

Part of subcall function 0080D8DC: GetModuleHandleA.KERNEL32(00000000,00000000,00000000,0080DAC6,?,?,?,0000000F), ref: 0080D954
Part of subcall function 0080D8DC: GetProcAddress.KERNEL32(00000000,00000000), ref: 0080D95A
Part of subcall function 0080D8DC: AllocateAndInitializeSid.ADVAPI32(00822BB0,00000001,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,0000000F,00000000,00000000,0080DAC6,?,?), ref: 0080D984
Part of subcall function 0080D8DC: AllocateAndInitializeSid.ADVAPI32(00822BB8,00000001,00000012,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00822BB0,00000001,00000000,00000000,00000000), ref: 0080D9AC
Part of subcall function 0080D8DC: GetCurrentProcess.KERNEL32(00822BB8,00000001,00000012,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00822BB0,00000001,00000000,00000000,00000000), ref: 0080D9B9

CreateFileMappingW.KERNEL32(000000FF,?,00000004,00000000,?,?,00000000,0080DDF1,?,00000000,?,0000000F), ref: 0080DD7C
CreateFileMappingW.KERNEL32(000000FF,?,00000004,00000000,?,00000000,000000FF,?,00000004,00000000,?,?,00000000,0080DDF1,?,00000000), ref: 0080DDAD
LocalFree.KERNEL32(00000000,000000FF,?,00000004,00000000,?,?,00000000,0080DDF1,?,00000000,?,0000000F), ref: 0080DDBE

Memory Dump Source

Source File: 00000007.00000002.1893873243.0000000000801000.00000020.00000001.01000000.00000015.sdmp, Offset: 00800000, based on PE: true

Associated: 00000007.00000002.1893849837.0000000000800000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000007.00000002.1893902337.000000000081F000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000007.00000002.1893926350.0000000000822000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000007.00000002.1893956770.0000000000824000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_800000_SweetIM.jbxd

Similarity

API ID: CreateFileMapping$AllocateInitialize$AddressCurrentFreeHandleLocalModuleProcProcessVersion
String ID:
API String ID: 1121073306-0
Opcode ID: 8137d9960b0a8a45dbb611a2ab9fe47ede5cf38ab8448d74c90034d4ebd8a824
Instruction ID: dffa95294c2d16c18ad7f4b5708b9f523eaf898a81334db9432f59e1a58abfaa
Opcode Fuzzy Hash: 8137d9960b0a8a45dbb611a2ab9fe47ede5cf38ab8448d74c90034d4ebd8a824
Instruction Fuzzy Hash: 0E312271A00619AFDB90EBE8DC41FDE77B8FB49720F504525F920E72C1E77199048BA5

Uniqueness

Uniqueness Score: -1.00%

Function 004910E0 Relevance: 7.6, APIs: 5, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00001000,?,?,00000000,?,?,00493240,000000FF,?,0049180D,?,?), ref: 0049111E
GetModuleFileNameW.KERNEL32(00000000,?,?,00000000,?,?,00493240,000000FF,?,0049180D,?,?), ref: 00491125
GetLongPathNameW.KERNEL32(?,?,00001000), ref: 0049113E
PathStripPathW.SHLWAPI(?,?,?,00000000,?,?,00493240,000000FF,?,0049180D,?,?), ref: 0049114B
wcslen.MSVCR71 ref: 00491158

Memory Dump Source

Source File: 00000007.00000002.1893049999.0000000000491000.00000020.00000001.01000000.00000012.sdmp, Offset: 00490000, based on PE: true

Associated: 00000007.00000002.1893029594.0000000000490000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000007.00000002.1893070082.0000000000494000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000007.00000002.1893089164.0000000000497000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000007.00000002.1893112207.0000000000498000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_490000_SweetIM.jbxd

Similarity

API ID: Path$ModuleName$FileHandleLongStripwcslen
String ID:
API String ID: 3296686682-0
Opcode ID: aa0db3a0a2961c4e81d7a69ab77020bd940626c0746ffc8b0409fb89afaebe3a
Instruction ID: 5502dd556a8199f6444913cc37d8a43662f868245f9035b4b0b900f77fe65433
Opcode Fuzzy Hash: aa0db3a0a2961c4e81d7a69ab77020bd940626c0746ffc8b0409fb89afaebe3a
Instruction Fuzzy Hash: BD21B372900219EBDB20CF95DC45EDABBB8EB98750F00417AF60993260D7746A89CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 007BA220 Relevance: 7.6, APIs: 5, Instructions: 62registryCOMMON

Download Yara Rule

APIs

Part of subcall function 007BA040: ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(HKEY_CLASSES_ROOT,?,00000000), ref: 007BA092
Part of subcall function 007BA040: ??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71 ref: 007BA0B9
Part of subcall function 007BA040: ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(HKEY_CURRENT_USER), ref: 007BA0C8
Part of subcall function 007BA040: ??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71(?), ref: 007BA0EF
Part of subcall function 007BA040: ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(HKEY_LOCAL_MACHINE), ref: 007BA0FE
Part of subcall function 007BA040: ??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71(?), ref: 007BA125
Part of subcall function 007BA040: ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(HKEY_USERS), ref: 007BA134
Part of subcall function 007BA040: ??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71(?), ref: 007BA15B
Part of subcall function 007BA040: ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(HKEY_CURRENT_CONFIG), ref: 007BA16A
Part of subcall function 007BA040: ??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71(?), ref: 007BA191
Part of subcall function 007BA040: ??$?MGU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@0@Z.MSVCP71(?,-0000000C,?), ref: 007BA1B6

RegOpenKeyExW.KERNEL32 ref: 007BA284
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z.MSVCP71(?,?,?,00000000,?,00000000,00020019,?), ref: 007BA2A9
?GetStringValue@@YAHAAVCRegKey@ATL@@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAV34@@Z.MGCOMMON(?,?,?,00000000,?,00000000,00020019,?), ref: 007BA2B4
RegCloseKey.KERNEL32(?), ref: 007BA2C3
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71(?,?,?,?,?,?,?,?,?,?,?,?,?,?,007D4CE1,000000FF), ref: 007BA2D5

Memory Dump Source

Source File: 00000007.00000002.1893726370.00000000007B1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000007.00000002.1893698679.00000000007B0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.1893761079.00000000007D7000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.1893806747.00000000007EC000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.1893827050.00000000007ED000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7b0000_SweetIM.jbxd

Similarity

API ID: G@std@@U?$char_traits@V?$allocator@$G@2@@std@@$??0?$basic_string@??1?$basic_string@$V?$basic_string@$??$?CloseG@1@@std@@G@2@@0@0@Key@OpenStringV01@@V34@@Value@@
String ID:
API String ID: 4131902397-0
Opcode ID: beafec4837d093860bdd8ce5fa9b4c9bcd66784eac6f2ea8f50a594e68a9ebeb
Instruction ID: 15c1ab9f260d5fbe6ae4fcf6107632307558712c613dddabeae0be8f2ef2e2d5
Opcode Fuzzy Hash: beafec4837d093860bdd8ce5fa9b4c9bcd66784eac6f2ea8f50a594e68a9ebeb
Instruction Fuzzy Hash: AB216FB1508340AFC304EF58C885B5BBBF4BB88718F144A1DF44992391E779E945CB93

Uniqueness

Uniqueness Score: -1.00%

Function 10018E0B Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

??0CErrException@@QAE@XZ.MGCOMMON ref: 10018E11
_CxxThrowException.MSVCR71(?,1002A55C), ref: 10018E23
?GetProcessVersion@CUpdateManager@@AAEXXZ.MGUPDATESUPPORT ref: 10018E38

Part of subcall function 10017950: GetModuleHandleW.KERNEL32(00000000,?,00000104), ref: 1001798C
Part of subcall function 10017950: GetModuleFileNameW.KERNEL32(00000000), ref: 10017993
Part of subcall function 10017950: GetFileVersionInfoSizeW.VERSION(?,?), ref: 100179A4
Part of subcall function 10017950: ??0CErrException@@QAE@XZ.MGCOMMON ref: 100179D7
Part of subcall function 10017950: _CxxThrowException.MSVCR71(?,1002A55C), ref: 100179E9
Part of subcall function 10017950: GetFileVersionInfoW.VERSION(00000000,?,00000000,00000000), ref: 100179FB
Part of subcall function 10017950: ??0CErrException@@QAE@XZ.MGCOMMON(00000000,?,00000000,00000000), ref: 10017A07
Part of subcall function 10017950: _CxxThrowException.MSVCR71(?,1002A55C), ref: 10017A16
Part of subcall function 10017950: VerQueryValueW.VERSION(00000000,100274DC,?,?,00000000,?,00000000,00000000), ref: 10017A29
Part of subcall function 10017950: ??0CErrException@@QAE@XZ.MGCOMMON(00000000,100274DC,?,?,00000000,?,00000000,00000000), ref: 10017A35
Part of subcall function 10017950: _CxxThrowException.MSVCR71(?,1002A55C), ref: 10017A44
Part of subcall function 10017950: ??_V@YAXPAX@Z.MSVCR71 ref: 10017A85

?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ.MSVCP71(?), ref: 10018E4A
?CreateIpcQueue@CIPC@@SGHPBDP6GX0PBXK1K@Z@Z.MGHOOKING(00000000), ref: 10018E51

Memory Dump Source

Source File: 00000007.00000002.1895242678.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1895219944.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1895275872.0000000010026000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1895304349.0000000010034000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1895371327.000000001003A000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_SweetIM.jbxd

Similarity

API ID: ExceptionException@@Throw$File$InfoModuleVersion$?c_str@?$basic_string@CreateD@2@@std@@D@std@@HandleManager@@NameProcessQueryQueue@SizeU?$char_traits@UpdateV?$allocator@ValueVersion@
String ID:
API String ID: 1336437505-0
Opcode ID: 10c8f7494c5ce0e2feb62c9e1e5f334fa6c1b2bc1f779cc607e4ee6f8e6b9a85
Instruction ID: 61ad1860af9ae9633a01ffac7cd6628ec7c704f053cd913ee887095c7b2ff9b0
Opcode Fuzzy Hash: 10c8f7494c5ce0e2feb62c9e1e5f334fa6c1b2bc1f779cc607e4ee6f8e6b9a85
Instruction Fuzzy Hash: FDF05E71E50268DFDB11DFA8DC4479DB7F4EB48601F20859BE10AD7650DB349B848B90

Uniqueness

Uniqueness Score: -1.00%

Function 00402A90 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 49COMMON

Download Yara Rule

APIs

AdaptersProxyInitialize.MGADAPTERSPROXY ref: 00402ABC

Strings

-AutoStartIM, xrefs: 00402AA4
AdaptersProxyInitialize() - Failed, GetLastError() of SetWindowsHookEx() = %d, xrefs: 00402AED

Memory Dump Source

Source File: 00000007.00000002.1892750434.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1892725646.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1892779763.0000000000409000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1892803659.000000000040D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1892825887.000000000040E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_SweetIM.jbxd

Similarity

API ID: AdaptersInitializeProxy
String ID: -AutoStartIM$AdaptersProxyInitialize() - Failed, GetLastError() of SetWindowsHookEx() = %d
API String ID: 1156828009-3424845215
Opcode ID: 764e5a2dcc12027edace63a78061153268f7ba7795b2600527ff552bd2ebb632
Instruction ID: a635ecefc97f4f0787df446defdbaf12bc68da4a27cc6cde385b7676d143fc41
Opcode Fuzzy Hash: 764e5a2dcc12027edace63a78061153268f7ba7795b2600527ff552bd2ebb632
Instruction Fuzzy Hash: DA01DB327082041BD320CE6CE9046A7B3D8DBC4724F004A7BEC59D3690E6B6AD1887CA

Uniqueness

Uniqueness Score: -1.00%

Function 004918F0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 32COMMON

Download Yara Rule

APIs

SetWindowsHookExW.USER32(00000005,00491860,?,00000000), ref: 0049190C
GetLastError.KERNEL32 ref: 0049191B
wsprintfW.USER32 ref: 00491940

Strings

SetWindowsHookEx - Failed, GetLastError = %d, xrefs: 0049192F

Memory Dump Source

Source File: 00000007.00000002.1893049999.0000000000491000.00000020.00000001.01000000.00000012.sdmp, Offset: 00490000, based on PE: true

Associated: 00000007.00000002.1893029594.0000000000490000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000007.00000002.1893070082.0000000000494000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000007.00000002.1893089164.0000000000497000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000007.00000002.1893112207.0000000000498000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_490000_SweetIM.jbxd

Similarity

API ID: ErrorHookLastWindowswsprintf
String ID: SetWindowsHookEx - Failed, GetLastError = %d
API String ID: 3389577207-4265691123
Opcode ID: 69b999d261fd1a92cf6cbf85ef633f31b5d0d4cff768b1980a6b033b35d7a42c
Instruction ID: a057d638169343c9c3f288b16c9800cf09aa822eaad5a3055159b6b55a591f7f
Opcode Fuzzy Hash: 69b999d261fd1a92cf6cbf85ef633f31b5d0d4cff768b1980a6b033b35d7a42c
Instruction Fuzzy Hash: 82F08271200304AFD710DB69EC05F277BE8EBD4750F10853ABB158A2E0E7705525C79E

Uniqueness

Uniqueness Score: -1.00%

Function 7C38C70B Relevance: 6.1, APIs: 4, Instructions: 128COMMON

Download Yara Rule

APIs

_lseek.MSVCR71(?,00000000,00000001,?,?), ref: 7C38C72B
_errno.MSVCR71(?,?), ref: 7C38C79D
_lseek.MSVCR71(00000001,00000000,00000002,?,?), ref: 7C38C7F7
_lseek.MSVCR71(00000001,00000080,00000000,?,?,?,?,?), ref: 7C38C829

Memory Dump Source

Source File: 00000007.00000002.1895440500.000000007C361000.00000020.00000001.01000000.00000011.sdmp, Offset: 7C360000, based on PE: true

Associated: 00000007.00000002.1895415267.000000007C360000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000007.00000002.1895478014.000000007C39A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000007.00000002.1895520568.000000007C3AB000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000007.00000002.1895544987.000000007C3AF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000007.00000002.1895571234.000000007C3B0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000007.00000002.1895592086.000000007C3B2000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7c360000_SweetIM.jbxd

Similarity

API ID: _lseek$_errno
String ID:
API String ID: 3764762582-0
Opcode ID: 9e4d2b254a56583694f2a5052af809b1d82a5bf7918e3e3cccbac1524d0bc75e
Instruction ID: ae989d02d8455c962e85c69de6ceb739e6164f37f692b3d680f032f02ddfee20
Opcode Fuzzy Hash: 9e4d2b254a56583694f2a5052af809b1d82a5bf7918e3e3cccbac1524d0bc75e
Instruction Fuzzy Hash: 5841A270A40709AFDB05CF69E980B98BBF4FF013D4F50826DE99A97681D330AA50CF91

Uniqueness

Uniqueness Score: -1.00%

Function 10016A90 Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 10008260: ??0CAutoLock@@QAE@ABVCLockable@@@Z.MGCOMMON(?,00000000,00000000,00000004,00000000,00000000), ref: 10008291
Part of subcall function 10008260: ??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71 ref: 100082B5
Part of subcall function 10008260: ??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71 ref: 100082C1
Part of subcall function 10008260: ??3@YAXPAX@Z.MSVCR71 ref: 100082C8
Part of subcall function 10008260: memmove.MSVCR71 ref: 100082E1
Part of subcall function 10008260: ??1CAutoLock@@QAE@XZ.MGCOMMON ref: 100082FC

??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z.MSVCP71(?,00000000,00000000,00000000,00000004,?,?,?,?,?,?,?,?,00000000,1001D2C5,000000FF), ref: 10016AFC

Part of subcall function 1001A4BE: malloc.MSVCR71 ref: 1001A4D7

??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71(?,?,?,?,?,?,?,?,?,?,00000000,1001D2C5,000000FF,?,10016FE5), ref: 10016B1F
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71(?,?,?,?,?,?,?,?,?,?,00000000,1001D2C5,000000FF,?,10016FE5), ref: 10016B2C
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71(00000000,00000007,00000007,00000000,?,?,?,?,?,?,?,?,?,00000000,1001D2C5,000000FF), ref: 10016B5B

Memory Dump Source

Source File: 00000007.00000002.1895242678.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1895219944.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1895275872.0000000010026000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1895304349.0000000010034000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1895371327.000000001003A000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_SweetIM.jbxd

Similarity

API ID: G@2@@std@@G@std@@U?$char_traits@V?$allocator@$??0?$basic_string@??1?$basic_string@$AutoLock@@$??3@Lockable@@@V01@@mallocmemmove
String ID:
API String ID: 3762477474-0
Opcode ID: 64c80945b6c55ce87e5b9b922149fccd86ba8e8d78e3de74a0510b02389f49b8
Instruction ID: eaba3622c5505e7464329a3f941418a6080a92f1b2f9bf855cd25b862db2d623
Opcode Fuzzy Hash: 64c80945b6c55ce87e5b9b922149fccd86ba8e8d78e3de74a0510b02389f49b8
Instruction Fuzzy Hash: B531BF75905258DBDB10CB98CD85BDEBBB8FF08700F204159E802A7381CB74AE85CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0080DE14 Relevance: 6.1, APIs: 4, Instructions: 77COMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(00000000,0080DEE0,?,00000000,?,0000000F,00000000,00000000,00000000,00000000,00000000,?,0081BFBA,00000000,000000FF,0081C1F0), ref: 0080DE44
OpenFileMappingW.KERNEL32(00000004,00000000,?,00000000,0080DEE0,?,00000000,?,0000000F,00000000,00000000,00000000,00000000,00000000,?,0081BFBA), ref: 0080DE88
OpenFileMappingW.KERNEL32(00000004,00000000,00000000,00000004,00000000,?,00000000,0080DEE0,?,00000000,?,0000000F,00000000,00000000,00000000,00000000), ref: 0080DEB1
OpenFileMappingA.KERNEL32(00000004,00000000,?), ref: 0080DEBE

Memory Dump Source

Source File: 00000007.00000002.1893873243.0000000000801000.00000020.00000001.01000000.00000015.sdmp, Offset: 00800000, based on PE: true

Associated: 00000007.00000002.1893849837.0000000000800000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000007.00000002.1893902337.000000000081F000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000007.00000002.1893926350.0000000000822000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000007.00000002.1893956770.0000000000824000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_800000_SweetIM.jbxd

Similarity

API ID: FileMappingOpen$Version
String ID:
API String ID: 1612670014-0
Opcode ID: 4cc0e5d198d3ca8e71087f42287312e629ea95cb56b5a008b9b565d91e215e5b
Instruction ID: bb1deda32f8c614c2e4b40eb455e622d85d4f0560fc8710b79f0205e204436d8
Opcode Fuzzy Hash: 4cc0e5d198d3ca8e71087f42287312e629ea95cb56b5a008b9b565d91e215e5b
Instruction Fuzzy Hash: B62196716007096FD751EAD8CC41BBF73B9FB58310F505454F900EB2C2DA74AD018A72

Uniqueness

Uniqueness Score: -1.00%

Function 007B7BE0 Relevance: 6.1, APIs: 4, Instructions: 74registryCOMMON

Download Yara Rule

APIs

?RearrangeSubkeyAndName@CRegistrySupp@@AAEXAAPBG0PAG@Z.MGCOMMON(?,?,?), ref: 007B7C01

Part of subcall function 007B6E30: _FindLastBackslash@4.MGCOMMON ref: 007B6E62
Part of subcall function 007B6E30: lstrcpyW.KERNEL32(?,00000000), ref: 007B6E75

?CreateOrOpenKey@CRegistrySupp@@AAEHPBG0HPAPAUHKEY__@@@Z.MGCOMMON ref: 007B7C2D
RegQueryValueExW.KERNEL32 ref: 007B7C75
RegCloseKey.ADVAPI32 ref: 007B7C82

Memory Dump Source

Source File: 00000007.00000002.1893726370.00000000007B1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000007.00000002.1893698679.00000000007B0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.1893761079.00000000007D7000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.1893806747.00000000007EC000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.1893827050.00000000007ED000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7b0000_SweetIM.jbxd

Similarity

API ID: RegistrySupp@@$Backslash@4CloseCreateFindKey@LastName@OpenQueryRearrangeSubkeyValueY__@@@lstrcpy
String ID:
API String ID: 3722663467-0
Opcode ID: b8d7fb4b01fc809d2e6ad27ac22f31f88260f7303bf08b24607bb0b9cb4aa918
Instruction ID: d111c2054621fd63070c35c45bdec709457495e2364716153df270874635304a
Opcode Fuzzy Hash: b8d7fb4b01fc809d2e6ad27ac22f31f88260f7303bf08b24607bb0b9cb4aa918
Instruction Fuzzy Hash: 7D213372109200AED329DF55D884FEBB7E8AFD4720F14891EE59997180E674A908C7B2

Uniqueness

Uniqueness Score: -1.00%

Function 0081D564 Relevance: 6.1, APIs: 4, Instructions: 72fileCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,?,?,00000000,0081D641,?,?,00000000,00000000,00000000,00000000,?,0081D6FA,00000000,0081DB46), ref: 0081D5AD
CreateFileMappingA.KERNEL32(000000FF,00000000,00000004,00000000,00000004,00000000), ref: 0081D5E1
MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00000000,?,?,?,?,00000000,0081D641,?,?,00000000,00000000,00000000), ref: 0081D5F4
CloseHandle.KERNEL32(00000000,00000000,000F001F,00000000,00000000,00000000,?,?,?,?,00000000,0081D641,?,?,00000000,00000000), ref: 0081D608

Memory Dump Source

Source File: 00000007.00000002.1893873243.0000000000801000.00000020.00000001.01000000.00000015.sdmp, Offset: 00800000, based on PE: true

Associated: 00000007.00000002.1893849837.0000000000800000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000007.00000002.1893902337.000000000081F000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000007.00000002.1893926350.0000000000822000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000007.00000002.1893956770.0000000000824000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_800000_SweetIM.jbxd

Similarity

API ID: File$CloseCreateCurrentHandleMappingProcessView
String ID:
API String ID: 3100119383-0
Opcode ID: ba99e7a2a2ca92807d2335fef6404b29269b90482f254520d138419861641517
Instruction ID: 994aef2aa5f962aca41da54a657ebd645b5e3c5e9f623e51049ee2f2642955f0
Opcode Fuzzy Hash: ba99e7a2a2ca92807d2335fef6404b29269b90482f254520d138419861641517
Instruction Fuzzy Hash: 2B21A870600309BFFB20EBA8DC43FABB7BCFB44714F504524B204E66D2D6B46955DA66

Uniqueness

Uniqueness Score: -1.00%

Function 7C384356 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

_errno.MSVCR71(7C3A1F68,0000000C), ref: 7C3843B5
__doserrno.MSVCR71(7C3A1F68,0000000C), ref: 7C3843C0

Part of subcall function 7C384179: ReadFile.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000003), ref: 7C3841F3
Part of subcall function 7C384179: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,7C3A1F20,00000014,7C3823CC,?,00000302,?), ref: 7C3841FD
Part of subcall function 7C384179: _errno.MSVCR71(?,?,?,?,?,?,?,?,?,7C3A1F20,00000014,7C3823CC,?,00000302,?), ref: 7C38420A
Part of subcall function 7C384179: __doserrno.MSVCR71(?,?,?,?,?,?,?,?,?,7C3A1F20,00000014,7C3823CC,?,00000302,?), ref: 7C384215

_errno.MSVCR71(7C3A1F68,0000000C), ref: 7C3843E5
__doserrno.MSVCR71(7C3A1F68,0000000C), ref: 7C3843F0

Part of subcall function 7C3746D7: _lock.MSVCR71(0000000A,7C3A0C88,00000008,7C3740C9,?,7C3A0C38,0000000C,7C369A22,?,?,00000001), ref: 7C374706
Part of subcall function 7C3746D7: _local_unwind2.MSVCR71(?,000000FF,7C3A0C88,00000008,7C3740C9,?,7C3A0C38,0000000C,7C369A22,?,?,00000001), ref: 7C37472E

Memory Dump Source

Source File: 00000007.00000002.1895440500.000000007C361000.00000020.00000001.01000000.00000011.sdmp, Offset: 7C360000, based on PE: true

Associated: 00000007.00000002.1895415267.000000007C360000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000007.00000002.1895478014.000000007C39A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000007.00000002.1895520568.000000007C3AB000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000007.00000002.1895544987.000000007C3AF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000007.00000002.1895571234.000000007C3B0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000007.00000002.1895592086.000000007C3B2000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7c360000_SweetIM.jbxd

Similarity

API ID: __doserrno_errno$ErrorFileLastRead_local_unwind2_lock
String ID:
API String ID: 1011281286-0
Opcode ID: 60609bc6c197bcd2b46d7d217f9beaa98c87fd315a29ce301568015a8b96fb09
Instruction ID: 22a18035754ed2d806a8aff91acd7f1aad0ff63dca6f3032464829d567f540f8
Opcode Fuzzy Hash: 60609bc6c197bcd2b46d7d217f9beaa98c87fd315a29ce301568015a8b96fb09
Instruction Fuzzy Hash: 5D110471940245DFEB01CFA8CC50B9C3BB4AF01398F114648E9726B9D1C7BA892ACF72

Uniqueness

Uniqueness Score: -1.00%

Function 7C37433B Relevance: 6.0, APIs: 4, Instructions: 43COMMON

Download Yara Rule

APIs

_get_osfhandle.MSVCR71(?,?,7C374406,?,?,?,7C3A0C68,0000000C,7C369A07,?,00000000,00000002), ref: 7C374341
_errno.MSVCR71(?,7C374406,?,?,?,7C3A0C68,0000000C,7C369A07,?,00000000,00000002), ref: 7C37434C
SetFilePointer.KERNEL32(00000000,?,00000000,?,?,?,7C374406,?,?,?,7C3A0C68,0000000C,7C369A07,?,00000000,00000002), ref: 7C374368
GetLastError.KERNEL32(?,?,7C374406,?,?,?,7C3A0C68,0000000C,7C369A07,?,00000000,00000002), ref: 7C374375

Memory Dump Source

Source File: 00000007.00000002.1895440500.000000007C361000.00000020.00000001.01000000.00000011.sdmp, Offset: 7C360000, based on PE: true

Associated: 00000007.00000002.1895415267.000000007C360000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000007.00000002.1895478014.000000007C39A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000007.00000002.1895520568.000000007C3AB000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000007.00000002.1895544987.000000007C3AF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000007.00000002.1895571234.000000007C3B0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000007.00000002.1895592086.000000007C3B2000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7c360000_SweetIM.jbxd

Similarity

API ID: ErrorFileLastPointer_errno_get_osfhandle
String ID:
API String ID: 4041642613-0
Opcode ID: 8f583592e29caf2eae9a4b26b58bc0b04bfbf2490d77a1c985dee1900b02a0cc
Instruction ID: c00f4e336965c5ff4b5ba158474134d273a8ec06fa1558c6d0d55d8bc0df2643
Opcode Fuzzy Hash: 8f583592e29caf2eae9a4b26b58bc0b04bfbf2490d77a1c985dee1900b02a0cc
Instruction Fuzzy Hash: AD01F4323041105BEA024F7DAC8468A377D9B823B4B210B49F5B2DB2E0DB35E8219E61

Uniqueness

Uniqueness Score: -1.00%

Function 00807994 Relevance: 4.7, APIs: 3, Instructions: 161filelibrarystringCOMMON

Download Yara Rule

APIs

Part of subcall function 008076D4: IsBadReadPtr.KERNEL32(00000000,00000002,00000000,0080771C,?,00000000,00000004,00000000,?,008079BA,00000000,00000004,00000000), ref: 008076F1

lstrcmpA.KERNEL32(00000000,?,00000000,00000004,00000000), ref: 00807A22
UnmapViewOfFile.KERNEL32(00000000,?,00000000,?,00000000,00000004,00000000), ref: 00807B2C
GetProcAddress.KERNEL32(00000000,?), ref: 00807B6E

Memory Dump Source

Source File: 00000007.00000002.1893873243.0000000000801000.00000020.00000001.01000000.00000015.sdmp, Offset: 00800000, based on PE: true

Associated: 00000007.00000002.1893849837.0000000000800000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000007.00000002.1893902337.000000000081F000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000007.00000002.1893926350.0000000000822000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000007.00000002.1893956770.0000000000824000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_800000_SweetIM.jbxd

Similarity

API ID: AddressFileProcReadUnmapViewlstrcmp
String ID:
API String ID: 3248418922-0
Opcode ID: 3fce470cc9f86ec5638dec8ac524dac28923e9fe1ff25d55473a07d1569caf15
Instruction ID: 353c8b8ebe9e1fba189f1022662b1e54dd4c795322b3d101a154fc0b878f6902
Opcode Fuzzy Hash: 3fce470cc9f86ec5638dec8ac524dac28923e9fe1ff25d55473a07d1569caf15
Instruction Fuzzy Hash: EC61E071E08219DFCBA0DFA8C985A9EB7F5FF18310F2445A5E801E7291D730AE44DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 7C3638E2 Relevance: 4.6, APIs: 3, Instructions: 92COMMON

Download Yara Rule

APIs

_global_unwind2.MSVCR71(?), ref: 7C363952
_local_unwind2.MSVCR71(?,?), ref: 7C36395F
_local_unwind2.MSVCR71(?,000000FF), ref: 7C3639B2

Memory Dump Source

Source File: 00000007.00000002.1895440500.000000007C361000.00000020.00000001.01000000.00000011.sdmp, Offset: 7C360000, based on PE: true

Associated: 00000007.00000002.1895415267.000000007C360000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000007.00000002.1895478014.000000007C39A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000007.00000002.1895520568.000000007C3AB000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000007.00000002.1895544987.000000007C3AF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000007.00000002.1895571234.000000007C3B0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000007.00000002.1895592086.000000007C3B2000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7c360000_SweetIM.jbxd

Similarity

API ID: _local_unwind2$_global_unwind2
String ID:
API String ID: 3251452985-0
Opcode ID: 840838da444c96539f220dfa40b0300418cfe70cfbaa9180f276c1b9ac0a05ed
Instruction ID: e57afbc53cecc80e8be334ad31aede892a41de38939606e8a2082a98cbd7957b
Opcode Fuzzy Hash: 840838da444c96539f220dfa40b0300418cfe70cfbaa9180f276c1b9ac0a05ed
Instruction Fuzzy Hash: CC31E8725002089BC740DF69CC80AAAB7E4FF443A0F058569EC5BAB688D735F919CFE1

Uniqueness

Uniqueness Score: -1.00%

Function 007B9F30 Relevance: 4.6, APIs: 3, Instructions: 69registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.KERNEL32(?,?,?,?,00000000,00000000,00000000,?), ref: 007B9FA1
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(?,?,?,?,00000000,00000000,00000000,?), ref: 007B9FC0
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71(?,00000001,?,?,?,?,00000000,00000000,00000000,?), ref: 007B9FE3

Memory Dump Source

Source File: 00000007.00000002.1893726370.00000000007B1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000007.00000002.1893698679.00000000007B0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.1893761079.00000000007D7000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.1893806747.00000000007EC000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.1893827050.00000000007ED000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7b0000_SweetIM.jbxd

Similarity

API ID: G@2@@std@@G@std@@U?$char_traits@V?$allocator@$??0?$basic_string@??1?$basic_string@Enum
String ID:
API String ID: 963253744-0
Opcode ID: dcbdfa11a1806f215c108c5800c788fe7ca9df0b08a3200f4e70b47c09bb3917
Instruction ID: b3bcec8a903da7e4ef794f20d07a99732623ef4adf7da9975f1eb5e0e5999454
Opcode Fuzzy Hash: dcbdfa11a1806f215c108c5800c788fe7ca9df0b08a3200f4e70b47c09bb3917
Instruction Fuzzy Hash: 01217171904209EFDB14CF99DC84BEEBBB8FB49710F108169B619E32D0D7746A44CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 7C36279A Relevance: 4.6, APIs: 3, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,7C370E09,7C39A3C0,00000010,7C36280C,000000E0,7C362829,7C370E09,7C36B104,00000018,7C39F610,00000008,7C368A34,7C370E09,?), ref: 7C3627DE
_lock.MSVCR71(00000004,7C39A3C0,00000010,7C36280C,000000E0,7C362829,7C370E09,7C36B104,00000018,7C39F610,00000008,7C368A34,7C370E09,?,?,7C368D70), ref: 7C368BF4
_lock.MSVCR71(00000004,7C39A3C0,00000010,7C36280C,000000E0,7C362829,7C370E09,7C36B104,00000018,7C39F610,00000008,7C368A34,7C370E09,?,?,7C368D70), ref: 7C368C45

Memory Dump Source

Source File: 00000007.00000002.1895440500.000000007C361000.00000020.00000001.01000000.00000011.sdmp, Offset: 7C360000, based on PE: true

Associated: 00000007.00000002.1895415267.000000007C360000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000007.00000002.1895478014.000000007C39A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000007.00000002.1895520568.000000007C3AB000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000007.00000002.1895544987.000000007C3AF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000007.00000002.1895571234.000000007C3B0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000007.00000002.1895592086.000000007C3B2000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7c360000_SweetIM.jbxd

Similarity

API ID: _lock$AllocateHeap
String ID:
API String ID: 2163177545-0
Opcode ID: 22a8413b9185f0dda03ab1ac3f2e7fae2e35115b808d8227ce09d8d66b570a54
Instruction ID: f5fa6ca664a73986fde3ac4d6c8153ec458af31827c4d608bac5f04f41a09370
Opcode Fuzzy Hash: 22a8413b9185f0dda03ab1ac3f2e7fae2e35115b808d8227ce09d8d66b570a54
Instruction Fuzzy Hash: CF110672A42214DBCB10AB74AC41BCCB778BB087E8F214215E8A67B9C8C73659459F97

Uniqueness

Uniqueness Score: -1.00%

Function 004027CC Relevance: 4.6, APIs: 3, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 00407C70: malloc.MSVCR71 ref: 00407C89

??0CUpdateManager@@QAE@XZ.MGUPDATESUPPORT ref: 004027FA
??0CUpdateAgent@@QAE@XZ.MGUPDATESUPPORT ref: 00402847
?start@CUpdateAgent@@QAEXXZ.MGUPDATESUPPORT ref: 0040285C

Memory Dump Source

Source File: 00000007.00000002.1892750434.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1892725646.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1892779763.0000000000409000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1892803659.000000000040D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1892825887.000000000040E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_SweetIM.jbxd

Similarity

API ID: Update$Agent@@$?start@Manager@@malloc
String ID:
API String ID: 2166456603-0
Opcode ID: dccc471687cc8cb5cb6bca3a90258d5caa46a047543604452ae7a15652855d8a
Instruction ID: 07ec44a7026ee5907f27cf8dbff873d518ab2f4fde9723369802e389e3d447fe
Opcode Fuzzy Hash: dccc471687cc8cb5cb6bca3a90258d5caa46a047543604452ae7a15652855d8a
Instruction Fuzzy Hash: F411AFB1A04384CBEB11DF95864876EFBE0AB44304F18867ED14A6B3C1C7F95E00DB45

Uniqueness

Uniqueness Score: -1.00%

Function 0081E39C Relevance: 4.5, APIs: 3, Instructions: 30COMMON

Download Yara Rule

APIs

GetVersion.KERNEL32 ref: 0081E3AD
GetNativeSystemInfo.KERNEL32 ref: 0081E3DD
SetLastError.KERNEL32(00000000), ref: 0081E401

Part of subcall function 0081E15C: GetCurrentProcess.KERNEL32(00000028,?,00000000,0081E332), ref: 0081E184
Part of subcall function 0081E15C: OpenProcessToken.ADVAPI32(00000000,00000028,?,00000000,0081E332), ref: 0081E18A
Part of subcall function 0081E15C: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,00000000,?,00000000,0081E310,?,00000000,00000028,?,00000000,0081E332), ref: 0081E1B8
Part of subcall function 0081E15C: LocalAlloc.KERNEL32(00000040,00000000,?,TokenIntegrityLevel,00000000,00000000,?,00000000,0081E310,?,00000000,00000028,?,00000000,0081E332), ref: 0081E1CF
Part of subcall function 0081E15C: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,00000000,00000000,00000040,00000000,?,TokenIntegrityLevel,00000000,00000000,?,00000000,0081E310,?,00000000), ref: 0081E1E7
Part of subcall function 0081E15C: LookupPrivilegeValueA.ADVAPI32(00000000,00000000,?), ref: 0081E210
Part of subcall function 0081E15C: LookupPrivilegeValueA.ADVAPI32(00000000,00000000,?), ref: 0081E243
Part of subcall function 0081E15C: LookupPrivilegeValueA.ADVAPI32(00000000,00000000,?), ref: 0081E276

Memory Dump Source

Source File: 00000007.00000002.1893873243.0000000000801000.00000020.00000001.01000000.00000015.sdmp, Offset: 00800000, based on PE: true

Associated: 00000007.00000002.1893849837.0000000000800000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000007.00000002.1893902337.000000000081F000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000007.00000002.1893926350.0000000000822000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000007.00000002.1893956770.0000000000824000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_800000_SweetIM.jbxd

Similarity

API ID: LookupPrivilegeTokenValue$InformationProcess$AllocCurrentErrorInfoLastLocalNativeOpenSystemVersion
String ID:
API String ID: 3389662072-0
Opcode ID: f82b6c5d5ac14f4c3f0be27b801aa515aac2012f5c0c890d35c954adbeaad5a3
Instruction ID: 3af3538ec88f05af04359d75390b7972ba9fc595807763b4b43b1fb2217c3987
Opcode Fuzzy Hash: f82b6c5d5ac14f4c3f0be27b801aa515aac2012f5c0c890d35c954adbeaad5a3
Instruction Fuzzy Hash: 97F08C60604B44AEE7A477BC8C8234A32D8FF15310F048060BD48C73E2EBB898C68673

Uniqueness

Uniqueness Score: -1.00%

Function 00485410 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

??0CConfigManager@@IAE@XZ.MGCONFIG(?,0048614E,000000FF), ref: 00485447

Part of subcall function 00485060: ??0CCriticalSec@@QAE@XZ.MGCOMMON ref: 004850CF
Part of subcall function 00485060: ??0CRegistrySupp@@QAE@PAUHKEY__@@@Z.MGCOMMON ref: 004850EC
Part of subcall function 00485060: ?GetRegValue@CRegistrySupp@@QAEKPAGPBG11@Z.MGCOMMON(?,021E0000,021E0000,00000000), ref: 00485137
Part of subcall function 00485060: ??0CRegistrySupp@@QAE@PAUHKEY__@@@Z.MGCOMMON(80000001), ref: 0048514D
Part of subcall function 00485060: ?GetRegValue@CRegistrySupp@@QAEKPAGPBG11@Z.MGCOMMON(?,021E0000,021E0000,00000000), ref: 00485196
Part of subcall function 00485060: ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(Could not find installation directory.,?,?,?,80000002), ref: 004851AA
Part of subcall function 00485060: ??0CErrRuntimeException@@QAE@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z.MGCOMMON(?,?,?,80000002), ref: 004851B4
Part of subcall function 00485060: ??0CErrRuntimeException@@QAE@ABV0@@Z.MGCOMMON(00000000), ref: 004851C7
Part of subcall function 00485060: _CxxThrowException.MSVCR71(?,004883F0), ref: 004851D7

Strings

|uH, xrefs: 0048543A, 0048545C

Memory Dump Source

Source File: 00000007.00000002.1892930100.0000000000481000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00480000, based on PE: true

Associated: 00000007.00000002.1892906598.0000000000480000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.1892951827.0000000000487000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.1892982403.000000000048B000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.1893010257.000000000048C000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_480000_SweetIM.jbxd

Similarity

API ID: RegistrySupp@@$Exception@@G11@G@std@@RuntimeU?$char_traits@V?$allocator@Value@Y__@@@$??0?$basic_string@ConfigCriticalExceptionG@2@@std@@G@2@@std@@@Manager@@Sec@@ThrowV0@@V?$basic_string@
String ID: |uH
API String ID: 665615503-2296712247
Opcode ID: 4f7c33b3bf6f59c2e8cd244f8c281a441e1a1fa37dac6ea2d59d533681c03bc1
Instruction ID: 95598061b3ab9fcd4a03f50ddc99088a05a19526db2c9056037f434a08d3595e
Opcode Fuzzy Hash: 4f7c33b3bf6f59c2e8cd244f8c281a441e1a1fa37dac6ea2d59d533681c03bc1
Instruction Fuzzy Hash: 18E0DFB1644A818FC701FB54A91A70C7BA0E301B14FA04FBEE856A3B92C32C4400C78E

Uniqueness

Uniqueness Score: -1.00%

Function 00406520 Relevance: 3.3, APIs: 2, Instructions: 276COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCR71 ref: 004066BC
??3@YAXPAX@Z.MSVCR71 ref: 00406812

Memory Dump Source

Source File: 00000007.00000002.1892750434.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1892725646.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1892779763.0000000000409000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1892803659.000000000040D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1892825887.000000000040E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_SweetIM.jbxd

Similarity

API ID: ??3@
String ID:
API String ID: 613200358-0
Opcode ID: 20cc2aec1de33ffa2700e6245c9a89da73af0b7d225d3a2df294cf70366b035d
Instruction ID: 9036bcffac93ac092c7c4d8a2ca14b54f415b57164b783b688ca5fc7954183eb
Opcode Fuzzy Hash: 20cc2aec1de33ffa2700e6245c9a89da73af0b7d225d3a2df294cf70366b035d
Instruction Fuzzy Hash: 0C91C5B1A00505AFCB18DF6DCD91AAF77E9AF88304B54853EF80AD7385DA34ED118B94

Uniqueness

Uniqueness Score: -1.00%

Function 00804228 Relevance: 3.1, APIs: 2, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1893873243.0000000000801000.00000020.00000001.01000000.00000015.sdmp, Offset: 00800000, based on PE: true

Associated: 00000007.00000002.1893849837.0000000000800000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000007.00000002.1893902337.000000000081F000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000007.00000002.1893926350.0000000000822000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000007.00000002.1893956770.0000000000824000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_800000_SweetIM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e36a70aeee3331114cc88cfcc40f15003538840dbd78ac1a9e5e40d8c4e5e110
Instruction ID: 5b1c95a2d1491f8fd7bf47b2762f589202bae87b08ef1c1b61e9d6d3b3f6c11c
Opcode Fuzzy Hash: e36a70aeee3331114cc88cfcc40f15003538840dbd78ac1a9e5e40d8c4e5e110
Instruction Fuzzy Hash: DB41EFB0A42A00AFDBB4DF68DC947567BE5FB58310F10A069EA04C73D2C7788D85CB69

Uniqueness

Uniqueness Score: -1.00%

Function 7C38C61B Relevance: 3.1, APIs: 2, Instructions: 55COMMON

Download Yara Rule

APIs

_lseek.MSVCR71(?,?,?,?,?,7C38C6D1,?,?,?,7C3A2228,0000000C), ref: 7C38C684
_errno.MSVCR71(?,?,7C38C6D1,?,?,?,7C3A2228,0000000C), ref: 7C38C699

Memory Dump Source

Source File: 00000007.00000002.1895440500.000000007C361000.00000020.00000001.01000000.00000011.sdmp, Offset: 7C360000, based on PE: true

Associated: 00000007.00000002.1895415267.000000007C360000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000007.00000002.1895478014.000000007C39A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000007.00000002.1895520568.000000007C3AB000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000007.00000002.1895544987.000000007C3AF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000007.00000002.1895571234.000000007C3B0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000007.00000002.1895592086.000000007C3B2000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7c360000_SweetIM.jbxd

Similarity

API ID: _errno_lseek
String ID:
API String ID: 3567847678-0
Opcode ID: 22dd8d7425e6015f791353235ccd8cf862658b657609c19c6a7e63bef93ec14a
Instruction ID: 51e22111f5459b364ca15ed4f9150122f28957d27bed5e0cd43ccea13691db1f
Opcode Fuzzy Hash: 22dd8d7425e6015f791353235ccd8cf862658b657609c19c6a7e63bef93ec14a
Instruction Fuzzy Hash: FD0104726057008BC7214A29F840A8A73F59F867F4F245B3DE4FFA22D8D32594069E72

Uniqueness

Uniqueness Score: -1.00%

Function 007B2C70 Relevance: 3.0, APIs: 2, Instructions: 41COMMON

Download Yara Rule

APIs

wcslen.MSVCR71 ref: 007B2CA3
GetFileAttributesW.KERNEL32(?), ref: 007B2CB1

Memory Dump Source

Source File: 00000007.00000002.1893726370.00000000007B1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000007.00000002.1893698679.00000000007B0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.1893761079.00000000007D7000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.1893806747.00000000007EC000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.1893827050.00000000007ED000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7b0000_SweetIM.jbxd

Similarity

API ID: AttributesFilewcslen
String ID:
API String ID: 239758025-0
Opcode ID: 661a14fd1871249cc5450ef8c5a3463cddd27947fd4f1282fb04cf18d845fea0
Instruction ID: b959751b4d5269d44b9d70dd59a5d28b235f073b19daba513c62d3e7d06e8e39
Opcode Fuzzy Hash: 661a14fd1871249cc5450ef8c5a3463cddd27947fd4f1282fb04cf18d845fea0
Instruction Fuzzy Hash: F40144B1E05618ABC7209F1D8C0079EFF78EB80770F10032AE820A33D0E3391902CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00402822 Relevance: 3.0, APIs: 2, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 00407C70: malloc.MSVCR71 ref: 00407C89

??0CUpdateAgent@@QAE@XZ.MGUPDATESUPPORT ref: 00402847
?start@CUpdateAgent@@QAEXXZ.MGUPDATESUPPORT ref: 0040285C
?start@CUpdateAgent@@QAEXXZ.MGUPDATESUPPORT ref: 0040286D

Memory Dump Source

Source File: 00000007.00000002.1892750434.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1892725646.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1892779763.0000000000409000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1892803659.000000000040D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1892825887.000000000040E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_SweetIM.jbxd

Similarity

API ID: Agent@@Update$?start@$malloc
String ID:
API String ID: 3711604974-0
Opcode ID: 6860f806424de4820ec1d4f3d0149429b72c65ca74d2ad400593a77074882282
Instruction ID: 4ad861c48b8bef9e8109e1a5be549c0537fb909fcc574e392edcdd07c383be02
Opcode Fuzzy Hash: 6860f806424de4820ec1d4f3d0149429b72c65ca74d2ad400593a77074882282
Instruction Fuzzy Hash: 2501A271A04384DBEB14CF9995487AEFBF1AB48300F14866EE506AB3D1C7F95E00DB55

Uniqueness

Uniqueness Score: -1.00%

Function 004C2F00 Relevance: 3.0, APIs: 2, Instructions: 34networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,10000000), ref: 004C2F13

Memory Dump Source

Source File: 00000007.00000002.1893316133.00000000004C1000.00000020.00000001.01000000.00000014.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000007.00000002.1893294302.00000000004C0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000007.00000002.1893337601.00000000004C5000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000007.00000002.1893360960.00000000004C9000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4c0000_SweetIM.jbxd

Similarity

API ID: InternetOpen
String ID:
API String ID: 2038078732-0
Opcode ID: 28a23804622b28666c06ede11cc09664b94b5600a997bcd49f9b9a165e695491
Instruction ID: 4073f37b8111b0b43e7b61601a23b0fd57db06ee8ed16dd3a2c192cc1b58daff
Opcode Fuzzy Hash: 28a23804622b28666c06ede11cc09664b94b5600a997bcd49f9b9a165e695491
Instruction Fuzzy Hash: DFF05B756047006BD3B4EB289D45F9777949B50730F10CB1EF179DB2D0C6B4E8458755

Uniqueness

Uniqueness Score: -1.00%

Function 7C371F2C Relevance: 3.0, APIs: 2, Instructions: 30COMMON

Download Yara Rule

APIs

Part of subcall function 7C371F01: free.MSVCR71(?,?,7C371F49,?,?,?,00000001,7C36A2CA,7C3AB638,?,?,?,?,?,?,7C39F1B0), ref: 7C371F14

_close.MSVCR71(?,?,?,?,00000001,7C36A2CA,7C3AB638,?,?,?,?,?,?,7C39F1B0,00000010), ref: 7C371F4C
free.MSVCR71(?), ref: 7C371F65

Memory Dump Source

Source File: 00000007.00000002.1895440500.000000007C361000.00000020.00000001.01000000.00000011.sdmp, Offset: 7C360000, based on PE: true

Associated: 00000007.00000002.1895415267.000000007C360000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000007.00000002.1895478014.000000007C39A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000007.00000002.1895520568.000000007C3AB000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000007.00000002.1895544987.000000007C3AF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000007.00000002.1895571234.000000007C3B0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000007.00000002.1895592086.000000007C3B2000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7c360000_SweetIM.jbxd

Similarity

API ID: free$_close
String ID:
API String ID: 3165389682-0
Opcode ID: d24db8e46b2dbc20ea99f7661e4c9889f443c1254eb1d307aba26b871089547c
Instruction ID: 28c3d6ed4d16b67dd88a9a0183da0ea7715db2ffc8a4366f935a4cc778985e36
Opcode Fuzzy Hash: d24db8e46b2dbc20ea99f7661e4c9889f443c1254eb1d307aba26b871089547c
Instruction Fuzzy Hash: 33F0A033625B0056D7214A3AEC80B8673EA5F822F5F144729E8A9925D4D73EE40B4F92

Uniqueness

Uniqueness Score: -1.00%

Function 7C361FA9 Relevance: 3.0, APIs: 2, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNEL32(00000000,00001000,00000000,7C361989,00000001), ref: 7C361FBA

Part of subcall function 7C361F41: GetEnvironmentVariableA.KERNEL32(__MSVCRT_HEAP_SELECT,?,00001090,?,?,7C361FD2), ref: 7C361F6A

HeapDestroy.KERNEL32 ref: 7C368F57

Memory Dump Source

Source File: 00000007.00000002.1895440500.000000007C361000.00000020.00000001.01000000.00000011.sdmp, Offset: 7C360000, based on PE: true

Associated: 00000007.00000002.1895415267.000000007C360000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000007.00000002.1895478014.000000007C39A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000007.00000002.1895520568.000000007C3AB000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000007.00000002.1895544987.000000007C3AF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000007.00000002.1895571234.000000007C3B0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000007.00000002.1895592086.000000007C3B2000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7c360000_SweetIM.jbxd

Similarity

API ID: Heap$CreateDestroyEnvironmentVariable
String ID:
API String ID: 609028066-0
Opcode ID: 07f45b4a6b0a13c14869e3d109acbb0eea470d5837f5bb70052929cdc5494fa1
Instruction ID: 13116fd24e758ba09abc68237113ac96594dd9083f347b4dbdee030374135db3
Opcode Fuzzy Hash: 07f45b4a6b0a13c14869e3d109acbb0eea470d5837f5bb70052929cdc5494fa1
Instruction Fuzzy Hash: 92E0A07175A200DBCB105B317D0536936B9BB442C1F200835E08AE9998EB22C044AF22

Uniqueness

Uniqueness Score: -1.00%

Function 004028D0 Relevance: 3.0, APIs: 2, Instructions: 11COMMON

Download Yara Rule

APIs

??1CUpdateManager@@UAE@XZ.MGUPDATESUPPORT ref: 004028D3
??3@YAXPAX@Z.MSVCR71 ref: 004028E1

Memory Dump Source

Source File: 00000007.00000002.1892750434.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1892725646.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1892779763.0000000000409000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1892803659.000000000040D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1892825887.000000000040E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_SweetIM.jbxd

Similarity

API ID: ??3@Manager@@Update
String ID:
API String ID: 3736159236-0
Opcode ID: 18432cb54a306e9afee6986c5d3e328aa486b8acaf3e151213a58d3967a05270
Instruction ID: 8b1ab164a86f969a1794e5390112f2949daa7e3d2253644e7128baa9dce5fd26
Opcode Fuzzy Hash: 18432cb54a306e9afee6986c5d3e328aa486b8acaf3e151213a58d3967a05270
Instruction Fuzzy Hash: C9C08CB2A0926003D2516628AC0CBCB6A880F22344F0884BFFA05A1291C6FDCC9083DA

Uniqueness

Uniqueness Score: -1.00%

Function 00802330 Relevance: 2.5, APIs: 2, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00002000,00000001,?,?,?,00802639), ref: 0080235F
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,?,00002000,00000001,?,?,?,00802639), ref: 00802386

Memory Dump Source

Source File: 00000007.00000002.1893873243.0000000000801000.00000020.00000001.01000000.00000015.sdmp, Offset: 00800000, based on PE: true

Associated: 00000007.00000002.1893849837.0000000000800000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000007.00000002.1893902337.000000000081F000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000007.00000002.1893926350.0000000000822000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000007.00000002.1893956770.0000000000824000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_800000_SweetIM.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: c789efb32e03167b79d7def272bb862fa061de039d19d5259a157ba719d9a5b8
Instruction ID: 788650af564a9d2ccbdee50b79cff76a0e864605e3564bffd35be0cc7c0e5cec
Opcode Fuzzy Hash: c789efb32e03167b79d7def272bb862fa061de039d19d5259a157ba719d9a5b8
Instruction Fuzzy Hash: C1F02773B003301BDBA0596D0C89B576984FF46B90F160071FA0CEF3EDD6E59C0146A1

Uniqueness

Uniqueness Score: -1.00%

Function 0081BDF8 Relevance: 1.8, APIs: 1, Instructions: 278fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0080DE14: GetVersion.KERNEL32(00000000,0080DEE0,?,00000000,?,0000000F,00000000,00000000,00000000,00000000,00000000,?,0081BFBA,00000000,000000FF,0081C1F0), ref: 0080DE44
Part of subcall function 0080DE14: OpenFileMappingW.KERNEL32(00000004,00000000,?,00000000,0080DEE0,?,00000000,?,0000000F,00000000,00000000,00000000,00000000,00000000,?,0081BFBA), ref: 0080DE88
Part of subcall function 0080DE14: OpenFileMappingW.KERNEL32(00000004,00000000,00000000,00000004,00000000,?,00000000,0080DEE0,?,00000000,?,0000000F,00000000,00000000,00000000,00000000), ref: 0080DEB1

MapViewOfFile.KERNEL32(00000032,000F001F,00000000,00000000,00000000,00000000,00000000,000000FF,?,00000000,00000000,00000000,?,00000000,000000FF,0081C1F0), ref: 0081C11F

Part of subcall function 0080DE14: OpenFileMappingA.KERNEL32(00000004,00000000,?), ref: 0080DEBE

Memory Dump Source

Source File: 00000007.00000002.1893873243.0000000000801000.00000020.00000001.01000000.00000015.sdmp, Offset: 00800000, based on PE: true

Associated: 00000007.00000002.1893849837.0000000000800000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000007.00000002.1893902337.000000000081F000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000007.00000002.1893926350.0000000000822000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000007.00000002.1893956770.0000000000824000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_800000_SweetIM.jbxd

Similarity

API ID: File$MappingOpen$VersionView
String ID:
API String ID: 1015710088-0
Opcode ID: 4d34e6b979ab733cc2fc0808ff73873023bf7e0194c41b787abb1305df3e5af5
Instruction ID: 4832d1781a81002f17531bff7cd1d2b7d6b1523539942d6f42beb9b1bb6bbbcf
Opcode Fuzzy Hash: 4d34e6b979ab733cc2fc0808ff73873023bf7e0194c41b787abb1305df3e5af5
Instruction Fuzzy Hash: 74B12A70A8020AAFDF50EBA8CC41BCEBBB9FF05304F109525F514E7292D775A956CB16

Uniqueness

Uniqueness Score: -1.00%

Function 7C38D583 Relevance: 1.6, APIs: 1, Instructions: 123COMMON

Download Yara Rule

APIs

_sopen.MSVCR71(?,00000109,?,000001A4,?,?,?,?,?,?,7C38A8E6,?,?,?,00000000,7C3A2060), ref: 7C38D6BA

Memory Dump Source

Source File: 00000007.00000002.1895440500.000000007C361000.00000020.00000001.01000000.00000011.sdmp, Offset: 7C360000, based on PE: true

Associated: 00000007.00000002.1895415267.000000007C360000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000007.00000002.1895478014.000000007C39A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000007.00000002.1895520568.000000007C3AB000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000007.00000002.1895544987.000000007C3AF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000007.00000002.1895571234.000000007C3B0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000007.00000002.1895592086.000000007C3B2000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7c360000_SweetIM.jbxd

Similarity

API ID: _sopen
String ID:
API String ID: 2002574630-0
Opcode ID: ae17608a33d8eb3bbe74b3202ccfe9af79818df2b671252cb975eb5ceb26ff23
Instruction ID: 52863afb6f354f296d0fda0f123a9e33acc562819e19aacc90dca955f9311660
Opcode Fuzzy Hash: ae17608a33d8eb3bbe74b3202ccfe9af79818df2b671252cb975eb5ceb26ff23
Instruction Fuzzy Hash: E43104B1D0110F9ADB059E9585507A97BFAAB413D8FE2427FC9CBA319CD3B085418F31

Uniqueness

Uniqueness Score: -1.00%

Function 7C38A79D Relevance: 1.6, APIs: 1, Instructions: 79COMMON

Download Yara Rule

APIs

_read.MSVCR71(?,?,?,?,7C38C034,?,7C3A2178,0000000C,7C38A78B,7C3AB638), ref: 7C38A7E7

Memory Dump Source

Source File: 00000007.00000002.1895440500.000000007C361000.00000020.00000001.01000000.00000011.sdmp, Offset: 7C360000, based on PE: true

Associated: 00000007.00000002.1895415267.000000007C360000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000007.00000002.1895478014.000000007C39A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000007.00000002.1895520568.000000007C3AB000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000007.00000002.1895544987.000000007C3AF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000007.00000002.1895571234.000000007C3B0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000007.00000002.1895592086.000000007C3B2000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7c360000_SweetIM.jbxd

Similarity

API ID: _read
String ID:
API String ID: 3312595324-0
Opcode ID: b5677d58f5a31d9f073b48dad21e98e0ee95b30f4c3b096d87c39108049e987b
Instruction ID: 64f0fdd3f0d2480ce75ff45e383d4addec2b27fb3d03522300e2f413a1aa7129
Opcode Fuzzy Hash: b5677d58f5a31d9f073b48dad21e98e0ee95b30f4c3b096d87c39108049e987b
Instruction Fuzzy Hash: C8215971404B018FD7268E2AD8507A2BBF1EB413A4B608B1CD8FB86AD0D775E447DFA0

Uniqueness

Uniqueness Score: -1.00%

Function 10013970 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

?agentStartUp@CUpdateAgent@@AAEHXZ.MGUPDATESUPPORT ref: 1001399D

Part of subcall function 10013290: ??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z.MSVCP71 ref: 100132E3
Part of subcall function 10013290: ??0CSerialize@@QAE@H@Z.MGCOMMON ref: 100132F7
Part of subcall function 10013290: ?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ.MSVCP71(00000000), ref: 1001332C
Part of subcall function 10013290: ?SendIpcMessage@CIPC@@SGHPBDPAXK1KKH@Z.MGHOOKING(00000000,1001CD75,?,?,0000141C,0000EA60,00000001), ref: 10013348
Part of subcall function 10013290: ??1CSerialize@@QAE@XZ.MGCOMMON ref: 100133BB

Part of subcall function 1001A4BE: malloc.MSVCR71 ref: 1001A4D7

Part of subcall function 10016DA0: ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(10026550,?,00000000), ref: 10016E35
Part of subcall function 10016DA0: ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(10026550,?,00000000), ref: 10016E51
Part of subcall function 10016DA0: ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(10026550,?,00000000), ref: 10016E7A
Part of subcall function 10016DA0: ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(10026550,?,00000000), ref: 10016E8F
Part of subcall function 10016DA0: ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(10026550,?,00000000), ref: 10016EA4
Part of subcall function 10016DA0: ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(Could not load the configuration data.), ref: 10016F1E
Part of subcall function 10016DA0: ??0CErrException@@QAE@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z.MGCOMMON ref: 10016F27

Memory Dump Source

Source File: 00000007.00000002.1895242678.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1895219944.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1895275872.0000000010026000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1895304349.0000000010034000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1895371327.000000001003A000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_SweetIM.jbxd

Similarity

API ID: U?$char_traits@V?$allocator@$G@std@@$G@2@@std@@$??0?$basic_string@$Serialize@@$??4?$basic_string@?agent?c_str@?$basic_string@Agent@@D@2@@std@@D@std@@Exception@@G@2@@std@@@Message@SendStartUpdateV01@V01@@V?$basic_string@malloc
String ID:
API String ID: 2218469973-0
Opcode ID: 980cf06ca8ba8ccf9e49a1f574d95879d7b842c5280b2da7b0acef1ddb0a4662
Instruction ID: 14849f992c3efe2a7f8de4a9dea91c03c9d46caea02f2262616971c80e3b5544
Opcode Fuzzy Hash: 980cf06ca8ba8ccf9e49a1f574d95879d7b842c5280b2da7b0acef1ddb0a4662
Instruction Fuzzy Hash: 6301D871E446589BD710CF9CD9027AAFBF8EB48620F00457EE51DD7B40D779A9408791

Uniqueness

Uniqueness Score: -1.00%

Function 007B6D50 Relevance: 1.5, APIs: 1, Instructions: 45registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(00000000,?,00000000,00000000,?,007B74AE,00000000,00000000,007B74AE,?,?,00000410), ref: 007B6D7D

Memory Dump Source

Source File: 00000007.00000002.1893726370.00000000007B1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000007.00000002.1893698679.00000000007B0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.1893761079.00000000007D7000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.1893806747.00000000007EC000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.1893827050.00000000007ED000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7b0000_SweetIM.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 8097a128a050d2cfaabe8c455b9f17572086fd4763f572c189d3251bf2983e08
Instruction ID: 3ddb40ef6340830e40941265c1744004dcb4a987fd1ddc4de205314bef1733be
Opcode Fuzzy Hash: 8097a128a050d2cfaabe8c455b9f17572086fd4763f572c189d3251bf2983e08
Instruction Fuzzy Hash: F901E8727082129BDB10CE58D544BABB3F8ABE4710F15881EF691D7294D378EC59CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 00405AA0 Relevance: 1.5, APIs: 1, Instructions: 45registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(00000000,00407AB0,00000000,00000000,?,00000004,00000000,00000004,00407AB0,Version,?,?), ref: 00405ACD

Memory Dump Source

Source File: 00000007.00000002.1892750434.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1892725646.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1892779763.0000000000409000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1892803659.000000000040D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1892825887.000000000040E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_SweetIM.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 8e0f261fb498567f39c6d4113f37a7819510f004cdc1dc57950dd1675264b290
Instruction ID: 83f86776f303fe8b395b8bbf86cdd7155bf2240a641d815e4755e0349b5e69bc
Opcode Fuzzy Hash: 8e0f261fb498567f39c6d4113f37a7819510f004cdc1dc57950dd1675264b290
Instruction Fuzzy Hash: 7D0128326046129BD710CE58D480A6BB3F8EBE8714F11492EF591E7290E374EC46CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00491A80 Relevance: 1.5, APIs: 1, Instructions: 45registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,00000000,00000000,?,?,?,00000000,00000000,00491FC0,Version,?,00000000,?,00000000,00000000), ref: 00491AAD

Memory Dump Source

Source File: 00000007.00000002.1893049999.0000000000491000.00000020.00000001.01000000.00000012.sdmp, Offset: 00490000, based on PE: true

Associated: 00000007.00000002.1893029594.0000000000490000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000007.00000002.1893070082.0000000000494000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000007.00000002.1893089164.0000000000497000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000007.00000002.1893112207.0000000000498000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_490000_SweetIM.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 8a596c7cf5d00e8bc5b6b3cd3369697adf1b85ec8bcafeadb4b3f3e1f87df6ef
Instruction ID: e73892f7694fd8e5d06716c1daf76746e330234f25c752257f2c73b00775e7bd
Opcode Fuzzy Hash: 8a596c7cf5d00e8bc5b6b3cd3369697adf1b85ec8bcafeadb4b3f3e1f87df6ef
Instruction Fuzzy Hash: A40128322056129BDB10CE58D444B6BB7E8EBE5710F11882EF591C72A0D374DC56CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 00491860 Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

CallNextHookEx.USER32(?,?,?,?), ref: 004918B7

Part of subcall function 00491490: GetModuleHandleW.KERNEL32(00000000,?,00001000,?,?,?,?,?,00493260,000000FF,?,00491898,?), ref: 004914FE
Part of subcall function 00491490: GetModuleFileNameW.KERNEL32(00000000,?,?,?,?,?,00493260,000000FF,?,00491898,?), ref: 00491505
Part of subcall function 00491490: GetLongPathNameW.KERNEL32(?,?,00001000), ref: 0049151E
Part of subcall function 00491490: wcscpy.MSVCR71 ref: 00491532
Part of subcall function 00491490: PathStripPathW.SHLWAPI(?), ref: 00491542
Part of subcall function 00491490: _wcsicmp.MSVCR71 ref: 00491554

Memory Dump Source

Source File: 00000007.00000002.1893049999.0000000000491000.00000020.00000001.01000000.00000012.sdmp, Offset: 00490000, based on PE: true

Associated: 00000007.00000002.1893029594.0000000000490000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000007.00000002.1893070082.0000000000494000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000007.00000002.1893089164.0000000000497000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000007.00000002.1893112207.0000000000498000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_490000_SweetIM.jbxd

Similarity

API ID: Path$ModuleName$CallFileHandleHookLongNextStrip_wcsicmpwcscpy
String ID:
API String ID: 4255812956-0
Opcode ID: 6b20648d0740f505ed66f369baf511e2b2772c9aa280548667a373127b82f62d
Instruction ID: 599babb467dfc48929ba05c9f1dd47f5d9f6761790e9bfd1b598fd7d77c0175f
Opcode Fuzzy Hash: 6b20648d0740f505ed66f369baf511e2b2772c9aa280548667a373127b82f62d
Instruction Fuzzy Hash: 94F06DB6A04249ABCB00DF85EC41FABBBA8EB49B64F04463AF81583350C6389910C6A4

Uniqueness

Uniqueness Score: -1.00%

Function 007B2BF0 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?), ref: 007B2C26

Memory Dump Source

Source File: 00000007.00000002.1893726370.00000000007B1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000007.00000002.1893698679.00000000007B0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.1893761079.00000000007D7000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.1893806747.00000000007EC000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.1893827050.00000000007ED000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7b0000_SweetIM.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 1240b07e5da49dd9afbad36eba28adceaa9b93d233de386112f16f3ab4e9de04
Instruction ID: dc7f9fe506eb3090c66aaf9deae35771e14b9ed2201da4041bac9ec991f7b37a
Opcode Fuzzy Hash: 1240b07e5da49dd9afbad36eba28adceaa9b93d233de386112f16f3ab4e9de04
Instruction Fuzzy Hash: 88F04FB1E45668ABC7109F9D9805BAEBB78E705B30F10472AE825A33D1D37919018BE1

Uniqueness

Uniqueness Score: -1.00%

Function 004026BB Relevance: 1.5, APIs: 1, Instructions: 27windowCOMMON

Download Yara Rule

APIs

?MessageBoxInitError@@YAXH@Z.MGCOMMON(000002BC,?,000000FF,0040851E,00000000,0040851E), ref: 004026D4
?getConfigManager@CConfigManager@@SAAAV1@XZ.MGCONFIG(?,000000FF,0040851E,00000000,0040851E), ref: 004026EE
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(SweetIMApplicationConfig), ref: 00402703
?configExists@CConfigManager@@QAE_NV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z.MGCONFIG ref: 0040270B
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(Main.ConfigFiles.SweetIMAppConfigFilePath), ref: 00402722
?getDefaultConfig@CConfigManager@@QAEAAVCConfig@@XZ.MGCONFIG ref: 0040272E
?getPropertyAsStringEx@CConfig@@QAE?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@V23@@Z.MGCONFIG(?), ref: 0040273E
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z.MSVCP71(?), ref: 00402755
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(SweetIMApplicationConfig), ref: 0040276C
?createConfig@CConfigManager@@QAEAAVCConfig@@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@0@Z.MGCONFIG ref: 00402777
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71 ref: 00402784
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(SweetIMApplicationConfig), ref: 00402799
?getConfig@CConfigManager@@QAEAAVCConfig@@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z.MGCONFIG ref: 004027A1
??0CUpdateManager@@QAE@XZ.MGUPDATESUPPORT ref: 004027FA
??0CUpdateAgent@@QAE@XZ.MGUPDATESUPPORT ref: 00402847
?start@CUpdateAgent@@QAEXXZ.MGUPDATESUPPORT ref: 0040285C

Memory Dump Source

Source File: 00000007.00000002.1892750434.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1892725646.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1892779763.0000000000409000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1892803659.000000000040D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1892825887.000000000040E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_SweetIM.jbxd

Similarity

API ID: G@std@@U?$char_traits@V?$allocator@$G@2@@std@@$ConfigManager@@$??0?$basic_string@$?getConfig@@V?$basic_string@$Config@Update$Agent@@G@2@@std@@@$??1?$basic_string@?config?create?start@DefaultError@@Exists@G@2@@std@@0@InitManager@MessagePropertyStringV01@@V23@@
String ID:
API String ID: 2919703622-0
Opcode ID: 3e09662b8f9d7abda28d3bc8487b002bbe48e405478c0be0080882450bba952e
Instruction ID: 855bba300f1d5865086f39b7daf4f7de868962e4c5198bb74001eb2de677687f
Opcode Fuzzy Hash: 3e09662b8f9d7abda28d3bc8487b002bbe48e405478c0be0080882450bba952e
Instruction Fuzzy Hash: ADF0A072A007109FEB20DF959A45BAAF3B0EF54700F00853FE943666C1EBB9A9008A95

Uniqueness

Uniqueness Score: -1.00%

Function 0081E5A8 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(0081E5A8,?,0000001C), ref: 0081E5C2

Memory Dump Source

Source File: 00000007.00000002.1893873243.0000000000801000.00000020.00000001.01000000.00000015.sdmp, Offset: 00800000, based on PE: true

Associated: 00000007.00000002.1893849837.0000000000800000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000007.00000002.1893902337.000000000081F000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000007.00000002.1893926350.0000000000822000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000007.00000002.1893956770.0000000000824000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_800000_SweetIM.jbxd

Similarity

API ID: QueryVirtual
String ID:
API String ID: 1804819252-0
Opcode ID: 3d86a359bb00cfdb19a475807e2018e7970451c54cedac3ece2bafa3af824176
Instruction ID: f73bcba5db688ed957bacf13073f6718d7f7fd1d28def765b07692fa1ac936da
Opcode Fuzzy Hash: 3d86a359bb00cfdb19a475807e2018e7970451c54cedac3ece2bafa3af824176
Instruction Fuzzy Hash: 43F03070940309AEFB308A98DD46BEA7778FB18319F044616EE04D52C0FAB499C08A92

Uniqueness

Uniqueness Score: -1.00%

Function 7C38A8AC Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

Part of subcall function 7C38D461: _lock.MSVCR71(00000001,7C3A2368,00000010,7C38A740,7C3A2050,0000000C), ref: 7C38D476

_errno.MSVCR71(7C3A2060,00000010), ref: 7C38A8C4

Memory Dump Source

Source File: 00000007.00000002.1895440500.000000007C361000.00000020.00000001.01000000.00000011.sdmp, Offset: 7C360000, based on PE: true

Associated: 00000007.00000002.1895415267.000000007C360000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000007.00000002.1895478014.000000007C39A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000007.00000002.1895520568.000000007C3AB000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000007.00000002.1895544987.000000007C3AF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000007.00000002.1895571234.000000007C3B0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000007.00000002.1895592086.000000007C3B2000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7c360000_SweetIM.jbxd

Similarity

API ID: _errno_lock
String ID:
API String ID: 3113008315-0
Opcode ID: c9115a1772648932efd3a1513df5525b6ad9ea7b4df2a7b69912d04c2dbdd84a
Instruction ID: 4fe9d4f54bbfdc30ca8fe13065fd6711ee0e9d8f74c9063263fcab1c44f1a043
Opcode Fuzzy Hash: c9115a1772648932efd3a1513df5525b6ad9ea7b4df2a7b69912d04c2dbdd84a
Instruction Fuzzy Hash: D2F0307194020AABEF419FA4CC006DD7AB4EF04394F504154E961AA1A0DB7A461BAF32

Uniqueness

Uniqueness Score: -1.00%

Function 0081E5F6 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 0081E60F

Memory Dump Source

Source File: 00000007.00000002.1893873243.0000000000801000.00000020.00000001.01000000.00000015.sdmp, Offset: 00800000, based on PE: true

Associated: 00000007.00000002.1893849837.0000000000800000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000007.00000002.1893902337.000000000081F000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000007.00000002.1893926350.0000000000822000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000007.00000002.1893956770.0000000000824000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_800000_SweetIM.jbxd

Similarity

API ID: FileModuleName
String ID:
API String ID: 514040917-0
Opcode ID: 8e2f7bbafe4b02ca50f58190dd8b11f33559603c0045d9966a3acb9b8e73fd96
Instruction ID: 90eb3e630a07bb9206f626a2bf06f97b9e0dbe857e3426e51a94b6b4fbc7e8ca
Opcode Fuzzy Hash: 8e2f7bbafe4b02ca50f58190dd8b11f33559603c0045d9966a3acb9b8e73fd96
Instruction Fuzzy Hash: 21E08C71640208BFE770DB689D4BFA733E8FB28711F404021BA0CDA1D0EAB09990CB95

Uniqueness

Uniqueness Score: -1.00%

Function 0081E5F8 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 0081E60F

Memory Dump Source

Source File: 00000007.00000002.1893873243.0000000000801000.00000020.00000001.01000000.00000015.sdmp, Offset: 00800000, based on PE: true

Associated: 00000007.00000002.1893849837.0000000000800000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000007.00000002.1893902337.000000000081F000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000007.00000002.1893926350.0000000000822000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000007.00000002.1893956770.0000000000824000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_800000_SweetIM.jbxd

Similarity

API ID: FileModuleName
String ID:
API String ID: 514040917-0
Opcode ID: bd4243126e38765bf9fb5036369bfcefcb0a84ecdf15e2ca8cea13079aabfd0d
Instruction ID: baeedeb8dd86e9a836ae5f1972ed6d5f9abfdcf5b9c00d16bff27b3f44e7c024
Opcode Fuzzy Hash: bd4243126e38765bf9fb5036369bfcefcb0a84ecdf15e2ca8cea13079aabfd0d
Instruction Fuzzy Hash: 12E08C71640208AFE770DB689D4BF9733A8FB28711F404021BA0CDA1D0EAB05590CB95

Uniqueness

Uniqueness Score: -1.00%

Function 7C3627FC Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

Part of subcall function 7C36279A: RtlAllocateHeap.NTDLL(00000000,7C370E09,7C39A3C0,00000010,7C36280C,000000E0,7C362829,7C370E09,7C36B104,00000018,7C39F610,00000008,7C368A34,7C370E09,?), ref: 7C3627DE

_callnewh.MSVCR71(000000E0,7C362829,7C370E09,7C36B104,00000018,7C39F610,00000008,7C368A34,7C370E09,?,?,7C368D70,00000004,7C39A2A8,00000010,7C368B62), ref: 7C368C9A

Memory Dump Source

Source File: 00000007.00000002.1895440500.000000007C361000.00000020.00000001.01000000.00000011.sdmp, Offset: 7C360000, based on PE: true

Associated: 00000007.00000002.1895415267.000000007C360000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000007.00000002.1895478014.000000007C39A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000007.00000002.1895520568.000000007C3AB000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000007.00000002.1895544987.000000007C3AF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000007.00000002.1895571234.000000007C3B0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000007.00000002.1895592086.000000007C3B2000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7c360000_SweetIM.jbxd

Similarity

API ID: AllocateHeap_callnewh
String ID:
API String ID: 80760763-0
Opcode ID: 745399c0ba11981261775c86068be182772b10d04a4bb9703cb79ba4fd5c9a85
Instruction ID: 38511ff6aaa0af884bda27a0fa2ceb4e679d65382c2656c121f6b4892d75454e
Opcode Fuzzy Hash: 745399c0ba11981261775c86068be182772b10d04a4bb9703cb79ba4fd5c9a85
Instruction Fuzzy Hash: 49D01234449303E9DB1145218E04D06AEA4AB845D5F12CD3EE4D6B0ADCD737C801AD03

Uniqueness

Uniqueness Score: -1.00%

Function 00801560 Relevance: 1.5, APIs: 1, Instructions: 17threadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 00801588

Memory Dump Source

Source File: 00000007.00000002.1893873243.0000000000801000.00000020.00000001.01000000.00000015.sdmp, Offset: 00800000, based on PE: true

Associated: 00000007.00000002.1893849837.0000000000800000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000007.00000002.1893902337.000000000081F000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000007.00000002.1893926350.0000000000822000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000007.00000002.1893956770.0000000000824000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_800000_SweetIM.jbxd

Similarity

API ID: CallsDisableLibraryThread
String ID:
API String ID: 1446121453-0
Opcode ID: 3ede228c609c2728a5a63e6961a0c10bfcb132ea4aca44ded35c200ef18dae80
Instruction ID: ee5f93db972ff4764abff18739680003e94d63167095b8b37cd63922c8369e88
Opcode Fuzzy Hash: 3ede228c609c2728a5a63e6961a0c10bfcb132ea4aca44ded35c200ef18dae80
Instruction Fuzzy Hash: 42E01239244201E7DB40AB54DC5CF8EB7D4FBB8B62F804455F401C6664C675C890CE21

Uniqueness

Uniqueness Score: -1.00%

Function 007B6670 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNEL32(?), ref: 007B6681

Memory Dump Source

Source File: 00000007.00000002.1893726370.00000000007B1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000007.00000002.1893698679.00000000007B0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.1893761079.00000000007D7000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.1893806747.00000000007EC000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.1893827050.00000000007ED000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7b0000_SweetIM.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: de11869011eb8acdff15096e71c2fc1e5d382e18368e9101143655bd0f28b110
Instruction ID: cebd90840399049d2221e89cc0a7535e84e83911e9ece4935f823ee07ede662b
Opcode Fuzzy Hash: de11869011eb8acdff15096e71c2fc1e5d382e18368e9101143655bd0f28b110
Instruction Fuzzy Hash: 10D0C9702093248BD3284F18A5087827BF8AB48B24B01496EA599C3300E7BD9880CB44

Uniqueness

Uniqueness Score: -1.00%

Function 008057E8 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

Part of subcall function 008057C0: TlsGetValue.KERNEL32(00000016), ref: 008057D8
Part of subcall function 008057C0: LocalFree.KERNEL32(00000000,00000016), ref: 008057E2

TlsFree.KERNEL32(00000016), ref: 00805805

Memory Dump Source

Source File: 00000007.00000002.1893873243.0000000000801000.00000020.00000001.01000000.00000015.sdmp, Offset: 00800000, based on PE: true

Associated: 00000007.00000002.1893849837.0000000000800000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000007.00000002.1893902337.000000000081F000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000007.00000002.1893926350.0000000000822000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000007.00000002.1893956770.0000000000824000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_800000_SweetIM.jbxd

Similarity

API ID: Free$LocalValue
String ID:
API String ID: 2967491550-0
Opcode ID: 25c0eadd4cc46b6db8ad84ab2819757877099a134549d549b5c2c0f0e6e3446a
Instruction ID: da660ce092d3ac546f20fda3f7a32b2020cf7431d17b657fcd82ae890247de45
Opcode Fuzzy Hash: 25c0eadd4cc46b6db8ad84ab2819757877099a134549d549b5c2c0f0e6e3446a
Instruction Fuzzy Hash: 6AC00220501F02D6DEE866799C1961721A4F700361B84D224A864C65E1DA248806DE36

Uniqueness

Uniqueness Score: -1.00%

Function 7C38A908 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

_fsopen.MSVCR71(?,?,00000040), ref: 7C38A912

Part of subcall function 7C38A8AC: _errno.MSVCR71(7C3A2060,00000010), ref: 7C38A8C4

Memory Dump Source

Source File: 00000007.00000002.1895440500.000000007C361000.00000020.00000001.01000000.00000011.sdmp, Offset: 7C360000, based on PE: true

Associated: 00000007.00000002.1895415267.000000007C360000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000007.00000002.1895478014.000000007C39A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000007.00000002.1895520568.000000007C3AB000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000007.00000002.1895544987.000000007C3AF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000007.00000002.1895571234.000000007C3B0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000007.00000002.1895592086.000000007C3B2000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7c360000_SweetIM.jbxd

Similarity

API ID: _errno_fsopen
String ID:
API String ID: 1754356438-0
Opcode ID: b52c794c3ab0d6e557bf0c9c473430f4865f9d02b10283d8a710e779f6884698
Instruction ID: c3e19978cce0290401abbd6b92cfe885c06f69ce2024db3d8ccc3609f78541a3
Opcode Fuzzy Hash: b52c794c3ab0d6e557bf0c9c473430f4865f9d02b10283d8a710e779f6884698
Instruction Fuzzy Hash: 9FB012B54442007EDE010640AC01B097B916B80720FD0C414B76C100609237912E9A17

Uniqueness

Uniqueness Score: -1.00%

Function 0080240C Relevance: 1.3, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(FFFFFFFF,00000000,00008000), ref: 00802470

Memory Dump Source

Source File: 00000007.00000002.1893873243.0000000000801000.00000020.00000001.01000000.00000015.sdmp, Offset: 00800000, based on PE: true

Associated: 00000007.00000002.1893849837.0000000000800000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000007.00000002.1893902337.000000000081F000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000007.00000002.1893926350.0000000000822000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000007.00000002.1893956770.0000000000824000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_800000_SweetIM.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 0de9f4ad364175af443b93ac24ca2c6a08017ba36ab9d185ca885a07dc02b33b
Instruction ID: 4499e384ce067ac163fa8e75d27d90ef3e4bc8ad17757e8c6a2452607ef80af2
Opcode Fuzzy Hash: 0de9f4ad364175af443b93ac24ca2c6a08017ba36ab9d185ca885a07dc02b33b
Instruction Fuzzy Hash: 5D21E370608B11AFC754DF19CC84A1ABBE1FF84760F14C969E498CB291D3B4E845CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 008024C4 Relevance: 1.3, APIs: 1, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 00802531

Memory Dump Source

Source File: 00000007.00000002.1893873243.0000000000801000.00000020.00000001.01000000.00000015.sdmp, Offset: 00800000, based on PE: true

Associated: 00000007.00000002.1893849837.0000000000800000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000007.00000002.1893902337.000000000081F000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000007.00000002.1893926350.0000000000822000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000007.00000002.1893956770.0000000000824000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_800000_SweetIM.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 996b6ff37b9f5d29cb7a8fe670aca3b3537c09954ebe647a180f1b26cfea522e
Instruction ID: d002dfbe465aa1f02c7e067ad46effdf336e0689cafe5e1fefb90bb3952d55ef
Opcode Fuzzy Hash: 996b6ff37b9f5d29cb7a8fe670aca3b3537c09954ebe647a180f1b26cfea522e
Instruction Fuzzy Hash: 58117C72A047059FC3A0DF29CD84A2ABBE5FBC4764F15C52CE598973A4D670EC408A85

Uniqueness

Uniqueness Score: -1.00%

Function 00802558 Relevance: 1.3, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(00000000,00000000,00004000,?,0000000C,?,?,00003FFF,008027BF), ref: 008025B2

Memory Dump Source

Source File: 00000007.00000002.1893873243.0000000000801000.00000020.00000001.01000000.00000015.sdmp, Offset: 00800000, based on PE: true

Associated: 00000007.00000002.1893849837.0000000000800000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000007.00000002.1893902337.000000000081F000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000007.00000002.1893926350.0000000000822000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000007.00000002.1893956770.0000000000824000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_800000_SweetIM.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: bc1d22e186018a7e539f4ac7b78faa7658dfcc5e2a20c909b6aba189814a2594
Instruction ID: 0e6f2ee3e8a000c1465c40a9d582b97be0c531e60f8729fb7c7f073d16747907
Opcode Fuzzy Hash: bc1d22e186018a7e539f4ac7b78faa7658dfcc5e2a20c909b6aba189814a2594
Instruction Fuzzy Hash: 2C012B726043144FC3909F28DCD8D2A77D4FB88324F15453CDA88D7781E6B6BC058BA4

Uniqueness

Uniqueness Score: -1.00%

Function 0081E315 Relevance: 1.3, APIs: 1, Instructions: 5COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,0081E317,00000000,?,00000000,0081E310,?,00000000,00000028,?,00000000,0081E332), ref: 0081E30A

Memory Dump Source

Source File: 00000007.00000002.1893873243.0000000000801000.00000020.00000001.01000000.00000015.sdmp, Offset: 00800000, based on PE: true

Associated: 00000007.00000002.1893849837.0000000000800000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000007.00000002.1893902337.000000000081F000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000007.00000002.1893926350.0000000000822000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000007.00000002.1893956770.0000000000824000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_800000_SweetIM.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: e803cf65837651f8079f62c4752b33c75ad3991cb06ef12f64c426698b45abb3
Instruction ID: 700bc7c8071e5e8bb151479a9d3934890fdd0436bb51051bf7a9955620f4ee50
Opcode Fuzzy Hash: e803cf65837651f8079f62c4752b33c75ad3991cb06ef12f64c426698b45abb3
Instruction Fuzzy Hash: A5A00279D05508F6EE60F6E8DA5989E666CFE4C3147F008807515D3545C6399A407A21

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 10012050 Relevance: 54.4, APIs: 36, Instructions: 444timeCOMMON

Download Yara Rule

APIs

??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(10026550), ref: 10012097
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z.MSVCP71(?), ref: 10012109
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z.MSVCP71(?), ref: 10012121
?StringCmpi@@YAHABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@0@Z.MGCOMMON(?,?), ref: 10012141
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71 ref: 1001215C
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71 ref: 1001216E
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z.MSVCP71(?), ref: 100121B0
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(10026550), ref: 100121C4
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z.MSVCP71(?), ref: 100121DE
?size@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIXZ.MSVCP71 ref: 100121E7
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71 ref: 10012251

Part of subcall function 10011340: ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z.MSVCP71(10011C73,00000000,?,?,?,?,?,10028B98,1001C968,000000FF,?,10011C73,10028B98,00000001,?), ref: 1001136D

??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(10026550), ref: 10012270
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z.MSVCP71(?), ref: 100122DF
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z.MSVCP71(?), ref: 100122FD
?StringCmpi@@YAHABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@0@Z.MGCOMMON(?,?), ref: 1001231A
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71 ref: 10012333
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71 ref: 10012345
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71 ref: 10012377
??3@YAXPAX@Z.MSVCR71 ref: 10012389
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z.MSVCP71(?), ref: 100123AF
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(10026550), ref: 100123C3
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z.MSVCP71(?), ref: 100123DA
?size@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIXZ.MSVCP71 ref: 100123E3
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71 ref: 1001244D
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z.MSVCP71(?), ref: 1001246F
?size@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIXZ.MSVCP71 ref: 1001247F
?StringCmpi@@YAHABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@0@Z.MGCOMMON(?,?), ref: 10012497
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z.MSVCP71(?), ref: 100124AD
?GetCurrentSystemDateTimeInFileTimeFormat@@YGHAAU_FILETIME@@@Z.MGCOMMON(?), ref: 100124E4
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71 ref: 1001251A
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71 ref: 10012538
??3@YAXPAX@Z.MSVCR71 ref: 10012547
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71 ref: 10012561
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71 ref: 1001257D
??3@YAXPAX@Z.MSVCR71 ref: 1001258C
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71 ref: 100125A9

Memory Dump Source

Source File: 00000007.00000002.1895242678.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1895219944.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1895275872.0000000010026000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1895304349.0000000010034000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1895371327.000000001003A000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_SweetIM.jbxd

Similarity

API ID: G@std@@U?$char_traits@V?$allocator@$G@2@@std@@$??1?$basic_string@$V01@@$??0?$basic_string@$??4?$basic_string@V01@$??3@?size@?$basic_string@Cmpi@@G@2@@std@@0@StringV?$basic_string@$Time$CurrentDateE@@@FileFormat@@System
String ID:
API String ID: 2950825681-0
Opcode ID: a7eb26a074964c3fbd55b5ba09ec97003bfa6e53e633031623fef521a87603b2
Instruction ID: 9edfa680bcc7f28b816e4f70f381903cba7b2abfd989d40d52bc57b8cc29db5f
Opcode Fuzzy Hash: a7eb26a074964c3fbd55b5ba09ec97003bfa6e53e633031623fef521a87603b2
Instruction Fuzzy Hash: AD026CB5E00219DFDB14CFA8C8C4ADEBBB5FF58300F258159E906AB241D770AE95CB61

Uniqueness

Uniqueness Score: -1.00%

Function 1001000B Relevance: 49.7, APIs: 33, Instructions: 208COMMON

Download Yara Rule

APIs

??0CErrException@@QAE@ABV0@@Z.MGCOMMON(?), ref: 10010012
_CxxThrowException.MSVCR71(?,1002A55C), ref: 10010021
??0CXmlNode@@QAE@PAVTiXmlNode@@@Z.MGXML_WRAPPER(00000000), ref: 1001005B
?getDocumentRoot@CXmlDocument@@QAE?AVCXmlNode@@XZ.MGXML_WRAPPER(?), ref: 10010071
?createElement@CXmlDocument@@QAE?AVCXmlNode@@ABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z.MGXML_WRAPPER(?,100384B8), ref: 10010082
?appendChild@CXmlNode@@QAEXABV1@@Z.MGXML_WRAPPER(?), ref: 1001009A
?createAttribute@CXmlDocument@@QAE?AVCXmlNode@@ABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z.MGXML_WRAPPER(?,10038598), ref: 100100B1
?setNodeValue@CXmlNode@@QAEXABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z.MGXML_WRAPPER(?), ref: 100100BD
?setAttributeNode@CXmlNode@@QAEXAAV1@@Z.MGXML_WRAPPER(?), ref: 100100CA
?createAttribute@CXmlDocument@@QAE?AVCXmlNode@@ABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z.MGXML_WRAPPER(?,100385B4), ref: 100100DB
_itow.MSVCR71 ref: 10010104
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(?), ref: 10010113
?setNodeValue@CXmlNode@@QAEXABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z.MGXML_WRAPPER(?), ref: 10010124
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71 ref: 10010131
?setAttributeNode@CXmlNode@@QAEXAAV1@@Z.MGXML_WRAPPER(?), ref: 1001013E
?createAttribute@CXmlDocument@@QAE?AVCXmlNode@@ABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z.MGXML_WRAPPER(?,100385D0), ref: 10010150
_itow.MSVCR71 ref: 10010177
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(?), ref: 10010186
?setNodeValue@CXmlNode@@QAEXABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z.MGXML_WRAPPER(?), ref: 10010197
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71 ref: 100101A4
?setAttributeNode@CXmlNode@@QAEXAAV1@@Z.MGXML_WRAPPER(?), ref: 100101B1
?createAttribute@CXmlDocument@@QAE?AVCXmlNode@@ABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z.MGXML_WRAPPER(?,100385EC), ref: 100101C3
_itow.MSVCR71 ref: 100101EA
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(?), ref: 100101F9
?setNodeValue@CXmlNode@@QAEXABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z.MGXML_WRAPPER(?), ref: 1001020A
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71 ref: 10010217
?setAttributeNode@CXmlNode@@QAEXAAV1@@Z.MGXML_WRAPPER(?), ref: 10010224
?createAttribute@CXmlDocument@@QAE?AVCXmlNode@@ABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z.MGXML_WRAPPER(?,10038608), ref: 10010236
_itow.MSVCR71 ref: 1001025D
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(?), ref: 1001026C
?setNodeValue@CXmlNode@@QAEXABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z.MGXML_WRAPPER(?), ref: 1001027D
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71 ref: 1001028A
?setAttributeNode@CXmlNode@@QAEXAAV1@@Z.MGXML_WRAPPER(?), ref: 10010297

Memory Dump Source

Source File: 00000007.00000002.1895242678.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1895219944.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1895275872.0000000010026000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1895304349.0000000010034000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1895371327.000000001003A000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_SweetIM.jbxd

Similarity

API ID: G@std@@Node@@U?$char_traits@V?$allocator@$G@2@@std@@@V?$basic_string@$?set$G@2@@std@@$Document@@$?createV1@@$AttributeAttribute@NodeNode@Value@$??0?$basic_string@??1?$basic_string@_itow$?append?getChild@DocumentElement@ExceptionException@@Node@@@Root@ThrowV0@@
String ID:
API String ID: 1457951927-0
Opcode ID: 80af54149ae95d943aca99fc643e7456aedbe6139b190b9bf6aac156b0d15db9
Instruction ID: fedcf85131375c788a8d33e27d96af3ea6c5ab7772c0e2443ba0577ea7245a53
Opcode Fuzzy Hash: 80af54149ae95d943aca99fc643e7456aedbe6139b190b9bf6aac156b0d15db9
Instruction Fuzzy Hash: B1813F72900219EFDB05DB94CDD8EEEB779FF58300F204159E60AA7190DB756B0ACB91

Uniqueness

Uniqueness Score: -1.00%

Function 10010030 Relevance: 46.7, APIs: 31, Instructions: 190COMMON

Download Yara Rule

APIs

??0CXmlNode@@QAE@PAVTiXmlNode@@@Z.MGXML_WRAPPER(00000000), ref: 1001005B
?getDocumentRoot@CXmlDocument@@QAE?AVCXmlNode@@XZ.MGXML_WRAPPER(?), ref: 10010071
?createElement@CXmlDocument@@QAE?AVCXmlNode@@ABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z.MGXML_WRAPPER(?,100384B8), ref: 10010082
?appendChild@CXmlNode@@QAEXABV1@@Z.MGXML_WRAPPER(?), ref: 1001009A
?createAttribute@CXmlDocument@@QAE?AVCXmlNode@@ABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z.MGXML_WRAPPER(?,10038598), ref: 100100B1
?setNodeValue@CXmlNode@@QAEXABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z.MGXML_WRAPPER(?), ref: 100100BD
?setAttributeNode@CXmlNode@@QAEXAAV1@@Z.MGXML_WRAPPER(?), ref: 100100CA
?createAttribute@CXmlDocument@@QAE?AVCXmlNode@@ABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z.MGXML_WRAPPER(?,100385B4), ref: 100100DB
_itow.MSVCR71 ref: 10010104
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(?), ref: 10010113
?setNodeValue@CXmlNode@@QAEXABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z.MGXML_WRAPPER(?), ref: 10010124
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71 ref: 10010131
?setAttributeNode@CXmlNode@@QAEXAAV1@@Z.MGXML_WRAPPER(?), ref: 1001013E
?createAttribute@CXmlDocument@@QAE?AVCXmlNode@@ABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z.MGXML_WRAPPER(?,100385D0), ref: 10010150
_itow.MSVCR71 ref: 10010177
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(?), ref: 10010186
?setNodeValue@CXmlNode@@QAEXABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z.MGXML_WRAPPER(?), ref: 10010197
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71 ref: 100101A4
?setAttributeNode@CXmlNode@@QAEXAAV1@@Z.MGXML_WRAPPER(?), ref: 100101B1
?createAttribute@CXmlDocument@@QAE?AVCXmlNode@@ABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z.MGXML_WRAPPER(?,100385EC), ref: 100101C3
_itow.MSVCR71 ref: 100101EA
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(?), ref: 100101F9
?setNodeValue@CXmlNode@@QAEXABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z.MGXML_WRAPPER(?), ref: 1001020A
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71 ref: 10010217
?setAttributeNode@CXmlNode@@QAEXAAV1@@Z.MGXML_WRAPPER(?), ref: 10010224
?createAttribute@CXmlDocument@@QAE?AVCXmlNode@@ABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z.MGXML_WRAPPER(?,10038608), ref: 10010236
_itow.MSVCR71 ref: 1001025D
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(?), ref: 1001026C
?setNodeValue@CXmlNode@@QAEXABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z.MGXML_WRAPPER(?), ref: 1001027D
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71 ref: 1001028A
?setAttributeNode@CXmlNode@@QAEXAAV1@@Z.MGXML_WRAPPER(?), ref: 10010297

Memory Dump Source

Source File: 00000007.00000002.1895242678.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1895219944.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1895275872.0000000010026000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1895304349.0000000010034000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1895371327.000000001003A000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_SweetIM.jbxd

Similarity

API ID: G@std@@Node@@U?$char_traits@V?$allocator@$G@2@@std@@@V?$basic_string@$?set$G@2@@std@@$Document@@$?createV1@@$AttributeAttribute@NodeNode@Value@$??0?$basic_string@??1?$basic_string@_itow$?append?getChild@DocumentElement@Node@@@Root@
String ID:
API String ID: 1720962597-0
Opcode ID: 67279235dc30fc9ad4d293d3941eea66cd6c7f9007e3dccdefa28af3da8a14d2
Instruction ID: b63f62dbe091d9155f456da4124b2b58ca8a67c4609a6d024ebf48f65a63a90b
Opcode Fuzzy Hash: 67279235dc30fc9ad4d293d3941eea66cd6c7f9007e3dccdefa28af3da8a14d2
Instruction Fuzzy Hash: BE813D72900259EFDB05DB94CDD8EEEB779FF58300F104159E60AA7290DB356B0ACB91

Uniqueness

Uniqueness Score: -1.00%

Function 1000A030 Relevance: 43.7, APIs: 29, Instructions: 177windowCOMMON

Download Yara Rule

APIs

Part of subcall function 10009980: GetSystemMetrics.USER32(00000000), ref: 10009991
Part of subcall function 10009980: GetSystemMetrics.USER32(00000001), ref: 10009997
Part of subcall function 10009980: ?CalcWindowNoneClientArea@@YAXPAUHWND__@@AAJ111@Z.MGCOMMON(?,?,?,?,?), ref: 100099C8
Part of subcall function 10009980: MoveWindow.USER32(?,00000000,00000000,?,?,00000001), ref: 10009A03
Part of subcall function 10009980: ?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ.MSVCP71 ref: 10009A08
Part of subcall function 10009980: SetWindowTextW.USER32(?,00000000), ref: 10009A10
Part of subcall function 10009980: GetDlgItem.USER32(?,000003E9), ref: 10009A1C
Part of subcall function 10009980: MoveWindow.USER32(00000000,?,?,?,?,00000001), ref: 10009A35

GetDlgItem.USER32(?,000003EA), ref: 1000A04C
MoveWindow.USER32(00000000,?,?,?,?,00000001), ref: 1000A077
?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ.MSVCP71 ref: 1000A07F
SetWindowTextW.USER32(?,00000000), ref: 1000A08B
GetDlgItem.USER32(?,000003EB), ref: 1000A097
MoveWindow.USER32(00000000,?,?,?,?,00000001), ref: 1000A0BC
?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ.MSVCP71 ref: 1000A0C4
SetWindowTextW.USER32(?,00000000), ref: 1000A0D0
GetDlgItem.USER32(?,000003EC), ref: 1000A0DC
MoveWindow.USER32(00000000,?,?,?,?,00000001), ref: 1000A0FD
GetDlgItem.USER32(?,000003EE), ref: 1000A105
MoveWindow.USER32(00000000,?,?,?,?,00000001), ref: 1000A12A
?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ.MSVCP71 ref: 1000A132
SetWindowTextW.USER32(?,00000000), ref: 1000A13E
GetDlgItem.USER32(?,000003EF), ref: 1000A14A
MoveWindow.USER32(00000000,?,?,?,?,00000001), ref: 1000A16B
GetDlgItem.USER32(?,000003F0), ref: 1000A173
MoveWindow.USER32(00000000,?,?,?,?,00000001), ref: 1000A198
?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ.MSVCP71 ref: 1000A1A0
SetWindowTextW.USER32(?,00000000), ref: 1000A1AC
GetDlgItem.USER32(?,000003F1), ref: 1000A1B8
MoveWindow.USER32(00000000,?,?,?,?,00000001), ref: 1000A1D9
GetDlgItem.USER32(?,000003E8), ref: 1000A1E1
MoveWindow.USER32(00000000,?,?,?,?,00000001), ref: 1000A20E
?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ.MSVCP71 ref: 1000A216
SetWindowTextW.USER32(00000000,00000000), ref: 1000A21E
SetFocus.USER32(00000000), ref: 1000A22F
GetWindowLongW.USER32(00000000,000000F0), ref: 1000A238
SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 1000A247

Memory Dump Source

Source File: 00000007.00000002.1895242678.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1895219944.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1895275872.0000000010026000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1895304349.0000000010034000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1895371327.000000001003A000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_SweetIM.jbxd

Similarity

API ID: Window$Move$Item$?c_str@?$basic_string@G@2@@std@@G@std@@TextU?$char_traits@V?$allocator@$LongMetricsSystem$Area@@CalcClientD__@@FocusJ111@None
String ID:
API String ID: 2009720327-0
Opcode ID: 8bd80772308a214750229a0c08da38e1a5d7c8a131a78b5bae00fab7406263dd
Instruction ID: f0dd9e411d4db66a476a21cdd87e85a00d1eb123b6125c91f6d3f6c7d5985a90
Opcode Fuzzy Hash: 8bd80772308a214750229a0c08da38e1a5d7c8a131a78b5bae00fab7406263dd
Instruction Fuzzy Hash: 6851B971250A00AFE215DBA5CCC5FEBB7EDEB8D701F104A0CF29E93290DA75B8458B65

Uniqueness

Uniqueness Score: -1.00%

Function 10002027 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 96windowCOMMON

Download Yara Rule

APIs

Part of subcall function 10001080: ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71 ref: 100010AA
Part of subcall function 10001080: ??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z.MSVCP71 ref: 100010BF
Part of subcall function 10001080: ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z.MSVCP71(00000000), ref: 100010CC
Part of subcall function 10001080: ??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71 ref: 100010E3

??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71 ref: 1000204F
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z.MSVCP71(?), ref: 10002061
??0CErrMessageFormatException@@QAE@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z.MGCOMMON ref: 1000206D
??0CErrMessageFormatException@@QAE@ABV0@@Z.MGCOMMON(00000000), ref: 1000207E
_CxxThrowException.MSVCR71(?,100298A8), ref: 10002090
??0CXmlNode@@QAE@PAVTiXmlNode@@@Z.MGXML_WRAPPER(00000000), ref: 100020D0
?createElement@CXmlDocument@@QAE?AVCXmlNode@@ABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z.MGXML_WRAPPER(?,10034F18), ref: 100020EB
?appendChild@CXmlNode@@QAEXABV1@@Z.MGXML_WRAPPER(?), ref: 10002103
?createAttribute@CXmlDocument@@QAE?AVCXmlNode@@ABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z.MGXML_WRAPPER(?,10034F34), ref: 10002114
?setNodeValue@CXmlNode@@QAEXABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z.MGXML_WRAPPER ref: 10002121
?setAttributeNode@CXmlNode@@QAEXAAV1@@Z.MGXML_WRAPPER(?), ref: 1000212E

Strings

Could not build the System Info Yahoo Messenger Parameter node: , xrefs: 10002036

Memory Dump Source

Source File: 00000007.00000002.1895242678.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1895219944.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1895275872.0000000010026000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1895304349.0000000010034000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1895371327.000000001003A000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_SweetIM.jbxd

Similarity

API ID: G@std@@U?$char_traits@V?$allocator@$G@2@@std@@Node@@$G@2@@std@@@V?$basic_string@$??0?$basic_string@V01@@$??1?$basic_string@?create?setDocument@@Exception@@FormatMessageV1@@$?appendAttributeAttribute@Child@Element@ExceptionNodeNode@Node@@@ThrowV01@V0@@Value@Y?$basic_string@
String ID: Could not build the System Info Yahoo Messenger Parameter node:
API String ID: 2505361947-2327002077
Opcode ID: 2194b88fcc05521de37789124dc3993ee4caf16909b9977d897b3bc66da714ee
Instruction ID: 1d4b36a032d98257420021c36b1f52e104c1d7e7753213a9d0e4feba005d643c
Opcode Fuzzy Hash: 2194b88fcc05521de37789124dc3993ee4caf16909b9977d897b3bc66da714ee
Instruction Fuzzy Hash: 58315C75900219EFDB04DF94CD88BEEBBB9FB4D310F108159F606A7290DB756A09CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 1000500C Relevance: 18.1, APIs: 12, Instructions: 55windowCOMMON

Download Yara Rule

APIs

??0CErrParseException@@QAE@ABV0@@Z.MGCOMMON(?), ref: 10005016
_CxxThrowException.MSVCR71(?,1002ACE8), ref: 10005028
?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ.MSVCP71 ref: 1000503E
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(00000000), ref: 1000504D
??0CErrMessageFormatException@@QAE@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z.MGCOMMON ref: 10005056
??0CErrMessageFormatException@@QAE@ABV0@@Z.MGCOMMON(00000000), ref: 10005067
_CxxThrowException.MSVCR71(?,100298A8), ref: 10005079
?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ.MSVCP71 ref: 1000508F
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(00000000), ref: 1000509E
??0CErrMessageFormatException@@QAE@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z.MGCOMMON ref: 100050A7
??0CErrMessageFormatException@@QAE@ABV0@@Z.MGCOMMON(00000000), ref: 100050B8
_CxxThrowException.MSVCR71(?,100298A8), ref: 100050CA

Memory Dump Source

Source File: 00000007.00000002.1895242678.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1895219944.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1895275872.0000000010026000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1895304349.0000000010034000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1895371327.000000001003A000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_SweetIM.jbxd

Similarity

API ID: G@std@@U?$char_traits@V?$allocator@$Exception@@$FormatG@2@@std@@Message$ExceptionThrowV0@@$??0?$basic_string@?c_str@?$basic_string@G@2@@std@@@V?$basic_string@$Parse
String ID:
API String ID: 1872964136-0
Opcode ID: dba4ef0f92ecff0974c5d3c0e975e16753c80d24de2fba34acc95da7461db1ee
Instruction ID: c98eaf7b577b07daa217bdbf4299a0579ed61d9cba4ff13fa2c869fe1b12148b
Opcode Fuzzy Hash: dba4ef0f92ecff0974c5d3c0e975e16753c80d24de2fba34acc95da7461db1ee
Instruction Fuzzy Hash: 80213871900159EFDF04EBE4CD889EEBB79EF09300F204588E106A7150DB34AA4ACF61

Uniqueness

Uniqueness Score: -1.00%

Function 10019000 Relevance: 10.5, APIs: 7, Instructions: 29COMMON

Download Yara Rule

APIs

??5CSerialize@@QAEAAV0@AA_N@Z.MGCOMMON(?,?,?,?,?,?,?,10013393,?), ref: 10019020
??5CSerialize@@QAEAAV0@AAH@Z.MGCOMMON ref: 10019028
??5CSerialize@@QAEAAV0@AAG@Z.MGCOMMON ref: 10019030
??5CSerialize@@QAEAAV0@AAG@Z.MGCOMMON ref: 10019038
??5CSerialize@@QAEAAV0@AAG@Z.MGCOMMON ref: 10019040
??5CSerialize@@QAEAAV0@AAG@Z.MGCOMMON ref: 10019048
??5CSerialize@@QAEAAV0@AAH@Z.MGCOMMON ref: 10019050

Memory Dump Source

Source File: 00000007.00000002.1895242678.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1895219944.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1895275872.0000000010026000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1895304349.0000000010034000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1895371327.000000001003A000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_SweetIM.jbxd

Similarity

API ID: Serialize@@
String ID:
API String ID: 2785693652-0
Opcode ID: ed6e9865869f65d037aa0460d8c48853322693eb286e9336815fc8c5ead14f5e
Instruction ID: 1317551fc14855cc103dff6d7ce59a734226e83fef293da8f33a8ae2d92783a6
Opcode Fuzzy Hash: ed6e9865869f65d037aa0460d8c48853322693eb286e9336815fc8c5ead14f5e
Instruction Fuzzy Hash: FAF06D756102509BDF08DFB0CC9C8AA37A9BB9C205320495DF507C7355EA35DA178B90

Uniqueness

Uniqueness Score: -1.00%

Function 1000C050 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 1001A4BE: malloc.MSVCR71 ref: 1001A4D7

wcscpy.MSVCR71 ref: 1000C095

Part of subcall function 1001A4BE: _callnewh.MSVCR71 ref: 1001A4C6
Part of subcall function 1001A4BE: ?_Nomemory@std@@YAXXZ.MSVCP71(?,100012ED,00000048,?,?,1001AA5B,000000FF), ref: 1001A4D0

wcscpy.MSVCR71 ref: 1000C0E8

Strings

IE_ChangeUI, xrefs: 1000C08F
IE_NewWinEnable, xrefs: 1000C0E2

Memory Dump Source

Source File: 00000007.00000002.1895242678.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1895219944.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1895275872.0000000010026000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1895304349.0000000010034000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1895371327.000000001003A000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_SweetIM.jbxd

Similarity

API ID: wcscpy$Nomemory@std@@_callnewhmalloc
String ID: IE_ChangeUI$IE_NewWinEnable
API String ID: 3223004405-1749009674
Opcode ID: 50dae4460c864e17b949f6e1dfb8a67a945918a81b124a36a87f672d75dba132
Instruction ID: 07b73f159b3703d69e43c3e3ddcc6016ff1610b39977a2b52c0307b07f46b7a0
Opcode Fuzzy Hash: 50dae4460c864e17b949f6e1dfb8a67a945918a81b124a36a87f672d75dba132
Instruction Fuzzy Hash: 52216578241A00DFD325DF24C595A12FBE1FF89704B15865CD6564F765C7B5F881CB80

Uniqueness

Uniqueness Score: -1.00%

Function 10009050 Relevance: 6.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

??0CBSCallbackImpl@@QAE@XZ.MGCOMMUNICATION(?,?,00000000,00000000,1001BB1C,000000FF,10015E0C,00000000), ref: 1000906E
??0CCriticalSec@@QAE@XZ.MGCOMMON(?,?,00000000), ref: 10009091
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z.MSVCP71(10026550), ref: 100090A4
??0CDownloadManager@@QAE@XZ.MGCOMMUNICATION ref: 100090C6

Memory Dump Source

Source File: 00000007.00000002.1895242678.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1895219944.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1895275872.0000000010026000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1895304349.0000000010034000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1895371327.000000001003A000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_SweetIM.jbxd

Similarity

API ID: ??0?$basic_string@CallbackCriticalDownloadG@2@@std@@G@std@@Impl@@Manager@@Sec@@U?$char_traits@V?$allocator@
String ID:
API String ID: 2689370638-0
Opcode ID: 0e7aaef2532351052f1cd4c482c69f22b6deda4ef5df211a683a40858a4638e0
Instruction ID: f7c5ed8cdb7070f5ddd4fcc7ab3ab5e2cbe15918a513db49f4932af4a4df9033
Opcode Fuzzy Hash: 0e7aaef2532351052f1cd4c482c69f22b6deda4ef5df211a683a40858a4638e0
Instruction Fuzzy Hash: D5111BB1404B91CFD320CF19D948756FBE8FFA8714F50491EE49683B61C7B8A509CB92

Uniqueness

Uniqueness Score: -1.00%

Function 10001000 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z.MSVCP71 ref: 1000102A
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z.MSVCP71 ref: 1000103F
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z.MSVCP71(00000000), ref: 1000104C
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ.MSVCP71 ref: 10001063

Memory Dump Source

Source File: 00000007.00000002.1895242678.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1895219944.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1895275872.0000000010026000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1895304349.0000000010034000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1895371327.000000001003A000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_SweetIM.jbxd

Similarity

API ID: G@2@@std@@G@std@@U?$char_traits@V?$allocator@$V01@@$??0?$basic_string@$??1?$basic_string@V01@Y?$basic_string@
String ID:
API String ID: 2664418556-0
Opcode ID: 5deae2c6e13679d44fd04fe4cffa3a30a6367b2e8923b51a785a374790a60c47
Instruction ID: 608b8208353776f13999110558d13293388a1ffc8a0242e206466f9f862c3f5a
Opcode Fuzzy Hash: 5deae2c6e13679d44fd04fe4cffa3a30a6367b2e8923b51a785a374790a60c47
Instruction Fuzzy Hash: 4DF01975108250EFD344DB54CD88B5BBBE4FB8C714F408A0DF89A83390C7789949CB52

Uniqueness

Uniqueness Score: -1.00%

Function 10008029 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

??0CErrRuntimeException@@QAE@ABV0@@Z.MGCOMMON(?), ref: 10008046
_CxxThrowException.MSVCR71(?,1002A56C), ref: 10008058
??0CErrRuntimeException@@QAE@XZ.MGCOMMON(?,1002A56C), ref: 10008076
_CxxThrowException.MSVCR71(?,1002A56C), ref: 10008088

Memory Dump Source

Source File: 00000007.00000002.1895242678.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1895219944.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1895275872.0000000010026000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1895304349.0000000010034000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1895371327.000000001003A000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_SweetIM.jbxd

Similarity

API ID: ExceptionException@@RuntimeThrow$V0@@
String ID:
API String ID: 341601282-0
Opcode ID: f3f5412b0a60ecd1272fb7c863a34995c26dc3d9e1dc6563102baffca5629631
Instruction ID: 34be5a7008e3d4b7de4d342594fd57473189df355444438238e7711bf684d744
Opcode Fuzzy Hash: f3f5412b0a60ecd1272fb7c863a34995c26dc3d9e1dc6563102baffca5629631
Instruction Fuzzy Hash: 64F0EC34A0011A8BDB54CBA4CC94AEEB379EF08244F504599A60AAA551DB34EEC6CF61

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report BundleSweetIMSetup.exe

Overview

General Information

Detection

Compliance

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Spreading

Networking

Change of System Appearance

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Config.Msi\48c20b.rbs

C:\Config.Msi\48c20f.rbs

C:\Program Files (x86)\SweetIM\Messenger\ContentPackagesActivationHandler.exe

C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe

C:\Program Files (x86)\SweetIM\Messenger\default.xml

C:\Program Files (x86)\SweetIM\Messenger\mgAdaptersProxy.dll

C:\Program Files (x86)\SweetIM\Messenger\mgArchive.dll

C:\Program Files (x86)\SweetIM\Messenger\mgFlashPlayer.dll

C:\Program Files (x86)\SweetIM\Messenger\mgICQAuto.dll

C:\Program Files (x86)\SweetIM\Messenger\mgICQMessengerAdapter.dll

C:\Program Files (x86)\SweetIM\Messenger\mgMediaPlayer.dll

C:\Program Files (x86)\SweetIM\Messenger\mgMsnAuto.dll

C:\Program Files (x86)\SweetIM\Messenger\mgMsnMessengerAdapter.dll

Windows Analysis Report
BundleSweetIMSetup.exe

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.
Tactics:	Collection
Data Sources:	Logon Session: Logon Session Creation, Process: Process Access, Process: Process Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre