Edit tour

Windows Analysis Report
14OWDrfahJ.exe

Overview

General Information

Sample Name:	14OWDrfahJ.exe
Original Sample Name:	725dbfed269993cb9944c2e1f7bde652.exe
Analysis ID:	1345577
MD5:	725dbfed269993cb9944c2e1f7bde652
SHA1:	7104f1350e38ec3c3ea49154f1bba976572cb271
SHA256:	6db8fff48b37469101d280c3e60463c27ace26ea8076e94e358ae74e49fb46ac
Tags:	exeLummaStealer
Infos:

Detection

PrivateLoader, RedLine, RisePro Stealer, SmokeLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected RedLine Stealer

Yara detected RisePro Stealer

Yara detected SmokeLoader

Antivirus detection for URL or domain

Antivirus detection for dropped file

Snort IDS alert for network traffic

Found malware configuration

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Yara detected PrivateLoader

Tries to steal Mail credentials (via file / registry access)

Found stalling execution ending in API Sleep call

PE file has a writeable .text section

Machine Learning detection for sample

Allocates memory in foreign processes

Injects a PE file into a foreign processes

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

.NET source code contains very large array initializations

Contains functionality to inject code into remote processes

Uses schtasks.exe or at.exe to add and modify task schedules

Tries to harvest and steal browser information (history, passwords, etc)

Writes to foreign memory regions

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Machine Learning detection for dropped file

C2 URLs / IPs found in malware configuration

Contains functionality to inject threads in other processes

Found decision node followed by non-executed suspicious APIs

Drops PE files to the application program directory (C:\ProgramData)

Contains functionality to query locales information (e.g. system language)

May sleep (evasive loops) to hinder dynamic analysis

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Uses code obfuscation techniques (call, push, ret)

Found evasive API chain (date check)

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

Stores files to the Windows start menu directory

JA3 SSL client fingerprint seen in connection with other malware

Contains functionality to dynamically determine API calls

Uses the system / local time for branch decision (may execute only at specific dates)

Contains long sleeps (>= 3 min)

May check the online IP address of the machine

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Drops PE files

Tries to load missing DLLs

Contains functionality to read the PEB

Uses a known web browser user agent for HTTP communication

Found evasive API chain checking for process token information

Creates a start menu entry (Start Menu\Programs\Startup)

Installs a Chrome extension

Creates a process in suspended mode (likely to inject code)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to shutdown / reboot the system

Internet Provider seen in connection with other malware

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

Yara detected Credential Stealer

Contains functionality to call native functions

Found dropped PE file which has not been started or loaded

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

PE file contains executable resources (Code or Archives)

IP address seen in connection with other malware

Enables debug privileges

Queries information about the installed CPU (vendor, model number etc)

AV process strings found (often used to terminate AV products)

Found inlined nop instructions (likely shell or obfuscated code)

PE file does not import any functions

Sample file is different than original file name gathered from version info

PE file contains an invalid checksum

Extensive use of GetProcAddress (often used to hide API calls)

Detected TCP or UDP traffic on non-standard ports

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Uses Microsoft's Enhanced Cryptographic Provider

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64

14OWDrfahJ.exe (PID: 7296 cmdline: C:\Users\user\Desktop\14OWDrfahJ.exe MD5: 725DBFED269993CB9944C2E1F7BDE652)

Ey3OF47.exe (PID: 7312 cmdline: C:\Users\user\AppData\Local\Temp\IXP000.TMP\Ey3OF47.exe MD5: A8089B11ACB5AEB2755B87605CC0365C)

BC5tT98.exe (PID: 7328 cmdline: C:\Users\user\AppData\Local\Temp\IXP001.TMP\BC5tT98.exe MD5: CC54031BCC9F48998C7AE467ACF73422)

2Iu7231.exe (PID: 7344 cmdline: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2Iu7231.exe MD5: EFBF47DBDF08AC3A28C0236D9C0A4C27)

conhost.exe (PID: 7352 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

AppLaunch.exe (PID: 7984 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe MD5: 89D41E1CF478A3D3C2C701A27A5692B2)

3rB05VU.exe (PID: 8008 cmdline: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe MD5: 5158C4F1C895E03E3157643FBA44BF15)

schtasks.exe (PID: 8044 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 8052 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 8092 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 8100 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

rundll32.exe (PID: 7468 cmdline: C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP000.TMP\ MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7600 cmdline: C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP001.TMP\ MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7740 cmdline: C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP002.TMP\ MD5: EF3179D498793BF4234F708D3BE28633)

OfficeTrackerNMP131.exe (PID: 8156 cmdline: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe MD5: 5158C4F1C895E03E3157643FBA44BF15)

OfficeTrackerNMP131.exe (PID: 8172 cmdline: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe MD5: 5158C4F1C895E03E3157643FBA44BF15)

MaxLoonaFest131.exe (PID: 10520 cmdline: "C:\Users\user\AppData\Local\MaxLoonaFest131\MaxLoonaFest131.exe" MD5: 5158C4F1C895E03E3157643FBA44BF15)

MaxLoonaFest131.exe (PID: 10636 cmdline: "C:\Users\user\AppData\Local\MaxLoonaFest131\MaxLoonaFest131.exe" MD5: 5158C4F1C895E03E3157643FBA44BF15)

FANBooster131.exe (PID: 10828 cmdline: "C:\Users\user\AppData\Local\Temp\FANBooster131\FANBooster131.exe" MD5: 5158C4F1C895E03E3157643FBA44BF15)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
PrivateLoader	According to sekoia, PrivateLoader is a modular malware whose main capability is to download and execute one or several payloads. The loader implements anti-analysis techniques, fingerprints the compromised host and reports statistics to its C2 server.	No Attribution	https://any.run/cybersecurity-blog/privateloader-analyzing-the-encryption-and-decryption-of-a-modern-loader/ https://bitsight.com/blog/unveiling-socks5systemz-rise-new-proxy-service-privateloader-and-amadey https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://blog.sekoia.io/traffers-a-deep-dive-into-the-information-stealer-ecosystem https://de.darktrace.com/blog/privateloader-network-based-indicators-of-compromise	https://malpedia.caad.fkie.fraunhofer.de/details/win.privateloader

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/ https://bartblaze.blogspot.com/2021/06/digital-artists-targeted-in-redline.html	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Name	Description	Attribution	Blogpost URLs	Link
SmokeLoader	The SmokeLoader family is a generic backdoor with a range of capabilities which depend on the modules included in any given build of the malware. The malware is delivered in a variety of ways and is broadly associated with criminal activity. The malware frequently tries to hide its C2 activity by generating requests to legitimate sites such as microsoft.com, bing.com, adobe.com, and others. Typically the actual Download returns an HTTP 404 but still contains data in the Response Body.	SMOKY SPIDER	http://security.neurolabs.club/2019/08/smokeloaders-hardcoded-domains-sneaky.html http://security.neurolabs.club/2019/10/dynamic-imports-and-working-around.html http://security.neurolabs.club/2020/04/diffing-malware-samples-using-bindiff.html http://security.neurolabs.club/2020/06/unpacking-smokeloader-and.html https://0xc0decafe.com/2020/12/23/detect-rc4-in-malicious-binaries	https://malpedia.caad.fkie.fraunhofer.de/details/win.smokeloader

Malware Configuration

Threatname: RedLine

{"C2 url": "194.49.94.152:19053", "Bot Id": "horda", "Authorization Header": "0014dde57a94712eabdc7d8099852c2b"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\IXP001.TMP\4eD052Od.exe	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
C:\Users\user\AppData\Local\Temp\IXP000.TMP\5Rp2df8.exe	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\IXP000.TMP\5Rp2df8.exe	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 19 88 44 24 2B 88 44 24 2F B0 C2 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	JoeSecurity_PrivateLoader	Yara detected PrivateLoader	Joe Security
C:\Users\user\AppData\Local\Temp\FANBooster131\FANBooster131.exe	JoeSecurity_PrivateLoader	Yara detected PrivateLoader	Joe Security
C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	JoeSecurity_PrivateLoader	Yara detected PrivateLoader	Joe Security
C:\Users\user\AppData\Local\MaxLoonaFest131\MaxLoonaFest131.exe	JoeSecurity_PrivateLoader	Yara detected PrivateLoader	Joe Security
Click to see the 2 entries

Memory Dumps

Source	Rule	Description	Author
00000011.00000002.2361383370.0000000000BB5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
0000000B.00000002.2372767482.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000000C.00000002.2581262150.0000000000BB1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000003.1636508373.0000000004A9B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PrivateLoader	Yara detected PrivateLoader	Joe Security
00000003.00000002.2216710591.00000000000BF000.00000004.00000001.01000000.00000006.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000003.1633263282.0000000004F58000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000000B.00000002.2373910611.0000000007321000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: AppLaunch.exe PID: 7984	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: AppLaunch.exe PID: 7984	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: 3rB05VU.exe PID: 8008	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: 3rB05VU.exe PID: 8008	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: OfficeTrackerNMP131.exe PID: 8156	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: OfficeTrackerNMP131.exe PID: 8172	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Click to see the 8 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
11.2.AppLaunch.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
3.2.2Iu7231.exe.bf000.1.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
3.2.2Iu7231.exe.bf000.1.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.3.14OWDrfahJ.exe.5046420.0.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.3.14OWDrfahJ.exe.5046420.0.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 19 88 44 24 2B 88 44 24 2F B0 C2 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
3.2.2Iu7231.exe.80000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
17.0.OfficeTrackerNMP131.exe.10000.0.unpack	JoeSecurity_PrivateLoader	Yara detected PrivateLoader	Joe Security
12.2.3rB05VU.exe.7f0000.0.unpack	JoeSecurity_PrivateLoader	Yara detected PrivateLoader	Joe Security
17.2.OfficeTrackerNMP131.exe.10000.0.unpack	JoeSecurity_PrivateLoader	Yara detected PrivateLoader	Joe Security
20.0.MaxLoonaFest131.exe.590000.0.unpack	JoeSecurity_PrivateLoader	Yara detected PrivateLoader	Joe Security
12.0.3rB05VU.exe.7f0000.0.unpack	JoeSecurity_PrivateLoader	Yara detected PrivateLoader	Joe Security
22.0.FANBooster131.exe.830000.0.unpack	JoeSecurity_PrivateLoader	Yara detected PrivateLoader	Joe Security
22.2.FANBooster131.exe.830000.0.unpack	JoeSecurity_PrivateLoader	Yara detected PrivateLoader	Joe Security
2.3.BC5tT98.exe.4aa2540.0.raw.unpack	JoeSecurity_PrivateLoader	Yara detected PrivateLoader	Joe Security
19.0.MaxLoonaFest131.exe.590000.0.unpack	JoeSecurity_PrivateLoader	Yara detected PrivateLoader	Joe Security
20.2.MaxLoonaFest131.exe.590000.0.unpack	JoeSecurity_PrivateLoader	Yara detected PrivateLoader	Joe Security
19.2.MaxLoonaFest131.exe.590000.0.unpack	JoeSecurity_PrivateLoader	Yara detected PrivateLoader	Joe Security
2.3.BC5tT98.exe.4aa2540.0.unpack	JoeSecurity_PrivateLoader	Yara detected PrivateLoader	Joe Security
18.0.OfficeTrackerNMP131.exe.10000.0.unpack	JoeSecurity_PrivateLoader	Yara detected PrivateLoader	Joe Security
18.2.OfficeTrackerNMP131.exe.10000.0.unpack	JoeSecurity_PrivateLoader	Yara detected PrivateLoader	Joe Security
Click to see the 15 entries

Snort Signatures

ET TROJAN [ANY.RUN] RisePro TCP v.0.x (Token) - Source IP: 194.49.94.152 - Destination IP: 192.168.2.4

Timestamp:	194.49.94.152192.168.2.450500497392046266 11/21/23-04:17:53.738836
SID:	2046266
Source Port:	50500
Destination Port:	49739
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP v.0.x (External IP) - Source IP: 194.49.94.152 - Destination IP: 192.168.2.4

Timestamp:	194.49.94.152192.168.2.450500497392046267 11/21/23-04:17:53.938221
SID:	2046267
Source Port:	50500
Destination Port:	49739
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC - Id1Response - Source IP: 194.49.94.152 - Destination IP: 192.168.2.4

Timestamp:	194.49.94.152192.168.2.419053497372043234 11/21/23-04:17:53.161550
SID:	2043234
Source Port:	19053
Destination Port:	49737
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Suspected RisePro TCP Heartbeat Packet - Source IP: 192.168.2.4 - Destination IP: 194.49.94.152

Timestamp:	192.168.2.4194.49.94.15249736505002049060 11/21/23-04:17:52.523115
SID:	2049060
Source Port:	49736
Destination Port:	50500
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP v.0.x (Token) - Source IP: 194.49.94.152 - Destination IP: 192.168.2.4

Timestamp:	194.49.94.152192.168.2.450500497402046266 11/21/23-04:17:53.817185
SID:	2046266
Source Port:	50500
Destination Port:	49740
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP v.0.x (Activity) - Source IP: 192.168.2.4 - Destination IP: 194.49.94.152

Timestamp:	192.168.2.4194.49.94.15249736505002046269 11/21/23-04:17:57.323617
SID:	2046269
Source Port:	49736
Destination Port:	50500
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP v.0.x (Token) - Source IP: 194.49.94.152 - Destination IP: 192.168.2.4

Timestamp:	194.49.94.152192.168.2.450500497362046266 11/21/23-04:17:52.401609
SID:	2046266
Source Port:	50500
Destination Port:	49736
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP v.0.x (Activity) - Source IP: 192.168.2.4 - Destination IP: 194.49.94.152

Timestamp:	192.168.2.4194.49.94.15249739505002046269 11/21/23-04:17:58.568287
SID:	2046269
Source Port:	49739
Destination Port:	50500
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP v.0.x (External IP) - Source IP: 194.49.94.152 - Destination IP: 192.168.2.4

Timestamp:	194.49.94.152192.168.2.450500497362046267 11/21/23-04:17:52.593099
SID:	2046267
Source Port:	50500
Destination Port:	49736
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Redline Stealer TCP CnC Activity - Source IP: 192.168.2.4 - Destination IP: 194.49.94.152

Timestamp:	192.168.2.4194.49.94.15249737190532043231 11/21/23-04:18:06.317470
SID:	2043231
Source Port:	49737
Destination Port:	19053
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP v.0.x (External IP) - Source IP: 194.49.94.152 - Destination IP: 192.168.2.4

Timestamp:	194.49.94.152192.168.2.450500497402046267 11/21/23-04:17:54.018834
SID:	2046267
Source Port:	50500
Destination Port:	49740
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP v.0.x (Token) - Source IP: 194.49.94.152 - Destination IP: 192.168.2.4

Timestamp:	194.49.94.152192.168.2.450500497442046266 11/21/23-04:18:05.978094
SID:	2046266
Source Port:	50500
Destination Port:	49744
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP v.0.x (Token) - Source IP: 194.49.94.152 - Destination IP: 192.168.2.4

Timestamp:	194.49.94.152192.168.2.450500497452046266 11/21/23-04:18:14.273521
SID:	2046266
Source Port:	50500
Destination Port:	49745
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP v.0.x (Token) - Source IP: 194.49.94.152 - Destination IP: 192.168.2.4

Timestamp:	194.49.94.152192.168.2.450500497462046266 11/21/23-04:18:23.010239
SID:	2046266
Source Port:	50500
Destination Port:	49746
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Related (MC-NMF Authorization) - Source IP: 192.168.2.4 - Destination IP: 194.49.94.152

Timestamp:	192.168.2.4194.49.94.15249737190532046045 11/21/23-04:17:52.975741
SID:	2046045
Source Port:	49737
Destination Port:	19053
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP v.0.x (Activity) - Source IP: 192.168.2.4 - Destination IP: 194.49.94.152

Timestamp:	192.168.2.4194.49.94.15249740505002046269 11/21/23-04:18:30.103136
SID:	2046269
Source Port:	49740
Destination Port:	50500
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: 194.49.94.152:19053

Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\BC5tT98.exe	Avira: detection malicious, Label: HEUR/AGEN.1305142
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\Ey3OF47.exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\5Rp2df8.exe	Avira: detection malicious, Label: HEUR/AGEN.1323769
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\4eD052Od.exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2Iu7231.exe	Avira: detection malicious, Label: HEUR/AGEN.1305142

Found malware configuration

Source: 0000000B.00000002.2373910611.0000000007321000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: RedLine {"C2 url": "194.49.94.152:19053", "Bot Id": "horda", "Authorization Header": "0014dde57a94712eabdc7d8099852c2b"}

Multi AV Scanner detection for submitted file

Source: 14OWDrfahJ.exe	ReversingLabs: Detection: 50%
Source: 14OWDrfahJ.exe	Virustotal: Detection: 56%			Perma Link

Antivirus / Scanner detection for submitted sample

Source: 14OWDrfahJ.exe

Avira: detected

Multi AV Scanner detection for domain / URL

Source: 194.49.94.152:19053

Virustotal: Detection: 16%

Perma Link

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Virustotal: Detection: 65%	Perma Link
Source: C:\Users\user\AppData\Local\MaxLoonaFest131\MaxLoonaFest131.exe	Virustotal: Detection: 65%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\FANBooster131\FANBooster131.exe	Virustotal: Detection: 65%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\5Rp2df8.exe	Virustotal: Detection: 66%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\Ey3OF47.exe	Virustotal: Detection: 54%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\4eD052Od.exe	Virustotal: Detection: 62%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\BC5tT98.exe	Virustotal: Detection: 56%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2Iu7231.exe	Virustotal: Detection: 34%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Virustotal: Detection: 65%	Perma Link

Machine Learning detection for sample

Source: 14OWDrfahJ.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\MaxLoonaFest131\MaxLoonaFest131.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\BC5tT98.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\FANBooster131\FANBooster131.exe	Joe Sandbox ML: detected
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\Ey3OF47.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\5Rp2df8.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\4eD052Od.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2Iu7231.exe	Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\14OWDrfahJ.exe	Code function: 0_2_00752F1D GetSystemDirectoryA,LoadLibraryA,GetProcAddress,DecryptFileA,FreeLibrary,SetCurrentDirectoryA,	0_2_00752F1D
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\Ey3OF47.exe	Code function: 1_2_00012F1D GetSystemDirectoryA,LoadLibraryA,GetProcAddress,DecryptFileA,FreeLibrary,SetCurrentDirectoryA,	1_2_00012F1D
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\BC5tT98.exe	Code function: 2_2_00BA2F1D GetSystemDirectoryA,LoadLibraryA,GetProcAddress,DecryptFileA,FreeLibrary,SetCurrentDirectoryA,	2_2_00BA2F1D
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2Iu7231.exe	Code function: 3_2_00081000 KiUserExceptionDispatcher,CryptDestroyKey,CryptDestroyKey,CryptDestroyKey,CryptDestroyKey,CryptDestroyKey,CryptDestroyKey,CryptDestroyKey,CryptDestroyKey,CryptDestroyKey,CryptDestroyKey,CryptDestroyKey,CryptDestroyKey,CryptDestroyKey,CryptDestroyKey,CryptDestroyKey,CryptDestroyKey,CryptDestroyKey,CryptDestroyKey,CryptDestroyKey,CryptDestroyKey,CryptDestroyKey,CryptDestroyKey,	3_2_00081000
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_00811560 CryptUnprotectData,CryptUnprotectData,LocalFree,LocalFree,	12_2_00811560
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_00031560 CryptUnprotectData,CryptUnprotectData,LocalFree,LocalFree,	17_2_00031560

Source: 14OWDrfahJ.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 34.117.59.81:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.59.81:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.59.81:443 -> 192.168.2.4:49742 version: TLS 1.2

Source: 14OWDrfahJ.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb source: 3rB05VU.exe, 0000000C.00000002.2582912924.0000000003E30000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831) source: 3rB05VU.exe, 0000000C.00000002.2582538713.0000000003CAA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831nJM source: 3rB05VU.exe, 0000000C.00000002.2581982519.0000000002F70000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Temp\tempAVSMIf5cNgqvav9.pdb\.m source: 3rB05VU.exe, 0000000C.00000002.2582456554.0000000003BC2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb source: 3rB05VU.exe, 0000000C.00000002.2582147162.0000000003350000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831.31/ source: 3rB05VU.exe, 0000000C.00000002.2582612223.0000000003D54000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831 source: 3rB05VU.exe, 0000000C.00000002.2582538713.0000000003CAA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb*12 source: 3rB05VU.exe, 0000000C.00000002.2582147162.0000000003320000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb** source: 3rB05VU.exe, 0000000C.00000002.2582407905.0000000003B51000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb source: 3rB05VU.exe, 0000000C.00000002.2582147162.0000000003350000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: 3rB05VU.exe, 0000000C.00000002.2582538713.0000000003CAA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: p.pdb source: 3rB05VU.exe, 0000000C.00000002.2582912924.0000000003E30000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Temp\Symbols\winload_prod.pdb?rH source: 3rB05VU.exe, 0000000C.00000002.2582538713.0000000003CAA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: 3rB05VU.exe, 0000000C.00000002.2583112343.0000000003F70000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: 3rB05VU.exe, 0000000C.00000002.2582912924.0000000003E30000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2E source: 3rB05VU.exe, 0000000C.00000002.2583615801.000000000428E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2D source: 3rB05VU.exe, 0000000C.00000002.2583615801.000000000428E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb source: 3rB05VU.exe, 0000000C.00000002.2582612223.0000000003D54000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2tion Data\A source: 3rB05VU.exe, 0000000C.00000002.2582147162.0000000003350000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb source: 3rB05VU.exe, 0000000C.00000002.2581982519.0000000002F70000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: 3rB05VU.exe, 0000000C.00000002.2583154801.0000000003FB2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: 3rB05VU.exe, 0000000C.00000002.2582612223.0000000003D54000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wextract.pdbGCTL source: 14OWDrfahJ.exe, BC5tT98.exe.1.dr, Ey3OF47.exe.0.dr
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbolsntkrnlmp.pdbwW source: 3rB05VU.exe, 0000000C.00000002.2582147162.0000000003350000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb source: 3rB05VU.exe, 0000000C.00000002.2583154801.0000000003FB2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2t source: 3rB05VU.exe, 0000000C.00000002.2582317012.0000000003A30000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb source: 3rB05VU.exe, 0000000C.00000002.2582147162.0000000003350000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2d source: 3rB05VU.exe, 0000000C.00000002.2582912924.0000000003E30000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb.O) source: 3rB05VU.exe, 0000000C.00000002.2583154801.0000000003FB2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\tempAVSgsImjMYlWzR3.pdb%k6 source: 3rB05VU.exe, 0000000C.00000002.2581982519.0000000002F70000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: 3rB05VU.exe, 0000000C.00000002.2582456554.0000000003BC2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb source: 3rB05VU.exe, 0000000C.00000002.2581982519.0000000002F70000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mp.pdb source: 3rB05VU.exe, 0000000C.00000002.2582317012.0000000003A30000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb source: 3rB05VU.exe, 0000000C.00000002.2583706770.0000000004378000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831r source: 3rB05VU.exe, 0000000C.00000002.2583154801.0000000003FB2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2j source: 3rB05VU.exe, 0000000C.00000002.2582147162.0000000003320000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Temp\tempAVSaeI8GhtgT29e.pdb*ta source: 3rB05VU.exe, 0000000C.00000002.2582456554.0000000003BC2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2b source: 3rB05VU.exe, 0000000C.00000002.2581982519.0000000002F70000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb source: 3rB05VU.exe, 0000000C.00000002.2583154801.0000000003FB2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Temp\Symbols\winload_prod.pdb source: OfficeTrackerNMP131.exe, 00000011.00000002.2362816797.0000000003CD0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb source: 3rB05VU.exe, 0000000C.00000002.2582407905.0000000003B51000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: 3rB05VU.exe, 0000000C.00000002.2582147162.0000000003320000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb source: 3rB05VU.exe, 0000000C.00000002.2583475835.0000000004177000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831 source: 3rB05VU.exe, 0000000C.00000002.2581982519.0000000002F70000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831 source: 3rB05VU.exe, 0000000C.00000002.2583749077.00000000043E2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Datarnlmp.pdbr source: 3rB05VU.exe, 0000000C.00000002.2583112343.0000000003F70000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdbe\CXJ source: 3rB05VU.exe, 0000000C.00000002.2581982519.0000000002F70000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\tempAVSaeI8GhtgT29e.pdbA source: 3rB05VU.exe, 0000000C.00000002.2582317012.0000000003A30000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb source: 3rB05VU.exe, 0000000C.00000002.2583706770.0000000004378000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb. source: 3rB05VU.exe, 0000000C.00000002.2582456554.0000000003BC2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb source: 3rB05VU.exe, 0000000C.00000002.2581982519.0000000002F70000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb. source: 3rB05VU.exe, 0000000C.00000002.2583244317.00000000040FC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdbAcrobat source: 3rB05VU.exe, 0000000C.00000002.2582912924.0000000003E30000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2G?; source: 3rB05VU.exe, 0000000C.00000002.2582612223.0000000003D54000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831 source: 3rB05VU.exe, 0000000C.00000002.2583008356.0000000003E96000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb**e\ source: 3rB05VU.exe, 0000000C.00000002.2583706770.0000000004378000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831e\. source: 3rB05VU.exe, 0000000C.00000002.2582612223.0000000003D54000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdbol source: 3rB05VU.exe, 0000000C.00000002.2582317012.0000000003A30000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb source: 3rB05VU.exe, 0000000C.00000002.2582407905.0000000003B51000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdbcrobat\DCa source: 3rB05VU.exe, 0000000C.00000002.2582912924.0000000003E30000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831O source: 3rB05VU.exe, 0000000C.00000002.2582912924.0000000003E30000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831 source: 3rB05VU.exe, 0000000C.00000002.2583154801.0000000003FB2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Temp\Symbols\ntkrnlmp.pdb source: 3rB05VU.exe, 0000000C.00000002.2583749077.00000000043E2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831tate~X source: 3rB05VU.exe, 0000000C.00000002.2582147162.0000000003350000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831 source: 3rB05VU.exe, 0000000C.00000002.2582456554.0000000003BC2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831 source: 3rB05VU.exe, 0000000C.00000002.2582147162.0000000003350000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\\.@\ source: OfficeTrackerNMP131.exe, 00000011.00000002.2362816797.0000000003CD0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Crowd Denylmp.pdb source: 3rB05VU.exe, 0000000C.00000002.2583154801.0000000003FB2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb source: 3rB05VU.exe, 0000000C.00000002.2583615801.000000000428E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: 3rB05VU.exe, 0000000C.00000002.2581982519.0000000002F70000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Temp\tempAVSaeI8GhtgT29e.pdb\.Y source: 3rB05VU.exe, 0000000C.00000002.2583749077.00000000043E2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb source: 3rB05VU.exe, 0000000C.00000002.2582456554.0000000003BC2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: 3rB05VU.exe, 0000000C.00000002.2583008356.0000000003E96000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Temp\Symbols\winload_prod.pdb\*X source: 3rB05VU.exe, 0000000C.00000002.2583749077.00000000043E2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdbAcrobatpData\1 source: 3rB05VU.exe, 0000000C.00000002.2581982519.0000000002F70000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb source: 3rB05VU.exe, 0000000C.00000002.2582407905.0000000003B51000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Temp\tempAVSgsImjMYlWzR3.pdb\.^7 source: OfficeTrackerNMP131.exe, 00000011.00000002.2362816797.0000000003CD0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831 source: 3rB05VU.exe, 0000000C.00000002.2581982519.0000000002F70000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831 source: 3rB05VU.exe, 0000000C.00000002.2583008356.0000000003E96000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Temp\Symbols\winload_prod.pdbs\*O7 source: OfficeTrackerNMP131.exe, 00000011.00000002.2362816797.0000000003CD0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Crashpadnlmp.pdb\ source: 3rB05VU.exe, 0000000C.00000002.2583154801.0000000003FB2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb source: 3rB05VU.exe, 0000000C.00000002.2583244317.00000000040FC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: 3rB05VU.exe, 0000000C.00000002.2582317012.0000000003A30000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831 source: 3rB05VU.exe, 0000000C.00000002.2582317012.0000000003A30000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb source: 3rB05VU.exe, 0000000C.00000002.2582407905.0000000003B51000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Temp\tempAVSaeI8GhtgT29e.pdb\.. source: 3rB05VU.exe, 0000000C.00000002.2582612223.0000000003D54000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb source: 3rB05VU.exe, 0000000C.00000002.2582147162.0000000003350000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Temp\Symbols\winload_prod.pdbs*Te source: 3rB05VU.exe, 0000000C.00000002.2583706770.0000000004378000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\tempAVSgsImjMYlWzR3.pdbFGw source: 3rB05VU.exe, 0000000C.00000002.2581982519.0000000002F70000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: 3rB05VU.exe, 0000000C.00000002.2581982519.0000000002F70000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Temp\Symbols\ntkrnlmp.pdbe\*s\ source: 3rB05VU.exe, 0000000C.00000002.2582612223.0000000003D54000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Temp\Symbols\ntkrnlmp.pdb source: 3rB05VU.exe, 0000000C.00000002.2582538713.0000000003CAA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A58310 source: 3rB05VU.exe, 0000000C.00000002.2583008356.0000000003E96000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Temp\tempAVSaeI8GhtgT29e.pdb\.Q source: 3rB05VU.exe, 0000000C.00000002.2582407905.0000000003B51000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2tory source: OfficeTrackerNMP131.exe, 00000011.00000002.2362816797.0000000003CD0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb source: 3rB05VU.exe, 0000000C.00000002.2583244317.00000000040FC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: OfficeTrackerNMP131.exe, 00000011.00000002.2362816797.0000000003CD0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831che source: 3rB05VU.exe, 0000000C.00000002.2583524935.00000000041D9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2I source: 3rB05VU.exe, 0000000C.00000002.2582456554.0000000003BC2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: lmp.pdb source: 3rB05VU.exe, 0000000C.00000002.2583154801.0000000003FB2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: .pdb\. source: 3rB05VU.exe, 0000000C.00000002.2582612223.0000000003D54000.00000004.00000020.00020000.00000000.sdmp, 3rB05VU.exe, 0000000C.00000002.2582456554.0000000003BC2000.00000004.00000020.00020000.00000000.sdmp, 3rB05VU.exe, 0000000C.00000002.2583749077.00000000043E2000.00000004.00000020.00020000.00000000.sdmp, 3rB05VU.exe, 0000000C.00000002.2582407905.0000000003B51000.00000004.00000020.00020000.00000000.sdmp, 3rB05VU.exe, 0000000C.00000002.2582538713.0000000003CAA000.00000004.00000020.00020000.00000000.sdmp, OfficeTrackerNMP131.exe, 00000011.00000002.2362816797.0000000003CD0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831 source: 3rB05VU.exe, 0000000C.00000002.2582912924.0000000003E30000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Temp\Symbols\ntkrnlmp.pdb source: OfficeTrackerNMP131.exe, 00000011.00000002.2362816797.0000000003CD0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Temp\tempAVSMIf5cNgqvav9.pdb\." source: 3rB05VU.exe, 0000000C.00000002.2582538713.0000000003CAA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: 3rB05VU.exe, 0000000C.00000002.2582147162.0000000003350000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Datanlmp.pdbr* source: 3rB05VU.exe, 0000000C.00000002.2583154801.0000000003FB2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb source: 3rB05VU.exe, 0000000C.00000002.2582612223.0000000003D54000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: 3rB05VU.exe, 0000000C.00000002.2582612223.0000000003D54000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: 3rB05VU.exe, 0000000C.00000002.2582456554.0000000003BC2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Temp\Symbols\ntkrnlmp.pdb..\? source: 3rB05VU.exe, 0000000C.00000002.2583749077.00000000043E2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: 3rB05VU.exe, 0000000C.00000002.2583749077.00000000043E2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb source: 3rB05VU.exe, 0000000C.00000002.2582317012.0000000003A30000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wextract.pdb source: 14OWDrfahJ.exe, BC5tT98.exe.1.dr, Ey3OF47.exe.0.dr
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdbeegkt source: 3rB05VU.exe, 0000000C.00000002.2581982519.0000000002F70000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A583106e source: 3rB05VU.exe, 0000000C.00000002.2582147162.0000000003350000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831 source: 3rB05VU.exe, 0000000C.00000002.2583615801.000000000428E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb source: 3rB05VU.exe, 0000000C.00000002.2582538713.0000000003CAA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdbZ source: 3rB05VU.exe, 0000000C.00000002.2582407905.0000000003B51000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdbDCH source: 3rB05VU.exe, 0000000C.00000002.2582407905.0000000003B51000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb source: 3rB05VU.exe, 0000000C.00000002.2583154801.0000000003FB2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831. source: 3rB05VU.exe, 0000000C.00000002.2582456554.0000000003BC2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb source: 3rB05VU.exe, 0000000C.00000002.2581982519.0000000002F70000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb5\|7 source: 3rB05VU.exe, 0000000C.00000002.2583154801.0000000003FB2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: 3rB05VU.exe, 0000000C.00000002.2581982519.0000000002F70000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831 source: 3rB05VU.exe, 0000000C.00000002.2582612223.0000000003D54000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb source: 3rB05VU.exe, 0000000C.00000002.2581982519.0000000002F70000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: 3rB05VU.exe, 0000000C.00000002.2583706770.0000000004378000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\* source: 3rB05VU.exe, 0000000C.00000002.2583615801.000000000428E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2tData\Packages\Microsoft.Windows.CallingShellApp_cw5n1h2txyewy\AC\** source: 3rB05VU.exe, 0000000C.00000002.2582147162.0000000003350000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831 source: 3rB05VU.exe, 0000000C.00000002.2582612223.0000000003D54000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831 source: 3rB05VU.exe, 0000000C.00000002.2583154801.0000000003FB2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: nlmp.pdb source: 3rB05VU.exe, 0000000C.00000002.2583154801.0000000003FB2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Temp\tempAVSgsImjMYlWzR3.pdb.Gp source: 3rB05VU.exe, 0000000C.00000002.2582538713.0000000003CAA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb source: 3rB05VU.exe, 0000000C.00000002.2583475835.0000000004177000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831 source: 3rB05VU.exe, 0000000C.00000002.2581982519.0000000002F70000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2ata source: 3rB05VU.exe, 0000000C.00000002.2582612223.0000000003D54000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb source: 3rB05VU.exe, 0000000C.00000002.2582147162.0000000003350000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb source: 3rB05VU.exe, 0000000C.00000002.2582612223.0000000003D54000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdbbets source: 3rB05VU.exe, 0000000C.00000002.2583615801.000000000428E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb source: 3rB05VU.exe, 0000000C.00000002.2581982519.0000000002F70000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdbC8 source: 3rB05VU.exe, 0000000C.00000002.2583154801.0000000003FB2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: rnlmp.pdb source: 3rB05VU.exe, 0000000C.00000002.2583112343.0000000003F70000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: nlmp.pdb\ source: 3rB05VU.exe, 0000000C.00000002.2583154801.0000000003FB2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb source: 3rB05VU.exe, 0000000C.00000002.2582407905.0000000003B51000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb source: 3rB05VU.exe, 0000000C.00000002.2582538713.0000000003CAA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831 source: 3rB05VU.exe, 0000000C.00000002.2583524935.00000000041D9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831 source: 3rB05VU.exe, 0000000C.00000002.2582147162.0000000003320000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb source: 3rB05VU.exe, 0000000C.00000002.2583008356.0000000003E96000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdbcrobat\DC source: 3rB05VU.exe, 0000000C.00000002.2583008356.0000000003E96000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: 3rB05VU.exe, 0000000C.00000002.2583749077.00000000043E2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdbathe source: 3rB05VU.exe, 0000000C.00000002.2582612223.0000000003D54000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdbeees source: 3rB05VU.exe, 0000000C.00000002.2582407905.0000000003B51000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Temp\tempAVSEtti_jQBHy11.pdb\* source: 3rB05VU.exe, 0000000C.00000002.2583749077.00000000043E2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Temp\Symbols\winload_prod.pdb source: 3rB05VU.exe, 0000000C.00000002.2583749077.00000000043E2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Temp\Symbols\winload_prod.pdbcrobat source: 3rB05VU.exe, 0000000C.00000002.2582612223.0000000003D54000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb source: 3rB05VU.exe, 0000000C.00000002.2582407905.0000000003B51000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\tempAVSmnUz2tnF899j.pdb source: 3rB05VU.exe, 0000000C.00000002.2583244317.00000000040FC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb source: 3rB05VU.exe, 0000000C.00000002.2581982519.0000000002F70000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: 3rB05VU.exe, 0000000C.00000002.2583615801.000000000428E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdbat source: 3rB05VU.exe, 0000000C.00000002.2582407905.0000000003B51000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb source: 3rB05VU.exe, 0000000C.00000002.2582912924.0000000003E30000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A58318 source: 3rB05VU.exe, 0000000C.00000002.2583615801.000000000428E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: 3rB05VU.exe, 0000000C.00000002.2583615801.000000000428E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831 source: 3rB05VU.exe, 0000000C.00000002.2583706770.0000000004378000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb-j source: 3rB05VU.exe, 0000000C.00000002.2581982519.0000000002F70000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2f source: 3rB05VU.exe, 0000000C.00000002.2582538713.0000000003CAA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: 3rB05VU.exe, 0000000C.00000002.2583244317.00000000040FC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb source: 3rB05VU.exe, 0000000C.00000002.2582912924.0000000003E30000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831&! source: 3rB05VU.exe, 0000000C.00000002.2583008356.0000000003E96000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb source: 3rB05VU.exe, 0000000C.00000002.2582147162.0000000003350000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2ownload.error= source: 3rB05VU.exe, 0000000C.00000002.2583244317.00000000040FC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb source: 3rB05VU.exe, 0000000C.00000002.2583008356.0000000003E96000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Temp\Symbols\winload_prod.pdb source: 3rB05VU.exe, 0000000C.00000002.2582538713.0000000003CAA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831 source: 3rB05VU.exe, 0000000C.00000002.2583749077.00000000043E2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\blob_storage\fccd7e85-a1ff-4466-9ff5-c20d62f6e0a2mp.pdb source: 3rB05VU.exe, 0000000C.00000002.2582317012.0000000003A30000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb source: 3rB05VU.exe, 0000000C.00000002.2583154801.0000000003FB2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdbn)+4 source: 3rB05VU.exe, 0000000C.00000002.2582147162.0000000003350000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831 source: 3rB05VU.exe, 0000000C.00000002.2583615801.000000000428E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: 3rB05VU.exe, 0000000C.00000002.2583154801.0000000003FB2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831" source: 3rB05VU.exe, 0000000C.00000002.2582456554.0000000003BC2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb source: 3rB05VU.exe, 0000000C.00000002.2582538713.0000000003CAA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2j source: 3rB05VU.exe, 0000000C.00000002.2583749077.00000000043E2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdbted8bbwe source: 3rB05VU.exe, 0000000C.00000002.2582147162.0000000003350000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Temp\Symbols\ntkrnlmp.pdb*elrw source: 3rB05VU.exe, 0000000C.00000002.2582538713.0000000003CAA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb source: 3rB05VU.exe, 0000000C.00000002.2582317012.0000000003A30000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdbtDi source: 3rB05VU.exe, 0000000C.00000002.2582317012.0000000003A30000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831 source: 3rB05VU.exe, 0000000C.00000002.2582317012.0000000003A30000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831 source: 3rB05VU.exe, 0000000C.00000002.2582456554.0000000003BC2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdbobeTemp source: 3rB05VU.exe, 0000000C.00000002.2582456554.0000000003BC2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdbe\l source: 3rB05VU.exe, 0000000C.00000002.2583475835.0000000004177000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2]! source: 3rB05VU.exe, 0000000C.00000002.2583008356.0000000003E96000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: 3rB05VU.exe, 0000000C.00000002.2582317012.0000000003A30000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: 3rB05VU.exe, 0000000C.00000002.2583524935.00000000041D9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Temp\tempAVSaeI8GhtgT29e.pdb\. source: 3rB05VU.exe, 0000000C.00000002.2582538713.0000000003CAA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2B source: 3rB05VU.exe, 0000000C.00000002.2583706770.0000000004378000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\SymbolsFA1AC2p.pdb}Cd source: 3rB05VU.exe, 0000000C.00000002.2582912924.0000000003E30000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Temp\Symbols\winload_prod.pdbemp source: 3rB05VU.exe, 0000000C.00000002.2582538713.0000000003CAA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb source: 3rB05VU.exe, 0000000C.00000002.2582456554.0000000003BC2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Temp\Symbols\winload_prod.pdb source: 3rB05VU.exe, 0000000C.00000002.2582612223.0000000003D54000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdbe\*he-p source: 3rB05VU.exe, 0000000C.00000002.2582538713.0000000003CAA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831MY source: 3rB05VU.exe, 0000000C.00000002.2583244317.00000000040FC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2story source: 3rB05VU.exe, 0000000C.00000002.2583112343.0000000003F70000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831 source: 3rB05VU.exe, 0000000C.00000002.2583244317.00000000040FC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb source: 3rB05VU.exe, 0000000C.00000002.2583154801.0000000003FB2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831.k source: 3rB05VU.exe, 0000000C.00000002.2583706770.0000000004378000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831 source: OfficeTrackerNMP131.exe, 00000011.00000002.2362816797.0000000003CD0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Temp\Symbols\ntkrnlmp.pdbes\**8 source: OfficeTrackerNMP131.exe, 00000011.00000002.2362816797.0000000003CD0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Temp\Symbols\winload_prod.pdb source: 3rB05VU.exe, 0000000C.00000002.2582538713.0000000003CAA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Temp\Symbols\ntkrnlmp.pdb source: 3rB05VU.exe, 0000000C.00000002.2582612223.0000000003D54000.00000004.00000020.00020000.00000000.sdmp

Spreading

Yara detected PrivateLoader

Source: Yara match	File source: 17.0.OfficeTrackerNMP131.exe.10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.3rB05VU.exe.7f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.OfficeTrackerNMP131.exe.10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.0.MaxLoonaFest131.exe.590000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.3rB05VU.exe.7f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.0.FANBooster131.exe.830000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.FANBooster131.exe.830000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3.BC5tT98.exe.4aa2540.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.0.MaxLoonaFest131.exe.590000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.MaxLoonaFest131.exe.590000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.MaxLoonaFest131.exe.590000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3.BC5tT98.exe.4aa2540.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.0.OfficeTrackerNMP131.exe.10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.OfficeTrackerNMP131.exe.10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000003.1636508373.0000000004A9B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\FANBooster131\FANBooster131.exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\MaxLoonaFest131\MaxLoonaFest131.exe, type: DROPPED

Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\ShaderCache\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\ThirdPartyModuleList64\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\SSLErrorAssistant\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Subresource Filter\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\SafetyTips\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	File opened: C:\Users\user\AppData\Local\Temp\tempAVSaeI8GhtgT29e\02zdBXl47cvzcookies.sqlite	Jump to behavior

Source: C:\Users\user\Desktop\14OWDrfahJ.exe	Code function: 0_2_00752390 FindFirstFileA,lstrcmpA,lstrcmpA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,	0_2_00752390
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\Ey3OF47.exe	Code function: 1_2_00012390 FindFirstFileA,lstrcmpA,lstrcmpA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,	1_2_00012390
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\BC5tT98.exe	Code function: 2_2_00BA2390 FindFirstFileA,lstrcmpA,lstrcmpA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,	2_2_00BA2390
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_007FEA60 FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,SHGetFolderPathA,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,	12_2_007FEA60
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_007FB990 CreateDirectoryA,FindFirstFileA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,GetLastError,SetFileAttributesA,GetLastError,RemoveDirectoryA,GetLastError,GetLastError,	12_2_007FB990
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_00829AA0 SHGetFolderPathA,FindFirstFileA,FindNextFileA,FindClose,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CreateDirectoryA,CopyFileA,CopyFileA,	12_2_00829AA0
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_008A93BA FindClose,FindFirstFileExW,GetLastError,	12_2_008A93BA
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_008A9440 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	12_2_008A9440
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_00811B60 CreateDirectoryA,FindFirstFileA,FindNextFileA,GetLastError,	12_2_00811B60
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_0001EA60 FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,SHGetFolderPathA,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,	17_2_0001EA60
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_0001B990 CreateDirectoryA,FindFirstFileA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,GetLastError,SetFileAttributesA,GetLastError,RemoveDirectoryA,GetLastError,GetLastError,	17_2_0001B990
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_00049AA0 SHGetFolderPathA,FindFirstFileA,FindNextFileA,FindClose,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CreateDirectoryA,CopyFileA,CopyFileA,	17_2_00049AA0
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_000C93BA FindClose,FindFirstFileExW,GetLastError,	17_2_000C93BA
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_000C9440 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	17_2_000C9440
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_00031B60 CreateDirectoryA,FindFirstFileA,FindNextFileA,GetLastError,	17_2_00031B60

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	11_2_070E1848
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	11_2_070E196F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 4x nop then jmp 0D7F13F4h	11_2_0D7F0CA8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 4x nop then jmp 0D7F643Dh	11_2_0D7F5F80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 4x nop then jmp 0D7F4BF7h	11_2_0D7F3998
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 4x nop then jmp 0D7F1AC3h	11_2_0D7F17F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 4x nop then jmp 0D7F267Fh	11_2_0D7F22E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 4x nop then jmp 0D7F2A73h	11_2_0D7F22E8

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP v.0.x (Token) 194.49.94.152:50500 -> 192.168.2.4:49736
Source: Traffic	Snort IDS: 2049060 ET TROJAN Suspected RisePro TCP Heartbeat Packet 192.168.2.4:49736 -> 194.49.94.152:50500
Source: Traffic	Snort IDS: 2046267 ET TROJAN [ANY.RUN] RisePro TCP v.0.x (External IP) 194.49.94.152:50500 -> 192.168.2.4:49736
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Related (MC-NMF Authorization) 192.168.2.4:49737 -> 194.49.94.152:19053
Source: Traffic	Snort IDS: 2043231 ET TROJAN Redline Stealer TCP CnC Activity 192.168.2.4:49737 -> 194.49.94.152:19053
Source: Traffic	Snort IDS: 2043234 ET MALWARE Redline Stealer TCP CnC - Id1Response 194.49.94.152:19053 -> 192.168.2.4:49737
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP v.0.x (Token) 194.49.94.152:50500 -> 192.168.2.4:49739
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP v.0.x (Token) 194.49.94.152:50500 -> 192.168.2.4:49740
Source: Traffic	Snort IDS: 2046267 ET TROJAN [ANY.RUN] RisePro TCP v.0.x (External IP) 194.49.94.152:50500 -> 192.168.2.4:49739
Source: Traffic	Snort IDS: 2046267 ET TROJAN [ANY.RUN] RisePro TCP v.0.x (External IP) 194.49.94.152:50500 -> 192.168.2.4:49740
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP v.0.x (Activity) 192.168.2.4:49736 -> 194.49.94.152:50500
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP v.0.x (Activity) 192.168.2.4:49739 -> 194.49.94.152:50500
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP v.0.x (Activity) 192.168.2.4:49740 -> 194.49.94.152:50500
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP v.0.x (Token) 194.49.94.152:50500 -> 192.168.2.4:49744
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP v.0.x (Token) 194.49.94.152:50500 -> 192.168.2.4:49745
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP v.0.x (Token) 194.49.94.152:50500 -> 192.168.2.4:49746

Yara detected PrivateLoader

Source: Yara match	File source: 17.0.OfficeTrackerNMP131.exe.10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.3rB05VU.exe.7f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.OfficeTrackerNMP131.exe.10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.0.MaxLoonaFest131.exe.590000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.3rB05VU.exe.7f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.0.FANBooster131.exe.830000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.FANBooster131.exe.830000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3.BC5tT98.exe.4aa2540.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.0.MaxLoonaFest131.exe.590000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.MaxLoonaFest131.exe.590000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.MaxLoonaFest131.exe.590000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3.BC5tT98.exe.4aa2540.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.0.OfficeTrackerNMP131.exe.10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.OfficeTrackerNMP131.exe.10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000003.1636508373.0000000004A9B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\FANBooster131\FANBooster131.exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\MaxLoonaFest131\MaxLoonaFest131.exe, type: DROPPED

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 194.49.94.152:19053

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: unknown	DNS query: name: ipinfo.io
Source: unknown	DNS query: name: ipinfo.io

Source: global traffic	HTTP traffic detected: GET /widget/demo/89.149.18.60 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /widget/demo/89.149.18.60 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /widget/demo/89.149.18.60 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: ipinfo.io

Source: Joe Sandbox View

ASN Name: EQUEST-ASNL EQUEST-ASNL

Source: Joe Sandbox View	IP Address: 194.49.94.152 194.49.94.152
Source: Joe Sandbox View	IP Address: 34.117.59.81 34.117.59.81
Source: Joe Sandbox View	IP Address: 34.117.59.81 34.117.59.81

Source: global traffic

TCP traffic: 192.168.2.4:49736 -> 194.49.94.152:50500

Source: BC5tT98.exe, 00000002.00000003.1636508373.0000000004A9B000.00000004.00000020.00020000.00000000.sdmp, 2Iu7231.exe.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: BC5tT98.exe, 00000002.00000003.1636508373.0000000004A9B000.00000004.00000020.00020000.00000000.sdmp, 2Iu7231.exe.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: BC5tT98.exe, 00000002.00000003.1636508373.0000000004A9B000.00000004.00000020.00020000.00000000.sdmp, 2Iu7231.exe.2.dr	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: BC5tT98.exe, 00000002.00000003.1636508373.0000000004A9B000.00000004.00000020.00020000.00000000.sdmp, 2Iu7231.exe.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: BC5tT98.exe, 00000002.00000003.1636508373.0000000004A9B000.00000004.00000020.00020000.00000000.sdmp, 2Iu7231.exe.2.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: BC5tT98.exe, 00000002.00000003.1636508373.0000000004A9B000.00000004.00000020.00020000.00000000.sdmp, 2Iu7231.exe.2.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: BC5tT98.exe, 00000002.00000003.1636508373.0000000004A9B000.00000004.00000020.00020000.00000000.sdmp, 2Iu7231.exe.2.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: BC5tT98.exe, 00000002.00000003.1636508373.0000000004A9B000.00000004.00000020.00020000.00000000.sdmp, 2Iu7231.exe.2.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: BC5tT98.exe, 00000002.00000003.1636508373.0000000004A9B000.00000004.00000020.00020000.00000000.sdmp, 2Iu7231.exe.2.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: BC5tT98.exe, 00000002.00000003.1636508373.0000000004A9B000.00000004.00000020.00020000.00000000.sdmp, 2Iu7231.exe.2.dr	String found in binary or memory: http://ocsp.thawte.com0
Source: AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: AppLaunch.exe, 0000000B.00000002.2373910611.0000000007321000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: AppLaunch.exe, 0000000B.00000002.2373910611.0000000007321000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: AppLaunch.exe, 0000000B.00000002.2373910611.0000000007321000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: AppLaunch.exe, 0000000B.00000002.2373910611.0000000007321000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/fault
Source: AppLaunch.exe, 0000000B.00000002.2373910611.0000000007321000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: AppLaunch.exe, 0000000B.00000002.2373910611.0000000007321000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: AppLaunch.exe, 0000000B.00000002.2373910611.0000000007321000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: AppLaunch.exe, 0000000B.00000002.2373910611.0000000007321000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: AppLaunch.exe, 0000000B.00000002.2373910611.0000000007321000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: AppLaunch.exe, 0000000B.00000002.2373910611.0000000007321000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: AppLaunch.exe, 0000000B.00000002.2373910611.0000000007321000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: AppLaunch.exe, 0000000B.00000002.2373910611.0000000007321000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rmX
Source: AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: AppLaunch.exe, 0000000B.00000002.2373910611.0000000007321000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: AppLaunch.exe, 0000000B.00000002.2373910611.0000000007419000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: AppLaunch.exe, 0000000B.00000002.2373910611.0000000007321000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: AppLaunch.exe, 0000000B.00000002.2373910611.0000000007321000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/D
Source: AppLaunch.exe, 0000000B.00000002.2373910611.0000000007321000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1
Source: AppLaunch.exe, 0000000B.00000002.2373910611.0000000007321000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10
Source: AppLaunch.exe, 0000000B.00000002.2373910611.0000000007321000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10Response
Source: AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10ResponseD
Source: AppLaunch.exe, 0000000B.00000002.2373910611.0000000007321000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2373910611.0000000007886000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11
Source: AppLaunch.exe, 0000000B.00000002.2373910611.0000000007321000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11Response
Source: AppLaunch.exe, 0000000B.00000002.2373910611.0000000007886000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11ResponseD
Source: AppLaunch.exe, 0000000B.00000002.2373910611.0000000007321000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12
Source: AppLaunch.exe, 0000000B.00000002.2373910611.0000000007321000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12Response
Source: AppLaunch.exe, 0000000B.00000002.2373910611.0000000007419000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12ResponseD
Source: AppLaunch.exe, 0000000B.00000002.2373910611.0000000007321000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13
Source: AppLaunch.exe, 0000000B.00000002.2373910611.0000000007321000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: AppLaunch.exe, 0000000B.00000002.2373910611.0000000007419000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13ResponseD
Source: AppLaunch.exe, 0000000B.00000002.2373910611.0000000007321000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14
Source: AppLaunch.exe, 0000000B.00000002.2373910611.0000000007321000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14Response
Source: AppLaunch.exe, 0000000B.00000002.2373910611.0000000007321000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15
Source: AppLaunch.exe, 0000000B.00000002.2373910611.0000000007321000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15Response
Source: AppLaunch.exe, 0000000B.00000002.2373910611.0000000007321000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16
Source: AppLaunch.exe, 0000000B.00000002.2373910611.0000000007321000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16Response
Source: AppLaunch.exe, 0000000B.00000002.2373910611.0000000007886000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16ResponseD
Source: AppLaunch.exe, 0000000B.00000002.2373910611.0000000007321000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17
Source: AppLaunch.exe, 0000000B.00000002.2373910611.0000000007321000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17Response
Source: AppLaunch.exe, 0000000B.00000002.2373910611.0000000007886000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17ResponseD
Source: AppLaunch.exe, 0000000B.00000002.2373910611.0000000007321000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18
Source: AppLaunch.exe, 0000000B.00000002.2373910611.0000000007321000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18Response
Source: AppLaunch.exe, 0000000B.00000002.2373910611.0000000007886000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18ResponseD
Source: AppLaunch.exe, 0000000B.00000002.2373910611.0000000007321000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19
Source: AppLaunch.exe, 0000000B.00000002.2373910611.0000000007321000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Response
Source: AppLaunch.exe, 0000000B.00000002.2373910611.0000000007886000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19ResponseD
Source: AppLaunch.exe, 0000000B.00000002.2373910611.0000000007321000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1ResponseD
Source: AppLaunch.exe, 0000000B.00000002.2373910611.0000000007321000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2
Source: AppLaunch.exe, 0000000B.00000002.2373910611.0000000007321000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20
Source: AppLaunch.exe, 0000000B.00000002.2373910611.0000000007321000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20Response
Source: AppLaunch.exe, 0000000B.00000002.2373910611.0000000007419000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20ResponseD
Source: AppLaunch.exe, 0000000B.00000002.2373910611.0000000007321000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21
Source: AppLaunch.exe, 0000000B.00000002.2373910611.0000000007321000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21Response
Source: AppLaunch.exe, 0000000B.00000002.2373910611.0000000007419000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21ResponseD
Source: AppLaunch.exe, 0000000B.00000002.2373910611.0000000007321000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22
Source: AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2373910611.0000000007321000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Response
Source: AppLaunch.exe, 0000000B.00000002.2373910611.0000000007886000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22ResponseD
Source: AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2373910611.0000000007321000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23
Source: AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2373910611.0000000007321000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23Response
Source: AppLaunch.exe, 0000000B.00000002.2373910611.0000000007886000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23ResponseD
Source: AppLaunch.exe, 0000000B.00000002.2373910611.0000000007321000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24
Source: AppLaunch.exe, 0000000B.00000002.2373910611.0000000007321000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24Response
Source: AppLaunch.exe, 0000000B.00000002.2373910611.0000000007321000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2ResponseD
Source: AppLaunch.exe, 0000000B.00000002.2373910611.0000000007321000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3
Source: AppLaunch.exe, 0000000B.00000002.2373910611.0000000007321000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Response
Source: AppLaunch.exe, 0000000B.00000002.2373910611.0000000007321000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4
Source: AppLaunch.exe, 0000000B.00000002.2373910611.0000000007321000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4Response
Source: AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4ResponseD
Source: AppLaunch.exe, 0000000B.00000002.2373910611.0000000007321000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5
Source: AppLaunch.exe, 0000000B.00000002.2373910611.0000000007321000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5Response
Source: AppLaunch.exe, 0000000B.00000002.2373910611.0000000007321000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2373910611.0000000007411000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6
Source: AppLaunch.exe, 0000000B.00000002.2373910611.0000000007321000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6Response
Source: AppLaunch.exe, 0000000B.00000002.2373910611.0000000007419000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6ResponseD
Source: AppLaunch.exe, 0000000B.00000002.2373910611.0000000007321000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7
Source: AppLaunch.exe, 0000000B.00000002.2373910611.0000000007321000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7Response
Source: AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7ResponseD
Source: AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2373910611.0000000007321000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8
Source: AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2373910611.0000000007321000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8Response
Source: AppLaunch.exe, 0000000B.00000002.2373910611.0000000007886000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8ResponseD
Source: AppLaunch.exe, 0000000B.00000002.2373910611.0000000007321000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9
Source: AppLaunch.exe, 0000000B.00000002.2373910611.0000000007321000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: AppLaunch.exe, 0000000B.00000002.2373910611.0000000007419000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9ResponseD
Source: BC5tT98.exe, 00000002.00000003.1636508373.0000000004A9B000.00000004.00000020.00020000.00000000.sdmp, 2Iu7231.exe.2.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: BC5tT98.exe, 00000002.00000003.1636508373.0000000004A9B000.00000004.00000020.00020000.00000000.sdmp, 2Iu7231.exe.2.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: BC5tT98.exe, 00000002.00000003.1636508373.0000000004A9B000.00000004.00000020.00020000.00000000.sdmp, 2Iu7231.exe.2.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: 3rB05VU.exe.2.dr	String found in binary or memory: http://www.winimage.com/zLibDll
Source: OfficeTrackerNMP131.exe, 00000011.00000003.2283329805.0000000003DC9000.00000004.00000020.00020000.00000000.sdmp, OfficeTrackerNMP131.exe, 00000011.00000003.2283612605.0000000003DBA000.00000004.00000020.00020000.00000000.sdmp, OfficeTrackerNMP131.exe, 00000011.00000003.2283305020.0000000003DBA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomple
Source: AppLaunch.exe, 0000000B.00000002.2380103032.0000000008E86000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000008FBC000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000009163000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000008F13000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2373910611.0000000007464000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.00000000090BC000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.00000000090D6000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2373910611.000000000798D000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000008EA1000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000009147000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.000000000902D000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000009049000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2373910611.00000000078F7000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2373910611.00000000074C6000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000008F2E000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2373910611.000000000792F000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000008FA0000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2373910611.0000000007A23000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2373910611.00000000079C5000.00000004.00000800.00020000.00000000.sdmp, 3rB05VU.exe, 0000000C.00000003.2249463056.000000000335A000.00000004.00000020.00020000.00000000.sdmp, 3rB05VU.exe, 0000000C.00000003.2251488550.000000000336B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: AppLaunch.exe, 0000000B.00000002.2373910611.0000000007321000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/ip
Source: AppLaunch.exe, 0000000B.00000002.2380103032.0000000008E86000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000008FBC000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000009163000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000008F13000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2373910611.0000000007464000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.00000000090BC000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.00000000090D6000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2373910611.000000000798D000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000008EA1000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000009147000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.000000000902D000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000009049000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2373910611.00000000078F7000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2373910611.00000000074C6000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000008F2E000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2373910611.000000000792F000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000008FA0000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2373910611.0000000007A23000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2373910611.00000000079C5000.00000004.00000800.00020000.00000000.sdmp, 3rB05VU.exe, 0000000C.00000003.2249463056.000000000335A000.00000004.00000020.00020000.00000000.sdmp, 3rB05VU.exe, 0000000C.00000003.2251488550.000000000336B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: OfficeTrackerNMP131.exe, 00000011.00000003.2283329805.0000000003DC9000.00000004.00000020.00020000.00000000.sdmp, OfficeTrackerNMP131.exe, 00000011.00000003.2283612605.0000000003DBA000.00000004.00000020.00020000.00000000.sdmp, OfficeTrackerNMP131.exe, 00000011.00000003.2283305020.0000000003DBA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/f
Source: AppLaunch.exe, 0000000B.00000002.2380103032.0000000008E86000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000008FBC000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000009163000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000008F13000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2373910611.0000000007464000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.00000000090BC000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.00000000090D6000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2373910611.000000000798D000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000008EA1000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000009147000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.000000000902D000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000009049000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2373910611.00000000078F7000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2373910611.00000000074C6000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000008F2E000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2373910611.000000000792F000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000008FA0000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2373910611.0000000007A23000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2373910611.00000000079C5000.00000004.00000800.00020000.00000000.sdmp, 3rB05VU.exe, 0000000C.00000003.2249463056.000000000335A000.00000004.00000020.00020000.00000000.sdmp, 3rB05VU.exe, 0000000C.00000003.2251488550.000000000336B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: OfficeTrackerNMP131.exe, 00000011.00000003.2283329805.0000000003DC9000.00000004.00000020.00020000.00000000.sdmp, OfficeTrackerNMP131.exe, 00000011.00000003.2283305020.0000000003DBA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/search
Source: AppLaunch.exe, 0000000B.00000002.2380103032.0000000008E86000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000008FBC000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000009163000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000008F13000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2373910611.0000000007464000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.00000000090BC000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.00000000090D6000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2373910611.000000000798D000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000008EA1000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000009147000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.000000000902D000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000009049000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2373910611.00000000078F7000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2373910611.00000000074C6000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000008F2E000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2373910611.000000000792F000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000008FA0000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2373910611.0000000007A23000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2373910611.00000000079C5000.00000004.00000800.00020000.00000000.sdmp, 3rB05VU.exe, 0000000C.00000003.2249463056.000000000335A000.00000004.00000020.00020000.00000000.sdmp, 3rB05VU.exe, 0000000C.00000003.2251488550.000000000336B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: AppLaunch.exe, 0000000B.00000002.2380103032.0000000008E86000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000008FBC000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000009163000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000008F13000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2373910611.0000000007464000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.00000000090BC000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.00000000090D6000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2373910611.000000000798D000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000008EA1000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000009147000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.000000000902D000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000009049000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2373910611.00000000078F7000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2373910611.00000000074C6000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000008F2E000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2373910611.000000000792F000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000008FA0000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2373910611.0000000007A23000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2373910611.00000000079C5000.00000004.00000800.00020000.00000000.sdmp, 3rB05VU.exe, 0000000C.00000003.2249463056.000000000335A000.00000004.00000020.00020000.00000000.sdmp, 3rB05VU.exe, 0000000C.00000003.2251488550.000000000336B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: AppLaunch.exe, 0000000B.00000002.2380103032.0000000008FBC000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000009163000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2373910611.0000000007464000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.00000000090D6000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000008EA1000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000009049000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000008F2E000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2373910611.000000000792F000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2373910611.00000000079C5000.00000004.00000800.00020000.00000000.sdmp, 3rB05VU.exe, 0000000C.00000003.2249463056.000000000335A000.00000004.00000020.00020000.00000000.sdmp, 3rB05VU.exe, 0000000C.00000003.2251488550.000000000336B000.00000004.00000020.00020000.00000000.sdmp, OfficeTrackerNMP131.exe, 00000012.00000003.2263669444.0000000003888000.00000004.00000020.00020000.00000000.sdmp, OfficeTrackerNMP131.exe, 00000012.00000003.2267666589.0000000003888000.00000004.00000020.00020000.00000000.sdmp, 3b6N2Xdh3CYwWeb Data.18.dr, 3b6N2Xdh3CYwWeb Data.12.dr, D87fZN3R3jFeWeb Data.18.dr, D87fZN3R3jFeWeb Data.12.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: AppLaunch.exe, 0000000B.00000002.2380103032.0000000008E86000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000008F13000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.00000000090BC000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2373910611.000000000798D000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000009147000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.000000000902D000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2373910611.00000000078F7000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2373910611.00000000074C6000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000008FA0000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2373910611.0000000007A23000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtabS
Source: AppLaunch.exe, 0000000B.00000002.2380103032.0000000008E86000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000008FBC000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000009163000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000008F13000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2373910611.0000000007464000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.00000000090BC000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.00000000090D6000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2373910611.000000000798D000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000008EA1000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000009147000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.000000000902D000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000009049000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2373910611.00000000078F7000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2373910611.00000000074C6000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000008F2E000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2373910611.000000000792F000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000008FA0000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2373910611.0000000007A23000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2373910611.00000000079C5000.00000004.00000800.00020000.00000000.sdmp, 3rB05VU.exe, 0000000C.00000003.2249463056.000000000335A000.00000004.00000020.00020000.00000000.sdmp, 3rB05VU.exe, 0000000C.00000003.2251488550.000000000336B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: OfficeTrackerNMP131.exe, 00000012.00000002.2886061884.0000000000F27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/
Source: 3rB05VU.exe, 0000000C.00000002.2581262150.0000000000B98000.00000004.00000020.00020000.00000000.sdmp, OfficeTrackerNMP131.exe, 00000011.00000002.2361383370.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp, OfficeTrackerNMP131.exe, 00000012.00000002.2886061884.0000000000F77000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/Mozilla/5.0
Source: OfficeTrackerNMP131.exe, 00000011.00000002.2361383370.0000000000B4D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/a
Source: BC5tT98.exe, 00000002.00000003.1636508373.0000000004A9B000.00000004.00000020.00020000.00000000.sdmp, 3rB05VU.exe, 0000000C.00000003.2222685763.0000000000B75000.00000004.00000020.00020000.00000000.sdmp, 3rB05VU.exe, 0000000C.00000000.2217497768.00000000008F6000.00000002.00000001.01000000.0000000A.sdmp, 3rB05VU.exe, 0000000C.00000002.2581115078.00000000008F6000.00000002.00000001.01000000.0000000A.sdmp, 3rB05VU.exe, 0000000C.00000003.2218839974.0000000000B41000.00000004.00000020.00020000.00000000.sdmp, OfficeTrackerNMP131.exe, 00000011.00000000.2237844332.0000000000116000.00000002.00000001.01000000.0000000C.sdmp, OfficeTrackerNMP131.exe, 00000011.00000002.2360401589.0000000000116000.00000002.00000001.01000000.0000000C.sdmp, OfficeTrackerNMP131.exe, 00000012.00000002.2885751133.0000000000116000.00000002.00000001.01000000.0000000C.sdmp, OfficeTrackerNMP131.exe, 00000012.00000000.2238719070.0000000000116000.00000002.00000001.01000000.0000000C.sdmp, MaxLoonaFest131.exe, 00000013.00000000.2359759982.0000000000696000.00000002.00000001.01000000.0000000E.sdmp, MaxLoonaFest131.exe, 00000013.00000002.2390326126.0000000000696000.00000002.00000001.01000000.0000000E.sdmp, MaxLoonaFest131.exe, 00000014.00000000.2442392337.0000000000696000.00000002.00000001.01000000.0000000E.sdmp, MaxLoonaFest131.exe, 00000014.00000002.2450878543.0000000000696000.00000002.00000001.01000000.0000000E.sdmp, FANBooster131.exe, 00000016.00000002.2538983831.0000000000936000.00000002.00000001.01000000.0000000F.sdmp, FANBooster131.exe, 00000016.00000000.2530405181.0000000000936000.00000002.00000001.01000000.0000000F.sdmp, MaxLoonaFest131.exe.12.dr, FANBooster131.exe.12.dr, OfficeTrackerNMP131.exe.12.dr, 3rB05VU.exe.2.dr	String found in binary or memory: https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-address
Source: OfficeTrackerNMP131.exe, 00000012.00000002.2886061884.0000000000F27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/89.149.18.60
Source: 3rB05VU.exe, 0000000C.00000002.2581262150.0000000000B98000.00000004.00000020.00020000.00000000.sdmp, OfficeTrackerNMP131.exe, 00000011.00000002.2361383370.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp, OfficeTrackerNMP131.exe, 00000012.00000002.2886061884.0000000000F77000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io:443/widget/demo/89.149.18.60
Source: OfficeTrackerNMP131.exe, 00000012.00000002.2886061884.0000000000F7D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.microsoft.
Source: OfficeTrackerNMP131.exe, 00000012.00000002.2886061884.0000000000F7D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.microsoft..
Source: D87fZN3R3jFeplaces.sqlite.12.dr	String found in binary or memory: https://support.mozilla.org
Source: D87fZN3R3jFeplaces.sqlite.12.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: D87fZN3R3jFeplaces.sqlite.12.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: 3rB05VU.exe, 0000000C.00000003.2253176691.000000000335A000.00000004.00000020.00020000.00000000.sdmp, 3rB05VU.exe, 0000000C.00000003.2250590767.0000000003349000.00000004.00000020.00020000.00000000.sdmp, OfficeTrackerNMP131.exe, 00000012.00000003.2265820672.0000000003876000.00000004.00000020.00020000.00000000.sdmp, IWPfiAXUTJTSHistory.18.dr, 02zdBXl47cvzHistory.12.dr, IWPfiAXUTJTSHistory.12.dr, 02zdBXl47cvzHistory.18.dr	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: IWPfiAXUTJTSHistory.18.dr, 02zdBXl47cvzHistory.12.dr, IWPfiAXUTJTSHistory.12.dr, 02zdBXl47cvzHistory.18.dr	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: 3rB05VU.exe, 0000000C.00000003.2253176691.000000000335A000.00000004.00000020.00020000.00000000.sdmp, 3rB05VU.exe, 0000000C.00000003.2250590767.0000000003349000.00000004.00000020.00020000.00000000.sdmp, OfficeTrackerNMP131.exe, 00000012.00000003.2265820672.0000000003876000.00000004.00000020.00020000.00000000.sdmp, IWPfiAXUTJTSHistory.18.dr, 02zdBXl47cvzHistory.12.dr, IWPfiAXUTJTSHistory.12.dr, 02zdBXl47cvzHistory.18.dr	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: IWPfiAXUTJTSHistory.18.dr, 02zdBXl47cvzHistory.12.dr, IWPfiAXUTJTSHistory.12.dr, 02zdBXl47cvzHistory.18.dr	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: 3rB05VU.exe, 0000000C.00000002.2583749077.00000000043E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/Ris
Source: FANBooster131.exe, 00000016.00000002.2539274464.000000000109E000.00000004.00000020.00020000.00000000.sdmp, passwords.txt.12.dr, i0Y2zBdGkYmG70fPowdUhlT85ovTRCZq.zip.17.dr, 9qAkkNWhLDEhe3SVi3MbZOkApbYumn_h.zip.12.dr, passwords.txt.17.dr	String found in binary or memory: https://t.me/RiseProSUPPORT
Source: OfficeTrackerNMP131.exe, 00000011.00000002.2361383370.0000000000BB5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORT&
Source: BC5tT98.exe, 00000002.00000003.1636508373.0000000004A9B000.00000004.00000020.00020000.00000000.sdmp, 2Iu7231.exe.2.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: AppLaunch.exe, 0000000B.00000002.2380103032.0000000008E86000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000008FBC000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000009163000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000008F13000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2373910611.0000000007464000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.00000000090BC000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.00000000090D6000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2373910611.000000000798D000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000008EA1000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000009147000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.000000000902D000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000009049000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2373910611.00000000078F7000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2373910611.00000000074C6000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000008F2E000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2373910611.000000000792F000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000008FA0000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2373910611.0000000007A23000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2373910611.00000000079C5000.00000004.00000800.00020000.00000000.sdmp, 3rB05VU.exe, 0000000C.00000003.2249463056.000000000335A000.00000004.00000020.00020000.00000000.sdmp, 3rB05VU.exe, 0000000C.00000003.2251488550.000000000336B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: AppLaunch.exe, 0000000B.00000002.2380103032.0000000008E86000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000008FBC000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000009163000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000008F13000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2373910611.0000000007464000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.00000000090BC000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.00000000090D6000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2373910611.000000000798D000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000008EA1000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000009147000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.000000000902D000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000009049000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2373910611.00000000078F7000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2373910611.00000000074C6000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000008F2E000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2373910611.000000000792F000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000008FA0000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2373910611.0000000007A23000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2373910611.00000000079C5000.00000004.00000800.00020000.00000000.sdmp, 3rB05VU.exe, 0000000C.00000003.2249463056.000000000335A000.00000004.00000020.00020000.00000000.sdmp, 3rB05VU.exe, 0000000C.00000003.2251488550.000000000336B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 3rB05VU.exe, OfficeTrackerNMP131.exe	String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address
Source: D87fZN3R3jFeplaces.sqlite.12.dr	String found in binary or memory: https://www.mozilla.org
Source: D87fZN3R3jFeplaces.sqlite.12.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: D87fZN3R3jFeplaces.sqlite.12.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: OfficeTrackerNMP131.exe, 00000011.00000002.2362816797.0000000003CD0000.00000004.00000020.00020000.00000000.sdmp, OfficeTrackerNMP131.exe, 00000011.00000002.2361383370.0000000000BB5000.00000004.00000020.00020000.00000000.sdmp, OfficeTrackerNMP131.exe, 00000012.00000002.2886061884.0000000000F7D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: OfficeTrackerNMP131.exe, 00000011.00000002.2362547750.000000000363F000.00000004.00000020.00020000.00000000.sdmp, OfficeTrackerNMP131.exe, 00000012.00000002.2887214445.0000000004131000.00000004.00000020.00020000.00000000.sdmp, D87fZN3R3jFeplaces.sqlite.17.dr, 3b6N2Xdh3CYwplaces.sqlite.12.dr, 3b6N2Xdh3CYwplaces.sqlite.17.dr, D87fZN3R3jFeplaces.sqlite.12.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: OfficeTrackerNMP131.exe, 00000011.00000002.2362816797.0000000003CD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/j
Source: OfficeTrackerNMP131.exe, 00000011.00000002.2361383370.0000000000BB5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/~
Source: D87fZN3R3jFeplaces.sqlite.12.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: OfficeTrackerNMP131.exe, 00000011.00000002.2362816797.0000000003CD0000.00000004.00000020.00020000.00000000.sdmp, OfficeTrackerNMP131.exe, 00000011.00000002.2361383370.0000000000BB5000.00000004.00000020.00020000.00000000.sdmp, OfficeTrackerNMP131.exe, 00000012.00000002.2886061884.0000000000F7D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: OfficeTrackerNMP131.exe, 00000012.00000002.2886061884.0000000000F7D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/ata4S
Source: OfficeTrackerNMP131.exe, 00000012.00000002.2886061884.0000000000F7D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/efox/xR
Source: OfficeTrackerNMP131.exe, 00000011.00000002.2362547750.000000000363F000.00000004.00000020.00020000.00000000.sdmp, OfficeTrackerNMP131.exe, 00000012.00000002.2887214445.0000000004131000.00000004.00000020.00020000.00000000.sdmp, D87fZN3R3jFeplaces.sqlite.17.dr, 3b6N2Xdh3CYwplaces.sqlite.12.dr, 3b6N2Xdh3CYwplaces.sqlite.17.dr, D87fZN3R3jFeplaces.sqlite.12.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: OfficeTrackerNMP131.exe, 00000011.00000002.2361383370.0000000000BB5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/sfox

Source: unknown

DNS traffic detected: queries for: ipinfo.io

Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe

Code function: 12_2_0080CA80 send,recv,recv,WSAGetLastError,recv,recv,recv,recv,__aulldiv,__aulldiv,send,Sleep,recv,Sleep,

12_2_0080CA80

Source: global traffic	HTTP traffic detected: GET /widget/demo/89.149.18.60 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /widget/demo/89.149.18.60 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /widget/demo/89.149.18.60 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: ipinfo.io

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443

Source: unknown	TCP traffic detected without corresponding DNS query: 194.49.94.152
Source: unknown	TCP traffic detected without corresponding DNS query: 194.49.94.152
Source: unknown	TCP traffic detected without corresponding DNS query: 194.49.94.152
Source: unknown	TCP traffic detected without corresponding DNS query: 194.49.94.152
Source: unknown	TCP traffic detected without corresponding DNS query: 194.49.94.152
Source: unknown	TCP traffic detected without corresponding DNS query: 194.49.94.152
Source: unknown	TCP traffic detected without corresponding DNS query: 194.49.94.152
Source: unknown	TCP traffic detected without corresponding DNS query: 194.49.94.152
Source: unknown	TCP traffic detected without corresponding DNS query: 194.49.94.152
Source: unknown	TCP traffic detected without corresponding DNS query: 194.49.94.152
Source: unknown	TCP traffic detected without corresponding DNS query: 194.49.94.152
Source: unknown	TCP traffic detected without corresponding DNS query: 194.49.94.152
Source: unknown	TCP traffic detected without corresponding DNS query: 194.49.94.152
Source: unknown	TCP traffic detected without corresponding DNS query: 194.49.94.152
Source: unknown	TCP traffic detected without corresponding DNS query: 194.49.94.152
Source: unknown	TCP traffic detected without corresponding DNS query: 194.49.94.152
Source: unknown	TCP traffic detected without corresponding DNS query: 194.49.94.152
Source: unknown	TCP traffic detected without corresponding DNS query: 194.49.94.152
Source: unknown	TCP traffic detected without corresponding DNS query: 194.49.94.152
Source: unknown	TCP traffic detected without corresponding DNS query: 194.49.94.152
Source: unknown	TCP traffic detected without corresponding DNS query: 194.49.94.152
Source: unknown	TCP traffic detected without corresponding DNS query: 194.49.94.152
Source: unknown	TCP traffic detected without corresponding DNS query: 194.49.94.152
Source: unknown	TCP traffic detected without corresponding DNS query: 194.49.94.152
Source: unknown	TCP traffic detected without corresponding DNS query: 194.49.94.152
Source: unknown	TCP traffic detected without corresponding DNS query: 194.49.94.152
Source: unknown	TCP traffic detected without corresponding DNS query: 194.49.94.152
Source: unknown	TCP traffic detected without corresponding DNS query: 194.49.94.152
Source: unknown	TCP traffic detected without corresponding DNS query: 194.49.94.152
Source: unknown	TCP traffic detected without corresponding DNS query: 194.49.94.152
Source: unknown	TCP traffic detected without corresponding DNS query: 194.49.94.152
Source: unknown	TCP traffic detected without corresponding DNS query: 194.49.94.152
Source: unknown	TCP traffic detected without corresponding DNS query: 194.49.94.152
Source: unknown	TCP traffic detected without corresponding DNS query: 194.49.94.152
Source: unknown	TCP traffic detected without corresponding DNS query: 194.49.94.152
Source: unknown	TCP traffic detected without corresponding DNS query: 194.49.94.152
Source: unknown	TCP traffic detected without corresponding DNS query: 194.49.94.152
Source: unknown	TCP traffic detected without corresponding DNS query: 194.49.94.152
Source: unknown	TCP traffic detected without corresponding DNS query: 194.49.94.152
Source: unknown	TCP traffic detected without corresponding DNS query: 194.49.94.152
Source: unknown	TCP traffic detected without corresponding DNS query: 194.49.94.152
Source: unknown	TCP traffic detected without corresponding DNS query: 194.49.94.152
Source: unknown	TCP traffic detected without corresponding DNS query: 194.49.94.152
Source: unknown	TCP traffic detected without corresponding DNS query: 194.49.94.152
Source: unknown	TCP traffic detected without corresponding DNS query: 194.49.94.152
Source: unknown	TCP traffic detected without corresponding DNS query: 194.49.94.152
Source: unknown	TCP traffic detected without corresponding DNS query: 194.49.94.152
Source: unknown	TCP traffic detected without corresponding DNS query: 194.49.94.152
Source: unknown	TCP traffic detected without corresponding DNS query: 194.49.94.152
Source: unknown	TCP traffic detected without corresponding DNS query: 194.49.94.152

Source: unknown	HTTPS traffic detected: 34.117.59.81:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.59.81:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.59.81:443 -> 192.168.2.4:49742 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected SmokeLoader

Source: Yara match

File source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\4eD052Od.exe, type: DROPPED

Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe

Code function: 12_2_007FC190 GdiplusStartup,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,GdipCreateBitmapFromHBITMAP,GdipSaveImageToFile,DeleteObject,GdipDisposeImage,DeleteObject,ReleaseDC,GdiplusShutdown,

12_2_007FC190

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.3.14OWDrfahJ.exe.5046420.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\5Rp2df8.exe, type: DROPPED	Matched rule: Detects RedLine infostealer Author: ditekSHen

PE file has a writeable .text section

Source: 4eD052Od.exe.1.dr

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

.NET source code contains very large array initializations

Source: 3.2.2Iu7231.exe.bf000.1.raw.unpack, -Module-.cs

Large array initialization: _003CModule_003E: array initializer size 2400

Source: C:\Users\user\Desktop\14OWDrfahJ.exe	Code function: 0_2_00753BA2	0_2_00753BA2
Source: C:\Users\user\Desktop\14OWDrfahJ.exe	Code function: 0_2_00755C9E	0_2_00755C9E
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\Ey3OF47.exe	Code function: 1_2_00013BA2	1_2_00013BA2
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\Ey3OF47.exe	Code function: 1_2_00015C9E	1_2_00015C9E
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\BC5tT98.exe	Code function: 2_2_00BA3BA2	2_2_00BA3BA2
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\BC5tT98.exe	Code function: 2_2_00BA5C9E	2_2_00BA5C9E
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2Iu7231.exe	Code function: 3_2_00081000	3_2_00081000
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2Iu7231.exe	Code function: 3_2_000AA251	3_2_000AA251
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2Iu7231.exe	Code function: 3_2_00081370	3_2_00081370
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2Iu7231.exe	Code function: 3_2_000AAA49	3_2_000AAA49
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 11_2_070E3FF7	11_2_070E3FF7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 11_2_070E1848	11_2_070E1848
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 11_2_070E1FB0	11_2_070E1FB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 11_2_070E01B0	11_2_070E01B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 11_2_070E1839	11_2_070E1839
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 11_2_072C0848	11_2_072C0848
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 11_2_072C1B68	11_2_072C1B68
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 11_2_072C0838	11_2_072C0838
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 11_2_072C1B59	11_2_072C1B59
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 11_2_0D7F2D20	11_2_0D7F2D20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 11_2_0D7F7DE0	11_2_0D7F7DE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 11_2_0D7F0CA8	11_2_0D7F0CA8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 11_2_0D7F5F80	11_2_0D7F5F80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 11_2_0D7F3998	11_2_0D7F3998
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 11_2_0D7F8B28	11_2_0D7F8B28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 11_2_0D7FDAD0	11_2_0D7FDAD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 11_2_0D7F17F8	11_2_0D7F17F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 11_2_0D7F0040	11_2_0D7F0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 11_2_0D7F53C0	11_2_0D7F53C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 11_2_0D7F22E8	11_2_0D7F22E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 11_2_0D7F53B0	11_2_0D7F53B0
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_0082C060	12_2_0082C060
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_00844190	12_2_00844190
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_008241F0	12_2_008241F0
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_008182C0	12_2_008182C0
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_0083A2F0	12_2_0083A2F0
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_0081E200	12_2_0081E200
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_0081E250	12_2_0081E250
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_00800520	12_2_00800520
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_0081A530	12_2_0081A530
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_008466C0	12_2_008466C0
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_007FEA60	12_2_007FEA60
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_00826AB0	12_2_00826AB0
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_00814BC0	12_2_00814BC0
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_00820DB0	12_2_00820DB0
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_00848DC0	12_2_00848DC0
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_00834D50	12_2_00834D50
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_0089EE10	12_2_0089EE10
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_0082CE40	12_2_0082CE40
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_00829090	12_2_00829090
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_007FD0B0	12_2_007FD0B0
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_00843170	12_2_00843170
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_0081B290	12_2_0081B290
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_00825460	12_2_00825460
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_00823540	12_2_00823540
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_0089F780	12_2_0089F780
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_0083F72B	12_2_0083F72B
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_0080F770	12_2_0080F770
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_00815880	12_2_00815880
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_008CD86E	12_2_008CD86E
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_008459B0	12_2_008459B0
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_00829AA0	12_2_00829AA0
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_00835AA0	12_2_00835AA0
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_00809B20	12_2_00809B20
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_00827DC0	12_2_00827DC0
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_0080BD10	12_2_0080BD10
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_00847EA0	12_2_00847EA0
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_00807FA0	12_2_00807FA0
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_00813F20	12_2_00813F20
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_00811F50	12_2_00811F50
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_008CA1A0	12_2_008CA1A0
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_0089A1D0	12_2_0089A1D0
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_008701F0	12_2_008701F0
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_008C8168	12_2_008C8168
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_007F2220	12_2_007F2220
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_008AC3A0	12_2_008AC3A0
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_008983C0	12_2_008983C0
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_008B0360	12_2_008B0360
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_0080BD10	12_2_0080BD10
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_007F2400	12_2_007F2400
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_008B2420	12_2_008B2420
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_008C05C0	12_2_008C05C0
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_0086E5F0	12_2_0086E5F0
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_008C06F0	12_2_008C06F0
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_008AC650	12_2_008AC650
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_008B2790	12_2_008B2790
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_00809B20	12_2_00809B20
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_00870990	12_2_00870990
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_008829C0	12_2_008829C0
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_008069D0	12_2_008069D0
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_008C49E0	12_2_008C49E0
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_00878970	12_2_00878970
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_008A4B90	12_2_008A4B90
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_007FAB00	12_2_007FAB00
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_00809B20	12_2_00809B20
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_00836FF0	12_2_00836FF0
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_008B2FF0	12_2_008B2FF0
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_008C0F00	12_2_008C0F00
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_00872F40	12_2_00872F40
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_008710ED	12_2_008710ED
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_008DD109	12_2_008DD109
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_00879220	12_2_00879220
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_0081D320	12_2_0081D320
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_00871329	12_2_00871329
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_008B1350	12_2_008B1350
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_007F7380	12_2_007F7380
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_008B14A0	12_2_008B14A0
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_0086D440	12_2_0086D440
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_00805450	12_2_00805450
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_008DB5C0	12_2_008DB5C0
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_008775F0	12_2_008775F0
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_008A36B0	12_2_008A36B0
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_008E3670	12_2_008E3670
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_0086B730	12_2_0086B730
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_00831990	12_2_00831990
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_008799E0	12_2_008799E0
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_00839A90	12_2_00839A90
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_008AFAF0	12_2_008AFAF0
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_0086FA10	12_2_0086FA10
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_008CDBB0	12_2_008CDBB0
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_00825BDE	12_2_00825BDE
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_008C1C70	12_2_008C1C70
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_008B1E80	12_2_008B1E80
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_00809B20	12_2_00809B20
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_00885E00	12_2_00885E00
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_008B3F90	12_2_008B3F90
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_0086DF70	12_2_0086DF70
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_0004C060	17_2_0004C060
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_00064190	17_2_00064190
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_000441F0	17_2_000441F0
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_0003E200	17_2_0003E200
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_0003E250	17_2_0003E250
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_000382C0	17_2_000382C0
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_0005A2F0	17_2_0005A2F0
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_00020520	17_2_00020520
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_0003A530	17_2_0003A530
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_000666C0	17_2_000666C0
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_0001EA60	17_2_0001EA60
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_00046AB0	17_2_00046AB0
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_0001AB00	17_2_0001AB00
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_00034BC0	17_2_00034BC0
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_00054D50	17_2_00054D50
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_00040DB0	17_2_00040DB0
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_00068DC0	17_2_00068DC0
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_000BEE10	17_2_000BEE10
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_0004CE40	17_2_0004CE40
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_00049090	17_2_00049090
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_0001D0B0	17_2_0001D0B0
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_00063170	17_2_00063170
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_0003B290	17_2_0003B290
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_00045460	17_2_00045460
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_00043540	17_2_00043540
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_0005F72B	17_2_0005F72B
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_0008B730	17_2_0008B730
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_0002F770	17_2_0002F770
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_000BF780	17_2_000BF780
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_000ED86E	17_2_000ED86E
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_00035880	17_2_00035880
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_000659B0	17_2_000659B0
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_00049AA0	17_2_00049AA0
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_00055AA0	17_2_00055AA0
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_00029B20	17_2_00029B20
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_0002BD10	17_2_0002BD10
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_00047DC0	17_2_00047DC0
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_00067EA0	17_2_00067EA0
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_00033F20	17_2_00033F20
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_00031F50	17_2_00031F50
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_00027FA0	17_2_00027FA0
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_000E8168	17_2_000E8168
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_000EA1A0	17_2_000EA1A0
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_000BA1D0	17_2_000BA1D0
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_000901F0	17_2_000901F0
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_00012220	17_2_00012220
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_000D0360	17_2_000D0360
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_000CC3A0	17_2_000CC3A0
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_000B83C0	17_2_000B83C0
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_00012400	17_2_00012400
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_000D2420	17_2_000D2420
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_0002BD10	17_2_0002BD10
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_000E05C0	17_2_000E05C0
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_0008E5F0	17_2_0008E5F0
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_000CC650	17_2_000CC650
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_000E06F0	17_2_000E06F0
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_000D2790	17_2_000D2790
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_00029B20	17_2_00029B20
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_00098970	17_2_00098970
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_00090990	17_2_00090990
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_000A29C0	17_2_000A29C0
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_000269D0	17_2_000269D0
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_000E49E0	17_2_000E49E0
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_000C4B90	17_2_000C4B90
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_00029B20	17_2_00029B20
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_000E0F00	17_2_000E0F00
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_00092F40	17_2_00092F40
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_00056FF0	17_2_00056FF0
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_000D2FF0	17_2_000D2FF0
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_000910ED	17_2_000910ED
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_000FD109	17_2_000FD109
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_00099220	17_2_00099220
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_00091329	17_2_00091329
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_0003D320	17_2_0003D320
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_000D1350	17_2_000D1350
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_00017380	17_2_00017380
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_0008D440	17_2_0008D440
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_00025450	17_2_00025450
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_000D14A0	17_2_000D14A0
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_000FB5C0	17_2_000FB5C0
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_000975F0	17_2_000975F0
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_00103670	17_2_00103670
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_000C36B0	17_2_000C36B0
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_00051990	17_2_00051990
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_000999E0	17_2_000999E0
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_0008FA10	17_2_0008FA10
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_00059A90	17_2_00059A90
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_000CFAF0	17_2_000CFAF0
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_000EDBB0	17_2_000EDBB0
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_00045BDE	17_2_00045BDE
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_000E1C70	17_2_000E1C70
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_000A5E00	17_2_000A5E00
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_000D1E80	17_2_000D1E80
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_00029B20	17_2_00029B20
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_0008DF70	17_2_0008DF70
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_000D3F90	17_2_000D3F90

Source: C:\Users\user\Desktop\14OWDrfahJ.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\Ey3OF47.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\BC5tT98.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2Iu7231.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Section loaded: sfc.dll	Jump to behavior

Source: 14OWDrfahJ.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.3.14OWDrfahJ.exe.5046420.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\5Rp2df8.exe, type: DROPPED	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073

Source: C:\Users\user\Desktop\14OWDrfahJ.exe	Code function: 0_2_00751F90 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,ExitWindowsEx,ExitWindowsEx,	0_2_00751F90
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\Ey3OF47.exe	Code function: 1_2_00011F90 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,ExitWindowsEx,ExitWindowsEx,	1_2_00011F90
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\BC5tT98.exe	Code function: 2_2_00BA1F90 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,ExitWindowsEx,ExitWindowsEx,	2_2_00BA1F90

Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: String function: 000CB970 appears 60 times
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: String function: 00074300 appears 55 times
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: String function: 00098F70 appears 86 times
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2Iu7231.exe	Code function: String function: 00092170 appears 52 times
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: String function: 00854300 appears 55 times
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: String function: 008AB970 appears 60 times
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: String function: 00878F70 appears 86 times

Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_00848DC0 SetPriorityClass,SetUnhandledExceptionFilter,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,LoadLibraryA,LoadLibraryA,CreateThread,CloseHandle,Sleep,GetTempPathA,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,SetCurrentDirectoryA,GetFileAttributesA,CreateMutexA,GetLastError,Sleep,Sleep,shutdown,closesocket,WSACleanup,Sleep,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,__aulldiv,__aulldiv,send,send,Sleep,Sleep,Sleep,GetModuleHandleA,GetProcAddress,GetCurrentProcess,CreateThread,CreateThread,CreateThread,CreateThread,FreeLibrary,WaitForSingleObject,CreateThread,CreateThread,CreateThread,CreateThread,CreateThread,CreateThread,CreateThread,CreateThread,WaitForSingleObject,WaitForSingleObject,CloseHandle,DeleteFileA,GetVersionExA,MessageBoxA,Sleep,shutdown,closesocket,WSACleanup,GetModuleHandleA,GetProcAddress,GetCurrentProcess,NtTerminateProcess,GetCurrentProcessId,	12_2_00848DC0
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_0001A470 GetModuleHandleA,GetProcAddress,GetProcessHeap,RtlAllocateHeap,NtQuerySystemInformation,HeapFree,RtlFreeHeap,RtlAllocateHeap,NtQuerySystemInformation,HeapFree,	17_2_0001A470
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_0001A6D0 GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetProcAddress,OpenProcess,CloseHandle,GetCurrentProcess,NtDuplicateObject,CloseHandle,CreateEventA,ResetEvent,CreateThread,WaitForSingleObject,RtlUnicodeStringToAnsiString,CloseHandle,CloseHandle,GetCurrentProcess,CloseHandle,TerminateThread,CloseHandle,CloseHandle,CloseHandle,	17_2_0001A6D0
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_00068DC0 SetPriorityClass,SetUnhandledExceptionFilter,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,LoadLibraryA,LoadLibraryA,CreateThread,FindCloseChangeNotification,Sleep,GetTempPathA,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,SetCurrentDirectoryA,GetFileAttributesA,CreateMutexA,GetLastError,Sleep,Sleep,shutdown,closesocket,WSACleanup,Sleep,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,__aulldiv,__aulldiv,send,send,Sleep,Sleep,Sleep,GetModuleHandleA,GetProcAddress,GetCurrentProcess,CreateThread,CreateThread,CreateThread,CreateThread,FreeLibrary,WaitForSingleObject,CreateThread,CreateThread,CreateThread,CreateThread,CreateThread,CreateThread,CreateThread,CreateThread,WaitForSingleObject,WaitForSingleObject,CloseHandle,DeleteFileA,GetVersionExA,MessageBoxA,Sleep,shutdown,closesocket,WSACleanup,GetModuleHandleA,GetProcAddress,GetCurrentProcess,NtTerminateProcess,GetCurrentProcessId,	17_2_00068DC0

Source: 14OWDrfahJ.exe	Static PE information: Resource name: RT_RCDATA type: Microsoft Cabinet archive data, many, 1053596 bytes, 2 files, at 0x2c +A "Ey3OF47.exe" +A "5Rp2df8.exe", ID 1788, number 1, 36 datablocks, 0x1503 compression
Source: Ey3OF47.exe.0.dr	Static PE information: Resource name: RT_RCDATA type: Microsoft Cabinet archive data, many, 829321 bytes, 2 files, at 0x2c +A "BC5tT98.exe" +A "4eD052Od.exe", ID 1786, number 1, 28 datablocks, 0x1503 compression
Source: BC5tT98.exe.1.dr	Static PE information: Resource name: RT_RCDATA type: Microsoft Cabinet archive data, many, 702168 bytes, 2 files, at 0x2c +A "2Iu7231.exe" +A "3rB05VU.exe", ID 1684, number 1, 56 datablocks, 0x1503 compression

Source: 4eD052Od.exe.1.dr

Static PE information: No import functions for PE file found

Source: 14OWDrfahJ.exe, 00000000.00000003.1633376402.000000000330F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameoffDef.exe. vs 14OWDrfahJ.exe
Source: 14OWDrfahJ.exe	Binary or memory string: OriginalFilenameWEXTRACT.EXE .MUID vs 14OWDrfahJ.exe

Source: 4eD052Od.exe.1.dr

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: 4eD052Od.exe.1.dr

Static PE information: Section .text

Source: 14OWDrfahJ.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: FANBooster131.lnk.12.dr

LNK file: ..\..\..\..\..\..\Local\Temp\FANBooster131\FANBooster131.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

File created: C:\Users\user\AppData\Local\SystemCache

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@26/50@1/2

Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\14OWDrfahJ.exe

Code function: 0_2_0075597D GetCurrentDirectoryA,SetCurrentDirectoryA,GetDiskFreeSpaceA,MulDiv,GetVolumeInformationA,memset,GetLastError,FormatMessageA,SetCurrentDirectoryA,memset,GetLastError,FormatMessageA,SetCurrentDirectoryA,

0_2_0075597D

Source: C:\Users\user\Desktop\14OWDrfahJ.exe

Code function: 0_2_00754FE0 FindResourceA,LoadResource,LockResource,GetDlgItem,ShowWindow,GetDlgItem,ShowWindow,FreeResource,SendMessageA,

0_2_00754FE0

Source: 14OWDrfahJ.exe	ReversingLabs: Detection: 50%
Source: 14OWDrfahJ.exe	Virustotal: Detection: 56%

Source: C:\Users\user\Desktop\14OWDrfahJ.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\14OWDrfahJ.exe C:\Users\user\Desktop\14OWDrfahJ.exe
Source: C:\Users\user\Desktop\14OWDrfahJ.exe	Process created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\Ey3OF47.exe C:\Users\user\AppData\Local\Temp\IXP000.TMP\Ey3OF47.exe
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\Ey3OF47.exe	Process created: C:\Users\user\AppData\Local\Temp\IXP001.TMP\BC5tT98.exe C:\Users\user\AppData\Local\Temp\IXP001.TMP\BC5tT98.exe
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\BC5tT98.exe	Process created: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2Iu7231.exe C:\Users\user\AppData\Local\Temp\IXP002.TMP\2Iu7231.exe
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2Iu7231.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\rundll32.exe C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP000.TMP\
Source: unknown	Process created: C:\Windows\System32\rundll32.exe C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP001.TMP\
Source: unknown	Process created: C:\Windows\System32\rundll32.exe C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP002.TMP\
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2Iu7231.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\BC5tT98.exe	Process created: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe
Source: unknown	Process created: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\MaxLoonaFest131\MaxLoonaFest131.exe "C:\Users\user\AppData\Local\MaxLoonaFest131\MaxLoonaFest131.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\MaxLoonaFest131\MaxLoonaFest131.exe "C:\Users\user\AppData\Local\MaxLoonaFest131\MaxLoonaFest131.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\FANBooster131\FANBooster131.exe "C:\Users\user\AppData\Local\Temp\FANBooster131\FANBooster131.exe"
Source: C:\Users\user\Desktop\14OWDrfahJ.exe	Process created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\Ey3OF47.exe C:\Users\user\AppData\Local\Temp\IXP000.TMP\Ey3OF47.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\Ey3OF47.exe	Process created: C:\Users\user\AppData\Local\Temp\IXP001.TMP\BC5tT98.exe C:\Users\user\AppData\Local\Temp\IXP001.TMP\BC5tT98.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\BC5tT98.exe	Process created: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2Iu7231.exe C:\Users\user\AppData\Local\Temp\IXP002.TMP\2Iu7231.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\BC5tT98.exe	Process created: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2Iu7231.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\14OWDrfahJ.exe	Code function: 0_2_00751F90 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,ExitWindowsEx,ExitWindowsEx,	0_2_00751F90
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\Ey3OF47.exe	Code function: 1_2_00011F90 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,ExitWindowsEx,ExitWindowsEx,	1_2_00011F90
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\BC5tT98.exe	Code function: 2_2_00BA1F90 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,ExitWindowsEx,ExitWindowsEx,	2_2_00BA1F90

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'

Source: C:\Users\user\Desktop\14OWDrfahJ.exe

File created: C:\Users\user\AppData\Local\Temp\IXP000.TMP

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe

Code function: 12_2_00807FA0 CopyFileA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,CopyFileA,SHGetFolderPathA,CoInitialize,CoCreateInstance,MultiByteToWideChar,CoUninitialize,CopyFileA,GetUserNameA,

12_2_00807FA0

Source: C:\Users\user\Desktop\14OWDrfahJ.exe

0_2_0075597D

Source: BC5tT98.exe, 00000002.00000003.1636508373.0000000004A9B000.00000004.00000020.00020000.00000000.sdmp, 3rB05VU.exe, 3rB05VU.exe, 0000000C.00000003.2222685763.0000000000B75000.00000004.00000020.00020000.00000000.sdmp, 3rB05VU.exe, 0000000C.00000000.2217497768.00000000008F6000.00000002.00000001.01000000.0000000A.sdmp, 3rB05VU.exe, 0000000C.00000002.2581115078.00000000008F6000.00000002.00000001.01000000.0000000A.sdmp, 3rB05VU.exe, 0000000C.00000003.2218839974.0000000000B41000.00000004.00000020.00020000.00000000.sdmp, OfficeTrackerNMP131.exe, OfficeTrackerNMP131.exe, 00000011.00000000.2237844332.0000000000116000.00000002.00000001.01000000.0000000C.sdmp, OfficeTrackerNMP131.exe, 00000011.00000002.2360401589.0000000000116000.00000002.00000001.01000000.0000000C.sdmp, OfficeTrackerNMP131.exe, 00000012.00000002.2885751133.0000000000116000.00000002.00000001.01000000.0000000C.sdmp, OfficeTrackerNMP131.exe, 00000012.00000000.2238719070.0000000000116000.00000002.00000001.01000000.0000000C.sdmp, MaxLoonaFest131.exe, 00000013.00000000.2359759982.0000000000696000.00000002.00000001.01000000.0000000E.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: BC5tT98.exe, 00000002.00000003.1636508373.0000000004A9B000.00000004.00000020.00020000.00000000.sdmp, 3rB05VU.exe, 0000000C.00000003.2222685763.0000000000B75000.00000004.00000020.00020000.00000000.sdmp, 3rB05VU.exe, 0000000C.00000000.2217497768.00000000008F6000.00000002.00000001.01000000.0000000A.sdmp, 3rB05VU.exe, 0000000C.00000002.2581115078.00000000008F6000.00000002.00000001.01000000.0000000A.sdmp, 3rB05VU.exe, 0000000C.00000003.2218839974.0000000000B41000.00000004.00000020.00020000.00000000.sdmp, OfficeTrackerNMP131.exe, 00000011.00000000.2237844332.0000000000116000.00000002.00000001.01000000.0000000C.sdmp, OfficeTrackerNMP131.exe, 00000011.00000002.2360401589.0000000000116000.00000002.00000001.01000000.0000000C.sdmp, OfficeTrackerNMP131.exe, 00000012.00000002.2885751133.0000000000116000.00000002.00000001.01000000.0000000C.sdmp, OfficeTrackerNMP131.exe, 00000012.00000000.2238719070.0000000000116000.00000002.00000001.01000000.0000000C.sdmp, MaxLoonaFest131.exe, 00000013.00000000.2359759982.0000000000696000.00000002.00000001.01000000.0000000E.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = sqlite_rename_table(sql, %Q), tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
Source: 3rB05VU.exe, 0000000C.00000003.2249149800.0000000000BF8000.00000004.00000020.00020000.00000000.sdmp, 3rB05VU.exe, 0000000C.00000003.2249217983.0000000000C09000.00000004.00000020.00020000.00000000.sdmp, 3rB05VU.exe, 0000000C.00000003.2248373350.0000000000BF8000.00000004.00000020.00020000.00000000.sdmp, 3rB05VU.exe, 0000000C.00000003.2248411636.0000000000C09000.00000004.00000020.00020000.00000000.sdmp, OfficeTrackerNMP131.exe, 00000011.00000003.2261504201.0000000000C19000.00000004.00000020.00020000.00000000.sdmp, OfficeTrackerNMP131.exe, 00000011.00000003.2262415785.0000000003645000.00000004.00000020.00020000.00000000.sdmp, OfficeTrackerNMP131.exe, 00000012.00000003.2262234619.000000000100E000.00000004.00000020.00020000.00000000.sdmp, OfficeTrackerNMP131.exe, 00000012.00000003.2262211046.0000000000FFD000.00000004.00000020.00020000.00000000.sdmp, OfficeTrackerNMP131.exe, 00000012.00000003.2263383740.0000000000FFD000.00000004.00000020.00020000.00000000.sdmp, OfficeTrackerNMP131.exe, 00000012.00000003.2265504372.000000000100C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a403a0b75e95c07da2caa7f780446a62\mscorlib.ni.dll

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe

Code function: 12_2_007FD0B0 RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,EnumDisplayDevicesA,EnumDisplayDevicesA,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey,

12_2_007FD0B0

Source: unknown

Process created: C:\Windows\System32\rundll32.exe C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP000.TMP\

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7352:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8100:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8052:120:WilError_03

Source: C:\Users\user\Desktop\14OWDrfahJ.exe	Command line argument: Kernel32.dll	0_2_00752BFB
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\Ey3OF47.exe	Command line argument: Kernel32.dll	1_2_00012BFB
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\BC5tT98.exe	Command line argument: Kernel32.dll	2_2_00BA2BFB
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Command line argument: 131	12_2_00848DC0
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Command line argument: 131	12_2_00848DC0
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Command line argument: 131	12_2_00848DC0
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Command line argument: 131	12_2_00848DC0
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Command line argument: 131	12_2_00848DC0
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Command line argument: 131	12_2_00848DC0
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Command line argument: 131	12_2_00848DC0
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Command line argument: /*************/	12_2_00848DC0
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Command line argument: \config.xml	12_2_00848DC0
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Command line argument: <config>	12_2_00848DC0
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Command line argument: </config>	12_2_00848DC0
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Command line argument: 131	12_2_00848DC0
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Command line argument: 131	12_2_00848DC0
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Command line argument: 89.149.18.60	12_2_00848DC0
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Command line argument: 89.149.18.60	12_2_00848DC0
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Command line argument: 89.149.18.60	12_2_00848DC0
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Command line argument: 89.149.18.60	12_2_00848DC0
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Command line argument: 89.149.18.60	12_2_00848DC0
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Command line argument: ntdll.dll	12_2_00848DC0
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Command line argument: 89.149.18.60	12_2_00848DC0
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Command line argument: 89.149.18.60	12_2_00848DC0
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Command line argument: 89.149.18.60	12_2_00848DC0
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Command line argument: Error	12_2_00848DC0
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Command line argument: ntdll.dll	12_2_00848DC0
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Command line argument: 131	17_2_00068DC0
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Command line argument: 131	17_2_00068DC0
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Command line argument: 131	17_2_00068DC0
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Command line argument: 131	17_2_00068DC0
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Command line argument: 131	17_2_00068DC0
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Command line argument: 131	17_2_00068DC0
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Command line argument: 131	17_2_00068DC0
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Command line argument: /*************/	17_2_00068DC0
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Command line argument: \config.xml	17_2_00068DC0
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Command line argument: <config>	17_2_00068DC0
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Command line argument: </config>	17_2_00068DC0
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Command line argument: 131	17_2_00068DC0
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Command line argument: 131	17_2_00068DC0
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Command line argument: 89.149.18.60	17_2_00068DC0
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Command line argument: 89.149.18.60	17_2_00068DC0
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Command line argument: 89.149.18.60	17_2_00068DC0
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Command line argument: 89.149.18.60	17_2_00068DC0
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Command line argument: 89.149.18.60	17_2_00068DC0
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Command line argument: ntdll.dll	17_2_00068DC0
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Command line argument: 89.149.18.60	17_2_00068DC0
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Command line argument: 89.149.18.60	17_2_00068DC0
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Command line argument: 89.149.18.60	17_2_00068DC0
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Command line argument: Error	17_2_00068DC0
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Command line argument: ntdll.dll	17_2_00068DC0

Source: 3rB05VU.exe	String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address
Source: OfficeTrackerNMP131.exe	String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address

Source: C:\Users\user\Desktop\14OWDrfahJ.exe	Automated click: OK
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\Ey3OF47.exe	Automated click: OK

Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: 14OWDrfahJ.exe

Static file information: File size 1200128 > 1048576

Source: 14OWDrfahJ.exe

Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x11ca00

Source: 14OWDrfahJ.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: 14OWDrfahJ.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: 14OWDrfahJ.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: 14OWDrfahJ.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: 14OWDrfahJ.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: 14OWDrfahJ.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: 14OWDrfahJ.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: 14OWDrfahJ.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb source: 3rB05VU.exe, 0000000C.00000002.2582912924.0000000003E30000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831) source: 3rB05VU.exe, 0000000C.00000002.2582538713.0000000003CAA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831nJM source: 3rB05VU.exe, 0000000C.00000002.2581982519.0000000002F70000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Temp\tempAVSMIf5cNgqvav9.pdb\.m source: 3rB05VU.exe, 0000000C.00000002.2582456554.0000000003BC2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb source: 3rB05VU.exe, 0000000C.00000002.2582147162.0000000003350000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831.31/ source: 3rB05VU.exe, 0000000C.00000002.2582612223.0000000003D54000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831 source: 3rB05VU.exe, 0000000C.00000002.2582538713.0000000003CAA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb*12 source: 3rB05VU.exe, 0000000C.00000002.2582147162.0000000003320000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb** source: 3rB05VU.exe, 0000000C.00000002.2582407905.0000000003B51000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb source: 3rB05VU.exe, 0000000C.00000002.2582147162.0000000003350000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: 3rB05VU.exe, 0000000C.00000002.2582538713.0000000003CAA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: p.pdb source: 3rB05VU.exe, 0000000C.00000002.2582912924.0000000003E30000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Temp\Symbols\winload_prod.pdb?rH source: 3rB05VU.exe, 0000000C.00000002.2582538713.0000000003CAA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: 3rB05VU.exe, 0000000C.00000002.2583112343.0000000003F70000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: 3rB05VU.exe, 0000000C.00000002.2582912924.0000000003E30000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2E source: 3rB05VU.exe, 0000000C.00000002.2583615801.000000000428E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2D source: 3rB05VU.exe, 0000000C.00000002.2583615801.000000000428E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb source: 3rB05VU.exe, 0000000C.00000002.2582612223.0000000003D54000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2tion Data\A source: 3rB05VU.exe, 0000000C.00000002.2582147162.0000000003350000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb source: 3rB05VU.exe, 0000000C.00000002.2581982519.0000000002F70000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: 3rB05VU.exe, 0000000C.00000002.2583154801.0000000003FB2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: 3rB05VU.exe, 0000000C.00000002.2582612223.0000000003D54000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wextract.pdbGCTL source: 14OWDrfahJ.exe, BC5tT98.exe.1.dr, Ey3OF47.exe.0.dr
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbolsntkrnlmp.pdbwW source: 3rB05VU.exe, 0000000C.00000002.2582147162.0000000003350000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb source: 3rB05VU.exe, 0000000C.00000002.2583154801.0000000003FB2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2t source: 3rB05VU.exe, 0000000C.00000002.2582317012.0000000003A30000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb source: 3rB05VU.exe, 0000000C.00000002.2582147162.0000000003350000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2d source: 3rB05VU.exe, 0000000C.00000002.2582912924.0000000003E30000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb.O) source: 3rB05VU.exe, 0000000C.00000002.2583154801.0000000003FB2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\tempAVSgsImjMYlWzR3.pdb%k6 source: 3rB05VU.exe, 0000000C.00000002.2581982519.0000000002F70000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: 3rB05VU.exe, 0000000C.00000002.2582456554.0000000003BC2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb source: 3rB05VU.exe, 0000000C.00000002.2581982519.0000000002F70000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mp.pdb source: 3rB05VU.exe, 0000000C.00000002.2582317012.0000000003A30000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb source: 3rB05VU.exe, 0000000C.00000002.2583706770.0000000004378000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831r source: 3rB05VU.exe, 0000000C.00000002.2583154801.0000000003FB2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2j source: 3rB05VU.exe, 0000000C.00000002.2582147162.0000000003320000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Temp\tempAVSaeI8GhtgT29e.pdb*ta source: 3rB05VU.exe, 0000000C.00000002.2582456554.0000000003BC2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2b source: 3rB05VU.exe, 0000000C.00000002.2581982519.0000000002F70000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb source: 3rB05VU.exe, 0000000C.00000002.2583154801.0000000003FB2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Temp\Symbols\winload_prod.pdb source: OfficeTrackerNMP131.exe, 00000011.00000002.2362816797.0000000003CD0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb source: 3rB05VU.exe, 0000000C.00000002.2582407905.0000000003B51000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: 3rB05VU.exe, 0000000C.00000002.2582147162.0000000003320000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb source: 3rB05VU.exe, 0000000C.00000002.2583475835.0000000004177000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831 source: 3rB05VU.exe, 0000000C.00000002.2581982519.0000000002F70000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831 source: 3rB05VU.exe, 0000000C.00000002.2583749077.00000000043E2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Datarnlmp.pdbr source: 3rB05VU.exe, 0000000C.00000002.2583112343.0000000003F70000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdbe\CXJ source: 3rB05VU.exe, 0000000C.00000002.2581982519.0000000002F70000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\tempAVSaeI8GhtgT29e.pdbA source: 3rB05VU.exe, 0000000C.00000002.2582317012.0000000003A30000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb source: 3rB05VU.exe, 0000000C.00000002.2583706770.0000000004378000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb. source: 3rB05VU.exe, 0000000C.00000002.2582456554.0000000003BC2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb source: 3rB05VU.exe, 0000000C.00000002.2581982519.0000000002F70000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb. source: 3rB05VU.exe, 0000000C.00000002.2583244317.00000000040FC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdbAcrobat source: 3rB05VU.exe, 0000000C.00000002.2582912924.0000000003E30000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2G?; source: 3rB05VU.exe, 0000000C.00000002.2582612223.0000000003D54000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831 source: 3rB05VU.exe, 0000000C.00000002.2583008356.0000000003E96000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb**e\ source: 3rB05VU.exe, 0000000C.00000002.2583706770.0000000004378000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831e\. source: 3rB05VU.exe, 0000000C.00000002.2582612223.0000000003D54000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdbol source: 3rB05VU.exe, 0000000C.00000002.2582317012.0000000003A30000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb source: 3rB05VU.exe, 0000000C.00000002.2582407905.0000000003B51000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdbcrobat\DCa source: 3rB05VU.exe, 0000000C.00000002.2582912924.0000000003E30000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831O source: 3rB05VU.exe, 0000000C.00000002.2582912924.0000000003E30000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831 source: 3rB05VU.exe, 0000000C.00000002.2583154801.0000000003FB2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Temp\Symbols\ntkrnlmp.pdb source: 3rB05VU.exe, 0000000C.00000002.2583749077.00000000043E2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831tate~X source: 3rB05VU.exe, 0000000C.00000002.2582147162.0000000003350000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831 source: 3rB05VU.exe, 0000000C.00000002.2582456554.0000000003BC2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831 source: 3rB05VU.exe, 0000000C.00000002.2582147162.0000000003350000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\\.@\ source: OfficeTrackerNMP131.exe, 00000011.00000002.2362816797.0000000003CD0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Crowd Denylmp.pdb source: 3rB05VU.exe, 0000000C.00000002.2583154801.0000000003FB2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb source: 3rB05VU.exe, 0000000C.00000002.2583615801.000000000428E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: 3rB05VU.exe, 0000000C.00000002.2581982519.0000000002F70000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Temp\tempAVSaeI8GhtgT29e.pdb\.Y source: 3rB05VU.exe, 0000000C.00000002.2583749077.00000000043E2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb source: 3rB05VU.exe, 0000000C.00000002.2582456554.0000000003BC2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: 3rB05VU.exe, 0000000C.00000002.2583008356.0000000003E96000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Temp\Symbols\winload_prod.pdb\*X source: 3rB05VU.exe, 0000000C.00000002.2583749077.00000000043E2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdbAcrobatpData\1 source: 3rB05VU.exe, 0000000C.00000002.2581982519.0000000002F70000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb source: 3rB05VU.exe, 0000000C.00000002.2582407905.0000000003B51000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Temp\tempAVSgsImjMYlWzR3.pdb\.^7 source: OfficeTrackerNMP131.exe, 00000011.00000002.2362816797.0000000003CD0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831 source: 3rB05VU.exe, 0000000C.00000002.2581982519.0000000002F70000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831 source: 3rB05VU.exe, 0000000C.00000002.2583008356.0000000003E96000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Temp\Symbols\winload_prod.pdbs\*O7 source: OfficeTrackerNMP131.exe, 00000011.00000002.2362816797.0000000003CD0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Crashpadnlmp.pdb\ source: 3rB05VU.exe, 0000000C.00000002.2583154801.0000000003FB2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb source: 3rB05VU.exe, 0000000C.00000002.2583244317.00000000040FC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: 3rB05VU.exe, 0000000C.00000002.2582317012.0000000003A30000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831 source: 3rB05VU.exe, 0000000C.00000002.2582317012.0000000003A30000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb source: 3rB05VU.exe, 0000000C.00000002.2582407905.0000000003B51000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Temp\tempAVSaeI8GhtgT29e.pdb\.. source: 3rB05VU.exe, 0000000C.00000002.2582612223.0000000003D54000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb source: 3rB05VU.exe, 0000000C.00000002.2582147162.0000000003350000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Temp\Symbols\winload_prod.pdbs*Te source: 3rB05VU.exe, 0000000C.00000002.2583706770.0000000004378000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\tempAVSgsImjMYlWzR3.pdbFGw source: 3rB05VU.exe, 0000000C.00000002.2581982519.0000000002F70000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: 3rB05VU.exe, 0000000C.00000002.2581982519.0000000002F70000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Temp\Symbols\ntkrnlmp.pdbe\*s\ source: 3rB05VU.exe, 0000000C.00000002.2582612223.0000000003D54000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Temp\Symbols\ntkrnlmp.pdb source: 3rB05VU.exe, 0000000C.00000002.2582538713.0000000003CAA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A58310 source: 3rB05VU.exe, 0000000C.00000002.2583008356.0000000003E96000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Temp\tempAVSaeI8GhtgT29e.pdb\.Q source: 3rB05VU.exe, 0000000C.00000002.2582407905.0000000003B51000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2tory source: OfficeTrackerNMP131.exe, 00000011.00000002.2362816797.0000000003CD0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb source: 3rB05VU.exe, 0000000C.00000002.2583244317.00000000040FC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: OfficeTrackerNMP131.exe, 00000011.00000002.2362816797.0000000003CD0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831che source: 3rB05VU.exe, 0000000C.00000002.2583524935.00000000041D9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2I source: 3rB05VU.exe, 0000000C.00000002.2582456554.0000000003BC2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: lmp.pdb source: 3rB05VU.exe, 0000000C.00000002.2583154801.0000000003FB2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: .pdb\. source: 3rB05VU.exe, 0000000C.00000002.2582612223.0000000003D54000.00000004.00000020.00020000.00000000.sdmp, 3rB05VU.exe, 0000000C.00000002.2582456554.0000000003BC2000.00000004.00000020.00020000.00000000.sdmp, 3rB05VU.exe, 0000000C.00000002.2583749077.00000000043E2000.00000004.00000020.00020000.00000000.sdmp, 3rB05VU.exe, 0000000C.00000002.2582407905.0000000003B51000.00000004.00000020.00020000.00000000.sdmp, 3rB05VU.exe, 0000000C.00000002.2582538713.0000000003CAA000.00000004.00000020.00020000.00000000.sdmp, OfficeTrackerNMP131.exe, 00000011.00000002.2362816797.0000000003CD0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831 source: 3rB05VU.exe, 0000000C.00000002.2582912924.0000000003E30000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Temp\Symbols\ntkrnlmp.pdb source: OfficeTrackerNMP131.exe, 00000011.00000002.2362816797.0000000003CD0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Temp\tempAVSMIf5cNgqvav9.pdb\." source: 3rB05VU.exe, 0000000C.00000002.2582538713.0000000003CAA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: 3rB05VU.exe, 0000000C.00000002.2582147162.0000000003350000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Datanlmp.pdbr* source: 3rB05VU.exe, 0000000C.00000002.2583154801.0000000003FB2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb source: 3rB05VU.exe, 0000000C.00000002.2582612223.0000000003D54000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: 3rB05VU.exe, 0000000C.00000002.2582612223.0000000003D54000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: 3rB05VU.exe, 0000000C.00000002.2582456554.0000000003BC2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Temp\Symbols\ntkrnlmp.pdb..\? source: 3rB05VU.exe, 0000000C.00000002.2583749077.00000000043E2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: 3rB05VU.exe, 0000000C.00000002.2583749077.00000000043E2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb source: 3rB05VU.exe, 0000000C.00000002.2582317012.0000000003A30000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wextract.pdb source: 14OWDrfahJ.exe, BC5tT98.exe.1.dr, Ey3OF47.exe.0.dr
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdbeegkt source: 3rB05VU.exe, 0000000C.00000002.2581982519.0000000002F70000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A583106e source: 3rB05VU.exe, 0000000C.00000002.2582147162.0000000003350000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831 source: 3rB05VU.exe, 0000000C.00000002.2583615801.000000000428E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb source: 3rB05VU.exe, 0000000C.00000002.2582538713.0000000003CAA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdbZ source: 3rB05VU.exe, 0000000C.00000002.2582407905.0000000003B51000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdbDCH source: 3rB05VU.exe, 0000000C.00000002.2582407905.0000000003B51000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb source: 3rB05VU.exe, 0000000C.00000002.2583154801.0000000003FB2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831. source: 3rB05VU.exe, 0000000C.00000002.2582456554.0000000003BC2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb source: 3rB05VU.exe, 0000000C.00000002.2581982519.0000000002F70000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb5\|7 source: 3rB05VU.exe, 0000000C.00000002.2583154801.0000000003FB2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: 3rB05VU.exe, 0000000C.00000002.2581982519.0000000002F70000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831 source: 3rB05VU.exe, 0000000C.00000002.2582612223.0000000003D54000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb source: 3rB05VU.exe, 0000000C.00000002.2581982519.0000000002F70000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: 3rB05VU.exe, 0000000C.00000002.2583706770.0000000004378000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\* source: 3rB05VU.exe, 0000000C.00000002.2583615801.000000000428E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2tData\Packages\Microsoft.Windows.CallingShellApp_cw5n1h2txyewy\AC\** source: 3rB05VU.exe, 0000000C.00000002.2582147162.0000000003350000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831 source: 3rB05VU.exe, 0000000C.00000002.2582612223.0000000003D54000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831 source: 3rB05VU.exe, 0000000C.00000002.2583154801.0000000003FB2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: nlmp.pdb source: 3rB05VU.exe, 0000000C.00000002.2583154801.0000000003FB2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Temp\tempAVSgsImjMYlWzR3.pdb.Gp source: 3rB05VU.exe, 0000000C.00000002.2582538713.0000000003CAA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb source: 3rB05VU.exe, 0000000C.00000002.2583475835.0000000004177000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831 source: 3rB05VU.exe, 0000000C.00000002.2581982519.0000000002F70000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2ata source: 3rB05VU.exe, 0000000C.00000002.2582612223.0000000003D54000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb source: 3rB05VU.exe, 0000000C.00000002.2582147162.0000000003350000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb source: 3rB05VU.exe, 0000000C.00000002.2582612223.0000000003D54000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdbbets source: 3rB05VU.exe, 0000000C.00000002.2583615801.000000000428E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb source: 3rB05VU.exe, 0000000C.00000002.2581982519.0000000002F70000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdbC8 source: 3rB05VU.exe, 0000000C.00000002.2583154801.0000000003FB2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: rnlmp.pdb source: 3rB05VU.exe, 0000000C.00000002.2583112343.0000000003F70000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: nlmp.pdb\ source: 3rB05VU.exe, 0000000C.00000002.2583154801.0000000003FB2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb source: 3rB05VU.exe, 0000000C.00000002.2582407905.0000000003B51000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb source: 3rB05VU.exe, 0000000C.00000002.2582538713.0000000003CAA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831 source: 3rB05VU.exe, 0000000C.00000002.2583524935.00000000041D9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831 source: 3rB05VU.exe, 0000000C.00000002.2582147162.0000000003320000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb source: 3rB05VU.exe, 0000000C.00000002.2583008356.0000000003E96000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdbcrobat\DC source: 3rB05VU.exe, 0000000C.00000002.2583008356.0000000003E96000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: 3rB05VU.exe, 0000000C.00000002.2583749077.00000000043E2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdbathe source: 3rB05VU.exe, 0000000C.00000002.2582612223.0000000003D54000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdbeees source: 3rB05VU.exe, 0000000C.00000002.2582407905.0000000003B51000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Temp\tempAVSEtti_jQBHy11.pdb\* source: 3rB05VU.exe, 0000000C.00000002.2583749077.00000000043E2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Temp\Symbols\winload_prod.pdb source: 3rB05VU.exe, 0000000C.00000002.2583749077.00000000043E2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Temp\Symbols\winload_prod.pdbcrobat source: 3rB05VU.exe, 0000000C.00000002.2582612223.0000000003D54000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb source: 3rB05VU.exe, 0000000C.00000002.2582407905.0000000003B51000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\tempAVSmnUz2tnF899j.pdb source: 3rB05VU.exe, 0000000C.00000002.2583244317.00000000040FC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb source: 3rB05VU.exe, 0000000C.00000002.2581982519.0000000002F70000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: 3rB05VU.exe, 0000000C.00000002.2583615801.000000000428E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdbat source: 3rB05VU.exe, 0000000C.00000002.2582407905.0000000003B51000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb source: 3rB05VU.exe, 0000000C.00000002.2582912924.0000000003E30000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A58318 source: 3rB05VU.exe, 0000000C.00000002.2583615801.000000000428E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: 3rB05VU.exe, 0000000C.00000002.2583615801.000000000428E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831 source: 3rB05VU.exe, 0000000C.00000002.2583706770.0000000004378000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb-j source: 3rB05VU.exe, 0000000C.00000002.2581982519.0000000002F70000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2f source: 3rB05VU.exe, 0000000C.00000002.2582538713.0000000003CAA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: 3rB05VU.exe, 0000000C.00000002.2583244317.00000000040FC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb source: 3rB05VU.exe, 0000000C.00000002.2582912924.0000000003E30000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831&! source: 3rB05VU.exe, 0000000C.00000002.2583008356.0000000003E96000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb source: 3rB05VU.exe, 0000000C.00000002.2582147162.0000000003350000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2ownload.error= source: 3rB05VU.exe, 0000000C.00000002.2583244317.00000000040FC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb source: 3rB05VU.exe, 0000000C.00000002.2583008356.0000000003E96000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Temp\Symbols\winload_prod.pdb source: 3rB05VU.exe, 0000000C.00000002.2582538713.0000000003CAA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831 source: 3rB05VU.exe, 0000000C.00000002.2583749077.00000000043E2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\blob_storage\fccd7e85-a1ff-4466-9ff5-c20d62f6e0a2mp.pdb source: 3rB05VU.exe, 0000000C.00000002.2582317012.0000000003A30000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb source: 3rB05VU.exe, 0000000C.00000002.2583154801.0000000003FB2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdbn)+4 source: 3rB05VU.exe, 0000000C.00000002.2582147162.0000000003350000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831 source: 3rB05VU.exe, 0000000C.00000002.2583615801.000000000428E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: 3rB05VU.exe, 0000000C.00000002.2583154801.0000000003FB2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831" source: 3rB05VU.exe, 0000000C.00000002.2582456554.0000000003BC2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb source: 3rB05VU.exe, 0000000C.00000002.2582538713.0000000003CAA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2j source: 3rB05VU.exe, 0000000C.00000002.2583749077.00000000043E2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdbted8bbwe source: 3rB05VU.exe, 0000000C.00000002.2582147162.0000000003350000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Temp\Symbols\ntkrnlmp.pdb*elrw source: 3rB05VU.exe, 0000000C.00000002.2582538713.0000000003CAA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb source: 3rB05VU.exe, 0000000C.00000002.2582317012.0000000003A30000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdbtDi source: 3rB05VU.exe, 0000000C.00000002.2582317012.0000000003A30000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831 source: 3rB05VU.exe, 0000000C.00000002.2582317012.0000000003A30000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831 source: 3rB05VU.exe, 0000000C.00000002.2582456554.0000000003BC2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdbobeTemp source: 3rB05VU.exe, 0000000C.00000002.2582456554.0000000003BC2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdbe\l source: 3rB05VU.exe, 0000000C.00000002.2583475835.0000000004177000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2]! source: 3rB05VU.exe, 0000000C.00000002.2583008356.0000000003E96000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: 3rB05VU.exe, 0000000C.00000002.2582317012.0000000003A30000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: 3rB05VU.exe, 0000000C.00000002.2583524935.00000000041D9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Temp\tempAVSaeI8GhtgT29e.pdb\. source: 3rB05VU.exe, 0000000C.00000002.2582538713.0000000003CAA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2B source: 3rB05VU.exe, 0000000C.00000002.2583706770.0000000004378000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\SymbolsFA1AC2p.pdb}Cd source: 3rB05VU.exe, 0000000C.00000002.2582912924.0000000003E30000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Temp\Symbols\winload_prod.pdbemp source: 3rB05VU.exe, 0000000C.00000002.2582538713.0000000003CAA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb source: 3rB05VU.exe, 0000000C.00000002.2582456554.0000000003BC2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Temp\Symbols\winload_prod.pdb source: 3rB05VU.exe, 0000000C.00000002.2582612223.0000000003D54000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdbe\*he-p source: 3rB05VU.exe, 0000000C.00000002.2582538713.0000000003CAA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831MY source: 3rB05VU.exe, 0000000C.00000002.2583244317.00000000040FC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2story source: 3rB05VU.exe, 0000000C.00000002.2583112343.0000000003F70000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831 source: 3rB05VU.exe, 0000000C.00000002.2583244317.00000000040FC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb source: 3rB05VU.exe, 0000000C.00000002.2583154801.0000000003FB2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831.k source: 3rB05VU.exe, 0000000C.00000002.2583706770.0000000004378000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831 source: OfficeTrackerNMP131.exe, 00000011.00000002.2362816797.0000000003CD0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Temp\Symbols\ntkrnlmp.pdbes\**8 source: OfficeTrackerNMP131.exe, 00000011.00000002.2362816797.0000000003CD0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Application Data\Application Data\Temp\Symbols\winload_prod.pdb source: 3rB05VU.exe, 0000000C.00000002.2582538713.0000000003CAA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Files\AppData\Local\Temp\Symbols\ntkrnlmp.pdb source: 3rB05VU.exe, 0000000C.00000002.2582612223.0000000003D54000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\14OWDrfahJ.exe	Code function: 0_2_0075724D push ecx; ret	0_2_00757260
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\Ey3OF47.exe	Code function: 1_2_0001724D push ecx; ret	1_2_00017260
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\BC5tT98.exe	Code function: 2_2_00BA724D push ecx; ret	2_2_00BA7260
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2Iu7231.exe	Code function: 3_2_000AE295 push ecx; ret	3_2_000AE2A8
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2Iu7231.exe	Code function: 3_2_000C11AE push esp; iretd	3_2_000C11B6
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2Iu7231.exe	Code function: 3_2_000C1256 push 0000002Fh; retf	3_2_000C1276
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2Iu7231.exe	Code function: 3_2_000C166F push edx; ret	3_2_000C1676
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_008AB537 push ecx; ret	12_2_008AB54A
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_0087B962 push ss; ret	12_2_0087B964
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_000CB537 push ecx; ret	17_2_000CB54A
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_0009B962 push ss; ret	17_2_0009B964

Source: C:\Users\user\Desktop\14OWDrfahJ.exe

Code function: 0_2_0075202A memset,memset,RegCreateKeyExA,RegQueryValueExA,RegCloseKey,GetSystemDirectoryA,LoadLibraryA,GetProcAddress,FreeLibrary,GetSystemDirectoryA,GetModuleFileNameA,LocalAlloc,RegCloseKey,RegSetValueExA,RegCloseKey,LocalFree,

0_2_0075202A

Source: 3rB05VU.exe.2.dr	Static PE information: real checksum: 0x0 should be: 0x1463bc
Source: OfficeTrackerNMP131.exe.12.dr	Static PE information: real checksum: 0x0 should be: 0x1463bc
Source: 5Rp2df8.exe.0.dr	Static PE information: real checksum: 0x23bfb should be: 0x34d09
Source: 4eD052Od.exe.1.dr	Static PE information: real checksum: 0x9b25 should be: 0x9c3f
Source: MaxLoonaFest131.exe.12.dr	Static PE information: real checksum: 0x0 should be: 0x1463bc
Source: FANBooster131.exe.12.dr	Static PE information: real checksum: 0x0 should be: 0x1463bc
Source: 2Iu7231.exe.2.dr	Static PE information: real checksum: 0x0 should be: 0x7dfa6

Source: initial sample

Static PE information: section name: .text entropy: 7.047633597935999

Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe

File created: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe

Jump to dropped file

Source: C:\Users\user\Desktop\14OWDrfahJ.exe	File created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\5Rp2df8.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	File created: C:\Users\user\AppData\Local\Temp\FANBooster131\FANBooster131.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	File created: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\BC5tT98.exe	File created: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2Iu7231.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\Ey3OF47.exe	File created: C:\Users\user\AppData\Local\Temp\IXP001.TMP\BC5tT98.exe	Jump to dropped file
Source: C:\Users\user\Desktop\14OWDrfahJ.exe	File created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\Ey3OF47.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\Ey3OF47.exe	File created: C:\Users\user\AppData\Local\Temp\IXP001.TMP\4eD052Od.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\BC5tT98.exe	File created: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	File created: C:\Users\user\AppData\Local\MaxLoonaFest131\MaxLoonaFest131.exe	Jump to dropped file

Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\af
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\am
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ar
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\az
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\be
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\bg
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\bn
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ca
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\cs
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\cy
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\da
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\de
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\el
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\en
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\en_CA
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\en_GB
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\en_US
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\es
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\es_419
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\et
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\eu
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\fa
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\fi
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\fil
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\fr
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\fr_CA
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\gl
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\gu
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\hi
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\hr
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\hu
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\hy
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\id
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\is
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\it
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\iw
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ja
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ka
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\kk
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\km
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\kn
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ko
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\lo
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\lt
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\lv
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ml
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\mn
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\mr
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ms
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\my
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ne
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\nl
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\no
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\pa
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\pl
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\pt_BR
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\pt_PT
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ro
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ru
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\si
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\sk
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\sl
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\sr
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\sv
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\sw
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ta
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\te
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\th
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\tr
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\uk
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ur
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\vi
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\zh_CN
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\zh_HK
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\zh_TW
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\zu
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_metadata
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ca
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\cs
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\da
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\de
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\el
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en_GB
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\es
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\es_419
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\et
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\fi
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\fil
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\fr
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\hi
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\hr
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\hu
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\id
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\it
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ja
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ko
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\lt
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\lv
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\nb
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\nl
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\pl
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\pt_BR
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\pt_PT
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ro
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ru
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\sk
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\sl
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\sr
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\sv
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\th
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\tr
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\uk
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\vi
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\zh_CN
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\zh_TW
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_metadata
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File created: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp

Source: C:\Users\user\Desktop\14OWDrfahJ.exe	Code function: 0_2_00751AE8 CompareStringA,GetFileAttributesA,LocalAlloc,GetPrivateProfileIntA,GetPrivateProfileStringA,GetShortPathNameA,CompareStringA,LocalAlloc,LocalAlloc,GetFileAttributesA,	0_2_00751AE8
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\Ey3OF47.exe	Code function: 1_2_00011AE8 CompareStringA,GetFileAttributesA,LocalAlloc,GetPrivateProfileIntA,GetPrivateProfileStringA,GetShortPathNameA,CompareStringA,LocalAlloc,LocalAlloc,GetFileAttributesA,	1_2_00011AE8
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\BC5tT98.exe	Code function: 2_2_00BA1AE8 CompareStringA,GetFileAttributesA,LocalAlloc,GetPrivateProfileIntA,GetPrivateProfileStringA,GetShortPathNameA,CompareStringA,LocalAlloc,LocalAlloc,GetFileAttributesA,	2_2_00BA1AE8

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST

Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MaxLoonaFest131			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MaxLoonaFest131			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe

Code function: 12_2_0086CFB0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

12_2_0086CFB0

Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found stalling execution ending in API Sleep call

Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Stalling execution: Execution stalls by calling Sleep
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Stalling execution: Execution stalls by calling Sleep

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Evasive API call chain: GetPEB, DecisionNodes, Sleep
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Evasive API call chain: GetPEB, DecisionNodes, Sleep

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe TID: 10476	Thread sleep time: -8301034833169293s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe TID: 10484	Thread sleep count: 1806 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe TID: 10484	Thread sleep count: 801 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe TID: 8004	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2Iu7231.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes	graph_3-20924

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_0087B220 GetSystemTime followed by cmp: cmp eax, 04h and CTI: jc 0087B261h		12_2_0087B220
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_0009B220 GetSystemTime followed by cmp: cmp eax, 04h and CTI: jc 0009B261h		17_2_0009B220

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Window / User API: threadDelayed 1806			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Window / User API: threadDelayed 801			Jump to behavior

Source: C:\Users\user\Desktop\14OWDrfahJ.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes	graph_0-2450
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\Ey3OF47.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes	graph_1-2574
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\BC5tT98.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes	graph_2-2453

Source: C:\Users\user\Desktop\14OWDrfahJ.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\IXP000.TMP\5Rp2df8.exe			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\Ey3OF47.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\IXP001.TMP\4eD052Od.exe			Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	API call chain: ExitProcess graph end node
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	API call chain: ExitProcess graph end node

Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\ShaderCache\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\ThirdPartyModuleList64\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\SSLErrorAssistant\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Subresource Filter\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\SafetyTips\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	File opened: C:\Users\user\AppData\Local\Temp\tempAVSaeI8GhtgT29e\02zdBXl47cvzcookies.sqlite	Jump to behavior

Source: 3rB05VU.exe, 0000000C.00000002.2582147162.0000000003350000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}14
Source: AppLaunch.exe, 0000000B.00000002.2373060572.0000000005496000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware
Source: OfficeTrackerNMP131.exe, 00000011.00000002.2361383370.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW<<
Source: FANBooster131.exe, 00000016.00000002.2539274464.00000000010BB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&
Source: MaxLoonaFest131.exe, 00000014.00000002.2451235806.0000000000E6A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: -c76a-4720-bcdb-53011b87bd06_{a33c7340-61ca-11ee-8c18-806e6f6e6963}_\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}_53CC54CF
Source: FANBooster131.exe, 00000016.00000003.2538616589.00000000010C8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: FANBooster131.exe, 00000016.00000002.2539134852.0000000000CFB000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b
Source: MaxLoonaFest131.exe, 00000013.00000002.2390970865.000000000101E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&4
Source: 3rB05VU.exe, 0000000C.00000002.2581262150.0000000000B98000.00000004.00000020.00020000.00000000.sdmp, 3rB05VU.exe, 0000000C.00000002.2581262150.0000000000BB1000.00000004.00000020.00020000.00000000.sdmp, OfficeTrackerNMP131.exe, 00000011.00000002.2361383370.0000000000B6D000.00000004.00000020.00020000.00000000.sdmp, OfficeTrackerNMP131.exe, 00000011.00000002.2361383370.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp, OfficeTrackerNMP131.exe, 00000012.00000003.2269824158.0000000000F86000.00000004.00000020.00020000.00000000.sdmp, OfficeTrackerNMP131.exe, 00000012.00000003.2268851533.0000000000F83000.00000004.00000020.00020000.00000000.sdmp, OfficeTrackerNMP131.exe, 00000012.00000002.2886061884.0000000000F7D000.00000004.00000020.00020000.00000000.sdmp, OfficeTrackerNMP131.exe, 00000012.00000003.2268035770.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, OfficeTrackerNMP131.exe, 00000012.00000003.2270468902.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, OfficeTrackerNMP131.exe, 00000012.00000002.2886061884.0000000000F27000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 3rB05VU.exe, 0000000C.00000002.2581262150.0000000000B50000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW(
Source: FANBooster131.exe, 00000016.00000003.2538616589.00000000010D0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: MaxLoonaFest131.exe, 00000013.00000002.2390970865.0000000001050000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307
Source: 3rB05VU.exe, 0000000C.00000002.2581262150.0000000000B81000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}18
Source: 3rB05VU.exe, 0000000C.00000003.2227248325.0000000000B85000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}=D
Source: MaxLoonaFest131.exe, 00000014.00000002.2451235806.0000000000E30000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}ile5
Source: FANBooster131.exe, 00000016.00000002.2539274464.00000000010BB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: MaxLoonaFest131.exe, 00000013.00000002.2390970865.0000000001048000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-9
Source: AppLaunch.exe, 0000000B.00000002.2373196339.0000000005530000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll5
Source: OfficeTrackerNMP131.exe, 00000012.00000002.2886061884.0000000000F27000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&
Source: MaxLoonaFest131.exe, 00000014.00000002.2451235806.0000000000E30000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: MaxLoonaFest131.exe, 00000014.00000002.2451235806.0000000000E37000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: #disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: AppLaunch.exe, 0000000B.00000002.2373060572.0000000005496000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Win32_VideoController(Standard display types)VMwareZP4PZU5LWin32_VideoControllerEEEE3RBEVideoController120060621000000.000000-00027230916display.infMSBDA_5B5GCW1PCI\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\3&61AAA01&0&78OKWin32_ComputerSystemuser-PC1280 x 1024 x 4294967296 colorsZBA461MD
Source: OfficeTrackerNMP131.exe, 00000011.00000002.2362816797.0000000003CD0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}HC
Source: 3rB05VU.exe, 0000000C.00000002.2581262150.0000000000B44000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: MaxLoonaFest131.exe, 00000014.00000002.2451235806.0000000000E37000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll1
Source: MaxLoonaFest131.exe, 00000013.00000002.2390970865.000000000101E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll2
Source: 3rB05VU.exe, 0000000C.00000003.2227248325.0000000000B85000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}01
Source: FANBooster131.exe, 00000016.00000002.2539274464.000000000109E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}fb+r
Source: MaxLoonaFest131.exe, 00000014.00000002.2451235806.0000000000E37000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}T
Source: OfficeTrackerNMP131.exe, 00000011.00000002.2361383370.0000000000B40000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\14OWDrfahJ.exe

Code function: 0_2_00755467 GetSystemInfo,CreateDirectoryA,RemoveDirectoryA,

0_2_00755467

Source: C:\Users\user\Desktop\14OWDrfahJ.exe	Code function: 0_2_00752390 FindFirstFileA,lstrcmpA,lstrcmpA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,	0_2_00752390
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\Ey3OF47.exe	Code function: 1_2_00012390 FindFirstFileA,lstrcmpA,lstrcmpA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,	1_2_00012390
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\BC5tT98.exe	Code function: 2_2_00BA2390 FindFirstFileA,lstrcmpA,lstrcmpA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,	2_2_00BA2390
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_007FEA60 FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,SHGetFolderPathA,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,	12_2_007FEA60
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_007FB990 CreateDirectoryA,FindFirstFileA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,GetLastError,SetFileAttributesA,GetLastError,RemoveDirectoryA,GetLastError,GetLastError,	12_2_007FB990
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_00829AA0 SHGetFolderPathA,FindFirstFileA,FindNextFileA,FindClose,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CreateDirectoryA,CopyFileA,CopyFileA,	12_2_00829AA0
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_008A93BA FindClose,FindFirstFileExW,GetLastError,	12_2_008A93BA
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_008A9440 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	12_2_008A9440
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_00811B60 CreateDirectoryA,FindFirstFileA,FindNextFileA,GetLastError,	12_2_00811B60
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_0001EA60 FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,SHGetFolderPathA,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,	17_2_0001EA60
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_0001B990 CreateDirectoryA,FindFirstFileA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,GetLastError,SetFileAttributesA,GetLastError,RemoveDirectoryA,GetLastError,GetLastError,	17_2_0001B990
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_00049AA0 SHGetFolderPathA,FindFirstFileA,FindNextFileA,FindClose,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CreateDirectoryA,CopyFileA,CopyFileA,	17_2_00049AA0
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_000C93BA FindClose,FindFirstFileExW,GetLastError,	17_2_000C93BA
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_000C9440 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	17_2_000C9440
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_00031B60 CreateDirectoryA,FindFirstFileA,FindNextFileA,GetLastError,	17_2_00031B60

Source: C:\Users\user\Desktop\14OWDrfahJ.exe

0_2_0075202A

Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2Iu7231.exe	Code function: 3_2_0009B22E mov ecx, dword ptr fs:[00000030h]	3_2_0009B22E
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2Iu7231.exe	Code function: 3_2_000A1799 mov eax, dword ptr fs:[00000030h]	3_2_000A1799
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2Iu7231.exe	Code function: 3_2_00081650 mov edi, dword ptr fs:[00000030h]	3_2_00081650
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_00848DC0 mov eax, dword ptr fs:[00000030h]	12_2_00848DC0
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_00848DC0 mov ecx, dword ptr fs:[00000030h]	12_2_00848DC0
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_00848DC0 mov eax, dword ptr fs:[00000030h]	12_2_00848DC0
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_00848DC0 mov eax, dword ptr fs:[00000030h]	12_2_00848DC0
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_00848DC0 mov eax, dword ptr fs:[00000030h]	12_2_00848DC0
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_00848DC0 mov eax, dword ptr fs:[00000030h]	12_2_00848DC0
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_00848DC0 mov eax, dword ptr fs:[00000030h]	12_2_00848DC0
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_00848DC0 mov eax, dword ptr fs:[00000030h]	12_2_00848DC0
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_00848DC0 mov eax, dword ptr fs:[00000030h]	12_2_00848DC0
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_00848DC0 mov eax, dword ptr fs:[00000030h]	12_2_00848DC0
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_00848DC0 mov eax, dword ptr fs:[00000030h]	12_2_00848DC0
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_00848DC0 mov eax, dword ptr fs:[00000030h]	12_2_00848DC0
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_00848DC0 mov eax, dword ptr fs:[00000030h]	12_2_00848DC0
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_00848DC0 mov eax, dword ptr fs:[00000030h]	12_2_00848DC0
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_00848DC0 mov eax, dword ptr fs:[00000030h]	12_2_00848DC0
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_00848DC0 mov eax, dword ptr fs:[00000030h]	12_2_00848DC0
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_00848DC0 mov eax, dword ptr fs:[00000030h]	12_2_00848DC0
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_00848DC0 mov eax, dword ptr fs:[00000030h]	12_2_00848DC0
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_00848DC0 mov eax, dword ptr fs:[00000030h]	12_2_00848DC0
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_00848DC0 mov eax, dword ptr fs:[00000030h]	12_2_00848DC0
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_00848DC0 mov eax, dword ptr fs:[00000030h]	12_2_00848DC0
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_00848DC0 mov eax, dword ptr fs:[00000030h]	12_2_00848DC0
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_00848DC0 mov eax, dword ptr fs:[00000030h]	12_2_00848DC0
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_00848DC0 mov eax, dword ptr fs:[00000030h]	12_2_00848DC0
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_00848DC0 mov eax, dword ptr fs:[00000030h]	12_2_00848DC0
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_00810C30 mov eax, dword ptr fs:[00000030h]	12_2_00810C30
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_00804E10 mov eax, dword ptr fs:[00000030h]	12_2_00804E10
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_00805450 mov eax, dword ptr fs:[00000030h]	12_2_00805450
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_00805450 mov eax, dword ptr fs:[00000030h]	12_2_00805450
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_00805450 mov eax, dword ptr fs:[00000030h]	12_2_00805450
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_00805450 mov eax, dword ptr fs:[00000030h]	12_2_00805450
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_00805450 mov eax, dword ptr fs:[00000030h]	12_2_00805450
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_00805450 mov eax, dword ptr fs:[00000030h]	12_2_00805450
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_00805450 mov eax, dword ptr fs:[00000030h]	12_2_00805450
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_00805450 mov eax, dword ptr fs:[00000030h]	12_2_00805450
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_00805450 mov eax, dword ptr fs:[00000030h]	12_2_00805450
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_00805450 mov eax, dword ptr fs:[00000030h]	12_2_00805450
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_00805450 mov eax, dword ptr fs:[00000030h]	12_2_00805450
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_00805450 mov eax, dword ptr fs:[00000030h]	12_2_00805450
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_00068DC0 mov eax, dword ptr fs:[00000030h]	17_2_00068DC0
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_00068DC0 mov ecx, dword ptr fs:[00000030h]	17_2_00068DC0
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_00068DC0 mov eax, dword ptr fs:[00000030h]	17_2_00068DC0
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_00068DC0 mov eax, dword ptr fs:[00000030h]	17_2_00068DC0
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_00068DC0 mov eax, dword ptr fs:[00000030h]	17_2_00068DC0
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_00068DC0 mov eax, dword ptr fs:[00000030h]	17_2_00068DC0
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_00068DC0 mov eax, dword ptr fs:[00000030h]	17_2_00068DC0
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_00068DC0 mov eax, dword ptr fs:[00000030h]	17_2_00068DC0
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_00068DC0 mov eax, dword ptr fs:[00000030h]	17_2_00068DC0
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_00068DC0 mov eax, dword ptr fs:[00000030h]	17_2_00068DC0
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_00068DC0 mov eax, dword ptr fs:[00000030h]	17_2_00068DC0
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_00068DC0 mov eax, dword ptr fs:[00000030h]	17_2_00068DC0
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_00068DC0 mov eax, dword ptr fs:[00000030h]	17_2_00068DC0
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_00068DC0 mov eax, dword ptr fs:[00000030h]	17_2_00068DC0
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_00068DC0 mov eax, dword ptr fs:[00000030h]	17_2_00068DC0
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_00068DC0 mov eax, dword ptr fs:[00000030h]	17_2_00068DC0
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_00068DC0 mov eax, dword ptr fs:[00000030h]	17_2_00068DC0
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_00068DC0 mov eax, dword ptr fs:[00000030h]	17_2_00068DC0
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_00068DC0 mov eax, dword ptr fs:[00000030h]	17_2_00068DC0
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_00068DC0 mov eax, dword ptr fs:[00000030h]	17_2_00068DC0
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_00068DC0 mov eax, dword ptr fs:[00000030h]	17_2_00068DC0
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_00068DC0 mov eax, dword ptr fs:[00000030h]	17_2_00068DC0
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_00068DC0 mov eax, dword ptr fs:[00000030h]	17_2_00068DC0
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_00068DC0 mov eax, dword ptr fs:[00000030h]	17_2_00068DC0
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_00068DC0 mov eax, dword ptr fs:[00000030h]	17_2_00068DC0
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_00030C30 mov eax, dword ptr fs:[00000030h]	17_2_00030C30
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_00024E10 mov eax, dword ptr fs:[00000030h]	17_2_00024E10
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_00025450 mov eax, dword ptr fs:[00000030h]	17_2_00025450
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_00025450 mov eax, dword ptr fs:[00000030h]	17_2_00025450
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_00025450 mov eax, dword ptr fs:[00000030h]	17_2_00025450
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_00025450 mov eax, dword ptr fs:[00000030h]	17_2_00025450
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_00025450 mov eax, dword ptr fs:[00000030h]	17_2_00025450
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_00025450 mov eax, dword ptr fs:[00000030h]	17_2_00025450
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_00025450 mov eax, dword ptr fs:[00000030h]	17_2_00025450
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_00025450 mov eax, dword ptr fs:[00000030h]	17_2_00025450
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_00025450 mov eax, dword ptr fs:[00000030h]	17_2_00025450
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_00025450 mov eax, dword ptr fs:[00000030h]	17_2_00025450
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_00025450 mov eax, dword ptr fs:[00000030h]	17_2_00025450
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_00025450 mov eax, dword ptr fs:[00000030h]	17_2_00025450

Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2Iu7231.exe

Code function: 3_2_0009AAEB IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

3_2_0009AAEB

Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2Iu7231.exe

Code function: 3_2_000A35CD GetProcessHeap,

3_2_000A35CD

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2Iu7231.exe

Code function: 3_2_000A3E97 LdrInitializeThunk,___free_lconv_mon,

3_2_000A3E97

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\14OWDrfahJ.exe	Code function: 0_2_00756F40 SetUnhandledExceptionFilter,	0_2_00756F40
Source: C:\Users\user\Desktop\14OWDrfahJ.exe	Code function: 0_2_00756CF0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00756CF0
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\Ey3OF47.exe	Code function: 1_2_00016F40 SetUnhandledExceptionFilter,	1_2_00016F40
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\Ey3OF47.exe	Code function: 1_2_00016CF0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00016CF0
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\BC5tT98.exe	Code function: 2_2_00BA6CF0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00BA6CF0
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\BC5tT98.exe	Code function: 2_2_00BA6F40 SetUnhandledExceptionFilter,	2_2_00BA6F40
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2Iu7231.exe	Code function: 3_2_0009232A SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_0009232A
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2Iu7231.exe	Code function: 3_2_0009AAEB IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_0009AAEB
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2Iu7231.exe	Code function: 3_2_00091DAF IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00091DAF
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2Iu7231.exe	Code function: 3_2_00091F14 SetUnhandledExceptionFilter,	3_2_00091F14
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_00848DC0 SetPriorityClass,SetUnhandledExceptionFilter,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,LoadLibraryA,LoadLibraryA,CreateThread,CloseHandle,Sleep,GetTempPathA,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,SetCurrentDirectoryA,GetFileAttributesA,CreateMutexA,GetLastError,Sleep,Sleep,shutdown,closesocket,WSACleanup,Sleep,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,__aulldiv,__aulldiv,send,send,Sleep,Sleep,Sleep,GetModuleHandleA,GetProcAddress,GetCurrentProcess,CreateThread,CreateThread,CreateThread,CreateThread,FreeLibrary,WaitForSingleObject,CreateThread,CreateThread,CreateThread,CreateThread,CreateThread,CreateThread,CreateThread,CreateThread,WaitForSingleObject,WaitForSingleObject,CloseHandle,DeleteFileA,GetVersionExA,MessageBoxA,Sleep,shutdown,closesocket,WSACleanup,GetModuleHandleA,GetProcAddress,GetCurrentProcess,NtTerminateProcess,GetCurrentProcessId,	12_2_00848DC0
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_008C62A4 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	12_2_008C62A4
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_008AB764 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	12_2_008AB764
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_008AB8F7 SetUnhandledExceptionFilter,	12_2_008AB8F7
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_008ABB0D SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	12_2_008ABB0D
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_00068DC0 SetPriorityClass,SetUnhandledExceptionFilter,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,LoadLibraryA,LoadLibraryA,CreateThread,FindCloseChangeNotification,Sleep,GetTempPathA,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,SetCurrentDirectoryA,GetFileAttributesA,CreateMutexA,GetLastError,Sleep,Sleep,shutdown,closesocket,WSACleanup,Sleep,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,__aulldiv,__aulldiv,send,send,Sleep,Sleep,Sleep,GetModuleHandleA,GetProcAddress,GetCurrentProcess,CreateThread,CreateThread,CreateThread,CreateThread,FreeLibrary,WaitForSingleObject,CreateThread,CreateThread,CreateThread,CreateThread,CreateThread,CreateThread,CreateThread,CreateThread,WaitForSingleObject,WaitForSingleObject,CloseHandle,DeleteFileA,GetVersionExA,MessageBoxA,Sleep,shutdown,closesocket,WSACleanup,GetModuleHandleA,GetProcAddress,GetCurrentProcess,NtTerminateProcess,GetCurrentProcessId,	17_2_00068DC0
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_000E62A4 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	17_2_000E62A4
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_000CB764 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	17_2_000CB764
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_000CB8F7 SetUnhandledExceptionFilter,	17_2_000CB8F7
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_000CBB0D SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	17_2_000CBB0D

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2Iu7231.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2Iu7231.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe base: 400000 value starts with: 4D5A

Jump to behavior

Contains functionality to inject code into remote processes

Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2Iu7231.exe

Code function: 3_2_000816B0 CreateProcessW,VirtualAllocEx,Wow64GetThreadContext,ReadProcessMemory,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,

3_2_000816B0

Writes to foreign memory regions

Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2Iu7231.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe base: 400000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2Iu7231.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe base: 402000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2Iu7231.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe base: 42E000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2Iu7231.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe base: 43A000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2Iu7231.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe base: 506D008	Jump to behavior

Contains functionality to inject threads in other processes

Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: 12_2_00809920 VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualAllocEx,LoadLibraryA,GetProcAddress,WriteProcessMemory,WriteProcessMemory,CreateRemoteThread,WaitForSingleObject,VirtualFreeEx,		12_2_00809920
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: 17_2_00029920 VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualAllocEx,LoadLibraryA,GetProcAddress,WriteProcessMemory,WriteProcessMemory,CreateRemoteThread,WaitForSingleObject,VirtualFreeEx,		17_2_00029920

Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2Iu7231.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Jump to behavior

Source: C:\Users\user\Desktop\14OWDrfahJ.exe

Code function: 0_2_007517EE LoadLibraryA,GetProcAddress,AllocateAndInitializeSid,FreeSid,FreeLibrary,

0_2_007517EE

Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2Iu7231.exe	Code function: GetLocaleInfoW,	3_2_000A3376
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2Iu7231.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	3_2_000A5605
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2Iu7231.exe	Code function: EnumSystemLocalesW,	3_2_000A58A7
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2Iu7231.exe	Code function: EnumSystemLocalesW,	3_2_000A58F2
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2Iu7231.exe	Code function: EnumSystemLocalesW,	3_2_000A598D
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2Iu7231.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	3_2_000A5A18
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2Iu7231.exe	Code function: GetLocaleInfoW,	3_2_000A5C6B
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2Iu7231.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	3_2_000A5D94
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2Iu7231.exe	Code function: EnumSystemLocalesW,	3_2_000A2E4D
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2Iu7231.exe	Code function: GetLocaleInfoW,	3_2_000A5E9A
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2Iu7231.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	3_2_000A5F69
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,EnumDisplayDevicesA,EnumDisplayDevicesA,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey,	12_2_007FD0B0
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: GetLocaleInfoW,	12_2_008E207B
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	12_2_008E21A4
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: GetLocaleInfoW,	12_2_008E22AA
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	12_2_008E2380
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: EnumSystemLocalesW,	12_2_008D8C9A
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: GetLocaleInfoW,	12_2_008D921D
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: GetLocaleInfoEx,FormatMessageA,	12_2_008A9704
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	12_2_008E1A0B
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: EnumSystemLocalesW,	12_2_008E1CB7
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: GetLocaleInfoW,	12_2_008E1C10
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: EnumSystemLocalesW,	12_2_008E1D9D
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: EnumSystemLocalesW,	12_2_008E1D02
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	12_2_008E1E28
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,EnumDisplayDevicesA,EnumDisplayDevicesA,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey,	17_2_0001D0B0
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: GetLocaleInfoW,	17_2_0010207B
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	17_2_001021A4
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: GetLocaleInfoW,	17_2_001022AA
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	17_2_00102380
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: EnumSystemLocalesW,	17_2_000F8C9A
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: GetLocaleInfoW,	17_2_000F921D
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: GetLocaleInfoEx,FormatMessageA,	17_2_000C9704
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	17_2_00101A0B
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: GetLocaleInfoW,	17_2_00101C10
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: EnumSystemLocalesW,	17_2_00101CB7
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: EnumSystemLocalesW,	17_2_00101D02
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: EnumSystemLocalesW,	17_2_00101D9D
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	17_2_00101E28

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Queries volume information: C:\ VolumeInformation
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Queries volume information: C:\ VolumeInformation
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\MaxLoonaFest131\MaxLoonaFest131.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\MaxLoonaFest131\MaxLoonaFest131.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\FANBooster131\FANBooster131.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2Iu7231.exe

Code function: 3_2_00091F81 cpuid

3_2_00091F81

Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\14OWDrfahJ.exe

Code function: 0_2_00757155 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_00757155

Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe

Code function: 12_2_008DAC6A GetTimeZoneInformation,

12_2_008DAC6A

Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe

12_2_007FD0B0

Source: C:\Users\user\Desktop\14OWDrfahJ.exe

Code function: 0_2_00752BFB GetVersion,GetModuleHandleW,GetProcAddress,CloseHandle,

0_2_00752BFB

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Source: 14OWDrfahJ.exe, 00000000.00000002.2647653855.00000000031B0000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: hJ.exe

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 11.2.AppLaunch.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.2Iu7231.exe.bf000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.2Iu7231.exe.bf000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.14OWDrfahJ.exe.5046420.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.2Iu7231.exe.80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.2372767482.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2216710591.00000000000BF000.00000004.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1633263282.0000000004F58000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2373910611.0000000007321000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: AppLaunch.exe PID: 7984, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\5Rp2df8.exe, type: DROPPED

Yara detected RisePro Stealer

Source: Yara match	File source: 00000011.00000002.2361383370.0000000000BB5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 3rB05VU.exe PID: 8008, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: OfficeTrackerNMP131.exe PID: 8156, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: OfficeTrackerNMP131.exe PID: 8172, type: MEMORYSTR

Yara detected SmokeLoader

Source: Yara match

File source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\4eD052Od.exe, type: DROPPED

Yara detected PrivateLoader

Source: Yara match	File source: 17.0.OfficeTrackerNMP131.exe.10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.3rB05VU.exe.7f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.OfficeTrackerNMP131.exe.10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.0.MaxLoonaFest131.exe.590000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.3rB05VU.exe.7f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.0.FANBooster131.exe.830000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.FANBooster131.exe.830000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3.BC5tT98.exe.4aa2540.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.0.MaxLoonaFest131.exe.590000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.MaxLoonaFest131.exe.590000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.MaxLoonaFest131.exe.590000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3.BC5tT98.exe.4aa2540.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.0.OfficeTrackerNMP131.exe.10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.OfficeTrackerNMP131.exe.10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000003.1636508373.0000000004A9B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\FANBooster131\FANBooster131.exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\MaxLoonaFest131\MaxLoonaFest131.exe, type: DROPPED

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\CURRENT
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig\CURRENT
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi\CURRENT
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\places.sqlite
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj\CURRENT
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\chrome-extension_cjelfplplebdjjenllpjcblmjkfcffne_0.indexeddb.leveldb\CURRENT
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\CURRENT
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File opened: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Download Service
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File opened: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\cookies.sqlite
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\signons.sqlite
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\LocalPrefs.json
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File opened: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\blob_storage\fccd7e85-a1ff-4466-9ff5-c20d62f6e0a2
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File opened: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\blob_storage
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\CURRENT
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File opened: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Code Cache
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File opened: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai\CURRENT
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne\CURRENT
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File opened: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj\CURRENT
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File opened: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\coupon_db
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi\CURRENT
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\CURRENT
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File opened: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File opened: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Cache
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File opened: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File opened: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extension Rules
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\signons.sqlite
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\formhistory.sqlite
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File opened: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File opened: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\databases
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\logins.json
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File opened: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File opened: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Download Service\Files
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai\CURRENT
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File opened: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig\CURRENT
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne\CURRENT
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File opened: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File opened: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\Extension State
Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	File opened: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Files\AppData\Local\Google\Chrome\User Data\Default\DawnCache

Source: Yara match	File source: 0000000C.00000002.2581262150.0000000000BB1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: AppLaunch.exe PID: 7984, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 3rB05VU.exe PID: 8008, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 11.2.AppLaunch.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.2Iu7231.exe.bf000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.2Iu7231.exe.bf000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.14OWDrfahJ.exe.5046420.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.2Iu7231.exe.80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.2372767482.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2216710591.00000000000BF000.00000004.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1633263282.0000000004F58000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2373910611.0000000007321000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: AppLaunch.exe PID: 7984, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\5Rp2df8.exe, type: DROPPED

Yara detected RisePro Stealer

Source: Yara match	File source: 00000011.00000002.2361383370.0000000000BB5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 3rB05VU.exe PID: 8008, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: OfficeTrackerNMP131.exe PID: 8156, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: OfficeTrackerNMP131.exe PID: 8172, type: MEMORYSTR

Yara detected SmokeLoader

Source: Yara match

File source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\4eD052Od.exe, type: DROPPED

Yara detected PrivateLoader

Source: Yara match	File source: 17.0.OfficeTrackerNMP131.exe.10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.3rB05VU.exe.7f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.OfficeTrackerNMP131.exe.10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.0.MaxLoonaFest131.exe.590000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.3rB05VU.exe.7f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.0.FANBooster131.exe.830000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.FANBooster131.exe.830000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3.BC5tT98.exe.4aa2540.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.0.MaxLoonaFest131.exe.590000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.MaxLoonaFest131.exe.590000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.MaxLoonaFest131.exe.590000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3.BC5tT98.exe.4aa2540.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.0.OfficeTrackerNMP131.exe.10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.OfficeTrackerNMP131.exe.10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000003.1636508373.0000000004A9B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\FANBooster131\FANBooster131.exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\MaxLoonaFest131\MaxLoonaFest131.exe, type: DROPPED

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact	Resource Development	Reconnaissance
Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	1 OS Credential Dumping	12 System Time Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	2 Ingress Tool Transfer	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	1 System Shutdown/Reboot	Acquire Infrastructure	Gather Victim Identity Information
Default Accounts	13 Native API	1 Browser Extensions	1 Access Token Manipulation	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	1 Browser Session Hijacking	Exfiltration Over Bluetooth	21 Encrypted Channel	SIM Card Swap	Obtain Device Cloud Backups	Network Denial of Service	Domains	Credentials
Domain Accounts	3 Command and Scripting Interpreter	1 Scheduled Task/Job	511 Process Injection	4 Obfuscated Files or Information	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	1 Data from Local System	Automated Exfiltration	1 Non-Standard Port			Data Encrypted for Impact	DNS Server	Email Addresses
Local Accounts	1 Scheduled Task/Job	21 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	2 Software Packing	NTDS	148 System Information Discovery	Distributed Component Object Model	1 Screen Capture	Traffic Duplication	2 Non-Application Layer Protocol			Data Destruction	Virtual Private Server	Employee Names
Cloud Accounts	Launchd	Network Logon Script	21 Registry Run Keys / Startup Folder	1 DLL Side-Loading	LSA Secrets	351 Security Software Discovery	SSH	1 Email Collection	Scheduled Transfer	113 Application Layer Protocol			Data Encrypted for Impact	Server	Gather Victim Network Information
Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	231 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Data Transfer Size Limits	Multiband Communication			Service Stop	Botnet	Domain Properties
External Remote Services	Systemd Timers	Startup Items	Startup Items	231 Virtualization/Sandbox Evasion	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over C2 Channel	Commonly Used Port			Inhibit System Recovery	Web Services	DNS
Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Access Token Manipulation	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Exfiltration Over Alternative Protocol	Application Layer Protocol			Defacement	Serverless	Network Trust Dependencies
Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	511 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Web Protocols			Internal Defacement	Malvertising	Network Topology
Supply Chain Compromise	PowerShell	Cron	Cron	1 Rundll32	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	File Transfer Protocols			External Defacement	Compromise Infrastructure	IP Addresses

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
14OWDrfahJ.exe	50%	ReversingLabs	Win32.Trojan.SmokeLoader
14OWDrfahJ.exe	57%	Virustotal		Browse
14OWDrfahJ.exe	100%	Avira	TR/Crypt.XPACK.Gen
14OWDrfahJ.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\IXP001.TMP\BC5tT98.exe	100%	Avira	HEUR/AGEN.1305142
C:\Users\user\AppData\Local\Temp\IXP000.TMP\Ey3OF47.exe	100%	Avira	TR/Crypt.XPACK.Gen
C:\Users\user\AppData\Local\Temp\IXP000.TMP\5Rp2df8.exe	100%	Avira	HEUR/AGEN.1323769
C:\Users\user\AppData\Local\Temp\IXP001.TMP\4eD052Od.exe	100%	Avira	TR/Crypt.XPACK.Gen
C:\Users\user\AppData\Local\Temp\IXP002.TMP\2Iu7231.exe	100%	Avira	HEUR/AGEN.1305142
C:\Users\user\AppData\Local\MaxLoonaFest131\MaxLoonaFest131.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\IXP001.TMP\BC5tT98.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\FANBooster131\FANBooster131.exe	100%	Joe Sandbox ML
C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\IXP000.TMP\Ey3OF47.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\IXP000.TMP\5Rp2df8.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\IXP001.TMP\4eD052Od.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\IXP002.TMP\2Iu7231.exe	100%	Joe Sandbox ML
C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe	65%	Virustotal		Browse
C:\Users\user\AppData\Local\MaxLoonaFest131\MaxLoonaFest131.exe	65%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\FANBooster131\FANBooster131.exe	65%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\IXP000.TMP\5Rp2df8.exe	67%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\IXP000.TMP\Ey3OF47.exe	54%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\IXP001.TMP\4eD052Od.exe	62%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\IXP001.TMP\BC5tT98.exe	56%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\IXP002.TMP\2Iu7231.exe	35%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe	65%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
https://api.ip.sb/ip	0%	URL Reputation	safe
http://tempuri.org/	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id21Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id2Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id12Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id23ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id6ResponseD	0%	Avira URL Cloud	safe
https://support.microsoft..	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id13ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id23ResponseD	1%	Virustotal		Browse
http://tempuri.org/	1%	Virustotal		Browse
http://tempuri.org/Entity/Id2Response	2%	Virustotal		Browse
http://tempuri.org/Entity/Id15Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id21Response	4%	Virustotal		Browse
http://tempuri.org/Entity/Id1ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id24Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id21ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id12Response	2%	Virustotal		Browse
https://support.microsoft..	0%	Virustotal		Browse
http://tempuri.org/Entity/Id15Response	2%	Virustotal		Browse
http://tempuri.org/Entity/Id10ResponseD	0%	Avira URL Cloud	safe
194.49.94.152:19053	100%	Avira URL Cloud	malware
http://tempuri.org/Entity/Id5Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id1ResponseD	1%	Virustotal		Browse
http://tempuri.org/Entity/Id13ResponseD	1%	Virustotal		Browse
http://tempuri.org/Entity/Id10ResponseD	1%	Virustotal		Browse
http://tempuri.org/Entity/Id24Response	2%	Virustotal		Browse
http://tempuri.org/Entity/Id10Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id21ResponseD	1%	Virustotal		Browse
http://tempuri.org/Entity/Id6ResponseD	1%	Virustotal		Browse
http://tempuri.org/Entity/Id8Response	0%	Avira URL Cloud	safe
194.49.94.152:19053	17%	Virustotal		Browse
http://tempuri.org/Entity/Id5Response	2%	Virustotal		Browse
http://tempuri.org/D	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id13Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id12ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id7ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id8Response	2%	Virustotal		Browse
http://tempuri.org/Entity/Id4ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id22Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id10Response	2%	Virustotal		Browse
http://tempuri.org/Entity/Id22ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id13Response	2%	Virustotal		Browse
http://tempuri.org/Entity/Id16ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id19ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id4ResponseD	1%	Virustotal		Browse
http://tempuri.org/Entity/Id12ResponseD	1%	Virustotal		Browse
http://tempuri.org/Entity/Id7ResponseD	1%	Virustotal		Browse
http://tempuri.org/Entity/Id18Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id3Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id9	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id18Response	2%	Virustotal		Browse
http://tempuri.org/Entity/Id16ResponseD	0%	Virustotal		Browse
http://tempuri.org/Entity/Id22ResponseD	2%	Virustotal		Browse
http://tempuri.org/Entity/Id8	0%	Avira URL Cloud	safe
http://tempuri.org/D	1%	Virustotal		Browse
http://tempuri.org/Entity/Id22Response	2%	Virustotal		Browse
http://tempuri.org/Entity/Id5	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id19ResponseD	1%	Virustotal		Browse
http://tempuri.org/Entity/Id3Response	2%	Virustotal		Browse
http://tempuri.org/Entity/Id9	1%	Virustotal		Browse
http://tempuri.org/Entity/Id5	1%	Virustotal		Browse
http://tempuri.org/Entity/Id8	1%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ipinfo.io	34.117.59.81	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
194.49.94.152:19053	true	17%, Virustotal, Browse Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtab	AppLaunch.exe, 0000000B.00000002.2380103032.0000000008FBC000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000009163000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2373910611.0000000007464000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.00000000090D6000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000008EA1000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000009049000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000008F2E000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2373910611.000000000792F000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2373910611.00000000079C5000.00000004.00000800.00020000.00000000.sdmp, 3rB05VU.exe, 0000000C.00000003.2249463056.000000000335A000.00000004.00000020.00020000.00000000.sdmp, 3rB05VU.exe, 0000000C.00000003.2251488550.000000000336B000.00000004.00000020.00020000.00000000.sdmp, OfficeTrackerNMP131.exe, 00000012.00000003.2263669444.0000000003888000.00000004.00000020.00020000.00000000.sdmp, OfficeTrackerNMP131.exe, 00000012.00000003.2267666589.0000000003888000.00000004.00000020.00020000.00000000.sdmp, 3b6N2Xdh3CYwWeb Data.18.dr, 3b6N2Xdh3CYwWeb Data.12.dr, D87fZN3R3jFeWeb Data.18.dr, D87fZN3R3jFeWeb Data.12.dr	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	AppLaunch.exe, 0000000B.00000002.2380103032.0000000008E86000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000008FBC000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000009163000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000008F13000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2373910611.0000000007464000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.00000000090BC000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.00000000090D6000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2373910611.000000000798D000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000008EA1000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000009147000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.000000000902D000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000009049000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2373910611.00000000078F7000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2373910611.00000000074C6000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000008F2E000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2373910611.000000000792F000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000008FA0000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2373910611.0000000007A23000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2373910611.00000000079C5000.00000004.00000800.00020000.00000000.sdmp, 3rB05VU.exe, 0000000C.00000003.2249463056.000000000335A000.00000004.00000020.00020000.00000000.sdmp, 3rB05VU.exe, 0000000C.00000003.2251488550.000000000336B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id23ResponseD	AppLaunch.exe, 0000000B.00000002.2373910611.0000000007886000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id12Response	AppLaunch.exe, 0000000B.00000002.2373910611.0000000007321000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/	AppLaunch.exe, 0000000B.00000002.2373910611.0000000007321000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id2Response	AppLaunch.exe, 0000000B.00000002.2373910611.0000000007321000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id21Response	AppLaunch.exe, 0000000B.00000002.2373910611.0000000007321000.00000004.00000800.00020000.00000000.sdmp	false	4%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-address	BC5tT98.exe, 00000002.00000003.1636508373.0000000004A9B000.00000004.00000020.00020000.00000000.sdmp, 3rB05VU.exe, 0000000C.00000003.2222685763.0000000000B75000.00000004.00000020.00020000.00000000.sdmp, 3rB05VU.exe, 0000000C.00000000.2217497768.00000000008F6000.00000002.00000001.01000000.0000000A.sdmp, 3rB05VU.exe, 0000000C.00000002.2581115078.00000000008F6000.00000002.00000001.01000000.0000000A.sdmp, 3rB05VU.exe, 0000000C.00000003.2218839974.0000000000B41000.00000004.00000020.00020000.00000000.sdmp, OfficeTrackerNMP131.exe, 00000011.00000000.2237844332.0000000000116000.00000002.00000001.01000000.0000000C.sdmp, OfficeTrackerNMP131.exe, 00000011.00000002.2360401589.0000000000116000.00000002.00000001.01000000.0000000C.sdmp, OfficeTrackerNMP131.exe, 00000012.00000002.2885751133.0000000000116000.00000002.00000001.01000000.0000000C.sdmp, OfficeTrackerNMP131.exe, 00000012.00000000.2238719070.0000000000116000.00000002.00000001.01000000.0000000C.sdmp, MaxLoonaFest131.exe, 00000013.00000000.2359759982.0000000000696000.00000002.00000001.01000000.0000000E.sdmp, MaxLoonaFest131.exe, 00000013.00000002.2390326126.0000000000696000.00000002.00000001.01000000.0000000E.sdmp, MaxLoonaFest131.exe, 00000014.00000000.2442392337.0000000000696000.00000002.00000001.01000000.0000000E.sdmp, MaxLoonaFest131.exe, 00000014.00000002.2450878543.0000000000696000.00000002.00000001.01000000.0000000E.sdmp, FANBooster131.exe, 00000016.00000002.2538983831.0000000000936000.00000002.00000001.01000000.0000000F.sdmp, FANBooster131.exe, 00000016.00000000.2530405181.0000000000936000.00000002.00000001.01000000.0000000F.sdmp, MaxLoonaFest131.exe.12.dr, FANBooster131.exe.12.dr, OfficeTrackerNMP131.exe.12.dr, 3rB05VU.exe.2.dr	false		high
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id6ResponseD	AppLaunch.exe, 0000000B.00000002.2373910611.0000000007419000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://support.microsoft..	OfficeTrackerNMP131.exe, 00000012.00000002.2886061884.0000000000F7D000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	low
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	AppLaunch.exe, 0000000B.00000002.2373910611.0000000007321000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id13ResponseD	AppLaunch.exe, 0000000B.00000002.2373910611.0000000007419000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat	AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id15Response	AppLaunch.exe, 0000000B.00000002.2373910611.0000000007321000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	AppLaunch.exe, 0000000B.00000002.2373910611.0000000007419000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.ip.sb/ip	AppLaunch.exe, 0000000B.00000002.2373910611.0000000007321000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id1ResponseD	AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	AppLaunch.exe, 0000000B.00000002.2380103032.0000000008E86000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000008FBC000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000009163000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000008F13000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2373910611.0000000007464000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.00000000090BC000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.00000000090D6000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2373910611.000000000798D000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000008EA1000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000009147000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.000000000902D000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000009049000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2373910611.00000000078F7000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2373910611.00000000074C6000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000008F2E000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2373910611.000000000792F000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000008FA0000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2373910611.0000000007A23000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2373910611.00000000079C5000.00000004.00000800.00020000.00000000.sdmp, 3rB05VU.exe, 0000000C.00000003.2249463056.000000000335A000.00000004.00000020.00020000.00000000.sdmp, 3rB05VU.exe, 0000000C.00000003.2251488550.000000000336B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t.me/RiseProSUPPORT	FANBooster131.exe, 00000016.00000002.2539274464.000000000109E000.00000004.00000020.00020000.00000000.sdmp, passwords.txt.12.dr, i0Y2zBdGkYmG70fPowdUhlT85ovTRCZq.zip.17.dr, 9qAkkNWhLDEhe3SVi3MbZOkApbYumn_h.zip.12.dr, passwords.txt.17.dr	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id24Response	AppLaunch.exe, 0000000B.00000002.2373910611.0000000007321000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	AppLaunch.exe, 0000000B.00000002.2380103032.0000000008E86000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000008FBC000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000009163000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000008F13000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2373910611.0000000007464000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.00000000090BC000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.00000000090D6000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2373910611.000000000798D000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000008EA1000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000009147000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.000000000902D000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000009049000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2373910611.00000000078F7000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2373910611.00000000074C6000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000008F2E000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2373910611.000000000792F000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000008FA0000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2373910611.0000000007A23000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2373910611.00000000079C5000.00000004.00000800.00020000.00000000.sdmp, 3rB05VU.exe, 0000000C.00000003.2249463056.000000000335A000.00000004.00000020.00020000.00000000.sdmp, 3rB05VU.exe, 0000000C.00000003.2251488550.000000000336B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	AppLaunch.exe, 0000000B.00000002.2373910611.0000000007321000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id21ResponseD	AppLaunch.exe, 0000000B.00000002.2373910611.0000000007419000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing	AppLaunch.exe, 0000000B.00000002.2373910611.0000000007321000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ipinfo.io/	OfficeTrackerNMP131.exe, 00000012.00000002.2886061884.0000000000F27000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id10ResponseD	AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	IWPfiAXUTJTSHistory.18.dr, 02zdBXl47cvzHistory.12.dr, IWPfiAXUTJTSHistory.12.dr, 02zdBXl47cvzHistory.18.dr	false		high
http://tempuri.org/Entity/Id5Response	AppLaunch.exe, 0000000B.00000002.2373910611.0000000007321000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	AppLaunch.exe, 0000000B.00000002.2373910611.0000000007321000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id10Response	AppLaunch.exe, 0000000B.00000002.2373910611.0000000007321000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id8Response	AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2373910611.0000000007321000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey	AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback	AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT	AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/D	AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/06/addressingex	AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce	AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse	AppLaunch.exe, 0000000B.00000002.2373910611.0000000007321000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.thawte.com/ThawteTimestampingCA.crl0	BC5tT98.exe, 00000002.00000003.1636508373.0000000004A9B000.00000004.00000020.00020000.00000000.sdmp, 2Iu7231.exe.2.dr	false		high
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510	AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id13Response	AppLaunch.exe, 0000000B.00000002.2373910611.0000000007321000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd	AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif	AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id12ResponseD	AppLaunch.exe, 0000000B.00000002.2373910611.0000000007419000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed	AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1	AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://t.me/Ris	3rB05VU.exe, 0000000C.00000002.2583749077.00000000043E2000.00000004.00000020.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1	AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty	AppLaunch.exe, 0000000B.00000002.2373910611.0000000007321000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct	AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id7ResponseD	AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement	AppLaunch.exe, 0000000B.00000002.2373910611.0000000007321000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT	AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	AppLaunch.exe, 0000000B.00000002.2380103032.0000000008E86000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000008FBC000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000009163000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000008F13000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2373910611.0000000007464000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.00000000090BC000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.00000000090D6000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2373910611.000000000798D000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000008EA1000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000009147000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.000000000902D000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000009049000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2373910611.00000000078F7000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2373910611.00000000074C6000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000008F2E000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2373910611.000000000792F000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2380103032.0000000008FA0000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2373910611.0000000007A23000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2373910611.00000000079C5000.00000004.00000800.00020000.00000000.sdmp, 3rB05VU.exe, 0000000C.00000003.2249463056.000000000335A000.00000004.00000020.00020000.00000000.sdmp, 3rB05VU.exe, 0000000C.00000003.2251488550.000000000336B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	AppLaunch.exe, 0000000B.00000002.2373910611.0000000007321000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id4ResponseD	AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap	AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2002/12/policy	AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id22Response	AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2373910611.0000000007321000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id22ResponseD	AppLaunch.exe, 0000000B.00000002.2373910611.0000000007886000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id16ResponseD	AppLaunch.exe, 0000000B.00000002.2373910611.0000000007886000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue	AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext	AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/Issue	AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id19ResponseD	AppLaunch.exe, 0000000B.00000002.2373910611.0000000007886000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/spnego	AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/sc	AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id18Response	AppLaunch.exe, 0000000B.00000002.2373910611.0000000007321000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd	AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id3Response	AppLaunch.exe, 0000000B.00000002.2373910611.0000000007321000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence	AppLaunch.exe, 0000000B.00000002.2373910611.0000000007321000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/actor/next	AppLaunch.exe, 0000000B.00000002.2373910611.0000000007321000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id9	AppLaunch.exe, 0000000B.00000002.2373910611.0000000007321000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomple	OfficeTrackerNMP131.exe, 00000011.00000003.2283329805.0000000003DC9000.00000004.00000020.00020000.00000000.sdmp, OfficeTrackerNMP131.exe, 00000011.00000003.2283612605.0000000003DBA000.00000004.00000020.00020000.00000000.sdmp, OfficeTrackerNMP131.exe, 00000011.00000003.2283305020.0000000003DBA000.00000004.00000020.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id8	AppLaunch.exe, 0000000B.00000002.2373910611.00000000073BB000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.2373910611.0000000007321000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id5	AppLaunch.exe, 0000000B.00000002.2373910611.0000000007321000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
194.49.94.152	unknown	unknown		42707	EQUEST-ASNL	true
34.117.59.81	ipinfo.io	United States		139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false

General Information

Joe Sandbox Version:	38.0.0 Ammolite
Analysis ID:	1345577
Start date and time:	2023-11-21 04:16:05 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 10m 40s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	23
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	14OWDrfahJ.exe renamed because original name is a hash value
Original Sample Name:	725dbfed269993cb9944c2e1f7bde652.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@26/50@1/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 95% Number of executed functions: 179 Number of non-executed functions: 138
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
03:17:52	Task Scheduler	Run new task: OfficeTrackerNMP131 HR path: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe
03:17:52	Task Scheduler	Run new task: OfficeTrackerNMP131 LG path: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe
03:17:54	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run MaxLoonaFest131 C:\Users\user\AppData\Local\MaxLoonaFest131\MaxLoonaFest131.exe
03:18:04	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run MaxLoonaFest131 C:\Users\user\AppData\Local\MaxLoonaFest131\MaxLoonaFest131.exe
03:18:13	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk
04:18:04	API Interceptor	15x Sleep call for process: AppLaunch.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
194.49.94.152	KGTr0pyiHy.exe	Get hash	malicious	PrivateLoader, RedLine, RisePro Stealer, SmokeLoader	Browse
	VvJtPX1Ju6.exe	Get hash	malicious	PrivateLoader, RedLine, RisePro Stealer, SmokeLoader	Browse
	dftpzJ6W8e.exe	Get hash	malicious	PrivateLoader, RedLine, RisePro Stealer, SmokeLoader	Browse
	file.exe	Get hash	malicious	PrivateLoader, RisePro Stealer	Browse
	file.exe	Get hash	malicious	PrivateLoader, RisePro Stealer	Browse
	file.exe	Get hash	malicious	PrivateLoader, RisePro Stealer	Browse
	file.exe	Get hash	malicious	PrivateLoader, RisePro Stealer	Browse
	file.exe	Get hash	malicious	PrivateLoader, RisePro Stealer	Browse
	file.exe	Get hash	malicious	PrivateLoader, RisePro Stealer	Browse
	lW0QDt6F5B.exe	Get hash	malicious	PrivateLoader, RedLine, RisePro Stealer, SmokeLoader	Browse
	nncbJPkOMX.exe	Get hash	malicious	PrivateLoader, RedLine, RisePro Stealer, SmokeLoader	Browse
	Wuaubi10yf.exe	Get hash	malicious	PrivateLoader, RedLine, RisePro Stealer, SmokeLoader	Browse
	file.exe	Get hash	malicious	PrivateLoader, RisePro Stealer	Browse
	file.exe	Get hash	malicious	PrivateLoader, RisePro Stealer	Browse
	file.exe	Get hash	malicious	PrivateLoader, RisePro Stealer	Browse
	file.exe	Get hash	malicious	PrivateLoader, RisePro Stealer	Browse
	file.exe	Get hash	malicious	PrivateLoader, RisePro Stealer	Browse
	file.exe	Get hash	malicious	PrivateLoader, RisePro Stealer	Browse
	file.exe	Get hash	malicious	PrivateLoader, RisePro Stealer	Browse
	file.exe	Get hash	malicious	PrivateLoader, RisePro Stealer	Browse
34.117.59.81	SecuriteInfo.com.Win32.KeyloggerX-gen.20370.1036.exe	Get hash	malicious	Unknown	Browse	ipinfo.io/ip
	SecuriteInfo.com.Win32.KeyloggerX-gen.20370.1036.exe	Get hash	malicious	Unknown	Browse	ipinfo.io/ip
	IP-Grabber.ps1	Get hash	malicious	Unknown	Browse	ipinfo.io/ip
	BadUsb.ps1	Get hash	malicious	Unknown	Browse	ipinfo.io/ip
	ZmYfQBiw.exe	Get hash	malicious	Unknown	Browse	ipinfo.io/
	jmdCh1Z3.exe	Get hash	malicious	Unknown	Browse	ipinfo.io/
	wAFWKlU1.exe	Get hash	malicious	Unknown	Browse	ipinfo.io/
	41zkbPOMpg.exe	Get hash	malicious	Unknown	Browse	ipinfo.io/geo
	41zkbPOMpg.exe	Get hash	malicious	Unknown	Browse	ipinfo.io/geo
	bYpCn0v8.posh.ps1	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	Bon8RXwP7S.exe	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	CCiocj0tkz.exe	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	7c.exe	Get hash	malicious	AsyncRAT, Blank Grabber, Clipboard Hijacker, EICAR, StormKitty, ToxicEye, WorldWind Stealer	Browse	ipinfo.io/json
	http://34.117.59.81	Get hash	malicious	Unknown	Browse	34.117.59.81/
	5b1d7866.exe	Get hash	malicious	RedLine	Browse	ipinfo.io/ip
	SecuriteInfo.com.Variant.Tedy.197311.29167.32662.exe	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	iTop Easy Desktop_Setup_IU.exe	Get hash	malicious	Unknown	Browse	ipinfo.io/
	sample.exe	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	04451999.exe.lnk	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	o5QR1PuuAx.exe	Get hash	malicious	Orcus	Browse	ipinfo.io/ip

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ipinfo.io	KGTr0pyiHy.exe	Get hash	malicious	PrivateLoader, RedLine, RisePro Stealer, SmokeLoader	Browse	34.117.59.81
	VvJtPX1Ju6.exe	Get hash	malicious	PrivateLoader, RedLine, RisePro Stealer, SmokeLoader	Browse	34.117.59.81
	dftpzJ6W8e.exe	Get hash	malicious	PrivateLoader, RedLine, RisePro Stealer, SmokeLoader	Browse	34.117.59.81
	file.exe	Get hash	malicious	PrivateLoader, RisePro Stealer	Browse	34.117.59.81
	file.exe	Get hash	malicious	PrivateLoader, RisePro Stealer	Browse	34.117.59.81
	file.exe	Get hash	malicious	PrivateLoader, RisePro Stealer	Browse	34.117.59.81
	file.exe	Get hash	malicious	PrivateLoader, RisePro Stealer	Browse	34.117.59.81
	file.exe	Get hash	malicious	PrivateLoader, RisePro Stealer	Browse	34.117.59.81
	file.exe	Get hash	malicious	PrivateLoader, RisePro Stealer	Browse	34.117.59.81
	file.exe	Get hash	malicious	PrivateLoader, RisePro Stealer	Browse	34.117.59.81
	file.exe	Get hash	malicious	PrivateLoader, RisePro Stealer	Browse	34.117.59.81
	lW0QDt6F5B.exe	Get hash	malicious	PrivateLoader, RedLine, RisePro Stealer, SmokeLoader	Browse	34.117.59.81
	nncbJPkOMX.exe	Get hash	malicious	PrivateLoader, RedLine, RisePro Stealer, SmokeLoader	Browse	34.117.59.81
	Wuaubi10yf.exe	Get hash	malicious	PrivateLoader, RedLine, RisePro Stealer, SmokeLoader	Browse	34.117.59.81
	sil5l1lROD.exe	Get hash	malicious	Unknown	Browse	34.117.59.81
	file.exe	Get hash	malicious	PrivateLoader, RisePro Stealer	Browse	34.117.59.81
	file.exe	Get hash	malicious	PrivateLoader, RisePro Stealer	Browse	34.117.59.81
	file.exe	Get hash	malicious	PrivateLoader, RisePro Stealer	Browse	34.117.59.81
	file.exe	Get hash	malicious	PrivateLoader, RisePro Stealer	Browse	34.117.59.81
	file.exe	Get hash	malicious	PrivateLoader, RisePro Stealer	Browse	34.117.59.81

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
EQUEST-ASNL	KGTr0pyiHy.exe	Get hash	malicious	PrivateLoader, RedLine, RisePro Stealer, SmokeLoader	Browse	194.49.94.152
	VvJtPX1Ju6.exe	Get hash	malicious	PrivateLoader, RedLine, RisePro Stealer, SmokeLoader	Browse	194.49.94.152
	dftpzJ6W8e.exe	Get hash	malicious	PrivateLoader, RedLine, RisePro Stealer, SmokeLoader	Browse	194.49.94.152
	file.exe	Get hash	malicious	Glupteba, Vidar	Browse	194.49.94.85
	file.exe	Get hash	malicious	PrivateLoader, RisePro Stealer	Browse	194.49.94.152
	file.exe	Get hash	malicious	Babuk, Clipboard Hijacker, CryptOne, Djvu, Glupteba, RedLine, SmokeLoader	Browse	194.49.94.77
	file.exe	Get hash	malicious	PrivateLoader, RisePro Stealer	Browse	194.49.94.152
	file.exe	Get hash	malicious	PrivateLoader, RisePro Stealer	Browse	194.49.94.152
	file.exe	Get hash	malicious	CryptOne, Djvu, Glupteba, RedLine, SmokeLoader, Vidar, Xmrig	Browse	194.49.94.77
	file.exe	Get hash	malicious	PrivateLoader, RisePro Stealer	Browse	194.49.94.152
	file.exe	Get hash	malicious	PrivateLoader, RisePro Stealer	Browse	194.49.94.152
	file.exe	Get hash	malicious	RedLine	Browse	194.49.94.142
	file.exe	Get hash	malicious	PrivateLoader, RisePro Stealer	Browse	194.49.94.152
	file.exe	Get hash	malicious	CryptOne, Djvu, Glupteba, RedLine, SmokeLoader, Vidar, Xmrig	Browse	194.49.94.77
	file.exe	Get hash	malicious	RedLine	Browse	194.49.94.80
	lW0QDt6F5B.exe	Get hash	malicious	PrivateLoader, RedLine, RisePro Stealer, SmokeLoader	Browse	194.49.94.152
	nncbJPkOMX.exe	Get hash	malicious	PrivateLoader, RedLine, RisePro Stealer, SmokeLoader	Browse	194.49.94.152
	Wuaubi10yf.exe	Get hash	malicious	PrivateLoader, RedLine, RisePro Stealer, SmokeLoader	Browse	194.49.94.152
	1DI50gCNGQ.exe	Get hash	malicious	Glupteba, RedLine, SmokeLoader, Vidar, Xmrig	Browse	194.49.94.77
	file.exe	Get hash	malicious	PrivateLoader, RisePro Stealer	Browse	194.49.94.152
GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	KGTr0pyiHy.exe	Get hash	malicious	PrivateLoader, RedLine, RisePro Stealer, SmokeLoader	Browse	34.117.59.81
	VvJtPX1Ju6.exe	Get hash	malicious	PrivateLoader, RedLine, RisePro Stealer, SmokeLoader	Browse	34.117.59.81
	dftpzJ6W8e.exe	Get hash	malicious	PrivateLoader, RedLine, RisePro Stealer, SmokeLoader	Browse	34.117.59.81
	file.exe	Get hash	malicious	PrivateLoader, RisePro Stealer	Browse	34.117.59.81
	file.exe	Get hash	malicious	PrivateLoader, RisePro Stealer	Browse	34.117.59.81
	file.exe	Get hash	malicious	PrivateLoader, RisePro Stealer	Browse	34.117.59.81
	https://s3waqgjv83b.larksuite.com/docx/U9qhdPDPIoyGGvxrwcPuMm4osRf?from=from_copylink	Get hash	malicious	Unknown	Browse	34.117.97.41
	file.exe	Get hash	malicious	PrivateLoader, RisePro Stealer	Browse	34.117.59.81
	CourierRequest_signed.apk	Get hash	malicious	Unknown	Browse	34.117.60.144
	file.exe	Get hash	malicious	PrivateLoader, RisePro Stealer	Browse	34.117.59.81
	file.exe	Get hash	malicious	PrivateLoader, RisePro Stealer	Browse	34.117.59.81
	file.exe	Get hash	malicious	PrivateLoader, RisePro Stealer	Browse	34.117.59.81
	G7DyaA9iz9.exe	Get hash	malicious	Pushdo	Browse	34.67.9.172
	file.exe	Get hash	malicious	PrivateLoader, RisePro Stealer	Browse	34.117.59.81
	lW0QDt6F5B.exe	Get hash	malicious	PrivateLoader, RedLine, RisePro Stealer, SmokeLoader	Browse	34.117.59.81
	nncbJPkOMX.exe	Get hash	malicious	PrivateLoader, RedLine, RisePro Stealer, SmokeLoader	Browse	34.117.59.81
	Wuaubi10yf.exe	Get hash	malicious	PrivateLoader, RedLine, RisePro Stealer, SmokeLoader	Browse	34.117.59.81
	sil5l1lROD.exe	Get hash	malicious	Unknown	Browse	34.117.59.81
	Fax-399383-3003-30393.xlsx	Get hash	malicious	Unknown	Browse	34.117.177.207
	Fax-399383-3003-30393.xlsx	Get hash	malicious	Unknown	Browse	34.117.177.207

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	KGTr0pyiHy.exe	Get hash	malicious	PrivateLoader, RedLine, RisePro Stealer, SmokeLoader	Browse	34.117.59.81
	VvJtPX1Ju6.exe	Get hash	malicious	PrivateLoader, RedLine, RisePro Stealer, SmokeLoader	Browse	34.117.59.81
	dftpzJ6W8e.exe	Get hash	malicious	PrivateLoader, RedLine, RisePro Stealer, SmokeLoader	Browse	34.117.59.81
	file.exe	Get hash	malicious	PrivateLoader, RisePro Stealer	Browse	34.117.59.81
	file.exe	Get hash	malicious	Babuk, Clipboard Hijacker, CryptOne, Djvu, Glupteba, RedLine, SmokeLoader	Browse	34.117.59.81
	file.exe	Get hash	malicious	PrivateLoader, RisePro Stealer	Browse	34.117.59.81
	file.exe	Get hash	malicious	PrivateLoader, RisePro Stealer	Browse	34.117.59.81
	file.exe	Get hash	malicious	PrivateLoader, RisePro Stealer	Browse	34.117.59.81
	file.exe	Get hash	malicious	CryptOne, Djvu, Glupteba, RedLine, SmokeLoader, Vidar, Xmrig	Browse	34.117.59.81
	NEWREST_Procurement.xlsx	Get hash	malicious	Unknown	Browse	34.117.59.81
	file.exe	Get hash	malicious	PrivateLoader, RisePro Stealer	Browse	34.117.59.81
	file.exe	Get hash	malicious	PrivateLoader, RisePro Stealer	Browse	34.117.59.81
	file.exe	Get hash	malicious	PrivateLoader, RisePro Stealer	Browse	34.117.59.81
	file.exe	Get hash	malicious	PrivateLoader, RisePro Stealer	Browse	34.117.59.81
	file.exe	Get hash	malicious	CryptOne, Djvu, Glupteba, RedLine, SmokeLoader, Vidar, Xmrig	Browse	34.117.59.81
	DOCUMENTOVIEW_FACTURAEXPRESS_ESCANEAD_PDFN3D0L3BG5D.exe	Get hash	malicious	Unknown	Browse	34.117.59.81
	DOCUMENTOVIEW_FACTURAEXPRESS_ESCANEAD_PDFN3D0L3BG5D.exe	Get hash	malicious	Unknown	Browse	34.117.59.81
	lW0QDt6F5B.exe	Get hash	malicious	PrivateLoader, RedLine, RisePro Stealer, SmokeLoader	Browse	34.117.59.81
	IMG123101.jpg.js.Docx	Get hash	malicious	Unknown	Browse	34.117.59.81
	nncbJPkOMX.exe	Get hash	malicious	PrivateLoader, RedLine, RisePro Stealer, SmokeLoader	Browse	34.117.59.81

Process:	C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1322267
Entropy (8bit):	6.666192479005095
Encrypted:	false
SSDEEP:	24576:NmmEs2wqfcRBxJCBEmAMpCOJMbgp2kvB1Pj5R+d3ThJZrU35Zln2i6:8dw/IyPxbgp2iB1Pju3TRrK5Zln2i6
MD5:	5158C4F1C895E03E3157643FBA44BF15
SHA1:	02E191C58D6D9B40779FDE325E04DAF2BFC55E70
SHA-256:	BE74C33F2F6CBD28A1CE43D6597ED5CD5F0052EE27FD11EE2F91514CF1400118
SHA-512:	C39DC8508F862F30D393F4C81B4CB16C5F8A673600F1821F3046D3EC2BE720BBAA5435E7A09B717760E5B41AB6EC75B830261545802AC08E104E47FBA571DEA5
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PrivateLoader, Description: Yara detected PrivateLoader, Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe, Author: Joe Security
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Virustotal, Detection: 65%, Browse
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........\|............e......e.4..,`.....e.....a>.....a.....a......a.....e.....e.....e..........>a....>a<......T....>a.....Rich...........PE..L....VRe...............".L..........K........`....@..........................p............@.................................dz..................................0.......8...........................H...@............`...............................text...xJ.......L.................. ..`.rdata.../...`...0...P..............@..@.data....5......."..................@....rsrc...............................@..@.reloc..0...........................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\MaxLoonaFest131\MaxLoonaFest131.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1322267
Entropy (8bit):	6.666192479005095
Encrypted:	false
SSDEEP:	24576:NmmEs2wqfcRBxJCBEmAMpCOJMbgp2kvB1Pj5R+d3ThJZrU35Zln2i6:8dw/IyPxbgp2iB1Pju3TRrK5Zln2i6
MD5:	5158C4F1C895E03E3157643FBA44BF15
SHA1:	02E191C58D6D9B40779FDE325E04DAF2BFC55E70
SHA-256:	BE74C33F2F6CBD28A1CE43D6597ED5CD5F0052EE27FD11EE2F91514CF1400118
SHA-512:	C39DC8508F862F30D393F4C81B4CB16C5F8A673600F1821F3046D3EC2BE720BBAA5435E7A09B717760E5B41AB6EC75B830261545802AC08E104E47FBA571DEA5
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PrivateLoader, Description: Yara detected PrivateLoader, Source: C:\Users\user\AppData\Local\MaxLoonaFest131\MaxLoonaFest131.exe, Author: Joe Security
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Virustotal, Detection: 65%, Browse
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........\|............e......e.4..,`.....e.....a>.....a.....a......a.....e.....e.....e..........>a....>a<......T....>a.....Rich...........PE..L....VRe...............".L..........K........`....@..........................p............@.................................dz..................................0.......8...........................H...@............`...............................text...xJ.......L.................. ..`.rdata.../...`...0...P..............@..@.data....5......."..................@....rsrc...............................@..@.reloc..0...........................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.log

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3094
Entropy (8bit):	5.33145931749415
Encrypted:	false
SSDEEP:	96:Pq5qHwCYqh3oPtI6eqzxP0aymTqdqlq7qqjqc85VD:Pq5qHwCYqh3qtI6eqzxP0atTqdqlq7qV
MD5:	2A56468A7C0F324A42EA599BF0511FAF
SHA1:	404B343A86EDEDF5B908D7359EB8AA957D1D4333
SHA-256:	6398E0BD46082BBC30008BC72A2BA092E0A1269052153D343AA40F935C59957C
SHA-512:	19B79181C40AA51C7ECEFCD4C9ED42D5BA19EA493AE99654D3A763EA9B21B1ABE5B5739AAC425E461609E1165BCEA749CFB997DE0D35303B4CF2A29BDEF30B17
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Temp\9qAkkNWhLDEhe3SVi3MbZOkApbYumn_h.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	5519
Entropy (8bit):	7.897524359443915
Encrypted:	false
SSDEEP:	96:pWGzqeAoMq+YK0KF8cAJiI2i+u8qo87RGqUHa5Sr1zeE4WBFr:dqASpF8wFzqoc5U65BWBFr
MD5:	80807121E3E92CEE6C36DF600CAD1E69
SHA1:	0D11B7895BA153C4CA9A8E6441F92B7F69AAB939
SHA-256:	3CA85418D7F09866CD35C749B8A5A490F6496CD9E695E69E159065EC618C02A7
SHA-512:	773384BBE7C9241A46F98F6160BB4925635400019EA63EF82EB2FE5AF13E1D359C7486060D10E9D2F130C6836B126588204893C67C701368C3A9554AC0A08DC0
Malicious:	false
Preview:	PK........L"uW................Cookies\..PK........L"uWQn.+............Cookies\Chrome_Default.txt.G..r...U.#.5C.....s$..-.D...7.\..$.G.)o....:....Z.C.f_..pm............"..t..t....}.k.@...a.2+P`.0.x.>....s..k%.._..b..P..((......B.....`.7..-m..JY..F....E..l.....I..&.....<J..M.......,V...)b.....Q..k......M?.5L....h}......X..'.0..tB.G...\;.a....4.......B4.......J.4.6.y:....4.-.UfE...3Ap.U5UX....Z.g:e.j.C..Bw..........e..a^.vU:....$..U......B..`._.e.....+...9.{u...7.e...H.]02...%yR".0...x...P<..N....R.}....{.G...;..c..x...kw.'S>.d\|.....B..k.9.t.!>.rh...~n.[....s#/....`.!..Kb8%&.vZB`....O\|.....>K......L...d0..03..t...T&.......`N.xp.."..J.......Q.....c..5...).Z.91.6.j..G.....Wr...a.52!..(^.U.....6....dB.D.^...7..0H.\J9.H.$^`e"..d...\....B.8Z=.qeP.3Y.>..'W.X..T..>z...,..K......g....%B.w4#...;.[]u\|....v...3.;L..U?..b.....u....... .......F...P.a...\|R3.=......r.:.64...#D..^..>.A..ZT.]E........t...f...1..3.....`...X.....C.]%...p.p.ym

C:\Users\user\AppData\Local\Temp\FANBooster131\FANBooster131.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1322267
Entropy (8bit):	6.666192479005095
Encrypted:	false
SSDEEP:	24576:NmmEs2wqfcRBxJCBEmAMpCOJMbgp2kvB1Pj5R+d3ThJZrU35Zln2i6:8dw/IyPxbgp2iB1Pju3TRrK5Zln2i6
MD5:	5158C4F1C895E03E3157643FBA44BF15
SHA1:	02E191C58D6D9B40779FDE325E04DAF2BFC55E70
SHA-256:	BE74C33F2F6CBD28A1CE43D6597ED5CD5F0052EE27FD11EE2F91514CF1400118
SHA-512:	C39DC8508F862F30D393F4C81B4CB16C5F8A673600F1821F3046D3EC2BE720BBAA5435E7A09B717760E5B41AB6EC75B830261545802AC08E104E47FBA571DEA5
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PrivateLoader, Description: Yara detected PrivateLoader, Source: C:\Users\user\AppData\Local\Temp\FANBooster131\FANBooster131.exe, Author: Joe Security
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Virustotal, Detection: 65%, Browse
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........\|............e......e.4..,`.....e.....a>.....a.....a......a.....e.....e.....e..........>a....>a<......T....>a.....Rich...........PE..L....VRe...............".L..........K........`....@..........................p............@.................................dz..................................0.......8...........................H...@............`...............................text...xJ.......L.................. ..`.rdata.../...`...0...P..............@..@.data....5......."..................@....rsrc...............................@..@.reloc..0...........................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\IXP000.TMP\5Rp2df8.exe

Download File

Process:	C:\Users\user\Desktop\14OWDrfahJ.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	194329
Entropy (8bit):	7.228014101885434
Encrypted:	false
SSDEEP:	3072:jDKW1LgppLRHMY0TBfJvjcTp5X2QyRk9Bo7KWH2yHsGe:jDKW1Lgbdl0TBBvjc/EIBr42f
MD5:	D46DFAA1A96F696178104F95A293D90B
SHA1:	909E21DF58F6874B39EF1D9056AE1376473DF3DB
SHA-256:	89B9C4C48D5ADC78C8A68F942F29C5910DDFF28E93396637395259FB43BB9FFB
SHA-512:	F414CA192BEF9BAFE1AA6DC03B9689674E741288FB402DF30236053648D45BB6E13E2A0D06ED12669DA490254F8D646A48111AECC4CF38A45C9997467817C79B
Malicious:	true
Yara Hits:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\5Rp2df8.exe, Author: Joe Security Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\5Rp2df8.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Virustotal, Detection: 67%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......h..-,q.~,q.~,q.~2#.~?q.~...~+q.~,q.~\q.~2#n~.q.~2#i~.q.~2#{~-q.~Rich,q.~..................$e....PE..L...t..P..........#..........Z....../.............@..........................@.......;..........................................P....`..T...............................................................@............................................text............................... ..`.rdata...m.......n..................@..@.data....0... ......................@....rsrc...T....`....... ..............@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\IXP000.TMP\Ey3OF47.exe

Download File

Process:	C:\Users\user\Desktop\14OWDrfahJ.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	975872
Entropy (8bit):	7.932567220315467
Encrypted:	false
SSDEEP:	24576:7yzQY6ImYCjOE00BoBXInozrpEZ3mbfxCqyXdHQO:uwImV62+BYozrpEi8qua
MD5:	A8089B11ACB5AEB2755B87605CC0365C
SHA1:	C035EE12225776F021D16E122292F141DEDD624C
SHA-256:	375A34A774523A7C660178999A78DA0957104AC315B0F2F6D2400AD5725361E5
SHA-512:	5776D2393D01E7D23695F3D7943172734F78387466D15141958A715AB8B7F76C1918813F60456C43106A3CAD015441AD38A3BC1EF7DD01C495DA165FEF0323BE
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Virustotal, Detection: 54%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........%...K..K..K...N..K...H..K...O..K...J..K..J...K...C..K.....K...I..K.Rich..K.........PE..L....`.b.................d...\|......`j............@..........................0......Rm....@...... .......................................]................... ..........T...............................@............................................text....c.......d.................. ..`.data...H............h..............@....idata..R............j..............@..@.rsrc....`.......^...\|..............@..@.reloc....... ......................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\IXP001.TMP\4eD052Od.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\Ey3OF47.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	38170
Entropy (8bit):	6.966236649868699
Encrypted:	false
SSDEEP:	768:f8FhylJE+hwr5hN7F0I0bQyvUgq65DQVi:f8qlJEQwrDNuIyvD5sV
MD5:	295C91C8DFB843E25805DDD1DB402BB3
SHA1:	1C97D7AFD1447A3AAD2C1403FC366755F610D8EA
SHA-256:	CCE2538CD7137A0BDD838C7D8483E0FEFB98E3B9ABE26C8E7469ADC27D57FD10
SHA-512:	B514BD0485A053E656BF4A1978C616C7DDDB358020D771AF57FC6F3F5B55C903C01C87D3D9FFE01D49DDBDE915B07F041458FC374DD3E9D79DEC1B84378D9009
Malicious:	true
Yara Hits:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\4eD052Od.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Virustotal, Detection: 62%, Browse
Preview:	MZ..............@.......@...............................................!..L.!This program cannot be run in DOS mode...$........PE..L.....Ue...............H.............2............@.................................%................................................................................................................................................................text............................... ...................................................................................................=?...C...?....r..9CL6(k..El..?.?e..v%.q.v.. .[..6......"m...B...Z.U...P(.......l....n.J.?..W.y.w....^.E.g...o.3...R.+.!>I.lU..C.9K............Yb..l{.F....ve...}.i.L..%)l.......d.{....Nv.6.}..9..]....P9....}.....{.V.(dE....3.0..Y......R...-kx...Q'b7.!..z"n..&1...J...e.......GS.yfs;...&~...g.R.....0.;].......`.........iVV)...sA.^.h...5.,.$...`z..u.4....Qx........U.8.....[......E....C:.m....x.?...7.~....7.....,.:\|......h(.W ...m......[6.r....yK.p.D

C:\Users\user\AppData\Local\Temp\IXP001.TMP\BC5tT98.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\Ey3OF47.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	848896
Entropy (8bit):	7.916586155218512
Encrypted:	false
SSDEEP:	24576:4ypiqqjCyPW8UoiXqnozrHHJ3muNxCWyMdCW:/IGSppi6ozrHHJ8Wl
MD5:	CC54031BCC9F48998C7AE467ACF73422
SHA1:	C3385C4E8512ECB6DBEC0B9A2AD8187BFF4E0F9C
SHA-256:	0ED1909BF61ABCC177900AFEB621C9F4A367141DA2047BCA0D52044BDEF5D729
SHA-512:	A215E90EE43E8D55A4E410F9723D42A900ACE1518F3F51FD3686C330477C5833CF2287497D645FCC9E01F73ADD04359D98456B40DCCDF2E84A4E027ADF05492C
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Virustotal, Detection: 56%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........%...K..K..K...N..K...H..K...O..K...J..K..J...K...C..K.....K...I..K.Rich..K.........PE..L....`.b.................d..........`j............@..........................@............@...... ......................................`l...................0..........T...............................@............................................text....c.......d.................. ..`.data...H............h..............@....idata..R............j..............@..@.rsrc....p.......n...\|..............@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\IXP002.TMP\2Iu7231.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP001.TMP\BC5tT98.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	505120
Entropy (8bit):	6.737133406380524
Encrypted:	false
SSDEEP:	6144:v3nNKoPE2gZB/6fZOE0EUAOtwdl7HaOBq3Nu13Cdq66666q18x:fnNTPE2CEgEdl76nEds/x
MD5:	EFBF47DBDF08AC3A28C0236D9C0A4C27
SHA1:	69AAABF9EA57E16104A3EB5F33D0CE15716D555A
SHA-256:	CF3DBE71579BC48E661CF9D5B59C7F14EF72AC70CAE6B8EDCFE741E19B44F8CC
SHA-512:	AD54945FA67FF90CF84CECDA717ED1E9A84D8AA00037E7A3FE1B2A77E864CF74FC3DDFDEBA1967C0BCB429CC8DB27F473CB763609A746B8069C0B33E626A891C
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Virustotal, Detection: 35%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........C..."..."..."..$P..."..$P..\"..$P..."..$P..."..."..{"..^.."..^..."..^..."..."..."..6^..."..Rich."..........PE..L...m.[e..............."............S.............@.......................................@.................................T...P....................... ........'.....................................@............................................text............................... ..`.rdata..............................@..@.data..............................@....reloc...'.......(...r..............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP001.TMP\BC5tT98.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1322267
Entropy (8bit):	6.666192479005095
Encrypted:	false
SSDEEP:	24576:NmmEs2wqfcRBxJCBEmAMpCOJMbgp2kvB1Pj5R+d3ThJZrU35Zln2i6:8dw/IyPxbgp2iB1Pju3TRrK5Zln2i6
MD5:	5158C4F1C895E03E3157643FBA44BF15
SHA1:	02E191C58D6D9B40779FDE325E04DAF2BFC55E70
SHA-256:	BE74C33F2F6CBD28A1CE43D6597ED5CD5F0052EE27FD11EE2F91514CF1400118
SHA-512:	C39DC8508F862F30D393F4C81B4CB16C5F8A673600F1821F3046D3EC2BE720BBAA5435E7A09B717760E5B41AB6EC75B830261545802AC08E104E47FBA571DEA5
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PrivateLoader, Description: Yara detected PrivateLoader, Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe, Author: Joe Security
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Virustotal, Detection: 65%, Browse
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........\|............e......e.4..,`.....e.....a>.....a.....a......a.....e.....e.....e..........>a....>a<......T....>a.....Rich...........PE..L....VRe...............".L..........K........`....@..........................p............@.................................dz..................................0.......8...........................H...@............`...............................text...xJ.......L.................. ..`.rdata.../...`...0...P..............@..@.data....5......."..................@....rsrc...............................@..@.reloc..0...........................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\i0Y2zBdGkYmG70fPowdUhlT85ovTRCZq.zip

Download File

Process:	C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	5517
Entropy (8bit):	7.899928372355382
Encrypted:	false
SSDEEP:	96:5WGzqeAoMq+YK0KF8cAJiI2i+uF81rXtQBoYx0iehfahx1Up+cBFV:NqASpF8wFm81r+ox5hChx1UpzBFV
MD5:	7F7BC9415457A480F57AAE9506C2F244
SHA1:	CAADF33B5FB6228456E88469D228B9006FCCAAE3
SHA-256:	24F74D39E56C5BF82A9C29D28606C38EFBCCE9A84845BA478B575D82BA15C43F
SHA-512:	48586915B212254399BD30597A9507BC837F840CB086EA20C9744CF9A4FAD79D82C506E8F3DE5AEC4A9E708C82D8449B5BEA34F12CCD7D26D6AEC79029B822E2
Malicious:	false
Preview:	PK........@"uW................Cookies\..PK........@"uWQn.+............Cookies\Chrome_Default.txt.G..r...U.#.5C.....s$..-.D...7.\..$.G.)o....:....Z.C.f_..pm............"..t..t....}.k.@...a.2+P`.0.x.>....s..k%.._..b..P..((......B.....`.7..-m..JY..F....E..l.....I..&.....<J..M.......,V...)b.....Q..k......M?.5L....h}......X..'.0..tB.G...\;.a....4.......B4.......J.4.6.y:....4.-.UfE...3Ap.U5UX....Z.g:e.j.C..Bw..........e..a^.vU:....$..U......B..`._.e.....+...9.{u...7.e...H.]02...%yR".0...x...P<..N....R.}....{.G...;..c..x...kw.'S>.d\|.....B..k.9.t.!>.rh...~n.[....s#/....`.!..Kb8%&.vZB`....O\|.....>K......L...d0..03..t...T&.......`N.xp.."..J.......Q.....c..5...).Z.91.6.j..G.....Wr...a.52!..(^.U.....6....dB.D.^...7..0H.\J9.H.$^`e"..d...\....B.8Z=.qeP.3Y.>..'W.X..T..>z...,..K......g....%B.w4#...;.[]u\|....v...3.;L..U?..b.....u....... .......F...P.a...\|R3.=......r.:.64...#D..^..>.A..ZT.]E........t...f...1..3.....`...X.....C.]%...p.p.ym

C:\Users\user\AppData\Local\Temp\rise131M9Asphalt.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7773627950641693
Encrypted:	false
SSDEEP:	3:L/+Qt:D+Q
MD5:	11EE83C5E89B7A29C0155B9E309152ED
SHA1:	C3604D6770D56C25DAFD8A0A526D51D8FB69B0FD
SHA-256:	B2B004404C7C4969B418C8AADBD00B273DFA658989F13BDF44D88E78F9CE8BC2
SHA-512:	A1A7402A99DF7D4AC271D571312634CA27FE52FABAB38DB32D300764E2E3B0DF5A49CC2303BB3899E60AC83F06071C4F71BC7010BF699175BAC9B7C25DB63DB1
Malicious:	false
Preview:	1700542535615

C:\Users\user\AppData\Local\Temp\tempAVSaeI8GhtgT29e\02zdBXl47cvzHistory

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tempAVSaeI8GhtgT29e\02zdBXl47cvzcookies.sqlite

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tempAVSaeI8GhtgT29e\2jQJv37iJ0lzHistory

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tempAVSaeI8GhtgT29e\3b6N2Xdh3CYwWeb Data

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tempAVSaeI8GhtgT29e\3b6N2Xdh3CYwplaces.sqlite

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tempAVSaeI8GhtgT29e\8ghN89CsjOW1Login Data For Account

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tempAVSaeI8GhtgT29e\D87fZN3R3jFeWeb Data

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tempAVSaeI8GhtgT29e\D87fZN3R3jFeplaces.sqlite

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tempAVSaeI8GhtgT29e\Ei8DrAmaYu9KLogin Data

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tempAVSaeI8GhtgT29e\IWPfiAXUTJTSHistory

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tempAVSaeI8GhtgT29e\JX0OQi4nZtiqWeb Data

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tempAVSaeI8GhtgT29e\QdX9ITDLyCRBLogin Data

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tempAVSaeI8GhtgT29e\UPG2LoPXwc7OHistory

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tempAVSaeI8GhtgT29e\o0qT3dWYBP7ZWeb Data

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tempAVSaeI8GhtgT29e\oOPEmFmu_xsJCookies

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tempAVSgsImjMYlWzR3\02zdBXl47cvzHistory

Download File

Process:	C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tempAVSgsImjMYlWzR3\02zdBXl47cvzcookies.sqlite

Download File

Process:	C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tempAVSgsImjMYlWzR3\2jQJv37iJ0lzHistory

Download File

Process:	C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tempAVSgsImjMYlWzR3\3b6N2Xdh3CYwWeb Data

Download File

Process:	C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tempAVSgsImjMYlWzR3\3b6N2Xdh3CYwplaces.sqlite

Download File

Process:	C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tempAVSgsImjMYlWzR3\8ghN89CsjOW1Login Data For Account

Download File

Process:	C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tempAVSgsImjMYlWzR3\D87fZN3R3jFeWeb Data

Download File

Process:	C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tempAVSgsImjMYlWzR3\D87fZN3R3jFeplaces.sqlite

Download File

Process:	C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tempAVSgsImjMYlWzR3\Ei8DrAmaYu9KLogin Data

Download File

Process:	C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tempAVSgsImjMYlWzR3\IWPfiAXUTJTSHistory

Download File

Process:	C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tempAVSgsImjMYlWzR3\JX0OQi4nZtiqWeb Data

Download File

Process:	C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tempAVSgsImjMYlWzR3\QdX9ITDLyCRBLogin Data

Download File

Process:	C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tempAVSgsImjMYlWzR3\UPG2LoPXwc7OHistory

Download File

Process:	C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tempAVSgsImjMYlWzR3\o0qT3dWYBP7ZWeb Data

Download File

Process:	C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tempAVSgsImjMYlWzR3\oOPEmFmu_xsJCookies

Download File

Process:	C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\Cookies\Chrome_Default.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe
File Type:	ASCII text, with very long lines (769), with CRLF line terminators
Category:	dropped
Size (bytes):	6085
Entropy (8bit):	6.038274200863744
Encrypted:	false
SSDEEP:	96:gxsumX/xKO2KbcRfbZJ5Jxjxcx1xcbza5BC126oxgxA26Fxr/CxbTxqCGYURxOeb:gWFXZQHRFJ5Pts7c3avC126Ygb6Lr/WY
MD5:	ACB5AD34236C58F9F7D219FB628E3B58
SHA1:	02E39404CA22F1368C46A7B8398F5F6001DB8F5C
SHA-256:	05E5013B848C2E619226F9E7A084DC7DCD1B3D68EE45108F552DB113D21B49D1
SHA-512:	5895F39765BA3CEDFD47D57203FD7E716347CD79277EDDCDC83A729A86E2E59F03F0E7B6B0D0E7C7A383755001EDACC82171052BE801E015E6BF7E6B9595767F
Malicious:	false
Preview:	.google.com.TRUE./.TRUE.1712145003.NID.ENC893_djEw3+k+F2A/rK1XOX2BXUq6pY2LBCOzoXODiJnrrvDbDsPWiYwKZowg9PxHqkTm37HpwC52rXpnuUFrQMpV3iKtdSHegOm+XguZZ6tGaCY2hGVyR8JgIqQma1WLXyhCiWqjou7/c3qSeaKyNoUKHa4TULX4ZnNNtXFoCuZcBAAy4tYcz+0BF4j/0Pg+MgV+s7367kYcjO4q3zwc+XorjSs7PlgWlYrcc55rCJplhJ+H13M00HIdLm+1t9PACck2xxSWX2DsA61sEDJCHEc=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.FALSE./.TRUE.1696413835..AspNetCore.AuthProvider.ENC893_djEwVWJCCNyFkY3ZM/58ZZ/F/bz9H1yPvi6FOaroXC+KU8E=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.TRUE./signin-oidc.TRUE.1696414135..AspNetCore.Correlation.mdRqPJxLbpyv7vX0eK9YkTR-xwcrW3VBLE4Y3HEvxuU.ENC893_djEwBAKLrkJs5PZ6BD7Beoa9N/bOSh5JtRch10gZT+E=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.TRUE./signin-oidc.TRUE.1696414135..AspNetCore.OpenIdConnect.Nonce.CfDJ8Kiuy_B5JgFMo7PeP95NLhqwcJ8koDy5pXkfoWsb5SbbU2hVCbsH2qt9GF_OVCqFkLEwhvzeADNQOF5RSmkDfh5RqfqlOkx5QWo4Lltvwb0CvwBFD8ujlm3BAglOeGca3ZatkLMUkH

C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\information.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5722
Entropy (8bit):	5.385073733001579
Encrypted:	false
SSDEEP:	96:twlQwbf9fJHBd8pvBUfioHmobapzOI4+68Dae5apYBRw/f0iV2z5JZx8kaNKs7sJ:t6RKgioGobaoI4+68Dae5apYBRw/f0ia
MD5:	EA9FBE4AFD11E6387A6017ADBC8FB714
SHA1:	7C6D84B8392743D89811B75D7057181D891DA4F1
SHA-256:	43E65FCFFB5A878CB9377CE942B853442FB197C4345B52E5F6B0922B541EBA3F
SHA-512:	42EC3E98B393DB00C289092D7C625988EC53D958FD54EF7B1A9D226EE1BE4ED67310DFE48160D091FD76F907F2EDC451B4239A80A69EA7444DD2893FA860C41B
Malicious:	false
Preview:	Version: 1.0..Date: Tue Nov 21 04:17:55 2023.MachineID: 9e146be9-c76a-4720-bcdb-53011b87bd06.GUID: {a33c7340-61ca-11ee-8c18-806e6f6e6963}.HWID: bae8dddaaca209009b2a630770ff8b0b..Path: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe.Work Dir: C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e..IP: 89.149.18.60.Location: US, Washington.Windows: Windows 10 Pro [x64].Computer Name: 367706.User Name: user.Display Resolution: 1280x1024.Display Language: en-CH.Keyboard Languages: English (United Kingdom) / English (United Kingdom).Local Time: 21/11/2023 4:17:55.TimeZone: UTC1..[Hardware].Processor: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz.CPU Count: 4.RAM: 8191 MB.VideoCard #0: Microsoft Basic Display Adapter..[Processes].System [4].Registry [92].smss.exe [324].csrss.exe [408].wininit.exe [484].csrss.exe [492].winlogon.exe [552].services.exe [620].lsass.exe [628].svchost.exe [752].fontdrvhost.exe [776].fontdrvhost.exe [784].svchost.exe [872].svchost.exe [920].dwm.exe [988].svchost.

C:\Users\user\AppData\Local\Temp\tempCMSaeI8GhtgT29e\passwords.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	4902
Entropy (8bit):	2.5402512142169575
Encrypted:	false
SSDEEP:	48:tMMMMMMMMMMdMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMMMMdMMMMMMMME:m
MD5:	974CC190D5703018C01CE08B904E227B
SHA1:	B4F0F2A72907FCF9551846411A7221F60A88F97D
SHA-256:	204A93E1274C57F489ADB21E0BF56064624582BB3B79FD59BA779EC8A137D8FF
SHA-512:	1949CD5EF9AE8ECB93C47E777DD183E758744D5768D024848E462B5416034D7D5CB2A9190D6AC7A2B8151380910ECDE4DF9396A8E9910B0582015A4923E7103E
Malicious:	false
Preview:	..................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\Cookies\Chrome_Default.txt

Download File

Process:	C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe
File Type:	ASCII text, with very long lines (769), with CRLF line terminators
Category:	dropped
Size (bytes):	6085
Entropy (8bit):	6.038274200863744
Encrypted:	false
SSDEEP:	96:gxsumX/xKO2KbcRfbZJ5Jxjxcx1xcbza5BC126oxgxA26Fxr/CxbTxqCGYURxOeb:gWFXZQHRFJ5Pts7c3avC126Ygb6Lr/WY
MD5:	ACB5AD34236C58F9F7D219FB628E3B58
SHA1:	02E39404CA22F1368C46A7B8398F5F6001DB8F5C
SHA-256:	05E5013B848C2E619226F9E7A084DC7DCD1B3D68EE45108F552DB113D21B49D1
SHA-512:	5895F39765BA3CEDFD47D57203FD7E716347CD79277EDDCDC83A729A86E2E59F03F0E7B6B0D0E7C7A383755001EDACC82171052BE801E015E6BF7E6B9595767F
Malicious:	false
Preview:	.google.com.TRUE./.TRUE.1712145003.NID.ENC893_djEw3+k+F2A/rK1XOX2BXUq6pY2LBCOzoXODiJnrrvDbDsPWiYwKZowg9PxHqkTm37HpwC52rXpnuUFrQMpV3iKtdSHegOm+XguZZ6tGaCY2hGVyR8JgIqQma1WLXyhCiWqjou7/c3qSeaKyNoUKHa4TULX4ZnNNtXFoCuZcBAAy4tYcz+0BF4j/0Pg+MgV+s7367kYcjO4q3zwc+XorjSs7PlgWlYrcc55rCJplhJ+H13M00HIdLm+1t9PACck2xxSWX2DsA61sEDJCHEc=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.FALSE./.TRUE.1696413835..AspNetCore.AuthProvider.ENC893_djEwVWJCCNyFkY3ZM/58ZZ/F/bz9H1yPvi6FOaroXC+KU8E=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.TRUE./signin-oidc.TRUE.1696414135..AspNetCore.Correlation.mdRqPJxLbpyv7vX0eK9YkTR-xwcrW3VBLE4Y3HEvxuU.ENC893_djEwBAKLrkJs5PZ6BD7Beoa9N/bOSh5JtRch10gZT+E=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.TRUE./signin-oidc.TRUE.1696414135..AspNetCore.OpenIdConnect.Nonce.CfDJ8Kiuy_B5JgFMo7PeP95NLhqwcJ8koDy5pXkfoWsb5SbbU2hVCbsH2qt9GF_OVCqFkLEwhvzeADNQOF5RSmkDfh5RqfqlOkx5QWo4Lltvwb0CvwBFD8ujlm3BAglOeGca3ZatkLMUkH

C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\information.txt

Download File

Process:	C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5724
Entropy (8bit):	5.385381816454912
Encrypted:	false
SSDEEP:	96:tCSQwbfvfJHBd8pvBUfioHmobapzOI4+68Dae5apYBRw/f0iV2z5JZx8kaNKs7sJ:O6rKgioGobaoI4+68Dae5apYBRw/f0ia
MD5:	7D4A9DA1C2A655174B9BBF021E0CC2F0
SHA1:	63110B815E0FD6BA95654DA61B21112BF67CC578
SHA-256:	7190F61BD4297F3738F27FF811F63553801C2170F3B8D5E2F97FF703BE649FCF
SHA-512:	4478B137B6C7EDFCFAFD81BFE4D95C4504309A6728BDEC67B3E60EEA50A20525A080900E2988854DC3C53D85135532746757ABCA3D78CD82AC87AF336B2E6A08
Malicious:	false
Preview:	Version: 1.0..Date: Tue Nov 21 04:17:57 2023.MachineID: 9e146be9-c76a-4720-bcdb-53011b87bd06.GUID: {a33c7340-61ca-11ee-8c18-806e6f6e6963}.HWID: bae8dddaaca209009b2a630770ff8b0b..Path: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe.Work Dir: C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3..IP: 89.149.18.60.Location: US, Washington.Windows: Windows 10 Pro [x64].Computer Name: 367706.User Name: user.Display Resolution: 1280x1024.Display Language: en-CH.Keyboard Languages: English (United Kingdom) / English (United Kingdom).Local Time: 21/11/2023 4:17:57.TimeZone: UTC1..[Hardware].Processor: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz.CPU Count: 4.RAM: 8191 MB.VideoCard #0: Microsoft Basic Display Adapter..[Processes].System [4].Registry [92].smss.exe [324].csrss.exe [408].wininit.exe [484].csrss.exe [492].winlogon.exe [552].services.exe [620].lsass.exe [628].svchost.exe [752].fontdrvhost.exe [776].fontdrvhost.exe [784].svchost.exe [872].svchost.exe [920].dwm.exe [988].svchos

C:\Users\user\AppData\Local\Temp\tempCMSgsImjMYlWzR3\passwords.txt

Download File

Process:	C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	4902
Entropy (8bit):	2.5402512142169575
Encrypted:	false
SSDEEP:	48:tMMMMMMMMMMdMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMMMMdMMMMMMMME:m
MD5:	974CC190D5703018C01CE08B904E227B
SHA1:	B4F0F2A72907FCF9551846411A7221F60A88F97D
SHA-256:	204A93E1274C57F489ADB21E0BF56064624582BB3B79FD59BA779EC8A137D8FF
SHA-512:	1949CD5EF9AE8ECB93C47E777DD183E758744D5768D024848E462B5416034D7D5CB2A9190D6AC7A2B8151380910ECDE4DF9396A8E9910B0582015A4923E7103E
Malicious:	false
Preview:	..................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Archive, ctime=Tue Nov 21 02:17:50 2023, mtime=Tue Nov 21 02:17:50 2023, atime=Mon Nov 20 22:31:48 2023, length=1322267, window=hide
Category:	dropped
Size (bytes):	1238
Entropy (8bit):	4.88859123282099
Encrypted:	false
SSDEEP:	24:8+dxnTXBeR9gKF3bAUA8fFcLtu5oqyFm:8qxzBeRHrAjIFcI5xyF
MD5:	BECFC67021DA211BA2C0D7B28AA122B1
SHA1:	6A996C2C56132AEF35A8185BB4081B8C81FD55C2
SHA-256:	B731C7F43F7A699347475A9AC2C8DF12DB980F1DFF3ACB4914387BADC25846F0
SHA-512:	12E7BC80002B5B49CBD7F31B92D9EF3BBAEB376054CD1CB778CD07C7CEB59EE0C064D91311D5F4E18A5186F39FD190DF7568566F07E551D12339FA2E946E2829
Malicious:	false
Preview:	L..................F.... ....4+O)....4+O)....J.......-......................0.:..DG..Yr?.D..U..k0.&...&......vk.v.....\|.....n 7O).......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^uW.............................%..A.p.p.D.a.t.a...B.P.1.....DW.X..Local.<......CW.^uW......b.......................m.L.o.c.a.l.....N.1.....uW....Temp..:......CW.^uW:.....l......................&..T.e.m.p.....d.1.....uW:...FANBOO~1..L......uW:.uW:..........................s;..F.A.N.B.o.o.s.t.e.r.1.3.1.....p.2..-..tW.. .FANBOO~1.EXE..T......uW:.uW:..............................F.A.N.B.o.o.s.t.e.r.1.3.1...e.x.e.......p...............-.......o............T.S.....C:\Users\user\AppData\Local\Temp\FANBooster131\FANBooster131.exe....F.A.N.B.o.o.s.t.e.r.1.3.1.<.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.F.A.N.B.o.o.s.t.e.r.1.3.1.\.F.A.N.B.o.o.s.t.e.r.1.3.1...e.x.e.........\|....I.J.H..K..:...`.......X.......367706...........hT..CrF.f4... ...T..b...,.......hT..CrF

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.950471609848932
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	14OWDrfahJ.exe
File size:	1'200'128 bytes
MD5:	725dbfed269993cb9944c2e1f7bde652
SHA1:	7104f1350e38ec3c3ea49154f1bba976572cb271
SHA256:	6db8fff48b37469101d280c3e60463c27ace26ea8076e94e358ae74e49fb46ac
SHA512:	1b3eff8e975ee797787b003106d8d222b7c51a85549b3060b80b95edf5e6ef7aa1cfb9d066fd37add46066127b179d8b5c6fdc4d720c47b6524dccbd589e3227
SSDEEP:	24576:NyHiBlVAY6BZzrjPP57SKJXenZzrIKg0maIxCKy3dHELZwIIe:oCBIBZvrN/JOZzrIK88KmaVr
TLSH:	3645235BABC89873C5B53BB038F922871A3A3EA15D34936F33D19C9E09719905431BB7
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........%...K...K...K...N...K...H...K...O...K...J...K...J...K...C...K.......K...I...K.Rich..K.........PE..L....`.b.................d.

File Icon


Icon Hash:	3b6120282c4c5a1f

Static PE Info

General

Entrypoint:	0x406a60
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x628D60E2 [Tue May 24 22:49:06 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	10
OS Version Minor:	0
File Version Major:	10
File Version Minor:	0
Subsystem Version Major:	10
Subsystem Version Minor:	0
Import Hash:	646167cce332c1c252cdcb1839e0cf48

Entrypoint Preview

Instruction
call 00007F4018C84DD5h
jmp 00007F4018C846E5h
push 00000058h
push 004072B8h
call 00007F4018C84E77h
xor ebx, ebx
mov dword ptr [ebp-20h], ebx
lea eax, dword ptr [ebp-68h]
push eax
call dword ptr [0040A184h]
mov dword ptr [ebp-04h], ebx
mov eax, dword ptr fs:[00000018h]
mov esi, dword ptr [eax+04h]
mov edi, ebx
mov edx, 004088ACh
mov ecx, esi
xor eax, eax
lock cmpxchg dword ptr [edx], ecx
test eax, eax
je 00007F4018C846FAh
cmp eax, esi
jne 00007F4018C846E9h
xor esi, esi
inc esi
mov edi, esi
jmp 00007F4018C846F2h
push 000003E8h
call dword ptr [0040A188h]
jmp 00007F4018C846B9h
xor esi, esi
inc esi
cmp dword ptr [004088B0h], esi
jne 00007F4018C846ECh
push 0000001Fh
call 00007F4018C84C0Bh
pop ecx
jmp 00007F4018C8471Ch
cmp dword ptr [004088B0h], ebx
jne 00007F4018C8470Eh
mov dword ptr [004088B0h], esi
push 004010C4h
push 004010B8h
call 00007F4018C84836h
pop ecx
pop ecx
test eax, eax
je 00007F4018C846F9h
mov dword ptr [ebp-04h], FFFFFFFEh
mov eax, 000000FFh
jmp 00007F4018C84819h
mov dword ptr [004081E4h], esi
cmp dword ptr [004088B0h], esi
jne 00007F4018C846FDh
push 004010B4h
push 004010ACh
call 00007F4018C84DC5h
pop ecx
pop ecx
mov dword ptr [000088B0h], 00000000h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa28c	0xb4	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc000	0x11c924	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x129000	0x888	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1410	0x54	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x1008	0x40	.text
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xa000	0x288	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6314	0x6400	False	0.5744140625	data	6.314163792045976	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x8000	0x1a48	0x200	False	0.609375	data	4.970639543960129	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0xa000	0x1052	0x1200	False	0.4140625	data	5.025949912909207	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0xc000	0x11d000	0x11ca00	False	0.9740518294356609	data	7.966087991764429	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x129000	0x888	0xa00	False	0.746484375	data	6.222637930812128	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
AVI	0xc9f8	0x2e1a	RIFF (little-endian) data, AVI, 272 x 60, 10.00 fps, video: RLE 8bpp	English	United States	0.2713099474665311
RT_ICON	0xf814	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	English	United States	0.3225609756097561
RT_ICON	0xfe7c	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	United States	0.41263440860215056
RT_ICON	0x10164	0x1e8	Device independent bitmap graphic, 24 x 48 x 4, image size 288	English	United States	0.4569672131147541
RT_ICON	0x1034c	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	United States	0.5574324324324325
RT_ICON	0x10474	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.6223347547974414
RT_ICON	0x1131c	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.7369133574007221
RT_ICON	0x11bc4	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	English	United States	0.783410138248848
RT_ICON	0x1228c	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.3829479768786127
RT_ICON	0x127f4	0xd9d2	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	1.0004662673505254
RT_ICON	0x201c8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.5300829875518672
RT_ICON	0x22770	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.6137429643527205
RT_ICON	0x23818	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.703688524590164
RT_ICON	0x241a0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.425531914893617
RT_DIALOG	0x24608	0x2f2	data	English	United States	0.4389920424403183
RT_DIALOG	0x248fc	0x1b0	data	English	United States	0.5625
RT_DIALOG	0x24aac	0x166	data	English	United States	0.5223463687150838
RT_DIALOG	0x24c14	0x1c0	data	English	United States	0.5446428571428571
RT_DIALOG	0x24dd4	0x130	data	English	United States	0.5526315789473685
RT_DIALOG	0x24f04	0x120	data	English	United States	0.5763888888888888
RT_STRING	0x25024	0x8c	Matlab v4 mat-file (little endian) l, numeric, rows 0, columns 0	English	United States	0.6214285714285714
RT_STRING	0x250b0	0x520	data	English	United States	0.4032012195121951
RT_STRING	0x255d0	0x5cc	data	English	United States	0.36455525606469
RT_STRING	0x25b9c	0x4b0	data	English	United States	0.385
RT_STRING	0x2604c	0x44a	data	English	United States	0.3970856102003643
RT_STRING	0x26498	0x3ce	data	English	United States	0.36858316221765913
RT_RCDATA	0x26868	0x7	ASCII text, with no line terminators	English	United States	2.142857142857143
RT_RCDATA	0x26870	0x10139c	Microsoft Cabinet archive data, many, 1053596 bytes, 2 files, at 0x2c +A "Ey3OF47.exe" +A "5Rp2df8.exe", ID 1788, number 1, 36 datablocks, 0x1503 compression	English	United States	1.0001583099365234
RT_RCDATA	0x127c0c	0x4	data	English	United States	3.0
RT_RCDATA	0x127c10	0x24	data	English	United States	0.7222222222222222
RT_RCDATA	0x127c34	0x7	ASCII text, with no line terminators	English	United States	2.142857142857143
RT_RCDATA	0x127c3c	0x7	ASCII text, with no line terminators	English	United States	2.142857142857143
RT_RCDATA	0x127c44	0x4	data	English	United States	3.0
RT_RCDATA	0x127c48	0xc	data	English	United States	1.6666666666666667
RT_RCDATA	0x127c54	0x4	data	English	United States	3.0
RT_RCDATA	0x127c58	0xc	data	English	United States	1.6666666666666667
RT_RCDATA	0x127c64	0x4	data	English	United States	3.0
RT_RCDATA	0x127c68	0x4	data	English	United States	3.0
RT_RCDATA	0x127c6c	0x7	ASCII text, with no line terminators	English	United States	2.142857142857143
RT_RCDATA	0x127c74	0x7	ASCII text, with no line terminators	English	United States	2.142857142857143
RT_GROUP_ICON	0x127c7c	0xbc	data	English	United States	0.6117021276595744
RT_VERSION	0x127d38	0x408	data	English	United States	0.42441860465116277
RT_MANIFEST	0x128140	0x7e2	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.3761149653121903

Imports

DLL	Import
ADVAPI32.dll	GetTokenInformation, RegDeleteValueA, RegOpenKeyExA, RegQueryInfoKeyA, FreeSid, OpenProcessToken, RegSetValueExA, RegCreateKeyExA, LookupPrivilegeValueA, AllocateAndInitializeSid, RegQueryValueExA, EqualSid, RegCloseKey, AdjustTokenPrivileges
KERNEL32.dll	_lopen, _llseek, CompareStringA, GetLastError, GetFileAttributesA, GetSystemDirectoryA, LoadLibraryA, DeleteFileA, GlobalAlloc, GlobalFree, CloseHandle, WritePrivateProfileStringA, IsDBCSLeadByte, GetWindowsDirectoryA, SetFileAttributesA, GetProcAddress, GlobalLock, LocalFree, RemoveDirectoryA, FreeLibrary, _lclose, CreateDirectoryA, GetPrivateProfileIntA, GetPrivateProfileStringA, GlobalUnlock, ReadFile, SizeofResource, WriteFile, GetDriveTypeA, lstrcmpA, SetFileTime, SetFilePointer, FindResourceA, CreateMutexA, GetVolumeInformationA, ExpandEnvironmentStringsA, GetCurrentDirectoryA, FreeResource, GetVersion, SetCurrentDirectoryA, GetTempPathA, LocalFileTimeToFileTime, CreateFileA, SetEvent, TerminateThread, GetVersionExA, LockResource, GetSystemInfo, CreateThread, ResetEvent, LoadResource, ExitProcess, GetModuleHandleW, CreateProcessA, FormatMessageA, GetTempFileNameA, DosDateTimeToFileTime, CreateEventA, GetExitCodeProcess, FindNextFileA, LocalAlloc, GetShortPathNameA, MulDiv, GetDiskFreeSpaceA, EnumResourceLanguagesA, GetTickCount, GetSystemTimeAsFileTime, GetCurrentThreadId, GetCurrentProcessId, QueryPerformanceCounter, TerminateProcess, SetUnhandledExceptionFilter, UnhandledExceptionFilter, GetStartupInfoW, Sleep, FindClose, GetCurrentProcess, FindFirstFileA, WaitForSingleObject, GetModuleFileNameA, LoadLibraryExA
GDI32.dll	GetDeviceCaps
USER32.dll	SetWindowLongA, GetDlgItemTextA, DialogBoxIndirectParamA, ShowWindow, MsgWaitForMultipleObjects, SetWindowPos, GetDC, GetWindowRect, DispatchMessageA, GetDesktopWindow, CharUpperA, SetDlgItemTextA, ExitWindowsEx, MessageBeep, EndDialog, CharPrevA, LoadStringA, CharNextA, EnableWindow, ReleaseDC, SetForegroundWindow, PeekMessageA, GetDlgItem, SendMessageA, SendDlgItemMessageA, MessageBoxA, SetWindowTextA, GetWindowLongA, CallWindowProcA, GetSystemMetrics
msvcrt.dll	_controlfp, ?terminate@@YAXXZ, _acmdln, _initterm, __setusermatherr, _except_handler4_common, memcpy, _ismbblead, __p__fmode, _cexit, _exit, exit, __set_app_type, __getmainargs, _amsg_exit, __p__commode, _XcptFilter, memcpy_s, _vsnprintf, memset
COMCTL32.dll
Cabinet.dll
VERSION.dll	GetFileVersionInfoA, VerQueryValueA, GetFileVersionInfoSizeA

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
194.49.94.152192.168.2.450500497392046266 11/21/23-04:17:53.738836	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP v.0.x (Token)	50500	49739	194.49.94.152	192.168.2.4
194.49.94.152192.168.2.450500497392046267 11/21/23-04:17:53.938221	TCP	2046267	ET TROJAN [ANY.RUN] RisePro TCP v.0.x (External IP)	50500	49739	194.49.94.152	192.168.2.4
194.49.94.152192.168.2.419053497372043234 11/21/23-04:17:53.161550	TCP	2043234	ET MALWARE Redline Stealer TCP CnC - Id1Response	19053	49737	194.49.94.152	192.168.2.4
192.168.2.4194.49.94.15249736505002049060 11/21/23-04:17:52.523115	TCP	2049060	ET TROJAN Suspected RisePro TCP Heartbeat Packet	49736	50500	192.168.2.4	194.49.94.152
194.49.94.152192.168.2.450500497402046266 11/21/23-04:17:53.817185	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP v.0.x (Token)	50500	49740	194.49.94.152	192.168.2.4
192.168.2.4194.49.94.15249736505002046269 11/21/23-04:17:57.323617	TCP	2046269	ET TROJAN [ANY.RUN] RisePro TCP v.0.x (Activity)	49736	50500	192.168.2.4	194.49.94.152
194.49.94.152192.168.2.450500497362046266 11/21/23-04:17:52.401609	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP v.0.x (Token)	50500	49736	194.49.94.152	192.168.2.4
192.168.2.4194.49.94.15249739505002046269 11/21/23-04:17:58.568287	TCP	2046269	ET TROJAN [ANY.RUN] RisePro TCP v.0.x (Activity)	49739	50500	192.168.2.4	194.49.94.152
194.49.94.152192.168.2.450500497362046267 11/21/23-04:17:52.593099	TCP	2046267	ET TROJAN [ANY.RUN] RisePro TCP v.0.x (External IP)	50500	49736	194.49.94.152	192.168.2.4
192.168.2.4194.49.94.15249737190532043231 11/21/23-04:18:06.317470	TCP	2043231	ET TROJAN Redline Stealer TCP CnC Activity	49737	19053	192.168.2.4	194.49.94.152
194.49.94.152192.168.2.450500497402046267 11/21/23-04:17:54.018834	TCP	2046267	ET TROJAN [ANY.RUN] RisePro TCP v.0.x (External IP)	50500	49740	194.49.94.152	192.168.2.4
194.49.94.152192.168.2.450500497442046266 11/21/23-04:18:05.978094	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP v.0.x (Token)	50500	49744	194.49.94.152	192.168.2.4
194.49.94.152192.168.2.450500497452046266 11/21/23-04:18:14.273521	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP v.0.x (Token)	50500	49745	194.49.94.152	192.168.2.4
194.49.94.152192.168.2.450500497462046266 11/21/23-04:18:23.010239	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP v.0.x (Token)	50500	49746	194.49.94.152	192.168.2.4
192.168.2.4194.49.94.15249737190532046045 11/21/23-04:17:52.975741	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Related (MC-NMF Authorization)	49737	19053	192.168.2.4	194.49.94.152
192.168.2.4194.49.94.15249740505002046269 11/21/23-04:18:30.103136	TCP	2046269	ET TROJAN [ANY.RUN] RisePro TCP v.0.x (Activity)	49740	50500	192.168.2.4	194.49.94.152

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 21, 2023 04:17:52.040343046 CET	49736	50500	192.168.2.4	194.49.94.152
Nov 21, 2023 04:17:52.220765114 CET	50500	49736	194.49.94.152	192.168.2.4
Nov 21, 2023 04:17:52.221031904 CET	49736	50500	192.168.2.4	194.49.94.152
Nov 21, 2023 04:17:52.232461929 CET	49736	50500	192.168.2.4	194.49.94.152
Nov 21, 2023 04:17:52.401608944 CET	50500	49736	194.49.94.152	192.168.2.4
Nov 21, 2023 04:17:52.412663937 CET	50500	49736	194.49.94.152	192.168.2.4
Nov 21, 2023 04:17:52.412791014 CET	49736	50500	192.168.2.4	194.49.94.152
Nov 21, 2023 04:17:52.523114920 CET	49736	50500	192.168.2.4	194.49.94.152
Nov 21, 2023 04:17:52.545394897 CET	49737	19053	192.168.2.4	194.49.94.152
Nov 21, 2023 04:17:52.593099117 CET	50500	49736	194.49.94.152	192.168.2.4
Nov 21, 2023 04:17:52.662170887 CET	49736	50500	192.168.2.4	194.49.94.152
Nov 21, 2023 04:17:52.730957031 CET	19053	49737	194.49.94.152	192.168.2.4
Nov 21, 2023 04:17:52.732558966 CET	49737	19053	192.168.2.4	194.49.94.152
Nov 21, 2023 04:17:52.748236895 CET	49737	19053	192.168.2.4	194.49.94.152
Nov 21, 2023 04:17:52.750293970 CET	50500	49736	194.49.94.152	192.168.2.4
Nov 21, 2023 04:17:52.899384975 CET	49738	443	192.168.2.4	34.117.59.81
Nov 21, 2023 04:17:52.899427891 CET	443	49738	34.117.59.81	192.168.2.4
Nov 21, 2023 04:17:52.899544954 CET	49738	443	192.168.2.4	34.117.59.81
Nov 21, 2023 04:17:52.903531075 CET	49738	443	192.168.2.4	34.117.59.81
Nov 21, 2023 04:17:52.903546095 CET	443	49738	34.117.59.81	192.168.2.4
Nov 21, 2023 04:17:52.933911085 CET	19053	49737	194.49.94.152	192.168.2.4
Nov 21, 2023 04:17:52.975740910 CET	49737	19053	192.168.2.4	194.49.94.152
Nov 21, 2023 04:17:53.104543924 CET	443	49738	34.117.59.81	192.168.2.4
Nov 21, 2023 04:17:53.104679108 CET	49738	443	192.168.2.4	34.117.59.81
Nov 21, 2023 04:17:53.106262922 CET	49738	443	192.168.2.4	34.117.59.81
Nov 21, 2023 04:17:53.106271029 CET	443	49738	34.117.59.81	192.168.2.4
Nov 21, 2023 04:17:53.106473923 CET	443	49738	34.117.59.81	192.168.2.4
Nov 21, 2023 04:17:53.161550045 CET	19053	49737	194.49.94.152	192.168.2.4
Nov 21, 2023 04:17:53.177567959 CET	49738	443	192.168.2.4	34.117.59.81
Nov 21, 2023 04:17:53.220909119 CET	49738	443	192.168.2.4	34.117.59.81
Nov 21, 2023 04:17:53.261264086 CET	443	49738	34.117.59.81	192.168.2.4
Nov 21, 2023 04:17:53.318181038 CET	49737	19053	192.168.2.4	194.49.94.152
Nov 21, 2023 04:17:53.344386101 CET	443	49738	34.117.59.81	192.168.2.4
Nov 21, 2023 04:17:53.344495058 CET	443	49738	34.117.59.81	192.168.2.4
Nov 21, 2023 04:17:53.344558001 CET	49738	443	192.168.2.4	34.117.59.81
Nov 21, 2023 04:17:53.347043037 CET	49738	443	192.168.2.4	34.117.59.81
Nov 21, 2023 04:17:53.347078085 CET	443	49738	34.117.59.81	192.168.2.4
Nov 21, 2023 04:17:53.347094059 CET	49738	443	192.168.2.4	34.117.59.81
Nov 21, 2023 04:17:53.347104073 CET	443	49738	34.117.59.81	192.168.2.4
Nov 21, 2023 04:17:53.347641945 CET	49736	50500	192.168.2.4	194.49.94.152
Nov 21, 2023 04:17:53.364162922 CET	49739	50500	192.168.2.4	194.49.94.152
Nov 21, 2023 04:17:53.452955008 CET	49740	50500	192.168.2.4	194.49.94.152
Nov 21, 2023 04:17:53.533644915 CET	50500	49736	194.49.94.152	192.168.2.4
Nov 21, 2023 04:17:53.551367998 CET	50500	49739	194.49.94.152	192.168.2.4
Nov 21, 2023 04:17:53.551655054 CET	49739	50500	192.168.2.4	194.49.94.152
Nov 21, 2023 04:17:53.564100027 CET	49739	50500	192.168.2.4	194.49.94.152
Nov 21, 2023 04:17:53.568279028 CET	49736	50500	192.168.2.4	194.49.94.152
Nov 21, 2023 04:17:53.633521080 CET	50500	49740	194.49.94.152	192.168.2.4
Nov 21, 2023 04:17:53.636614084 CET	49740	50500	192.168.2.4	194.49.94.152
Nov 21, 2023 04:17:53.657569885 CET	49740	50500	192.168.2.4	194.49.94.152
Nov 21, 2023 04:17:53.738836050 CET	50500	49739	194.49.94.152	192.168.2.4
Nov 21, 2023 04:17:53.751092911 CET	50500	49739	194.49.94.152	192.168.2.4
Nov 21, 2023 04:17:53.751163006 CET	49739	50500	192.168.2.4	194.49.94.152
Nov 21, 2023 04:17:53.752554893 CET	50500	49736	194.49.94.152	192.168.2.4
Nov 21, 2023 04:17:53.787293911 CET	49736	50500	192.168.2.4	194.49.94.152
Nov 21, 2023 04:17:53.817184925 CET	50500	49740	194.49.94.152	192.168.2.4
Nov 21, 2023 04:17:53.838006973 CET	50500	49740	194.49.94.152	192.168.2.4
Nov 21, 2023 04:17:53.838093042 CET	49740	50500	192.168.2.4	194.49.94.152
Nov 21, 2023 04:17:53.865349054 CET	49739	50500	192.168.2.4	194.49.94.152
Nov 21, 2023 04:17:53.938220978 CET	50500	49739	194.49.94.152	192.168.2.4
Nov 21, 2023 04:17:53.943679094 CET	49740	50500	192.168.2.4	194.49.94.152
Nov 21, 2023 04:17:53.971033096 CET	50500	49736	194.49.94.152	192.168.2.4
Nov 21, 2023 04:17:53.990118027 CET	49739	50500	192.168.2.4	194.49.94.152
Nov 21, 2023 04:17:54.006561041 CET	49736	50500	192.168.2.4	194.49.94.152
Nov 21, 2023 04:17:54.018834114 CET	50500	49740	194.49.94.152	192.168.2.4
Nov 21, 2023 04:17:54.064990044 CET	49741	443	192.168.2.4	34.117.59.81
Nov 21, 2023 04:17:54.065061092 CET	443	49741	34.117.59.81	192.168.2.4
Nov 21, 2023 04:17:54.065274000 CET	49741	443	192.168.2.4	34.117.59.81
Nov 21, 2023 04:17:54.068826914 CET	49740	50500	192.168.2.4	194.49.94.152
Nov 21, 2023 04:17:54.069278955 CET	49741	443	192.168.2.4	34.117.59.81
Nov 21, 2023 04:17:54.069294930 CET	443	49741	34.117.59.81	192.168.2.4
Nov 21, 2023 04:17:54.110136986 CET	50500	49739	194.49.94.152	192.168.2.4
Nov 21, 2023 04:17:54.160866976 CET	49742	443	192.168.2.4	34.117.59.81
Nov 21, 2023 04:17:54.160929918 CET	443	49742	34.117.59.81	192.168.2.4
Nov 21, 2023 04:17:54.161000967 CET	49742	443	192.168.2.4	34.117.59.81
Nov 21, 2023 04:17:54.163357019 CET	49742	443	192.168.2.4	34.117.59.81
Nov 21, 2023 04:17:54.163381100 CET	443	49742	34.117.59.81	192.168.2.4
Nov 21, 2023 04:17:54.188002110 CET	50500	49740	194.49.94.152	192.168.2.4
Nov 21, 2023 04:17:54.190182924 CET	50500	49736	194.49.94.152	192.168.2.4
Nov 21, 2023 04:17:54.236803055 CET	49736	50500	192.168.2.4	194.49.94.152
Nov 21, 2023 04:17:54.269109011 CET	443	49741	34.117.59.81	192.168.2.4
Nov 21, 2023 04:17:54.269215107 CET	49741	443	192.168.2.4	34.117.59.81
Nov 21, 2023 04:17:54.271672964 CET	49741	443	192.168.2.4	34.117.59.81
Nov 21, 2023 04:17:54.271681070 CET	443	49741	34.117.59.81	192.168.2.4
Nov 21, 2023 04:17:54.272026062 CET	443	49741	34.117.59.81	192.168.2.4
Nov 21, 2023 04:17:54.318257093 CET	49741	443	192.168.2.4	34.117.59.81
Nov 21, 2023 04:17:54.361197948 CET	443	49742	34.117.59.81	192.168.2.4
Nov 21, 2023 04:17:54.361288071 CET	49742	443	192.168.2.4	34.117.59.81
Nov 21, 2023 04:17:54.363162994 CET	49742	443	192.168.2.4	34.117.59.81
Nov 21, 2023 04:17:54.363173962 CET	443	49742	34.117.59.81	192.168.2.4
Nov 21, 2023 04:17:54.363388062 CET	443	49742	34.117.59.81	192.168.2.4
Nov 21, 2023 04:17:54.411920071 CET	49742	443	192.168.2.4	34.117.59.81
Nov 21, 2023 04:17:54.463267088 CET	49741	443	192.168.2.4	34.117.59.81
Nov 21, 2023 04:17:54.480608940 CET	49742	443	192.168.2.4	34.117.59.81
Nov 21, 2023 04:17:54.509253979 CET	443	49741	34.117.59.81	192.168.2.4
Nov 21, 2023 04:17:54.525271893 CET	443	49742	34.117.59.81	192.168.2.4
Nov 21, 2023 04:17:54.588347912 CET	443	49741	34.117.59.81	192.168.2.4
Nov 21, 2023 04:17:54.588489056 CET	443	49741	34.117.59.81	192.168.2.4
Nov 21, 2023 04:17:54.588548899 CET	49741	443	192.168.2.4	34.117.59.81
Nov 21, 2023 04:17:54.589034081 CET	49741	443	192.168.2.4	34.117.59.81
Nov 21, 2023 04:17:54.589034081 CET	49741	443	192.168.2.4	34.117.59.81
Nov 21, 2023 04:17:54.589056969 CET	443	49741	34.117.59.81	192.168.2.4
Nov 21, 2023 04:17:54.589066029 CET	443	49741	34.117.59.81	192.168.2.4
Nov 21, 2023 04:17:54.589418888 CET	49739	50500	192.168.2.4	194.49.94.152
Nov 21, 2023 04:17:54.604598045 CET	443	49742	34.117.59.81	192.168.2.4
Nov 21, 2023 04:17:54.604705095 CET	443	49742	34.117.59.81	192.168.2.4
Nov 21, 2023 04:17:54.604753017 CET	49742	443	192.168.2.4	34.117.59.81
Nov 21, 2023 04:17:54.604990005 CET	49742	443	192.168.2.4	34.117.59.81
Nov 21, 2023 04:17:54.605010986 CET	443	49742	34.117.59.81	192.168.2.4
Nov 21, 2023 04:17:54.605021954 CET	49742	443	192.168.2.4	34.117.59.81
Nov 21, 2023 04:17:54.605026960 CET	443	49742	34.117.59.81	192.168.2.4
Nov 21, 2023 04:17:54.605345011 CET	49740	50500	192.168.2.4	194.49.94.152
Nov 21, 2023 04:17:54.784481049 CET	50500	49739	194.49.94.152	192.168.2.4
Nov 21, 2023 04:17:54.799472094 CET	50500	49740	194.49.94.152	192.168.2.4
Nov 21, 2023 04:17:54.802699089 CET	49739	50500	192.168.2.4	194.49.94.152
Nov 21, 2023 04:17:54.818387032 CET	49740	50500	192.168.2.4	194.49.94.152
Nov 21, 2023 04:17:55.003098011 CET	50500	49739	194.49.94.152	192.168.2.4
Nov 21, 2023 04:17:55.003825903 CET	50500	49740	194.49.94.152	192.168.2.4
Nov 21, 2023 04:17:55.022469997 CET	49739	50500	192.168.2.4	194.49.94.152
Nov 21, 2023 04:17:55.037599087 CET	49740	50500	192.168.2.4	194.49.94.152
Nov 21, 2023 04:17:55.221600056 CET	50500	49739	194.49.94.152	192.168.2.4
Nov 21, 2023 04:17:55.222229004 CET	50500	49740	194.49.94.152	192.168.2.4
Nov 21, 2023 04:17:55.246911049 CET	49739	50500	192.168.2.4	194.49.94.152
Nov 21, 2023 04:17:55.261157990 CET	49740	50500	192.168.2.4	194.49.94.152
Nov 21, 2023 04:17:55.441155910 CET	50500	49739	194.49.94.152	192.168.2.4
Nov 21, 2023 04:17:55.455831051 CET	50500	49740	194.49.94.152	192.168.2.4
Nov 21, 2023 04:17:55.490098953 CET	49739	50500	192.168.2.4	194.49.94.152
Nov 21, 2023 04:17:55.505696058 CET	49740	50500	192.168.2.4	194.49.94.152
Nov 21, 2023 04:17:57.323616982 CET	49736	50500	192.168.2.4	194.49.94.152
Nov 21, 2023 04:17:57.516359091 CET	50500	49736	194.49.94.152	192.168.2.4
Nov 21, 2023 04:17:57.583803892 CET	49736	50500	192.168.2.4	194.49.94.152
Nov 21, 2023 04:17:58.231121063 CET	49737	19053	192.168.2.4	194.49.94.152
Nov 21, 2023 04:17:58.417993069 CET	19053	49737	194.49.94.152	192.168.2.4
Nov 21, 2023 04:17:58.418009043 CET	19053	49737	194.49.94.152	192.168.2.4
Nov 21, 2023 04:17:58.418020964 CET	19053	49737	194.49.94.152	192.168.2.4
Nov 21, 2023 04:17:58.418211937 CET	49737	19053	192.168.2.4	194.49.94.152
Nov 21, 2023 04:17:58.568286896 CET	49739	50500	192.168.2.4	194.49.94.152
Nov 21, 2023 04:17:58.584676981 CET	49740	50500	192.168.2.4	194.49.94.152
Nov 21, 2023 04:17:58.766223907 CET	50500	49740	194.49.94.152	192.168.2.4
Nov 21, 2023 04:17:58.813298941 CET	50500	49739	194.49.94.152	192.168.2.4
Nov 21, 2023 04:17:58.818175077 CET	49740	50500	192.168.2.4	194.49.94.152
Nov 21, 2023 04:17:59.291296005 CET	49737	19053	192.168.2.4	194.49.94.152
Nov 21, 2023 04:17:59.477844000 CET	19053	49737	194.49.94.152	192.168.2.4
Nov 21, 2023 04:17:59.618172884 CET	49737	19053	192.168.2.4	194.49.94.152
Nov 21, 2023 04:18:00.001149893 CET	50500	49739	194.49.94.152	192.168.2.4
Nov 21, 2023 04:18:00.193185091 CET	49739	50500	192.168.2.4	194.49.94.152
Nov 21, 2023 04:18:02.460905075 CET	49739	50500	192.168.2.4	194.49.94.152
Nov 21, 2023 04:18:02.460999966 CET	49739	50500	192.168.2.4	194.49.94.152
Nov 21, 2023 04:18:02.499955893 CET	49737	19053	192.168.2.4	194.49.94.152
Nov 21, 2023 04:18:02.648171902 CET	50500	49739	194.49.94.152	192.168.2.4
Nov 21, 2023 04:18:02.648190975 CET	50500	49739	194.49.94.152	192.168.2.4
Nov 21, 2023 04:18:02.648260117 CET	49739	50500	192.168.2.4	194.49.94.152
Nov 21, 2023 04:18:02.686374903 CET	19053	49737	194.49.94.152	192.168.2.4
Nov 21, 2023 04:18:02.690416098 CET	49737	19053	192.168.2.4	194.49.94.152
Nov 21, 2023 04:18:02.876235962 CET	19053	49737	194.49.94.152	192.168.2.4
Nov 21, 2023 04:18:02.895020008 CET	50500	49739	194.49.94.152	192.168.2.4
Nov 21, 2023 04:18:02.992866039 CET	49737	19053	192.168.2.4	194.49.94.152
Nov 21, 2023 04:18:03.178277016 CET	19053	49737	194.49.94.152	192.168.2.4
Nov 21, 2023 04:18:03.178299904 CET	19053	49737	194.49.94.152	192.168.2.4
Nov 21, 2023 04:18:03.178355932 CET	49737	19053	192.168.2.4	194.49.94.152
Nov 21, 2023 04:18:03.363892078 CET	19053	49737	194.49.94.152	192.168.2.4
Nov 21, 2023 04:18:03.365464926 CET	19053	49737	194.49.94.152	192.168.2.4
Nov 21, 2023 04:18:03.368822098 CET	49737	19053	192.168.2.4	194.49.94.152
Nov 21, 2023 04:18:03.555672884 CET	19053	49737	194.49.94.152	192.168.2.4
Nov 21, 2023 04:18:03.615060091 CET	49737	19053	192.168.2.4	194.49.94.152
Nov 21, 2023 04:18:03.667345047 CET	49737	19053	192.168.2.4	194.49.94.152
Nov 21, 2023 04:18:03.853121042 CET	19053	49737	194.49.94.152	192.168.2.4
Nov 21, 2023 04:18:03.862746000 CET	49737	19053	192.168.2.4	194.49.94.152
Nov 21, 2023 04:18:04.048834085 CET	19053	49737	194.49.94.152	192.168.2.4
Nov 21, 2023 04:18:04.094501972 CET	49737	19053	192.168.2.4	194.49.94.152
Nov 21, 2023 04:18:04.280379057 CET	19053	49737	194.49.94.152	192.168.2.4
Nov 21, 2023 04:18:04.295054913 CET	49737	19053	192.168.2.4	194.49.94.152
Nov 21, 2023 04:18:04.480779886 CET	19053	49737	194.49.94.152	192.168.2.4
Nov 21, 2023 04:18:04.615159035 CET	49737	19053	192.168.2.4	194.49.94.152
Nov 21, 2023 04:18:04.981602907 CET	49737	19053	192.168.2.4	194.49.94.152
Nov 21, 2023 04:18:05.166915894 CET	19053	49737	194.49.94.152	192.168.2.4
Nov 21, 2023 04:18:05.167583942 CET	19053	49737	194.49.94.152	192.168.2.4
Nov 21, 2023 04:18:05.169142962 CET	49737	19053	192.168.2.4	194.49.94.152
Nov 21, 2023 04:18:05.355046034 CET	19053	49737	194.49.94.152	192.168.2.4
Nov 21, 2023 04:18:05.361871958 CET	49737	19053	192.168.2.4	194.49.94.152
Nov 21, 2023 04:18:05.475064039 CET	49739	50500	192.168.2.4	194.49.94.152
Nov 21, 2023 04:18:05.547663927 CET	19053	49737	194.49.94.152	192.168.2.4
Nov 21, 2023 04:18:05.548894882 CET	49737	19053	192.168.2.4	194.49.94.152
Nov 21, 2023 04:18:05.597862005 CET	49744	50500	192.168.2.4	194.49.94.152
Nov 21, 2023 04:18:05.662235022 CET	50500	49739	194.49.94.152	192.168.2.4
Nov 21, 2023 04:18:05.672930956 CET	50500	49739	194.49.94.152	192.168.2.4
Nov 21, 2023 04:18:05.673011065 CET	49739	50500	192.168.2.4	194.49.94.152
Nov 21, 2023 04:18:05.734707117 CET	19053	49737	194.49.94.152	192.168.2.4
Nov 21, 2023 04:18:05.742527008 CET	49737	19053	192.168.2.4	194.49.94.152
Nov 21, 2023 04:18:05.787836075 CET	50500	49744	194.49.94.152	192.168.2.4
Nov 21, 2023 04:18:05.787940979 CET	49744	50500	192.168.2.4	194.49.94.152
Nov 21, 2023 04:18:05.812410116 CET	49744	50500	192.168.2.4	194.49.94.152
Nov 21, 2023 04:18:05.928479910 CET	19053	49737	194.49.94.152	192.168.2.4
Nov 21, 2023 04:18:05.933094978 CET	49737	19053	192.168.2.4	194.49.94.152
Nov 21, 2023 04:18:05.978094101 CET	50500	49744	194.49.94.152	192.168.2.4
Nov 21, 2023 04:18:06.063220978 CET	50500	49744	194.49.94.152	192.168.2.4
Nov 21, 2023 04:18:06.115165949 CET	49744	50500	192.168.2.4	194.49.94.152
Nov 21, 2023 04:18:06.118829012 CET	19053	49737	194.49.94.152	192.168.2.4
Nov 21, 2023 04:18:06.119371891 CET	49737	19053	192.168.2.4	194.49.94.152
Nov 21, 2023 04:18:06.305097103 CET	19053	49737	194.49.94.152	192.168.2.4
Nov 21, 2023 04:18:06.317470074 CET	49737	19053	192.168.2.4	194.49.94.152
Nov 21, 2023 04:18:06.537103891 CET	19053	49737	194.49.94.152	192.168.2.4
Nov 21, 2023 04:18:06.615164042 CET	49737	19053	192.168.2.4	194.49.94.152
Nov 21, 2023 04:18:06.737102032 CET	49737	19053	192.168.2.4	194.49.94.152
Nov 21, 2023 04:18:08.504393101 CET	50500	49744	194.49.94.152	192.168.2.4
Nov 21, 2023 04:18:08.643755913 CET	49744	50500	192.168.2.4	194.49.94.152
Nov 21, 2023 04:18:13.902446032 CET	49745	50500	192.168.2.4	194.49.94.152
Nov 21, 2023 04:18:14.087707043 CET	50500	49745	194.49.94.152	192.168.2.4
Nov 21, 2023 04:18:14.088000059 CET	49745	50500	192.168.2.4	194.49.94.152
Nov 21, 2023 04:18:14.111452103 CET	49745	50500	192.168.2.4	194.49.94.152
Nov 21, 2023 04:18:14.273520947 CET	50500	49745	194.49.94.152	192.168.2.4
Nov 21, 2023 04:18:14.296509981 CET	50500	49745	194.49.94.152	192.168.2.4
Nov 21, 2023 04:18:14.296603918 CET	49745	50500	192.168.2.4	194.49.94.152
Nov 21, 2023 04:18:14.396428108 CET	49745	50500	192.168.2.4	194.49.94.152
Nov 21, 2023 04:18:14.481733084 CET	50500	49745	194.49.94.152	192.168.2.4
Nov 21, 2023 04:18:14.536936045 CET	49745	50500	192.168.2.4	194.49.94.152
Nov 21, 2023 04:18:14.641097069 CET	50500	49745	194.49.94.152	192.168.2.4
Nov 21, 2023 04:18:14.645366907 CET	49745	50500	192.168.2.4	194.49.94.152
Nov 21, 2023 04:18:22.650744915 CET	49746	50500	192.168.2.4	194.49.94.152
Nov 21, 2023 04:18:22.830430031 CET	50500	49746	194.49.94.152	192.168.2.4
Nov 21, 2023 04:18:22.830509901 CET	49746	50500	192.168.2.4	194.49.94.152
Nov 21, 2023 04:18:22.841165066 CET	49746	50500	192.168.2.4	194.49.94.152
Nov 21, 2023 04:18:23.010238886 CET	50500	49746	194.49.94.152	192.168.2.4
Nov 21, 2023 04:18:23.016913891 CET	50500	49736	194.49.94.152	192.168.2.4
Nov 21, 2023 04:18:23.017086029 CET	49736	50500	192.168.2.4	194.49.94.152
Nov 21, 2023 04:18:23.077378988 CET	50500	49746	194.49.94.152	192.168.2.4
Nov 21, 2023 04:18:23.130734921 CET	49746	50500	192.168.2.4	194.49.94.152
Nov 21, 2023 04:18:23.250880957 CET	50500	49736	194.49.94.152	192.168.2.4
Nov 21, 2023 04:18:23.362656116 CET	50500	49746	194.49.94.152	192.168.2.4
Nov 21, 2023 04:18:23.443166018 CET	49746	50500	192.168.2.4	194.49.94.152
Nov 21, 2023 04:18:23.450149059 CET	49746	50500	192.168.2.4	194.49.94.152
Nov 21, 2023 04:18:23.622783899 CET	50500	49746	194.49.94.152	192.168.2.4
Nov 21, 2023 04:18:23.622853994 CET	49746	50500	192.168.2.4	194.49.94.152
Nov 21, 2023 04:18:23.844960928 CET	50500	49740	194.49.94.152	192.168.2.4
Nov 21, 2023 04:18:23.845124006 CET	49740	50500	192.168.2.4	194.49.94.152
Nov 21, 2023 04:18:24.079030991 CET	50500	49740	194.49.94.152	192.168.2.4
Nov 21, 2023 04:18:24.552201986 CET	49736	50500	192.168.2.4	194.49.94.152
Nov 21, 2023 04:18:24.552278996 CET	49736	50500	192.168.2.4	194.49.94.152
Nov 21, 2023 04:18:24.733159065 CET	50500	49736	194.49.94.152	192.168.2.4
Nov 21, 2023 04:18:24.733366013 CET	49736	50500	192.168.2.4	194.49.94.152
Nov 21, 2023 04:18:24.733589888 CET	50500	49736	194.49.94.152	192.168.2.4
Nov 21, 2023 04:18:24.970302105 CET	50500	49736	194.49.94.152	192.168.2.4
Nov 21, 2023 04:18:27.568372011 CET	49736	50500	192.168.2.4	194.49.94.152
Nov 21, 2023 04:18:27.748786926 CET	50500	49736	194.49.94.152	192.168.2.4
Nov 21, 2023 04:18:27.751279116 CET	50500	49736	194.49.94.152	192.168.2.4
Nov 21, 2023 04:18:27.751322031 CET	49736	50500	192.168.2.4	194.49.94.152
Nov 21, 2023 04:18:30.103136063 CET	49740	50500	192.168.2.4	194.49.94.152
Nov 21, 2023 04:18:30.298135996 CET	50500	49740	194.49.94.152	192.168.2.4
Nov 21, 2023 04:18:30.349415064 CET	49740	50500	192.168.2.4	194.49.94.152
Nov 21, 2023 04:18:53.861433983 CET	50500	49740	194.49.94.152	192.168.2.4
Nov 21, 2023 04:18:53.927634001 CET	49740	50500	192.168.2.4	194.49.94.152
Nov 21, 2023 04:18:54.729805946 CET	49740	50500	192.168.2.4	194.49.94.152
Nov 21, 2023 04:18:54.970335007 CET	50500	49740	194.49.94.152	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 21, 2023 04:17:52.733964920 CET	54903	53	192.168.2.4	1.1.1.1
Nov 21, 2023 04:17:52.859714985 CET	53	54903	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 21, 2023 04:17:52.733964920 CET	192.168.2.4	1.1.1.1	0x12df	Standard query (0)	ipinfo.io	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 21, 2023 04:17:52.859714985 CET	1.1.1.1	192.168.2.4	0x12df	No error (0)	ipinfo.io		34.117.59.81	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

https:

ipinfo.io

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.4	49738	34.117.59.81	443	C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe

Timestamp	kBytes transferred	Direction	Data
2023-11-21 03:17:53 UTC	0	OUT	GET /widget/demo/89.149.18.60 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36 Host: ipinfo.io
2023-11-21 03:17:53 UTC	0	IN	HTTP/1.1 200 OK access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin content-type: application/json; charset=utf-8 Content-Length: 959 date: Tue, 21 Nov 2023 03:17:53 GMT x-envoy-upstream-service-time: 2 strict-transport-security: max-age=2592000; includeSubDomains vary: Accept-Encoding Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-11-21 03:17:53 UTC	0	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 39 2e 31 34 39 2e 31 38 2e 36 30 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 39 2e 31 34 39 2e 31 38 2e 36 30 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 57 61 73 68 69 6e 67 74 6f 6e 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 57 61 73 68 69 6e 67 74 6f 6e 2c 20 44 2e 43 2e 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 33 38 2e 38 39 35 31 2c 2d 37 37 2e 30 33 36 34 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 32 31 32 32 33 38 20 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 0a 20 20 20 20 22 70 6f 73 74 61 6c 22 3a 20 22 32 30 30 30 34 22 2c 0a 20 20 20 20 22 74 69 6d 65 7a 6f 6e 65 Data Ascii: { "input": "89.149.18.60", "data": { "ip": "89.149.18.60", "city": "Washington", "region": "Washington, D.C.", "country": "US", "loc": "38.8951,-77.0364", "org": "AS212238 Datacamp Limited", "postal": "20004", "timezone
2023-11-21 03:17:53 UTC	1	IN	Data Raw: 20 20 22 61 64 64 72 65 73 73 22 3a 20 22 53 74 72 2e 20 43 2e 41 2e 20 52 6f 73 65 74 74 69 2c 20 4e 72 2e 31 37 22 2c 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 52 4f 22 2c 0a 20 20 20 20 20 20 22 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 40 62 69 6e 62 6f 78 2e 63 6f 6d 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 41 62 75 73 65 20 63 6f 6e 74 61 63 74 20 72 6f 6c 65 20 6f 62 6a 65 63 74 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 39 2e 31 34 39 2e 31 38 2e 30 2f 32 34 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 34 30 20 33 37 38 20 36 30 30 20 30 30 30 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: "address": "Str. C.A. Rosetti, Nr.17", "country": "RO", "email": "abuse@binbox.com", "name": "Abuse contact role object", "network": "89.149.18.0/24", "phone": "+40 378 600 000" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	34.117.59.81	443	192.168.2.4	49738	C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe

Timestamp	kBytes transferred	Direction	Data
2023-11-21 03:17:53 UTC	0	OUT	GET /widget/demo/89.149.18.60 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36 Host: ipinfo.io
2023-11-21 03:17:53 UTC	0	IN	HTTP/1.1 200 OK access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin content-type: application/json; charset=utf-8 Content-Length: 959 date: Tue, 21 Nov 2023 03:17:53 GMT x-envoy-upstream-service-time: 2 strict-transport-security: max-age=2592000; includeSubDomains vary: Accept-Encoding Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-11-21 03:17:53 UTC	0	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 39 2e 31 34 39 2e 31 38 2e 36 30 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 39 2e 31 34 39 2e 31 38 2e 36 30 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 57 61 73 68 69 6e 67 74 6f 6e 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 57 61 73 68 69 6e 67 74 6f 6e 2c 20 44 2e 43 2e 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 33 38 2e 38 39 35 31 2c 2d 37 37 2e 30 33 36 34 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 32 31 32 32 33 38 20 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 0a 20 20 20 20 22 70 6f 73 74 61 6c 22 3a 20 22 32 30 30 30 34 22 2c 0a 20 20 20 20 22 74 69 6d 65 7a 6f 6e 65 Data Ascii: { "input": "89.149.18.60", "data": { "ip": "89.149.18.60", "city": "Washington", "region": "Washington, D.C.", "country": "US", "loc": "38.8951,-77.0364", "org": "AS212238 Datacamp Limited", "postal": "20004", "timezone
2023-11-21 03:17:53 UTC	1	IN	Data Raw: 20 20 22 61 64 64 72 65 73 73 22 3a 20 22 53 74 72 2e 20 43 2e 41 2e 20 52 6f 73 65 74 74 69 2c 20 4e 72 2e 31 37 22 2c 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 52 4f 22 2c 0a 20 20 20 20 20 20 22 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 40 62 69 6e 62 6f 78 2e 63 6f 6d 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 41 62 75 73 65 20 63 6f 6e 74 61 63 74 20 72 6f 6c 65 20 6f 62 6a 65 63 74 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 39 2e 31 34 39 2e 31 38 2e 30 2f 32 34 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 34 30 20 33 37 38 20 36 30 30 20 30 30 30 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: "address": "Str. C.A. Rosetti, Nr.17", "country": "RO", "email": "abuse@binbox.com", "name": "Abuse contact role object", "network": "89.149.18.0/24", "phone": "+40 378 600 000" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.4	49741	34.117.59.81	443	C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe

Timestamp	kBytes transferred	Direction	Data
2023-11-21 03:17:54 UTC	1	OUT	GET /widget/demo/89.149.18.60 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36 Host: ipinfo.io
2023-11-21 03:17:54 UTC	2	IN	HTTP/1.1 200 OK access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin content-type: application/json; charset=utf-8 content-length: 959 date: Tue, 21 Nov 2023 03:17:54 GMT x-envoy-upstream-service-time: 2 strict-transport-security: max-age=2592000; includeSubDomains vary: Accept-Encoding Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-11-21 03:17:54 UTC	2	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 39 2e 31 34 39 2e 31 38 2e 36 30 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 39 2e 31 34 39 2e 31 38 2e 36 30 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 57 61 73 68 69 6e 67 74 6f 6e 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 57 61 73 68 69 6e 67 74 6f 6e 2c 20 44 2e 43 2e 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 33 38 2e 38 39 35 31 2c 2d 37 37 2e 30 33 36 34 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 32 31 32 32 33 38 20 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 0a 20 20 20 20 22 70 6f 73 74 61 6c 22 3a 20 22 32 30 30 30 34 22 2c 0a 20 20 20 20 22 74 69 6d 65 7a 6f 6e 65 Data Ascii: { "input": "89.149.18.60", "data": { "ip": "89.149.18.60", "city": "Washington", "region": "Washington, D.C.", "country": "US", "loc": "38.8951,-77.0364", "org": "AS212238 Datacamp Limited", "postal": "20004", "timezone
2023-11-21 03:17:54 UTC	3	IN	Data Raw: 20 20 22 61 64 64 72 65 73 73 22 3a 20 22 53 74 72 2e 20 43 2e 41 2e 20 52 6f 73 65 74 74 69 2c 20 4e 72 2e 31 37 22 2c 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 52 4f 22 2c 0a 20 20 20 20 20 20 22 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 40 62 69 6e 62 6f 78 2e 63 6f 6d 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 41 62 75 73 65 20 63 6f 6e 74 61 63 74 20 72 6f 6c 65 20 6f 62 6a 65 63 74 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 39 2e 31 34 39 2e 31 38 2e 30 2f 32 34 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 34 30 20 33 37 38 20 36 30 30 20 30 30 30 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: "address": "Str. C.A. Rosetti, Nr.17", "country": "RO", "email": "abuse@binbox.com", "name": "Abuse contact role object", "network": "89.149.18.0/24", "phone": "+40 378 600 000" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	34.117.59.81	443	192.168.2.4	49741	C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe

Timestamp	kBytes transferred	Direction	Data
2023-11-21 03:17:54 UTC	1	OUT	GET /widget/demo/89.149.18.60 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36 Host: ipinfo.io
2023-11-21 03:17:54 UTC	2	IN	HTTP/1.1 200 OK access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin content-type: application/json; charset=utf-8 content-length: 959 date: Tue, 21 Nov 2023 03:17:54 GMT x-envoy-upstream-service-time: 2 strict-transport-security: max-age=2592000; includeSubDomains vary: Accept-Encoding Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-11-21 03:17:54 UTC	2	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 39 2e 31 34 39 2e 31 38 2e 36 30 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 39 2e 31 34 39 2e 31 38 2e 36 30 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 57 61 73 68 69 6e 67 74 6f 6e 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 57 61 73 68 69 6e 67 74 6f 6e 2c 20 44 2e 43 2e 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 33 38 2e 38 39 35 31 2c 2d 37 37 2e 30 33 36 34 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 32 31 32 32 33 38 20 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 0a 20 20 20 20 22 70 6f 73 74 61 6c 22 3a 20 22 32 30 30 30 34 22 2c 0a 20 20 20 20 22 74 69 6d 65 7a 6f 6e 65 Data Ascii: { "input": "89.149.18.60", "data": { "ip": "89.149.18.60", "city": "Washington", "region": "Washington, D.C.", "country": "US", "loc": "38.8951,-77.0364", "org": "AS212238 Datacamp Limited", "postal": "20004", "timezone
2023-11-21 03:17:54 UTC	3	IN	Data Raw: 20 20 22 61 64 64 72 65 73 73 22 3a 20 22 53 74 72 2e 20 43 2e 41 2e 20 52 6f 73 65 74 74 69 2c 20 4e 72 2e 31 37 22 2c 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 52 4f 22 2c 0a 20 20 20 20 20 20 22 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 40 62 69 6e 62 6f 78 2e 63 6f 6d 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 41 62 75 73 65 20 63 6f 6e 74 61 63 74 20 72 6f 6c 65 20 6f 62 6a 65 63 74 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 39 2e 31 34 39 2e 31 38 2e 30 2f 32 34 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 34 30 20 33 37 38 20 36 30 30 20 30 30 30 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: "address": "Str. C.A. Rosetti, Nr.17", "country": "RO", "email": "abuse@binbox.com", "name": "Abuse contact role object", "network": "89.149.18.0/24", "phone": "+40 378 600 000" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.4	49742	34.117.59.81	443	C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe

Timestamp	kBytes transferred	Direction	Data
2023-11-21 03:17:54 UTC	1	OUT	GET /widget/demo/89.149.18.60 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36 Host: ipinfo.io
2023-11-21 03:17:54 UTC	3	IN	HTTP/1.1 200 OK access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin content-type: application/json; charset=utf-8 Content-Length: 959 date: Tue, 21 Nov 2023 03:17:54 GMT x-envoy-upstream-service-time: 2 strict-transport-security: max-age=2592000; includeSubDomains vary: Accept-Encoding Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-11-21 03:17:54 UTC	4	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 39 2e 31 34 39 2e 31 38 2e 36 30 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 39 2e 31 34 39 2e 31 38 2e 36 30 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 57 61 73 68 69 6e 67 74 6f 6e 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 57 61 73 68 69 6e 67 74 6f 6e 2c 20 44 2e 43 2e 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 33 38 2e 38 39 35 31 2c 2d 37 37 2e 30 33 36 34 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 32 31 32 32 33 38 20 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 0a 20 20 20 20 22 70 6f 73 74 61 6c 22 3a 20 22 32 30 30 30 34 22 2c 0a 20 20 20 20 22 74 69 6d 65 7a 6f 6e 65 Data Ascii: { "input": "89.149.18.60", "data": { "ip": "89.149.18.60", "city": "Washington", "region": "Washington, D.C.", "country": "US", "loc": "38.8951,-77.0364", "org": "AS212238 Datacamp Limited", "postal": "20004", "timezone
2023-11-21 03:17:54 UTC	4	IN	Data Raw: 20 20 22 61 64 64 72 65 73 73 22 3a 20 22 53 74 72 2e 20 43 2e 41 2e 20 52 6f 73 65 74 74 69 2c 20 4e 72 2e 31 37 22 2c 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 52 4f 22 2c 0a 20 20 20 20 20 20 22 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 40 62 69 6e 62 6f 78 2e 63 6f 6d 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 41 62 75 73 65 20 63 6f 6e 74 61 63 74 20 72 6f 6c 65 20 6f 62 6a 65 63 74 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 39 2e 31 34 39 2e 31 38 2e 30 2f 32 34 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 34 30 20 33 37 38 20 36 30 30 20 30 30 30 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: "address": "Str. C.A. Rosetti, Nr.17", "country": "RO", "email": "abuse@binbox.com", "name": "Abuse contact role object", "network": "89.149.18.0/24", "phone": "+40 378 600 000" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	34.117.59.81	443	192.168.2.4	49742	C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe

Timestamp	kBytes transferred	Direction	Data
2023-11-21 03:17:54 UTC	1	OUT	GET /widget/demo/89.149.18.60 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36 Host: ipinfo.io
2023-11-21 03:17:54 UTC	3	IN	HTTP/1.1 200 OK access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin content-type: application/json; charset=utf-8 Content-Length: 959 date: Tue, 21 Nov 2023 03:17:54 GMT x-envoy-upstream-service-time: 2 strict-transport-security: max-age=2592000; includeSubDomains vary: Accept-Encoding Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-11-21 03:17:54 UTC	4	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 39 2e 31 34 39 2e 31 38 2e 36 30 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 39 2e 31 34 39 2e 31 38 2e 36 30 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 57 61 73 68 69 6e 67 74 6f 6e 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 57 61 73 68 69 6e 67 74 6f 6e 2c 20 44 2e 43 2e 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 33 38 2e 38 39 35 31 2c 2d 37 37 2e 30 33 36 34 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 32 31 32 32 33 38 20 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 0a 20 20 20 20 22 70 6f 73 74 61 6c 22 3a 20 22 32 30 30 30 34 22 2c 0a 20 20 20 20 22 74 69 6d 65 7a 6f 6e 65 Data Ascii: { "input": "89.149.18.60", "data": { "ip": "89.149.18.60", "city": "Washington", "region": "Washington, D.C.", "country": "US", "loc": "38.8951,-77.0364", "org": "AS212238 Datacamp Limited", "postal": "20004", "timezone
2023-11-21 03:17:54 UTC	4	IN	Data Raw: 20 20 22 61 64 64 72 65 73 73 22 3a 20 22 53 74 72 2e 20 43 2e 41 2e 20 52 6f 73 65 74 74 69 2c 20 4e 72 2e 31 37 22 2c 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 52 4f 22 2c 0a 20 20 20 20 20 20 22 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 40 62 69 6e 62 6f 78 2e 63 6f 6d 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 41 62 75 73 65 20 63 6f 6e 74 61 63 74 20 72 6f 6c 65 20 6f 62 6a 65 63 74 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 39 2e 31 34 39 2e 31 38 2e 30 2f 32 34 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 34 30 20 33 37 38 20 36 30 30 20 30 30 30 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: "address": "Str. C.A. Rosetti, Nr.17", "country": "RO", "email": "abuse@binbox.com", "name": "Abuse contact role object", "network": "89.149.18.0/24", "phone": "+40 378 600 000" } }}

Target ID:	0
Start time:	04:16:52
Start date:	21/11/2023
Path:	C:\Users\user\Desktop\14OWDrfahJ.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\14OWDrfahJ.exe
Imagebase:	0x750000
File size:	1'200'128 bytes
MD5 hash:	725DBFED269993CB9944C2E1F7BDE652
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000003.1633263282.0000000004F58000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	04:16:52
Start date:	21/11/2023
Path:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\Ey3OF47.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\Ey3OF47.exe
Imagebase:	0x10000
File size:	975'872 bytes
MD5 hash:	A8089B11ACB5AEB2755B87605CC0365C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 54%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	04:16:52
Start date:	21/11/2023
Path:	C:\Users\user\AppData\Local\Temp\IXP001.TMP\BC5tT98.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\IXP001.TMP\BC5tT98.exe
Imagebase:	0xba0000
File size:	848'896 bytes
MD5 hash:	CC54031BCC9F48998C7AE467ACF73422
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PrivateLoader, Description: Yara detected PrivateLoader, Source: 00000002.00000003.1636508373.0000000004A9B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 56%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	04:16:52
Start date:	21/11/2023
Path:	C:\Users\user\AppData\Local\Temp\IXP002.TMP\2Iu7231.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\IXP002.TMP\2Iu7231.exe
Imagebase:	0x80000
File size:	505'120 bytes
MD5 hash:	EFBF47DBDF08AC3A28C0236D9C0A4C27
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000003.00000002.2216710591.00000000000BF000.00000004.00000001.01000000.00000006.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 35%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	04:16:52
Start date:	21/11/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	04:17:02
Start date:	21/11/2023
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP000.TMP\
Imagebase:	0x7ff74f990000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	04:17:10
Start date:	21/11/2023
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP001.TMP\
Imagebase:	0x7ff74f990000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	04:17:18
Start date:	21/11/2023
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP002.TMP\
Imagebase:	0x7ff71e800000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	04:17:50
Start date:	21/11/2023
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
Imagebase:	0x6b0000
File size:	103'528 bytes
MD5 hash:	89D41E1CF478A3D3C2C701A27A5692B2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000000B.00000002.2372767482.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000000B.00000002.2373910611.0000000007321000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	04:17:50
Start date:	21/11/2023
Path:	C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe
Imagebase:	0x7f0000
File size:	1'322'267 bytes
MD5 hash:	5158C4F1C895E03E3157643FBA44BF15
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000C.00000002.2581262150.0000000000BB1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PrivateLoader, Description: Yara detected PrivateLoader, Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 65%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	04:17:51
Start date:	21/11/2023
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /f /RU "user" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST
Imagebase:	0xe40000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	04:17:51
Start date:	21/11/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	04:17:51
Start date:	21/11/2023
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /f /RU "user" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST
Imagebase:	0xe40000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	04:17:51
Start date:	21/11/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	04:17:52
Start date:	21/11/2023
Path:	C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe
Wow64 process (32bit):	true
Commandline:	C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe
Imagebase:	0x10000
File size:	1'322'267 bytes
MD5 hash:	5158C4F1C895E03E3157643FBA44BF15
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000011.00000002.2361383370.0000000000BB5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PrivateLoader, Description: Yara detected PrivateLoader, Source: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 65%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	04:17:52
Start date:	21/11/2023
Path:	C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe
Wow64 process (32bit):	true
Commandline:	C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe
Imagebase:	0x10000
File size:	1'322'267 bytes
MD5 hash:	5158C4F1C895E03E3157643FBA44BF15
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	19
Start time:	04:18:04
Start date:	21/11/2023
Path:	C:\Users\user\AppData\Local\MaxLoonaFest131\MaxLoonaFest131.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\MaxLoonaFest131\MaxLoonaFest131.exe"
Imagebase:	0x590000
File size:	1'322'267 bytes
MD5 hash:	5158C4F1C895E03E3157643FBA44BF15
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PrivateLoader, Description: Yara detected PrivateLoader, Source: C:\Users\user\AppData\Local\MaxLoonaFest131\MaxLoonaFest131.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 65%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	04:18:13
Start date:	21/11/2023
Path:	C:\Users\user\AppData\Local\MaxLoonaFest131\MaxLoonaFest131.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\MaxLoonaFest131\MaxLoonaFest131.exe"
Imagebase:	0x590000
File size:	1'322'267 bytes
MD5 hash:	5158C4F1C895E03E3157643FBA44BF15
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	04:18:22
Start date:	21/11/2023
Path:	C:\Users\user\AppData\Local\Temp\FANBooster131\FANBooster131.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\FANBooster131\FANBooster131.exe"
Imagebase:	0x830000
File size:	1'322'267 bytes
MD5 hash:	5158C4F1C895E03E3157643FBA44BF15
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PrivateLoader, Description: Yara detected PrivateLoader, Source: C:\Users\user\AppData\Local\Temp\FANBooster131\FANBooster131.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 65%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	29.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	28.2%
Total number of Nodes:	963
Total number of Limit Nodes:	27

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 0075202A Relevance: 42.2, APIs: 16, Strings: 8, Instructions: 185
registrylibrarymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00752050
memset.MSVCRT ref: 0075205F
RegCreateKeyExA.KERNELBASE(80000002,Software\Microsoft\Windows\CurrentVersion\RunOnce,00000000,00000000,00000000,0002001F,00000000,?,?,?,?,?,?,00000000,00000000), ref: 0075208C

Part of subcall function 0075171E: _vsnprintf.MSVCRT ref: 00751750

RegQueryValueExA.KERNELBASE(?,wextract_cleanup0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 007520C9
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 007520EA
GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00752103
LoadLibraryA.KERNELBASE(?,advpack.dll,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00752122
GetProcAddress.KERNEL32(00000000,DelNodeRunDLL32), ref: 00752134
FreeLibrary.KERNELBASE(00000000,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00752144
GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0075215B
GetModuleFileNameA.KERNEL32(?,00000104,?,?,?,?,?,?,?,?,00000000,00000000), ref: 0075218C
LocalAlloc.KERNEL32(00000040,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 007521C1
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 007521E4
RegSetValueExA.KERNELBASE(?,wextract_cleanup0,00000000,00000001,00000000,00000002,?,?,?,?,?,?,?,?,?), ref: 0075223D
RegCloseKey.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00752249
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00752250

Strings

DelNodeRunDLL32, xrefs: 0075212E
%s /D:%s, xrefs: 007521FF, 00752210
wextract_cleanup0, xrefs: 007520A5, 007520BE, 007520F0, 00752232
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 007521A8, 00752204
advpack.dll, xrefs: 00752109
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 00752082
rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s", xrefs: 007521F6
wextract_cleanup%d, xrefs: 0075209E

Memory Dump Source

Source File: 00000000.00000002.2647217088.0000000000751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00750000, based on PE: true

Associated: 00000000.00000002.2647191730.0000000000750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647237467.0000000000758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_750000_14OWDrfahJ.jbxd

Similarity

API ID: Close$DirectoryFreeLibraryLocalSystemValuememset$AddressAllocCreateFileLoadModuleNameProcQuery_vsnprintf
String ID: %s /D:%s$C:\Users\user\AppData\Local\Temp\IXP000.TMP\$DelNodeRunDLL32$Software\Microsoft\Windows\CurrentVersion\RunOnce$advpack.dll$rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s"$wextract_cleanup%d$wextract_cleanup0
API String ID: 178549006-3726664654
Opcode ID: 0771bd97e218f9e7af29936048e58239318673d68e79ba04f201800ade96c3cb
Instruction ID: 891f1ffe5e289a17553894e67904f86c7f4fab6b0170b7bd2a6d1b23f928b21a
Opcode Fuzzy Hash: 0771bd97e218f9e7af29936048e58239318673d68e79ba04f201800ade96c3cb
Instruction Fuzzy Hash: 9051D871900218BBDB209B64DC49FFB7738EB45702F0042A4BE49A7191EEF99D4D8A65

Uniqueness

Uniqueness Score: -1.00%

Function 00753BA2 Relevance: 40.6, APIs: 11, Strings: 12, Instructions: 308
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00753C11
CompareStringA.KERNEL32(0000007F,00000001,?,000000FF,<None>,000000FF,00000104,00000004), ref: 00753CDC

Part of subcall function 0075468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 007546A0
Part of subcall function 0075468F: SizeofResource.KERNEL32(00000000,00000000,?,00752D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 007546A9
Part of subcall function 0075468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 007546C3
Part of subcall function 0075468F: LoadResource.KERNEL32(00000000,00000000,?,00752D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 007546CC
Part of subcall function 0075468F: LockResource.KERNEL32(00000000,?,00752D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 007546D3
Part of subcall function 0075468F: memcpy_s.MSVCRT ref: 007546E5
Part of subcall function 0075468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 007546EF

CompareStringA.KERNEL32(0000007F,00000001,?,000000FF,<None>,000000FF,00000104,?,00758C42), ref: 00753D8F
GetProcAddress.KERNEL32(00000000,DoInfInstall), ref: 00753E26
FreeLibrary.KERNEL32(00000000,?,00758C42), ref: 00753EFF
LocalFree.KERNEL32(?,?,?,?,00758C42), ref: 00753F1F
FreeLibrary.KERNEL32(00000000,?,00758C42), ref: 00753F40
LocalFree.KERNEL32(?,?,?,?,00758C42), ref: 00753F47
FreeLibrary.KERNEL32(00000000,DoInfInstall,00000000,00000010,00000000,?,00758C42), ref: 00753F76
LocalFree.KERNEL32(?,advpack.dll,00000000,00000010,00000000,?,?,?,00758C42), ref: 00753F80
LocalFree.KERNEL32(?,00000000,00000000,00000010,00000000,?,?,?,00758C42), ref: 00753FC2

Strings

D, xrefs: 00753C19
RUNPROGRAM, xrefs: 00753D05
DoInfInstall, xrefs: 00753E1F, 00753E24, 00753F68
smo, xrefs: 00753E68
POSTRUNPROGRAM, xrefs: 00753D60
<None>, xrefs: 00753CC9, 00753D7D
SHOWWINDOW, xrefs: 00753C34
ADMQCMD, xrefs: 00753C9E
REBOOT, xrefs: 00753BE2
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00753E74
USRQCMD, xrefs: 00753CAD
advpack.dll, xrefs: 00753F9D

Memory Dump Source

Source File: 00000000.00000002.2647217088.0000000000751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00750000, based on PE: true

Associated: 00000000.00000002.2647191730.0000000000750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647237467.0000000000758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_750000_14OWDrfahJ.jbxd

Similarity

API ID: Free$Resource$Local$Library$CompareFindString$AddressLoadLockProcSizeofmemcpy_smemset
String ID: <None>$ADMQCMD$C:\Users\user\AppData\Local\Temp\IXP000.TMP\$D$DoInfInstall$POSTRUNPROGRAM$REBOOT$RUNPROGRAM$SHOWWINDOW$USRQCMD$advpack.dll$smo
API String ID: 1032054927-2222961441
Opcode ID: 3f360d2c9e9c03f745c9bf1421a37ad4b9bea7a748ce9ebf3f2691759c2301a4
Instruction ID: 517b85bc2a348d7afd356f9e3abe6994fff5bd82a7f5e7ae3f2b618a8311d540
Opcode Fuzzy Hash: 3f360d2c9e9c03f745c9bf1421a37ad4b9bea7a748ce9ebf3f2691759c2301a4
Instruction Fuzzy Hash: C2B1C470A04301DBE7209F248845BEA76F4EB84797F10492DFE85D61E1EBFC8949CB66

Uniqueness

Uniqueness Score: -1.00%

Function 00751AE8 Relevance: 38.8, APIs: 10, Strings: 12, Instructions: 291
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CompareStringA.KERNEL32(0000007F,00000001,00000000,000000FF,.INF,000000FF,?,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,?,00000000,00000001,00000000), ref: 00751BE7
GetFileAttributesA.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,?,00000000,00000001,00000000), ref: 00751BFE
LocalAlloc.KERNEL32(00000040,00000200,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,?,00000000,00000001,00000000), ref: 00751C57
GetPrivateProfileIntA.KERNEL32(?,Reboot,00000000,?), ref: 00751C88
GetPrivateProfileStringA.KERNEL32(Version,AdvancedINF,00751140,00000000,00000008,?), ref: 00751CB8
GetShortPathNameA.KERNEL32(?,?,00000104), ref: 00751D1B

Part of subcall function 007544B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00754518
Part of subcall function 007544B9: MessageBoxA.USER32(?,?,smo,00010010), ref: 00754554

Strings

rundll32.exe %s,InstallHinfSection %s 128 %s, xrefs: 00751D3B
DefaultInstall, xrefs: 00751C74, 00751C87, 00751CCE, 00751CD3, 00751D2D, 00751D39
setupx.dll, xrefs: 00751D14
AdvancedINF, xrefs: 00751CAE
", xrefs: 00751B25
.BAT, xrefs: 00751D83
Command.com /c %s, xrefs: 00751D9B, 00751DE8
Version, xrefs: 00751CB3
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00751BA0
.INF, xrefs: 00751BDB
setupapi.dll, xrefs: 00751D23, 00751D3A
Reboot, xrefs: 00751C82

Memory Dump Source

Source File: 00000000.00000002.2647217088.0000000000751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00750000, based on PE: true

Associated: 00000000.00000002.2647191730.0000000000750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647237467.0000000000758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_750000_14OWDrfahJ.jbxd

Similarity

API ID: String$PrivateProfile$AllocAttributesCompareFileLoadLocalMessageNamePathShort
String ID: "$.BAT$.INF$AdvancedINF$C:\Users\user\AppData\Local\Temp\IXP000.TMP\$Command.com /c %s$DefaultInstall$Reboot$Version$rundll32.exe %s,InstallHinfSection %s 128 %s$setupapi.dll$setupx.dll
API String ID: 383838535-2280873615
Opcode ID: ae1383ff7d324d483b4bc55ca9fff2edc875971453acfa0149ef6035d91f0a51
Instruction ID: ad08c04dd6b5ea8ce17f4cf9ad2baeaac14ce60d2c0aa5cfa660ccf9d092bcc6
Opcode Fuzzy Hash: ae1383ff7d324d483b4bc55ca9fff2edc875971453acfa0149ef6035d91f0a51
Instruction Fuzzy Hash: E2A128B0A00318ABEB209B24CC45FEA7769DB45313F9442A8ED55A32C1DBFC9D8DCB50

Uniqueness

Uniqueness Score: -1.00%

Function 0075597D Relevance: 19.7, APIs: 13, Instructions: 212
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryA.KERNEL32(00000104,?,00000000,00000000), ref: 007559A8
SetCurrentDirectoryA.KERNELBASE(?), ref: 007559AF
GetDiskFreeSpaceA.KERNELBASE(00000000,?,?,?,?,00000001), ref: 00755A13
MulDiv.KERNEL32(?,?,00000400), ref: 00755A40
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 00755A64
memset.MSVCRT ref: 00755A7C
GetLastError.KERNEL32(00000000,?,00000200,00000000), ref: 00755A98
FormatMessageA.KERNEL32(00001000,00000000,00000000), ref: 00755AA5
SetCurrentDirectoryA.KERNEL32(?,?,?,00000010,00000000), ref: 00755BFC

Part of subcall function 007544B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00754518
Part of subcall function 007544B9: MessageBoxA.USER32(?,?,smo,00010010), ref: 00754554

Part of subcall function 00756285: GetLastError.KERNEL32(00755BBC), ref: 00756285

Memory Dump Source

Source File: 00000000.00000002.2647217088.0000000000751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00750000, based on PE: true

Associated: 00000000.00000002.2647191730.0000000000750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647237467.0000000000758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_750000_14OWDrfahJ.jbxd

Similarity

API ID: CurrentDirectory$ErrorLastMessage$DiskFormatFreeInformationLoadSpaceStringVolumememset
String ID:
API String ID: 4237285672-0
Opcode ID: fdd565cd73cb9040f4fd6d9240699bc14fb0eb1d8ba70679e695f709a2915a88
Instruction ID: 0c3091e5bc5685661f89dc9264a06300e076f6e6a2e7dbed165c13476053fc4b
Opcode Fuzzy Hash: fdd565cd73cb9040f4fd6d9240699bc14fb0eb1d8ba70679e695f709a2915a88
Instruction Fuzzy Hash: 1271ABB150071CAFDB159B64CC99FFB77BCEB48302F4481A9F905D2140EAB89E49CB24

Uniqueness

Uniqueness Score: -1.00%

Function 00754FE0 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 121
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0075468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 007546A0
Part of subcall function 0075468F: SizeofResource.KERNEL32(00000000,00000000,?,00752D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 007546A9
Part of subcall function 0075468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 007546C3
Part of subcall function 0075468F: LoadResource.KERNEL32(00000000,00000000,?,00752D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 007546CC
Part of subcall function 0075468F: LockResource.KERNEL32(00000000,?,00752D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 007546D3
Part of subcall function 0075468F: memcpy_s.MSVCRT ref: 007546E5
Part of subcall function 0075468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 007546EF

FindResourceA.KERNEL32(00000000,CABINET,0000000A), ref: 00754FFE
LoadResource.KERNEL32(00000000,00000000), ref: 00755006
LockResource.KERNEL32(00000000), ref: 0075500D
GetDlgItem.USER32(00000000,00000842), ref: 00755030
ShowWindow.USER32(00000000), ref: 00755037
GetDlgItem.USER32(00000841,00000005), ref: 0075504A
ShowWindow.USER32(00000000), ref: 00755051
FreeResource.KERNEL32(00000000,00000000,00000010,00000000), ref: 00755111
SendMessageA.USER32(00000FA1,00000000,00000000,00000000), ref: 00755159

Strings

CABINET, xrefs: 00754FE6, 00754FF7
*MEMCAB, xrefs: 007550C7

Memory Dump Source

Source File: 00000000.00000002.2647217088.0000000000751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00750000, based on PE: true

Associated: 00000000.00000002.2647191730.0000000000750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647237467.0000000000758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_750000_14OWDrfahJ.jbxd

Similarity

API ID: Resource$Find$FreeItemLoadLockShowWindow$MessageSendSizeofmemcpy_s
String ID: *MEMCAB$CABINET
API String ID: 1305606123-2642027498
Opcode ID: 73d7e67f556a92d92f469080fa2c8ab4ff8fd893ee2a1d8dc7a3aa891f4f74aa
Instruction ID: 6809f92193ca96005137d44676a2eea0034c2ca6d250e38a239c002776b871f2
Opcode Fuzzy Hash: 73d7e67f556a92d92f469080fa2c8ab4ff8fd893ee2a1d8dc7a3aa891f4f74aa
Instruction Fuzzy Hash: 3431FCB0640B19BBE7205B619C9EFE73A5CB74475BF048134FE05A21E1EBFC8C448A69

Uniqueness

Uniqueness Score: -1.00%

Function 00752F1D Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 120
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryA.KERNEL32(?,00000105), ref: 00752F93
LoadLibraryA.KERNEL32(?,advapi32.dll), ref: 00752FB2
GetProcAddress.KERNEL32(00000000,DecryptFileA), ref: 00752FC6
DecryptFileA.ADVAPI32 ref: 00752FE6
FreeLibrary.KERNEL32(00000000), ref: 00752FF8
SetCurrentDirectoryA.KERNELBASE(C:\Users\user\AppData\Local\Temp\IXP000.TMP\), ref: 0075301C

Part of subcall function 007551E5: LocalAlloc.KERNEL32(00000040,00000001,00000000,?,00000002,00000000,00752F4D,?,00000002,00000000), ref: 00755201

Strings

DecryptFileA, xrefs: 00752FC0
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00752FDB, 00753017
advapi32.dll, xrefs: 00752F99

Memory Dump Source

Source File: 00000000.00000002.2647217088.0000000000751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00750000, based on PE: true

Associated: 00000000.00000002.2647191730.0000000000750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647237467.0000000000758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_750000_14OWDrfahJ.jbxd

Similarity

API ID: DirectoryLibrary$AddressAllocCurrentDecryptFileFreeLoadLocalProcSystem
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\$DecryptFileA$advapi32.dll
API String ID: 2126469477-1173327654
Opcode ID: b40f560039b9097c440b2accf0e148bd7e92a4c8661240773f28edad9a424753
Instruction ID: 3bb2c5e70ba2b16ac8d4cbbfaab6f73fe00b7cdb277f5b00dbc2aa5a367a9622
Opcode Fuzzy Hash: b40f560039b9097c440b2accf0e148bd7e92a4c8661240773f28edad9a424753
Instruction Fuzzy Hash: 0741E931A00309DBDB70AB71AC496E637A99B44793F008165AD09D21E1FFFCCE8DCA65

Uniqueness

Uniqueness Score: -1.00%

Function 00755467 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?,?,?,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 007554C9
CreateDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 0075553D
RemoveDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 0075556F

Part of subcall function 007553A1: RemoveDirectoryA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 007553FB
Part of subcall function 007553A1: GetFileAttributesA.KERNELBASE(?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 00755402
Part of subcall function 007553A1: GetTempFileNameA.KERNEL32(C:\Users\user\AppData\Local\Temp\IXP000.TMP\,IXP,00000000,?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 0075541F
Part of subcall function 007553A1: DeleteFileA.KERNEL32(?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 0075542B
Part of subcall function 007553A1: CreateDirectoryA.KERNEL32(?,00000000,?,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 00755434

Strings

i386, xrefs: 007554FE
ppc, xrefs: 007554E9
alpha, xrefs: 007554F0
mips, xrefs: 007554F7
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 0075547D, 00755481, 007554AB, 0075551C, 0075553C, 00755568

Memory Dump Source

Source File: 00000000.00000002.2647217088.0000000000751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00750000, based on PE: true

Associated: 00000000.00000002.2647191730.0000000000750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647237467.0000000000758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_750000_14OWDrfahJ.jbxd

Similarity

API ID: Directory$File$CreateRemove$AttributesDeleteInfoNameSystemTemp
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\$alpha$i386$mips$ppc
API String ID: 1979080616-3374052426
Opcode ID: c2411734195dee2e329cbbe97a576a370259ece6ae408974b582528df24254bc
Instruction ID: 4636e1e52559abde38c5298f3a298211b5aecf2e3663e1113ad1c2f072ecbc20
Opcode Fuzzy Hash: c2411734195dee2e329cbbe97a576a370259ece6ae408974b582528df24254bc
Instruction Fuzzy Hash: 47312871B00B14E7DB109B259C286FE779BAB81303B54412AAD06D2550FEFC8E1D8695

Uniqueness

Uniqueness Score: -1.00%

Function 00752390 Relevance: 12.1, APIs: 8, Instructions: 93
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileA.KERNELBASE(?,00758A3A,007511F4,00758A3A,00000000,?,?), ref: 007523F6
lstrcmpA.KERNEL32(?,007511F8), ref: 00752427
lstrcmpA.KERNEL32(?,007511FC), ref: 0075243B
SetFileAttributesA.KERNEL32(?,00000080,?), ref: 00752495
DeleteFileA.KERNEL32(?), ref: 007524A3
FindNextFileA.KERNELBASE(00000000,00000010), ref: 007524AF
FindClose.KERNELBASE(00000000), ref: 007524BE
RemoveDirectoryA.KERNELBASE(00758A3A), ref: 007524C5

Memory Dump Source

Source File: 00000000.00000002.2647217088.0000000000751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00750000, based on PE: true

Associated: 00000000.00000002.2647191730.0000000000750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647237467.0000000000758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_750000_14OWDrfahJ.jbxd

Similarity

API ID: File$Find$lstrcmp$AttributesCloseDeleteDirectoryFirstNextRemove
String ID:
API String ID: 836429354-0
Opcode ID: e292760ce402de1ab3f2161cd6d7cde379fd003b7bc1e53c3d0de749e0a50c5e
Instruction ID: 2af81b11dc957ab9abccd2f26dc1ea56a8d5fe972afd0be8bce4bf6d65889495
Opcode Fuzzy Hash: e292760ce402de1ab3f2161cd6d7cde379fd003b7bc1e53c3d0de749e0a50c5e
Instruction Fuzzy Hash: 82316231604744EBD320DB64CC8DAEB73A8AB85307F44493DB95986191EFBC9D0E8766

Uniqueness

Uniqueness Score: -1.00%

Function 00752BFB Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 63libraryloaderCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(?,00000002,00000000,?,00756BB0,00750000,00000000,00000002,0000000A), ref: 00752C03
GetModuleHandleW.KERNEL32(Kernel32.dll,?,00756BB0,00750000,00000000,00000002,0000000A), ref: 00752C18
GetProcAddress.KERNEL32(00000000,HeapSetInformation), ref: 00752C28
CloseHandle.KERNEL32(00000000,?,?,00756BB0,00750000,00000000,00000002,0000000A), ref: 00752C98

Strings

Kernel32.dll, xrefs: 00752C13
HeapSetInformation, xrefs: 00752C22

Memory Dump Source

Source File: 00000000.00000002.2647217088.0000000000751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00750000, based on PE: true

Associated: 00000000.00000002.2647191730.0000000000750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647237467.0000000000758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_750000_14OWDrfahJ.jbxd

Similarity

API ID: Handle$AddressCloseModuleProcVersion
String ID: HeapSetInformation$Kernel32.dll
API String ID: 62482547-3460614246
Opcode ID: 0556eaea33e836a394424f145584da00888399da8c9555207bcd5250805fa3ca
Instruction ID: e742f83a0b5e6863c88fd45d32dd9ab851b18e76a5edf0c14bbd83853ce2933c
Opcode Fuzzy Hash: 0556eaea33e836a394424f145584da00888399da8c9555207bcd5250805fa3ca
Instruction Fuzzy Hash: FE11E771300305ABE7106B75AC49AEE3759AB46353F048125BD04D3293DEEDDC0B8679

Uniqueness

Uniqueness Score: -1.00%

Function 007555A0 Relevance: 31.7, APIs: 12, Strings: 6, Instructions: 248
memorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0075468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 007546A0
Part of subcall function 0075468F: SizeofResource.KERNEL32(00000000,00000000,?,00752D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 007546A9
Part of subcall function 0075468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 007546C3
Part of subcall function 0075468F: LoadResource.KERNEL32(00000000,00000000,?,00752D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 007546CC
Part of subcall function 0075468F: LockResource.KERNEL32(00000000,?,00752D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 007546D3
Part of subcall function 0075468F: memcpy_s.MSVCRT ref: 007546E5
Part of subcall function 0075468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 007546EF

LocalAlloc.KERNEL32(00000040,00000001,00000000,?,00000002,00000000), ref: 007555CF
lstrcmpA.KERNEL32(00000000,<None>,00000000), ref: 00755638
LocalFree.KERNEL32(00000000), ref: 0075564C
LocalFree.KERNEL32(00000000,00000000,00000000,00000010,00000000,00000000), ref: 00755620

Part of subcall function 007544B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00754518
Part of subcall function 007544B9: MessageBoxA.USER32(?,?,smo,00010010), ref: 00754554

Part of subcall function 00756285: GetLastError.KERNEL32(00755BBC), ref: 00756285

GetTempPathA.KERNEL32(00000104,C:\Users\user\AppData\Local\Temp\IXP000.TMP\), ref: 007556B9
GetDriveTypeA.KERNEL32(0000005A,?,A:\), ref: 0075571E
GetFileAttributesA.KERNEL32(0000005A,?,A:\), ref: 00755737
GetWindowsDirectoryA.KERNEL32(0000005A,00000104,00000000,?,A:\), ref: 007557CD
GetFileAttributesA.KERNEL32(0000005A,msdownld.tmp,00000000,?,A:\), ref: 007557EF
CreateDirectoryA.KERNEL32(0000005A,00000000,?,A:\), ref: 00755802

Part of subcall function 00752630: GetWindowsDirectoryA.KERNEL32(?,00000104,00000000), ref: 00752654

SetFileAttributesA.KERNEL32(0000005A,00000002,?,A:\), ref: 00755830

Part of subcall function 00756517: FindResourceA.KERNEL32(00750000,000007D6,00000005), ref: 0075652A
Part of subcall function 00756517: LoadResource.KERNEL32(00750000,00000000,?,?,00752EE8,00000000,007519E0,00000547,0000083E,?,?,?,?,?,?,?), ref: 00756538
Part of subcall function 00756517: DialogBoxIndirectParamA.USER32(00750000,00000000,00000547,007519E0,00000000), ref: 00756557
Part of subcall function 00756517: FreeResource.KERNEL32(00000000,?,?,00752EE8,00000000,007519E0,00000547,0000083E,?,?,?,?,?,?,?,00000002), ref: 00756560

GetWindowsDirectoryA.KERNEL32(0000005A,00000104,?,A:\), ref: 00755878

Part of subcall function 0075597D: GetCurrentDirectoryA.KERNEL32(00000104,?,00000000,00000000), ref: 007559A8
Part of subcall function 0075597D: SetCurrentDirectoryA.KERNELBASE(?), ref: 007559AF

Strings

RUNPROGRAM, xrefs: 007555BD, 00755600
<None>, xrefs: 00755632
A:\, xrefs: 007556F4
msdownld.tmp, xrefs: 007557D3
Z, xrefs: 0075570A
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 007556AE, 007556B3, 0075583D

Memory Dump Source

Source File: 00000000.00000002.2647217088.0000000000751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00750000, based on PE: true

Associated: 00000000.00000002.2647191730.0000000000750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647237467.0000000000758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_750000_14OWDrfahJ.jbxd

Similarity

API ID: Resource$Directory$Free$AttributesFileFindLoadLocalWindows$Current$AllocCreateDialogDriveErrorIndirectLastLockMessageParamPathSizeofStringTempTypelstrcmpmemcpy_s
String ID: <None>$A:\$C:\Users\user\AppData\Local\Temp\IXP000.TMP\$RUNPROGRAM$Z$msdownld.tmp
API String ID: 2436801531-2740620654
Opcode ID: 1f5fe1854ab72b0f66ed855c332753bfa63558fd6c2a8bde9ef57b939c35ef22
Instruction ID: 96b44cee95c8bcf7ba69801bfa9a9349d211f373416ce92c9d7e2369532c9831
Opcode Fuzzy Hash: 1f5fe1854ab72b0f66ed855c332753bfa63558fd6c2a8bde9ef57b939c35ef22
Instruction Fuzzy Hash: E98148B0A04A48EBDB209B308C65BEA726D9F64303F404565FD86D2191EFFC9DCE8A14

Uniqueness

Uniqueness Score: -1.00%

Function 00752CAA Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 183
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00752CD9
memset.MSVCRT ref: 00752CE9
memset.MSVCRT ref: 00752CF9

Part of subcall function 0075468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 007546A0
Part of subcall function 0075468F: SizeofResource.KERNEL32(00000000,00000000,?,00752D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 007546A9
Part of subcall function 0075468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 007546C3
Part of subcall function 0075468F: LoadResource.KERNEL32(00000000,00000000,?,00752D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 007546CC
Part of subcall function 0075468F: LockResource.KERNEL32(00000000,?,00752D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 007546D3
Part of subcall function 0075468F: memcpy_s.MSVCRT ref: 007546E5
Part of subcall function 0075468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 007546EF

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00752D34
SetEvent.KERNEL32(00000000,?,?,?,?,?,?,?,00000002,00000000), ref: 00752D40
CreateMutexA.KERNEL32(00000000,00000001,?,00000104,00000004,?,?,?,?,?,?,?,00000002,00000000), ref: 00752DAE
GetLastError.KERNEL32(?,?,?,?,?,?,?,00000002,00000000), ref: 00752DBD
CloseHandle.KERNEL32(smo,00000000,00000020,00000004,?,?,?,?,?,?,?,00000002,00000000), ref: 00752E0A

Part of subcall function 007544B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00754518
Part of subcall function 007544B9: MessageBoxA.USER32(?,?,smo,00010010), ref: 00754554

Strings

INSTANCECHECK, xrefs: 00752D95
VERCHECK, xrefs: 00752E54
smo, xrefs: 00752D04, 00752DD9, 00752DF0
EXTRACTOPT, xrefs: 00752D4D
TITLE, xrefs: 00752D09

Memory Dump Source

Source File: 00000000.00000002.2647217088.0000000000751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00750000, based on PE: true

Associated: 00000000.00000002.2647191730.0000000000750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647237467.0000000000758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_750000_14OWDrfahJ.jbxd

Similarity

API ID: Resource$memset$CreateEventFindLoad$CloseErrorFreeHandleLastLockMessageMutexSizeofStringmemcpy_s
String ID: EXTRACTOPT$INSTANCECHECK$TITLE$VERCHECK$smo
API String ID: 1002816675-4137116347
Opcode ID: 6021997d44e456aeaa79f105088a57d2a6df43a26c9156a8e135b55fec823398
Instruction ID: e840b409f006fe4f49f94063d654813b66edba17bcd11780c1dccff59e80c3d3
Opcode Fuzzy Hash: 6021997d44e456aeaa79f105088a57d2a6df43a26c9156a8e135b55fec823398
Instruction Fuzzy Hash: 8751D570340305E7E75467359C0FBFA2698E746713F408039BE46D51D2EEEC8C4AC62A

Uniqueness

Uniqueness Score: -1.00%

Function 007544B9 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 160
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00754518
MessageBoxA.USER32(?,?,smo,00010010), ref: 00754554
LocalAlloc.KERNEL32(00000040,00000065), ref: 007545A3
LocalAlloc.KERNEL32(00000040,00000065), ref: 007545E3
LocalAlloc.KERNEL32(00000040,00000002), ref: 0075460D
MessageBeep.USER32(00000000), ref: 00754630
MessageBoxA.USER32(?,00000000,smo,00000000), ref: 00754666
LocalFree.KERNEL32(00000000), ref: 0075466F

Part of subcall function 0075681F: GetVersionExA.KERNEL32(?,00000000,00000002), ref: 0075686E
Part of subcall function 0075681F: GetSystemMetrics.USER32(0000004A), ref: 007568A7
Part of subcall function 0075681F: RegOpenKeyExA.ADVAPI32(80000001,Control Panel\Desktop\ResourceLocale,00000000,00020019,?), ref: 007568CC
Part of subcall function 0075681F: RegQueryValueExA.ADVAPI32(?,00751140,00000000,?,?,0000000C), ref: 007568F4
Part of subcall function 0075681F: RegCloseKey.ADVAPI32(?), ref: 00756902

Strings

smo, xrefs: 00754545, 0075465A
LoadString() Error. Could not load string resource., xrefs: 007544E4

Memory Dump Source

Source File: 00000000.00000002.2647217088.0000000000751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00750000, based on PE: true

Associated: 00000000.00000002.2647191730.0000000000750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647237467.0000000000758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_750000_14OWDrfahJ.jbxd

Similarity

API ID: Local$AllocMessage$BeepCloseFreeLoadMetricsOpenQueryStringSystemValueVersion
String ID: LoadString() Error. Could not load string resource.$smo
API String ID: 3244514340-2161240188
Opcode ID: 5ac8ee35aecc73e2d290af93041050905ccef2b93d07e314fd63c37bd1450de8
Instruction ID: b14b5cb6194c7ac9baa0e27cfa54238e27e9462df2b271c0ce948e8dd950e806
Opcode Fuzzy Hash: 5ac8ee35aecc73e2d290af93041050905ccef2b93d07e314fd63c37bd1450de8
Instruction Fuzzy Hash: 54510871900219ABDB219F28CC48BE67BB8EF45306F1041A4FD09A7241DBB9DD4DCBA0

Uniqueness

Uniqueness Score: -1.00%

Function 007553A1 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 71
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0075171E: _vsnprintf.MSVCRT ref: 00751750

RemoveDirectoryA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 007553FB
GetFileAttributesA.KERNELBASE(?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 00755402
GetTempFileNameA.KERNEL32(C:\Users\user\AppData\Local\Temp\IXP000.TMP\,IXP,00000000,?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 0075541F
DeleteFileA.KERNEL32(?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 0075542B
CreateDirectoryA.KERNEL32(?,00000000,?,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 00755434
CreateDirectoryA.KERNELBASE(?,00000000,?,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 00755452

Strings

IXP, xrefs: 00755419
IXP%03d.TMP, xrefs: 007553C0
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 007553B7, 007553E1, 0075541E

Memory Dump Source

Source File: 00000000.00000002.2647217088.0000000000751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00750000, based on PE: true

Associated: 00000000.00000002.2647191730.0000000000750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647237467.0000000000758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_750000_14OWDrfahJ.jbxd

Similarity

API ID: DirectoryFile$Create$AttributesDeleteNameRemoveTemp_vsnprintf
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\$IXP$IXP%03d.TMP
API String ID: 1082909758-775753704
Opcode ID: 49d4dbde124e7d73cbe9174b2529d800f20a3e710d7b61985b831253f30f940e
Instruction ID: 4b395180ef421af238de1ff4005c9ed761ecbfa16a27a883d408ee17747fef79
Opcode Fuzzy Hash: 49d4dbde124e7d73cbe9174b2529d800f20a3e710d7b61985b831253f30f940e
Instruction Fuzzy Hash: 6211C871700604B7D3109B269C49FEF766DDBC5713F504125BA4AD21D0DEFC8D8A86A6

Uniqueness

Uniqueness Score: -1.00%

Function 0075256D Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 75
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,System\CurrentControlSet\Control\Session Manager,00000000,00020019,?,00000000,00754096,00754096,?,00751ED3,00000001,00000000,?,?,00754137,?), ref: 007525B2
RegQueryValueExA.KERNELBASE(?,PendingFileRenameOperations,00000000,00000000,00000000,00754096,?,00751ED3,00000001,00000000,?,?,00754137,?,00754096), ref: 007525CB
RegCloseKey.KERNELBASE(?,?,00751ED3,00000001,00000000,?,?,00754137,?,00754096), ref: 007525DD
RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Session Manager\FileRenameOperations,00000000,00020019,?,00000000,00754096,00754096,?,00751ED3,00000001,00000000,?,?,00754137,?), ref: 007525FF
RegQueryInfoKeyA.ADVAPI32(?,00000000,00000000,00000000,00000000,00000000,00000000,00754096,00000000,00000000,00000000,00000000,?,00751ED3,00000001,00000000), ref: 0075261A

Strings

System\CurrentControlSet\Control\Session Manager, xrefs: 007525A8
PendingFileRenameOperations, xrefs: 007525C3
System\CurrentControlSet\Control\Session Manager\FileRenameOperations, xrefs: 007525F5

Memory Dump Source

Source File: 00000000.00000002.2647217088.0000000000751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00750000, based on PE: true

Associated: 00000000.00000002.2647191730.0000000000750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647237467.0000000000758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_750000_14OWDrfahJ.jbxd

Similarity

API ID: OpenQuery$CloseInfoValue
String ID: PendingFileRenameOperations$System\CurrentControlSet\Control\Session Manager$System\CurrentControlSet\Control\Session Manager\FileRenameOperations
API String ID: 2209512893-559176071
Opcode ID: bc1cbfea53a31db6bc6a067a2b7221dea148fb33a3bdd40e0dc533f63bd13611
Instruction ID: df1d72bfc6dd62d0a52c523f937e0d07ae1831f0a56a8e7ef2811e06f75dda1d
Opcode Fuzzy Hash: bc1cbfea53a31db6bc6a067a2b7221dea148fb33a3bdd40e0dc533f63bd13611
Instruction Fuzzy Hash: 6D118675912228FB9B209B919C09DFB7F7CEF027A3F5041A5BC08A2041E6B94E49D6A1

Uniqueness

Uniqueness Score: -1.00%

Function 00756A60 Relevance: 13.6, APIs: 9, Instructions: 138
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00757155: GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 00757182
Part of subcall function 00757155: GetCurrentProcessId.KERNEL32 ref: 00757191
Part of subcall function 00757155: GetCurrentThreadId.KERNEL32 ref: 0075719A
Part of subcall function 00757155: GetTickCount.KERNEL32 ref: 007571A3
Part of subcall function 00757155: QueryPerformanceCounter.KERNEL32(?), ref: 007571B8

GetStartupInfoW.KERNEL32(?,007572B8,00000058), ref: 00756A7F
Sleep.KERNEL32(000003E8), ref: 00756AB4
_amsg_exit.MSVCRT ref: 00756AC9
_initterm.MSVCRT ref: 00756B1D
__IsNonwritableInCurrentImage.LIBCMT ref: 00756B49
exit.KERNELBASE ref: 00756BBF
_ismbblead.MSVCRT ref: 00756BDA

Memory Dump Source

Source File: 00000000.00000002.2647217088.0000000000751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00750000, based on PE: true

Associated: 00000000.00000002.2647191730.0000000000750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647237467.0000000000758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_750000_14OWDrfahJ.jbxd

Similarity

API ID: Current$Time$CountCounterFileImageInfoNonwritablePerformanceProcessQuerySleepStartupSystemThreadTick_amsg_exit_initterm_ismbbleadexit
String ID:
API String ID: 836923961-0
Opcode ID: 667583a467749fa20c038aae62acc1977ea202363405cac183ef8d293e96876b
Instruction ID: c7f00c09022c440fbadb353a26edb8f48eeef1e0287f004ce15d19883660730f
Opcode Fuzzy Hash: 667583a467749fa20c038aae62acc1977ea202363405cac183ef8d293e96876b
Instruction Fuzzy Hash: 9941D2B0904369DBDB619B6498057EA77B0FB44723FA4812AEC41E7290CFFC5C49CB96

Uniqueness

Uniqueness Score: -1.00%

Function 007558C8 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 74
memoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LocalAlloc.KERNEL32(00000040,?,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,00755534,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 007558E7
CreateFileA.KERNELBASE(00000000,40000000,00000000,00000000,00000001,04000080,00000000,TMP4351$.TMP,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,00755534,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 00755943
LocalFree.KERNEL32(00000000,?,00755534,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 0075594D
CloseHandle.KERNEL32(00000000,?,00755534,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 0075595C
GetFileAttributesA.KERNELBASE(C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,00755534,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 00755963

Strings

TMP4351$.TMP, xrefs: 00755923
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 007558CD, 007558CF, 00755919, 00755962

Memory Dump Source

Source File: 00000000.00000002.2647217088.0000000000751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00750000, based on PE: true

Associated: 00000000.00000002.2647191730.0000000000750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647237467.0000000000758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_750000_14OWDrfahJ.jbxd

Similarity

API ID: FileLocal$AllocAttributesCloseCreateFreeHandle
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\$TMP4351$.TMP
API String ID: 747627703-1664176527
Opcode ID: 9fdbc0eeb288a16a232e4456292e05e382fe9b89c210d4c38dcfe760b3e5846e
Instruction ID: c31f74fb48f2ccf7568b96fdbcdfce3b724fff2ebfec3276e3e7c6beb8fdcb7b
Opcode Fuzzy Hash: 9fdbc0eeb288a16a232e4456292e05e382fe9b89c210d4c38dcfe760b3e5846e
Instruction Fuzzy Hash: 65113331600320BBD7201B7A9C0CBDB7E99EB45362B104625B909D31D0DBFC980982A4

Uniqueness

Uniqueness Score: -1.00%

Function 00753FEF Relevance: 10.6, APIs: 7, Instructions: 97processsynchronizationwindowCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?,?,?,00000000), ref: 00754033
WaitForSingleObject.KERNEL32(?,000000FF), ref: 00754049
GetExitCodeProcess.KERNELBASE(?,?), ref: 0075405C
CloseHandle.KERNEL32(?), ref: 0075409C
CloseHandle.KERNEL32(?), ref: 007540A8
GetLastError.KERNEL32(00000000,?,00000200,00000000), ref: 007540DC
FormatMessageA.KERNELBASE(00001000,00000000,00000000), ref: 007540E9

Memory Dump Source

Source File: 00000000.00000002.2647217088.0000000000751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00750000, based on PE: true

Associated: 00000000.00000002.2647191730.0000000000750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647237467.0000000000758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_750000_14OWDrfahJ.jbxd

Similarity

API ID: CloseHandleProcess$CodeCreateErrorExitFormatLastMessageObjectSingleWait
String ID:
API String ID: 3183975587-0
Opcode ID: dbf8f481bed75dd59f62efc560b80659235bf38736ff92148941a76b5e420fb4
Instruction ID: 8442750c2389f4b3975f41f31c75eb0180bdbaedcb8e1db9abccd9990302d786
Opcode Fuzzy Hash: dbf8f481bed75dd59f62efc560b80659235bf38736ff92148941a76b5e420fb4
Instruction Fuzzy Hash: D531B93164071CBBEB205B65DC4DFEB7778D794706F2081A9FA09D21A0CAB84CC5CB15

Uniqueness

Uniqueness Score: -1.00%

Function 007551E5 Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0075468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 007546A0
Part of subcall function 0075468F: SizeofResource.KERNEL32(00000000,00000000,?,00752D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 007546A9
Part of subcall function 0075468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 007546C3
Part of subcall function 0075468F: LoadResource.KERNEL32(00000000,00000000,?,00752D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 007546CC
Part of subcall function 0075468F: LockResource.KERNEL32(00000000,?,00752D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 007546D3
Part of subcall function 0075468F: memcpy_s.MSVCRT ref: 007546E5
Part of subcall function 0075468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 007546EF

LocalAlloc.KERNEL32(00000040,00000001,00000000,?,00000002,00000000,00752F4D,?,00000002,00000000), ref: 00755201
LocalFree.KERNEL32(00000000,00000000,00000000,00000010,00000000,00000000), ref: 00755250

Part of subcall function 007544B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00754518
Part of subcall function 007544B9: MessageBoxA.USER32(?,?,smo,00010010), ref: 00754554

Part of subcall function 00756285: GetLastError.KERNEL32(00755BBC), ref: 00756285

Strings

UPROMPT, xrefs: 007551EF, 00755230
<None>, xrefs: 00755262

Memory Dump Source

Source File: 00000000.00000002.2647217088.0000000000751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00750000, based on PE: true

Associated: 00000000.00000002.2647191730.0000000000750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647237467.0000000000758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_750000_14OWDrfahJ.jbxd

Similarity

API ID: Resource$FindFreeLoadLocal$AllocErrorLastLockMessageSizeofStringmemcpy_s
String ID: <None>$UPROMPT
API String ID: 957408736-2980973527
Opcode ID: 31712f82db22308ba3dc20dae00d2bd9517192c0796aa2d1c3416ec4b0be2822
Instruction ID: 5f28b0eaa3c77786d06d4668607992e534320b30350f1bca22256c5c44f2b85c
Opcode Fuzzy Hash: 31712f82db22308ba3dc20dae00d2bd9517192c0796aa2d1c3416ec4b0be2822
Instruction Fuzzy Hash: 171122B0240705FBE7146BB14C59BFB219DEB89397F008039BF06D6180EAFD8C084239

Uniqueness

Uniqueness Score: -1.00%

Function 007552B6 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 65fileCOMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNELBASE(03304D88,00000080,?,00000000), ref: 007552F2
DeleteFileA.KERNELBASE(03304D88), ref: 007552FA
LocalFree.KERNEL32(03304D88,?,00000000), ref: 00755305
LocalFree.KERNEL32(03304D88), ref: 0075530C
SetCurrentDirectoryA.KERNELBASE(007511FC,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\), ref: 00755363

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00755334

Memory Dump Source

Source File: 00000000.00000002.2647217088.0000000000751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00750000, based on PE: true

Associated: 00000000.00000002.2647191730.0000000000750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647237467.0000000000758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_750000_14OWDrfahJ.jbxd

Similarity

API ID: FileFreeLocal$AttributesCurrentDeleteDirectory
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\
API String ID: 2833751637-305352358
Opcode ID: 25c8694a6553e60b1d7a879d68bde290ad1572f04369138756d1747c73121136
Instruction ID: 612116723de39c2b6da4fac1d4e1f5e121e13da8851eed8c20b33861ecbd6cf5
Opcode Fuzzy Hash: 25c8694a6553e60b1d7a879d68bde290ad1572f04369138756d1747c73121136
Instruction Fuzzy Hash: E121D131521718DBDB609B20DC19BE937A0BB00357F448269ED4A631A0DFFD5D8CCB99

Uniqueness

Uniqueness Score: -1.00%

Function 00751FE1 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 23registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE(80000002,Software\Microsoft\Windows\CurrentVersion\RunOnce,00000000,00020006,0075538C,?,?,0075538C), ref: 00752005
RegDeleteValueA.KERNELBASE(0075538C,wextract_cleanup0,?,?,0075538C), ref: 00752017
RegCloseKey.ADVAPI32(0075538C,?,?,0075538C), ref: 00752020

Strings

wextract_cleanup0, xrefs: 00751FE7, 0075200F
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 00751FFB

Memory Dump Source

Source File: 00000000.00000002.2647217088.0000000000751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00750000, based on PE: true

Associated: 00000000.00000002.2647191730.0000000000750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647237467.0000000000758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_750000_14OWDrfahJ.jbxd

Similarity

API ID: CloseDeleteOpenValue
String ID: Software\Microsoft\Windows\CurrentVersion\RunOnce$wextract_cleanup0
API String ID: 849931509-702805525
Opcode ID: 3668e7bba6c574f2fe2184ad87d1a4292e38a081398076bd79e5081ee55adfe8
Instruction ID: 3eb96334b6dc41593f7df28aacc00f1e4148374651700fa1929fcfad6e0a3b39
Opcode Fuzzy Hash: 3668e7bba6c574f2fe2184ad87d1a4292e38a081398076bd79e5081ee55adfe8
Instruction Fuzzy Hash: 1FE04870551318BBDB214F90ED0AFD97B29F701743F1002A5BD0CB00E1FBE95918D60A

Uniqueness

Uniqueness Score: -1.00%

Function 00754CD0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNELBASE(?,?,?,?), ref: 00754DB5
SetDlgItemTextA.USER32(00000000,00000837,?), ref: 00754DDD

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00754D36, 00754DE3

Memory Dump Source

Source File: 00000000.00000002.2647217088.0000000000751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00750000, based on PE: true

Associated: 00000000.00000002.2647191730.0000000000750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647237467.0000000000758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_750000_14OWDrfahJ.jbxd

Similarity

API ID: AttributesFileItemText
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\
API String ID: 3625706803-305352358
Opcode ID: fde6947948a58368964c3a0be1b8f769ee34c7fdeee0cb0e3f4b2f7e616f9226
Instruction ID: 7217ba9e024d6380a112017e48445110e5a2dc9a5db1a0fd2dee08f2a03b7dd6
Opcode Fuzzy Hash: fde6947948a58368964c3a0be1b8f769ee34c7fdeee0cb0e3f4b2f7e616f9226
Instruction Fuzzy Hash: 2F4112363003059BCB258F28DC486F573B5AB4530AF048668DD8A97285EAFEDECEC750

Uniqueness

Uniqueness Score: -1.00%

Function 00754C37 Relevance: 4.5, APIs: 3, Instructions: 39timeCOMMON

Download Yara Rule

APIs

DosDateTimeToFileTime.KERNEL32(?,?,?), ref: 00754C54
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00754C66
SetFileTime.KERNELBASE(?,?,?,?), ref: 00754C7E

Memory Dump Source

Source File: 00000000.00000002.2647217088.0000000000751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00750000, based on PE: true

Associated: 00000000.00000002.2647191730.0000000000750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647237467.0000000000758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_750000_14OWDrfahJ.jbxd

Similarity

API ID: Time$File$DateLocal
String ID:
API String ID: 2071732420-0
Opcode ID: 105166c62d1567b96bc7bb8a11ee651720e29c940e26612e8f99da06fa28bae3
Instruction ID: f524022aaf5602519797b8bdb3a263ec085aa1c4f35ad60252d0d74ef6a7af87
Opcode Fuzzy Hash: 105166c62d1567b96bc7bb8a11ee651720e29c940e26612e8f99da06fa28bae3
Instruction Fuzzy Hash: 08F0627260120C7BAB549FB5CC489FB77BCEB44246744463AA915D1050EAB8D958CB71

Uniqueness

Uniqueness Score: -1.00%

Function 0075487A Relevance: 3.1, APIs: 2, Instructions: 59fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(00008000,-80000000,00000000,00000000,?,00000080,00000000,00000000,00000000,00000000,00754A23,?,00754F67,*MEMCAB,00008000,00000180), ref: 007548DE
CreateFileA.KERNEL32(00008000,-80000000,00000000,00000000,?,00000080,00000000,?,00754F67,*MEMCAB,00008000,00000180), ref: 00754902

Memory Dump Source

Source File: 00000000.00000002.2647217088.0000000000751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00750000, based on PE: true

Associated: 00000000.00000002.2647191730.0000000000750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647237467.0000000000758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_750000_14OWDrfahJ.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 0405b182d42d2656783b6fdd53e1c80e38586ba7994b1da8f0b1d24da22b5513
Instruction ID: 79bb7f47275732181a6ae63b6cfb7a62a1cbf05bd193ef9b85ca27847a1f5a0e
Opcode Fuzzy Hash: 0405b182d42d2656783b6fdd53e1c80e38586ba7994b1da8f0b1d24da22b5513
Instruction Fuzzy Hash: 8F014BA3E1167426F32442294C89FF7551CDB9673AF2B0334BDAAE71D1D6A86C4882E0

Uniqueness

Uniqueness Score: -1.00%

Function 00754AD0 Relevance: 3.0, APIs: 2, Instructions: 47fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00753680: MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000004FF), ref: 0075369F
Part of subcall function 00753680: PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 007536B2
Part of subcall function 00753680: PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 007536DA

WriteFile.KERNELBASE(?,?,?,?,00000000), ref: 00754B05

Memory Dump Source

Source File: 00000000.00000002.2647217088.0000000000751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00750000, based on PE: true

Associated: 00000000.00000002.2647191730.0000000000750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647237467.0000000000758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_750000_14OWDrfahJ.jbxd

Similarity

API ID: MessagePeek$FileMultipleObjectsWaitWrite
String ID:
API String ID: 1084409-0
Opcode ID: ba6517084b94cb4eee97daaf86bd36365c7c0153eb193e26744af3b25c1545d5
Instruction ID: 34a10a0261841840933c25a6120222095c1c7858d702ad47a4abe6b99621651c
Opcode Fuzzy Hash: ba6517084b94cb4eee97daaf86bd36365c7c0153eb193e26744af3b25c1545d5
Instruction Fuzzy Hash: 4E016D71200305ABDB548F58DC05BE277A9B74472BF14C229EA39AB1E0EBF8DC55CB85

Uniqueness

Uniqueness Score: -1.00%

Function 0075658A Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

CharPrevA.USER32(00758B3E,00758B3F,00000001,00758B3E,-00000003,?,007560EC,00751140,?), ref: 007565BA

Memory Dump Source

Source File: 00000000.00000002.2647217088.0000000000751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00750000, based on PE: true

Associated: 00000000.00000002.2647191730.0000000000750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647237467.0000000000758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_750000_14OWDrfahJ.jbxd

Similarity

API ID: CharPrev
String ID:
API String ID: 122130370-0
Opcode ID: b1d516c1683138778a0a362b1f4fc8e32066b10931115bc5f8c4a32943d3baf7
Instruction ID: d7bd7b054d878c9f3975a91394f11e7308d61ba26d5ad2a92bd53bd60c8e548c
Opcode Fuzzy Hash: b1d516c1683138778a0a362b1f4fc8e32066b10931115bc5f8c4a32943d3baf7
Instruction Fuzzy Hash: C9F042321442509BD331451D9884BE6BFDDDB85352F94016EEDDAC3205FADD4D5D83B4

Uniqueness

Uniqueness Score: -1.00%

Function 0075621E Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 0075623F

Part of subcall function 007544B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00754518
Part of subcall function 007544B9: MessageBoxA.USER32(?,?,smo,00010010), ref: 00754554

Part of subcall function 00756285: GetLastError.KERNEL32(00755BBC), ref: 00756285

Memory Dump Source

Source File: 00000000.00000002.2647217088.0000000000751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00750000, based on PE: true

Associated: 00000000.00000002.2647191730.0000000000750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647237467.0000000000758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_750000_14OWDrfahJ.jbxd

Similarity

API ID: DirectoryErrorLastLoadMessageStringWindows
String ID:
API String ID: 381621628-0
Opcode ID: 15293d927ac0a634fcb6826f902a8e3a7e2f98e81d2f2bc800f27c3c96db29c8
Instruction ID: f25fe12468e9fc5d324ee18b57b6f30cf03923825e4ceeb9b5a0e98c730b9fa0
Opcode Fuzzy Hash: 15293d927ac0a634fcb6826f902a8e3a7e2f98e81d2f2bc800f27c3c96db29c8
Instruction Fuzzy Hash: 06F0B470600308EBEB90EB748D06FFE33A8EB44702F804069AD89D7081EDFC9D488654

Uniqueness

Uniqueness Score: -1.00%

Function 00754B60 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?,00000000,00000000,?,00754FA1,00000000), ref: 00754B98

Memory Dump Source

Source File: 00000000.00000002.2647217088.0000000000751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00750000, based on PE: true

Associated: 00000000.00000002.2647191730.0000000000750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647237467.0000000000758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_750000_14OWDrfahJ.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: cb26e8425687a29b4c3851fd8c55874f2aec3522e1c3bc6c083d8e2a2c6adc3e
Instruction ID: b612a209cf20eb84484aec3115fce7e1412f4ebd1043c9fd1ab0dadf35396c89
Opcode Fuzzy Hash: cb26e8425687a29b4c3851fd8c55874f2aec3522e1c3bc6c083d8e2a2c6adc3e
Instruction Fuzzy Hash: 36F0FE71600F489F47A18F3B8C016D2BBF4AA993633100B2A946EE2190EFB8A445CF91

Uniqueness

Uniqueness Score: -1.00%

Function 007566AE Relevance: 1.5, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(?,00754777,?,00754E38,?), ref: 007566B1

Memory Dump Source

Source File: 00000000.00000002.2647217088.0000000000751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00750000, based on PE: true

Associated: 00000000.00000002.2647191730.0000000000750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647237467.0000000000758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_750000_14OWDrfahJ.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 3350098e1aa777777318314771196e457fa1fef4b20ebe9bbfcbb67aa189553b
Instruction ID: f81fee1e83883ee6479c63096f166c31d706562573463c3dc37ca016d1de8542
Opcode Fuzzy Hash: 3350098e1aa777777318314771196e457fa1fef4b20ebe9bbfcbb67aa189553b
Instruction Fuzzy Hash: C2B09276232541526A2006316C295AA2841E6C123B7E45BA0F036C12E0DABEC84AD008

Uniqueness

Uniqueness Score: -1.00%

Function 00754CA0 Relevance: 1.3, APIs: 1, Instructions: 8memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNELBASE(00000000,?), ref: 00754CAA

Memory Dump Source

Source File: 00000000.00000002.2647217088.0000000000751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00750000, based on PE: true

Associated: 00000000.00000002.2647191730.0000000000750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647237467.0000000000758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_750000_14OWDrfahJ.jbxd

Similarity

API ID: AllocGlobal
String ID:
API String ID: 3761449716-0
Opcode ID: 36817470c5ecef71c8c7aeccfc101987d0225d10fa38c7c7b61714c71705af21
Instruction ID: f42f24009d5b2ba0dfa74698861d7e07acc5e7a3851ff1da7d0504b32a490cf9
Opcode Fuzzy Hash: 36817470c5ecef71c8c7aeccfc101987d0225d10fa38c7c7b61714c71705af21
Instruction Fuzzy Hash: 93B0123204430CB7DF001FC2EC09FC63F1DE7C4762F144010F60C450909AB29410869A

Uniqueness

Uniqueness Score: -1.00%

Function 00754CC0 Relevance: 1.3, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

GlobalFree.KERNELBASE(?), ref: 00754CC8

Memory Dump Source

Source File: 00000000.00000002.2647217088.0000000000751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00750000, based on PE: true

Associated: 00000000.00000002.2647191730.0000000000750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647237467.0000000000758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_750000_14OWDrfahJ.jbxd

Similarity

API ID: FreeGlobal
String ID:
API String ID: 2979337801-0
Opcode ID: 611640089edc3ac2feae19fd94ea9e781b2c9dd4b5fdece2d2b96b109867a10c
Instruction ID: 7c7e786429eca331f17e06ed11496e9d5e21c0156c7fd4dfd02925ca707e902d
Opcode Fuzzy Hash: 611640089edc3ac2feae19fd94ea9e781b2c9dd4b5fdece2d2b96b109867a10c
Instruction Fuzzy Hash: 5DB0123100020CB78F001B42EC088853F1DD6C02617004020F60C410219B7798118589

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00755C9E Relevance: 24.9, APIs: 10, Strings: 4, Instructions: 422COMMON

Download Yara Rule

APIs

CharNextA.USER32(?,00000000,?,?), ref: 00755CEE
GetModuleFileNameA.KERNEL32(00758B3E,00000104,00000000,?,?), ref: 00755DFC
CharUpperA.USER32(?), ref: 00755E3E
CharUpperA.USER32(-00000052), ref: 00755EE1
CompareStringA.KERNEL32(0000007F,00000001,RegServer,000000FF,?,000000FF), ref: 00755F6F
CharUpperA.USER32(?), ref: 00755FA7
CharUpperA.USER32(-0000004E), ref: 00756008
CharUpperA.USER32(?), ref: 007560AA
CloseHandle.KERNEL32(00000000,00751140,00000000,00000040,00000000), ref: 007561F1
ExitProcess.KERNEL32 ref: 007561F8

Strings

RegServer, xrefs: 00755F66
", xrefs: 00755D78
", xrefs: 0075612D
:, xrefs: 00756118

Memory Dump Source

Source File: 00000000.00000002.2647217088.0000000000751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00750000, based on PE: true

Associated: 00000000.00000002.2647191730.0000000000750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647237467.0000000000758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_750000_14OWDrfahJ.jbxd

Similarity

API ID: Char$Upper$CloseCompareExitFileHandleModuleNameNextProcessString
String ID: "$"$:$RegServer
API String ID: 1203814774-25366791
Opcode ID: e8ac66f2e68bd25f2def84dfcaf079ec4d27fa185f378a95290789e3a44bf0ec
Instruction ID: 99a329c894985b718766ade1e310e10f08984391f16b12aa0ecf1956b91c24a6
Opcode Fuzzy Hash: e8ac66f2e68bd25f2def84dfcaf079ec4d27fa185f378a95290789e3a44bf0ec
Instruction Fuzzy Hash: 83D17C71A04B499BEF358B388C697F93771AB15303F5481A9CC86D7190DAFC8E8E8B15

Uniqueness

Uniqueness Score: -1.00%

Function 00751F90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94shutdownCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028,?,?), ref: 00751EFB
OpenProcessToken.ADVAPI32(00000000), ref: 00751F02
ExitWindowsEx.USER32(00000002,00000000), ref: 00751FD3

Strings

SeShutdownPrivilege, xrefs: 00751F28

Memory Dump Source

Source File: 00000000.00000002.2647217088.0000000000751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00750000, based on PE: true

Associated: 00000000.00000002.2647191730.0000000000750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647237467.0000000000758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_750000_14OWDrfahJ.jbxd

Similarity

API ID: Process$CurrentExitOpenTokenWindows
String ID: SeShutdownPrivilege
API String ID: 2795981589-3733053543
Opcode ID: ce2b1134ea140a1a61b17927f33d310376fdbdba0a571ae03fd17cca4e3b4ec4
Instruction ID: c4049170c72226f1e56a9c39cd960c71867905d21c144b4be859730e9609747c
Opcode Fuzzy Hash: ce2b1134ea140a1a61b17927f33d310376fdbdba0a571ae03fd17cca4e3b4ec4
Instruction Fuzzy Hash: 4E21E671A41305BBDB205BA19C4AFFF3AB8DB85713F504128FE06E20C0D7FC88099265

Uniqueness

Uniqueness Score: -1.00%

Function 007517EE Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 71librarymemoryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(advapi32.dll,00000002,?,00000000,?,?,?,007518DD), ref: 0075181A
GetProcAddress.KERNEL32(00000000,CheckTokenMembership), ref: 0075182C
AllocateAndInitializeSid.ADVAPI32(007518DD,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,007518DD), ref: 00751855
FreeSid.ADVAPI32(?,?,?,?,007518DD), ref: 00751883
FreeLibrary.KERNEL32(00000000,?,?,?,007518DD), ref: 0075188A

Strings

CheckTokenMembership, xrefs: 00751826
advapi32.dll, xrefs: 00751810

Memory Dump Source

Source File: 00000000.00000002.2647217088.0000000000751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00750000, based on PE: true

Associated: 00000000.00000002.2647191730.0000000000750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647237467.0000000000758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_750000_14OWDrfahJ.jbxd

Similarity

API ID: FreeLibrary$AddressAllocateInitializeLoadProc
String ID: CheckTokenMembership$advapi32.dll
API String ID: 4204503880-1888249752
Opcode ID: 26312e71d1c83277d87f965e79a8f28e46621f8c2eb14a0f90ac004d9c9dbb37
Instruction ID: 1e0ac4ab9aea45b0e5a2642f385443407ad43e4f39e84474e73c2e5fbd20bb72
Opcode Fuzzy Hash: 26312e71d1c83277d87f965e79a8f28e46621f8c2eb14a0f90ac004d9c9dbb37
Instruction Fuzzy Hash: 65118171E00309BBDB109FA4DC49AFEBB78EF44713F504569FA15E3290EAB89D048B95

Uniqueness

Uniqueness Score: -1.00%

Function 00756CF0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 13COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,00756E26,00751000), ref: 00756CF7
UnhandledExceptionFilter.KERNEL32(&nu,?,00756E26,00751000), ref: 00756D00
GetCurrentProcess.KERNEL32(C0000409,?,00756E26,00751000), ref: 00756D0B
TerminateProcess.KERNEL32(00000000,?,00756E26,00751000), ref: 00756D12

Strings

&nu, xrefs: 00756CFD

Memory Dump Source

Source File: 00000000.00000002.2647217088.0000000000751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00750000, based on PE: true

Associated: 00000000.00000002.2647191730.0000000000750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647237467.0000000000758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_750000_14OWDrfahJ.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminate
String ID: &nu
API String ID: 3231755760-412098778
Opcode ID: cd21c4c8e39cb30ef0487b97ec50778fcecadb54d63f076f8dbb0b7790bfaa47
Instruction ID: 342bc6f042a5ce3f911cba4f1ed5efbb4aa54d5e500efe9eda00f35453836ad7
Opcode Fuzzy Hash: cd21c4c8e39cb30ef0487b97ec50778fcecadb54d63f076f8dbb0b7790bfaa47
Instruction Fuzzy Hash: 75D0C932000B0CBBEB002BF1EC0CA993F39EB48213F448120F31982020CABA58518B5B

Uniqueness

Uniqueness Score: -1.00%

Function 00757155 Relevance: 7.6, APIs: 5, Instructions: 51timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 00757182
GetCurrentProcessId.KERNEL32 ref: 00757191
GetCurrentThreadId.KERNEL32 ref: 0075719A
GetTickCount.KERNEL32 ref: 007571A3
QueryPerformanceCounter.KERNEL32(?), ref: 007571B8

Memory Dump Source

Source File: 00000000.00000002.2647217088.0000000000751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00750000, based on PE: true

Associated: 00000000.00000002.2647191730.0000000000750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647237467.0000000000758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_750000_14OWDrfahJ.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 743b825ce910602a990dea889f7cfe871515423a17fbb60dbfe67debdaaaf9c7
Instruction ID: 6367672dfa56a8312723821a0039634104c74800e9fd439e866d3e59fe1d3b24
Opcode Fuzzy Hash: 743b825ce910602a990dea889f7cfe871515423a17fbb60dbfe67debdaaaf9c7
Instruction Fuzzy Hash: 7E113D71D0160CEBCB54DFB8EA48ADEB7F4EF48312F918565D805E7250DA789A04CB45

Uniqueness

Uniqueness Score: -1.00%

Function 00756F40 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00006EF0), ref: 00756F45

Memory Dump Source

Source File: 00000000.00000002.2647217088.0000000000751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00750000, based on PE: true

Associated: 00000000.00000002.2647191730.0000000000750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647237467.0000000000758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_750000_14OWDrfahJ.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: aacda1995837e0071f1426bb6e09e99a897d4972088a30ddd874953c918ea6a5
Instruction ID: 84d8fd8cb044865d817dc17904f6eaa3cb91d2db73660125e4a8f3c3c7b42651
Opcode Fuzzy Hash: aacda1995837e0071f1426bb6e09e99a897d4972088a30ddd874953c918ea6a5
Instruction Fuzzy Hash: 6E9002A42526045796111B709D1A495B5A16B4D603BC19570A411C5494DBE844455516

Uniqueness

Uniqueness Score: -1.00%

Function 00753210 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 188windowCOMMON

Download Yara Rule

APIs

LoadStringA.USER32(000003E8,00758598,00000200), ref: 00753271
GetDesktopWindow.USER32 ref: 007533E2
SetWindowTextA.USER32(?,smo), ref: 007533F7
SendDlgItemMessageA.USER32(?,00000835,000000C5,00000103,00000000), ref: 00753410
GetDlgItem.USER32(?,00000836), ref: 00753426
EnableWindow.USER32(00000000), ref: 0075342D
EndDialog.USER32(?,00000000), ref: 0075343F

Strings

smo, xrefs: 007533F1
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 007532E2, 007532E7, 00753331, 00753344, 0075335B, 0075336A

Memory Dump Source

Source File: 00000000.00000002.2647217088.0000000000751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00750000, based on PE: true

Associated: 00000000.00000002.2647191730.0000000000750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647237467.0000000000758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_750000_14OWDrfahJ.jbxd

Similarity

API ID: Window$Item$DesktopDialogEnableLoadMessageSendStringText
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\$smo
API String ID: 2418873061-1076603444
Opcode ID: 5b447ed249aa1f1036cfef4f23d43dd704755151220289e3b52cb513131a4ba7
Instruction ID: 6d9332fe34d36b09a9a082e25fad461e6611ae9e8b8e61c948c25d81889d368c
Opcode Fuzzy Hash: 5b447ed249aa1f1036cfef4f23d43dd704755151220289e3b52cb513131a4ba7
Instruction Fuzzy Hash: C6512830340798B7EB211B355C4DFFB2E58AB86BC7F108138FE05960E0DAFC8A499265

Uniqueness

Uniqueness Score: -1.00%

Function 007534F0 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 119threadwindowCOMMON

Download Yara Rule

APIs

TerminateThread.KERNEL32(00000000), ref: 00753535
EndDialog.USER32(?,?), ref: 00753541
ResetEvent.KERNEL32 ref: 0075355F
SetEvent.KERNEL32(00751140,00000000,00000020,00000004), ref: 00753590
GetDesktopWindow.USER32 ref: 007535C7
GetDlgItem.USER32(?,0000083B), ref: 007535F1
SendMessageA.USER32(00000000), ref: 007535F8
GetDlgItem.USER32(?,0000083B), ref: 00753610
SendMessageA.USER32(00000000), ref: 00753617
SetWindowTextA.USER32(?,smo), ref: 00753623
CreateThread.KERNEL32(00000000,00000000,Function_00004FE0,00000000,00000000,00758798), ref: 00753637
EndDialog.USER32(?,00000000), ref: 00753671

Strings

smo, xrefs: 0075361D

Memory Dump Source

Source File: 00000000.00000002.2647217088.0000000000751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00750000, based on PE: true

Associated: 00000000.00000002.2647191730.0000000000750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647237467.0000000000758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_750000_14OWDrfahJ.jbxd

Similarity

API ID: DialogEventItemMessageSendThreadWindow$CreateDesktopResetTerminateText
String ID: smo
API String ID: 2406144884-2762499640
Opcode ID: b172a344fde2bd4ca7db0237f0d7e30056ac980290603ecdc3a86df193035ded
Instruction ID: 1ac2f7f479a979cde406bd74535499619f5219b404291d2377638f5e05ae3657
Opcode Fuzzy Hash: b172a344fde2bd4ca7db0237f0d7e30056ac980290603ecdc3a86df193035ded
Instruction Fuzzy Hash: B031A671240304BBD7601F75AC4DEEA3A74F785B83F608539FA02A52B0DAFD8914CA5A

Uniqueness

Uniqueness Score: -1.00%

Function 00754224 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 132libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(SHELL32.DLL,?,?,00000001), ref: 00754236
GetProcAddress.KERNEL32(00000000,SHBrowseForFolder), ref: 0075424C
GetProcAddress.KERNEL32(00000000,000000C3), ref: 00754263
GetProcAddress.KERNEL32(00000000,SHGetPathFromIDList), ref: 0075427A
GetTempPathA.KERNEL32(00000104,007588C0,?,00000001), ref: 0075429F
CharPrevA.USER32(007588C0,00EB1181,?,00000001), ref: 007542C2
CharPrevA.USER32(007588C0,00000000,?,00000001), ref: 007542D6
FreeLibrary.KERNEL32(00000000,?,00000001), ref: 00754391
FreeLibrary.KERNEL32(00000000,?,00000001), ref: 007543A5

Strings

SHELL32.DLL, xrefs: 0075422F
SHBrowseForFolder, xrefs: 00754246
SHGetPathFromIDList, xrefs: 00754274

Memory Dump Source

Source File: 00000000.00000002.2647217088.0000000000751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00750000, based on PE: true

Associated: 00000000.00000002.2647191730.0000000000750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647237467.0000000000758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_750000_14OWDrfahJ.jbxd

Similarity

API ID: AddressLibraryProc$CharFreePrev$LoadPathTemp
String ID: SHBrowseForFolder$SHELL32.DLL$SHGetPathFromIDList
API String ID: 1865808269-1731843650
Opcode ID: 8120f1a62ffd0565f0a13895b1aa5e23abd11b52f7edde0265eb5c94dfc088ea
Instruction ID: 837797dd66ee0f8e9b393109ac549e4830ee36abb8ec1767d2818492a0694b50
Opcode Fuzzy Hash: 8120f1a62ffd0565f0a13895b1aa5e23abd11b52f7edde0265eb5c94dfc088ea
Instruction Fuzzy Hash: 1741C3B4A00304AFE7119B609C89AEE7FB4EB4534AF044169ED41B7291DFFC8C498B66

Uniqueness

Uniqueness Score: -1.00%

Function 00752773 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 114registryCOMMON

Download Yara Rule

APIs

CharUpperA.USER32(902A8B49,00000000,00000000,00000000), ref: 007527A8
CharNextA.USER32(0000054D), ref: 007527B5
CharNextA.USER32(00000000), ref: 007527BC
RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00020019,?,?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 00752829
RegQueryValueExA.ADVAPI32(?,00751140,00000000,?,-00000005,?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 00752852
ExpandEnvironmentStringsA.KERNEL32(-00000005,?,00000104,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 00752870
RegCloseKey.ADVAPI32(?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 007528A0
GetWindowsDirectoryA.KERNEL32(-00000005,00000104), ref: 007528AA
GetSystemDirectoryA.KERNEL32(-00000005,00000104), ref: 007528B9

Strings

Software\Microsoft\Windows\CurrentVersion\App Paths, xrefs: 007527E4

Memory Dump Source

Source File: 00000000.00000002.2647217088.0000000000751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00750000, based on PE: true

Associated: 00000000.00000002.2647191730.0000000000750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647237467.0000000000758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_750000_14OWDrfahJ.jbxd

Similarity

API ID: Char$DirectoryNext$CloseEnvironmentExpandOpenQueryStringsSystemUpperValueWindows
String ID: Software\Microsoft\Windows\CurrentVersion\App Paths
API String ID: 2659952014-2428544900
Opcode ID: 6fac2e5f072c3d26f702507cfa9112ea541c9a49fa204c95f13624866d1791da
Instruction ID: c3ae5e774f15e54d09ee6fc2ba2d5fdc220f5bf0d4d86cd8bd34744567a4ae7e
Opcode Fuzzy Hash: 6fac2e5f072c3d26f702507cfa9112ea541c9a49fa204c95f13624866d1791da
Instruction Fuzzy Hash: 41410A71D0021CAFDB248B64DC45AFA7BBCEF16702F1040A9F949D2141DBF85E8A8FA1

Uniqueness

Uniqueness Score: -1.00%

Function 00752267 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 88registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\RunOnce,00000000,0002001F,?,00000001), ref: 007522A3
RegQueryValueExA.ADVAPI32(?,wextract_cleanup0,00000000,00000000,?,?,00000001), ref: 007522D8
memset.MSVCRT ref: 007522F5
GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00752305
RegSetValueExA.ADVAPI32(?,wextract_cleanup0,00000000,00000001,?,?,?,?,?,?,?,?,?), ref: 0075236E
RegCloseKey.ADVAPI32(?), ref: 0075237A

Strings

wextract_cleanup0, xrefs: 0075227C, 007522CD, 00752363
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00752321
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 00752299
rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s", xrefs: 0075232D

Memory Dump Source

Source File: 00000000.00000002.2647217088.0000000000751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00750000, based on PE: true

Associated: 00000000.00000002.2647191730.0000000000750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647237467.0000000000758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_750000_14OWDrfahJ.jbxd

Similarity

API ID: Value$CloseDirectoryOpenQuerySystemmemset
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\$Software\Microsoft\Windows\CurrentVersion\RunOnce$rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s"$wextract_cleanup0
API String ID: 3027380567-2036266374
Opcode ID: f2a2cc4e54f900f41e855dc431276cd88fdc9acdb8349139e3b7e7adb11e56b5
Instruction ID: f06682f1c3594274f5136aa50390dd5c326110f911aa4da4f1a0db9fa77c2a64
Opcode Fuzzy Hash: f2a2cc4e54f900f41e855dc431276cd88fdc9acdb8349139e3b7e7adb11e56b5
Instruction Fuzzy Hash: DA31C871A00218ABDB619B50DC49FEB7B7CEF15702F4401E9B90DA6051EEF96F8DCA50

Uniqueness

Uniqueness Score: -1.00%

Function 00753100 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 70windowCOMMON

Download Yara Rule

APIs

EndDialog.USER32(?,00000000), ref: 0075313B
GetDesktopWindow.USER32 ref: 0075314B
SetDlgItemTextA.USER32(?,00000834), ref: 0075316A
SetWindowTextA.USER32(?,smo), ref: 00753176
SetForegroundWindow.USER32(?), ref: 0075317D
GetDlgItem.USER32(?,00000834), ref: 00753185
GetWindowLongA.USER32(00000000,000000FC), ref: 00753190
SetWindowLongA.USER32(00000000,000000FC,007530C0), ref: 007531A3
SendDlgItemMessageA.USER32(?,00000834,000000B1,000000FF,00000000), ref: 007531CA

Strings

smo, xrefs: 00753170

Memory Dump Source

Source File: 00000000.00000002.2647217088.0000000000751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00750000, based on PE: true

Associated: 00000000.00000002.2647191730.0000000000750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647237467.0000000000758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_750000_14OWDrfahJ.jbxd

Similarity

API ID: Window$Item$LongText$DesktopDialogForegroundMessageSend
String ID: smo
API String ID: 3785188418-2762499640
Opcode ID: f8f39d584e0444d193720a0f5b0ab058368358eba4b805f9fc89653bab070367
Instruction ID: 66936903c83f110f8b1b0575f1f2713f0397a8b738c83750a34b2b147e667126
Opcode Fuzzy Hash: f8f39d584e0444d193720a0f5b0ab058368358eba4b805f9fc89653bab070367
Instruction Fuzzy Hash: B911D231604B19BBDB115B349C0DBDA3A64FB4A763F008620FD15A11F0DBFC8A45C78A

Uniqueness

Uniqueness Score: -1.00%

Function 007518A3 Relevance: 16.6, APIs: 11, Instructions: 112memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 007517EE: LoadLibraryA.KERNEL32(advapi32.dll,00000002,?,00000000,?,?,?,007518DD), ref: 0075181A
Part of subcall function 007517EE: GetProcAddress.KERNEL32(00000000,CheckTokenMembership), ref: 0075182C
Part of subcall function 007517EE: AllocateAndInitializeSid.ADVAPI32(007518DD,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,007518DD), ref: 00751855
Part of subcall function 007517EE: FreeSid.ADVAPI32(?,?,?,?,007518DD), ref: 00751883
Part of subcall function 007517EE: FreeLibrary.KERNEL32(00000000,?,?,?,007518DD), ref: 0075188A

GetCurrentProcess.KERNEL32(00000008,?,00000000,00000001), ref: 007518EB
OpenProcessToken.ADVAPI32(00000000), ref: 007518F2
GetTokenInformation.ADVAPI32(?,00000002,00000000,00000000,?), ref: 0075190A
GetLastError.KERNEL32 ref: 00751918
LocalAlloc.KERNEL32(00000000,?,?), ref: 0075192C
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?), ref: 00751944
AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00751964
EqualSid.ADVAPI32(00000004,?), ref: 0075197A
FreeSid.ADVAPI32(?), ref: 0075199C
LocalFree.KERNEL32(00000000), ref: 007519A3
CloseHandle.KERNEL32(?), ref: 007519AD

Memory Dump Source

Source File: 00000000.00000002.2647217088.0000000000751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00750000, based on PE: true

Associated: 00000000.00000002.2647191730.0000000000750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647237467.0000000000758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_750000_14OWDrfahJ.jbxd

Similarity

API ID: Free$Token$AllocateInformationInitializeLibraryLocalProcess$AddressAllocCloseCurrentEqualErrorHandleLastLoadOpenProc
String ID:
API String ID: 2168512254-0
Opcode ID: 6dddc1d5156c44634372f4b781326b32bf7d6c3d56e4e02c072dbfbc0ba16189
Instruction ID: 3a430106ddc9ed775066686163e8bf70e727074b34c3b1784f5f7cbc9977f2d7
Opcode Fuzzy Hash: 6dddc1d5156c44634372f4b781326b32bf7d6c3d56e4e02c072dbfbc0ba16189
Instruction Fuzzy Hash: DE314371A0024AEFDB109FA5DC48AEFBBBCFF04303F504529E945D2150EBB9A949CB65

Uniqueness

Uniqueness Score: -1.00%

Function 0075468F Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 007546A0
SizeofResource.KERNEL32(00000000,00000000,?,00752D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 007546A9
FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 007546C3
LoadResource.KERNEL32(00000000,00000000,?,00752D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 007546CC
LockResource.KERNEL32(00000000,?,00752D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 007546D3
memcpy_s.MSVCRT ref: 007546E5
FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 007546EF

Strings

smo, xrefs: 007546E4
TITLE, xrefs: 0075469D, 007546C0

Memory Dump Source

Source File: 00000000.00000002.2647217088.0000000000751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00750000, based on PE: true

Associated: 00000000.00000002.2647191730.0000000000750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647237467.0000000000758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_750000_14OWDrfahJ.jbxd

Similarity

API ID: Resource$Find$FreeLoadLockSizeofmemcpy_s
String ID: TITLE$smo
API String ID: 3370778649-3033500379
Opcode ID: f75627ae7657b9579acf78e02ce3abc19920901358f5296654596afb83bd6d91
Instruction ID: e02747f3c47b43ca2089c415a93cd38cb6477ca34adeea1fa1cc5fe96cfd2e8b
Opcode Fuzzy Hash: f75627ae7657b9579acf78e02ce3abc19920901358f5296654596afb83bd6d91
Instruction Fuzzy Hash: 8B01D6322403047BE31017A55C4DFEB7E6CDBC6B53F048124FE4986180D9E9888682AA

Uniqueness

Uniqueness Score: -1.00%

Function 0075681F Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 81registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,00000000,00000002), ref: 0075686E
GetSystemMetrics.USER32(0000004A), ref: 007568A7
RegOpenKeyExA.ADVAPI32(80000001,Control Panel\Desktop\ResourceLocale,00000000,00020019,?), ref: 007568CC
RegQueryValueExA.ADVAPI32(?,00751140,00000000,?,?,0000000C), ref: 007568F4
RegCloseKey.ADVAPI32(?), ref: 00756902

Part of subcall function 007566F9: CharNextA.USER32(?,00000001,00000000,00000000,?,?,?,0075691A), ref: 00756741

Strings

Control Panel\Desktop\ResourceLocale, xrefs: 007568C2
;Fu, xrefs: 00756940

Memory Dump Source

Source File: 00000000.00000002.2647217088.0000000000751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00750000, based on PE: true

Associated: 00000000.00000002.2647191730.0000000000750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647237467.0000000000758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_750000_14OWDrfahJ.jbxd

Similarity

API ID: CharCloseMetricsNextOpenQuerySystemValueVersion
String ID: ;Fu$Control Panel\Desktop\ResourceLocale
API String ID: 3346862599-664461131
Opcode ID: f8691df08f53d9550a342605b796066e46905761a678534c1254ff4e8f406d17
Instruction ID: f0a0972630e107ddd18b6116355169efc23842019e6d86390d88eb81de8c2a9f
Opcode Fuzzy Hash: f8691df08f53d9550a342605b796066e46905761a678534c1254ff4e8f406d17
Instruction Fuzzy Hash: 58316D31B0131C9FDB218B11CC05BEAB778EB45726F4041A9ED4DA3140DBB8A9898B56

Uniqueness

Uniqueness Score: -1.00%

Function 00753450 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

EndDialog.USER32(?,?), ref: 00753490
GetDesktopWindow.USER32 ref: 0075349A
SetWindowTextA.USER32(?,smo), ref: 007534B2
SetDlgItemTextA.USER32(?,00000838), ref: 007534C4
SetForegroundWindow.USER32(?), ref: 007534CB
EndDialog.USER32(?,00000002), ref: 007534D8

Strings

smo, xrefs: 007534AC

Memory Dump Source

Source File: 00000000.00000002.2647217088.0000000000751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00750000, based on PE: true

Associated: 00000000.00000002.2647191730.0000000000750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647237467.0000000000758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_750000_14OWDrfahJ.jbxd

Similarity

API ID: Window$DialogText$DesktopForegroundItem
String ID: smo
API String ID: 852535152-2762499640
Opcode ID: 8efeecda8a3ae8a4082b2273c3fd1473ee16457add4ae42a6c26f3662e2205e3
Instruction ID: 23dce8997c4556e9a94b64aee745f21fa0328249cc7d178cdd74ff377d54c920
Opcode Fuzzy Hash: 8efeecda8a3ae8a4082b2273c3fd1473ee16457add4ae42a6c26f3662e2205e3
Instruction Fuzzy Hash: DC018031240698ABD7965B64DC0C9FD3A64EB05783F00C524FE46865B0CBFC8A45DB89

Uniqueness

Uniqueness Score: -1.00%

Function 00752AAC Relevance: 12.1, APIs: 8, Instructions: 118COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(?,00000104,00000000,00000000,?), ref: 00752AE6
IsDBCSLeadByte.KERNEL32(00000000), ref: 00752AF2
CharNextA.USER32(?), ref: 00752B12
CharUpperA.USER32 ref: 00752B1E
CharPrevA.USER32(?,?), ref: 00752B55
CharNextA.USER32(?), ref: 00752BD4

Memory Dump Source

Source File: 00000000.00000002.2647217088.0000000000751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00750000, based on PE: true

Associated: 00000000.00000002.2647191730.0000000000750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647237467.0000000000758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_750000_14OWDrfahJ.jbxd

Similarity

API ID: Char$Next$ByteFileLeadModuleNamePrevUpper
String ID:
API String ID: 571164536-0
Opcode ID: 172d36bed4a16dfd00fdccb20fe281ce0be3b591f0ed803591061201e85df4d6
Instruction ID: 8fdbcc20f0bf3ee5403c4042a08fa287b1f143e1c61e65240a1fc40329bacac6
Opcode Fuzzy Hash: 172d36bed4a16dfd00fdccb20fe281ce0be3b591f0ed803591061201e85df4d6
Instruction Fuzzy Hash: FA411374504249AFDB159F348C04AFD7BA99F57302F1441AAECC293202EBAC4E4BCB65

Uniqueness

Uniqueness Score: -1.00%

Function 007528E8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 140memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(00000000), ref: 00752A6F

Part of subcall function 00752773: CharUpperA.USER32(902A8B49,00000000,00000000,00000000), ref: 007527A8
Part of subcall function 00752773: CharNextA.USER32(0000054D), ref: 007527B5
Part of subcall function 00752773: CharNextA.USER32(00000000), ref: 007527BC
Part of subcall function 00752773: RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00020019,?,?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 00752829
Part of subcall function 00752773: RegQueryValueExA.ADVAPI32(?,00751140,00000000,?,-00000005,?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 00752852
Part of subcall function 00752773: ExpandEnvironmentStringsA.KERNEL32(-00000005,?,00000104,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 00752870
Part of subcall function 00752773: RegCloseKey.ADVAPI32(?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 007528A0

GlobalAlloc.KERNEL32(00000042,00000000,?,?,?,?,?,?,?,?,00753938,?,?,?,?,-00000005), ref: 00752958
GlobalLock.KERNEL32(00000000,?,?,?,?,?,?,?,?,00753938,?,?,?,?,-00000005,?), ref: 00752969
GlobalUnlock.KERNEL32(00000000,?,?,?,?,?,?,?,?,00753938,?,?,?,?,-00000005,?), ref: 00752A21
GlobalUnlock.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00753938,?,?), ref: 00752A81

Strings

89u, xrefs: 0075293D, 0075297E, 00752940

Memory Dump Source

Source File: 00000000.00000002.2647217088.0000000000751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00750000, based on PE: true

Associated: 00000000.00000002.2647191730.0000000000750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647237467.0000000000758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_750000_14OWDrfahJ.jbxd

Similarity

API ID: Global$Char$NextUnlock$AllocCloseEnvironmentExpandFreeLockOpenQueryStringsUpperValue
String ID: 89u
API String ID: 3949799724-4224869683
Opcode ID: fedacce303a69a1d6e40d47c855cc1d78c643f1673497ebccf7f08ee2bf80540
Instruction ID: eda2c62ec08f795150a10af9c37b60b47c691a52533728da704b56ee50719f84
Opcode Fuzzy Hash: fedacce303a69a1d6e40d47c855cc1d78c643f1673497ebccf7f08ee2bf80540
Instruction Fuzzy Hash: AA514E31D00219EBDB21CF94C884AEEF7B5FF49702F14812AED05E3252DB799946CB94

Uniqueness

Uniqueness Score: -1.00%

Function 007543D0 Relevance: 10.6, APIs: 7, Instructions: 97COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 007543F1
GetWindowRect.USER32(00000000,?), ref: 0075440B
GetDC.USER32(?), ref: 00754423
GetDeviceCaps.GDI32(00000000,00000008), ref: 0075442E
GetDeviceCaps.GDI32(00000000,0000000A), ref: 0075443A
ReleaseDC.USER32(?,00000000), ref: 00754447
SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,00000005,?,00000001), ref: 007544A2

Memory Dump Source

Source File: 00000000.00000002.2647217088.0000000000751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00750000, based on PE: true

Associated: 00000000.00000002.2647191730.0000000000750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647237467.0000000000758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_750000_14OWDrfahJ.jbxd

Similarity

API ID: Window$CapsDeviceRect$Release
String ID:
API String ID: 2212493051-0
Opcode ID: 7962b2af23160fcd11a38d91ecd0140e8af6fac4c139c2d5e61973f4e817020a
Instruction ID: d72c561849ce9ad0073ea70e3d93fcc11e6d02cc265a2b0cf1563f93849f30a8
Opcode Fuzzy Hash: 7962b2af23160fcd11a38d91ecd0140e8af6fac4c139c2d5e61973f4e817020a
Instruction Fuzzy Hash: B8315E32E00619AFCB14CFB8DD889EEBBB5EB89311F154269F905F3240DAB46C458B64

Uniqueness

Uniqueness Score: -1.00%

Function 00756298 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 90COMMON

Download Yara Rule

APIs

Part of subcall function 0075171E: _vsnprintf.MSVCRT ref: 00751750

LoadResource.KERNEL32(00000000,00000000,?,?,00000002,00000000,?,007551CA,00000004,00000024,00752F71,?,00000002,00000000), ref: 007562CD
LockResource.KERNEL32(00000000,?,?,00000002,00000000,?,007551CA,00000004,00000024,00752F71,?,00000002,00000000), ref: 007562D4
FreeResource.KERNEL32(00000000,?,?,00000002,00000000,?,007551CA,00000004,00000024,00752F71,?,00000002,00000000), ref: 0075631B
FindResourceA.KERNEL32(00000000,00000004,0000000A), ref: 00756345
FreeResource.KERNEL32(00000000,?,?,00000002,00000000,?,007551CA,00000004,00000024,00752F71,?,00000002,00000000), ref: 00756357

Strings

UPDFILE%lu, xrefs: 007562B3, 00756329

Memory Dump Source

Source File: 00000000.00000002.2647217088.0000000000751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00750000, based on PE: true

Associated: 00000000.00000002.2647191730.0000000000750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647237467.0000000000758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_750000_14OWDrfahJ.jbxd

Similarity

API ID: Resource$Free$FindLoadLock_vsnprintf
String ID: UPDFILE%lu
API String ID: 2922116661-2329316264
Opcode ID: 4ec382d0aacecbed1bea5b3b94916cacd465c25d446a4d5c9c5a35fee32efa96
Instruction ID: ce2d981a330c681b48974af33324399c876bbec22cf8544890ae1202bdfcef36
Opcode Fuzzy Hash: 4ec382d0aacecbed1bea5b3b94916cacd465c25d446a4d5c9c5a35fee32efa96
Instruction Fuzzy Hash: DC21F675A00219ABDB109F64CC499FF7B78FF48712B404229FD06A3241DBBD9D0A8BE5

Uniqueness

Uniqueness Score: -1.00%

Function 00753A3F Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 73memorystringCOMMON

Download Yara Rule

APIs

Part of subcall function 0075468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 007546A0
Part of subcall function 0075468F: SizeofResource.KERNEL32(00000000,00000000,?,00752D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 007546A9
Part of subcall function 0075468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 007546C3
Part of subcall function 0075468F: LoadResource.KERNEL32(00000000,00000000,?,00752D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 007546CC
Part of subcall function 0075468F: LockResource.KERNEL32(00000000,?,00752D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 007546D3
Part of subcall function 0075468F: memcpy_s.MSVCRT ref: 007546E5
Part of subcall function 0075468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 007546EF

LocalAlloc.KERNEL32(00000040,00000001,00000000,?,00000002,00000000,00752F64,?,00000002,00000000), ref: 00753A5D
LocalFree.KERNEL32(00000000,00000000,00000010,00000000,00000000), ref: 00753AB3

Part of subcall function 007544B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00754518
Part of subcall function 007544B9: MessageBoxA.USER32(?,?,smo,00010010), ref: 00754554

Part of subcall function 00756285: GetLastError.KERNEL32(00755BBC), ref: 00756285

lstrcmpA.KERNEL32(<None>,00000000), ref: 00753AD0
LocalFree.KERNEL32 ref: 00753B13

Part of subcall function 00756517: FindResourceA.KERNEL32(00750000,000007D6,00000005), ref: 0075652A
Part of subcall function 00756517: LoadResource.KERNEL32(00750000,00000000,?,?,00752EE8,00000000,007519E0,00000547,0000083E,?,?,?,?,?,?,?), ref: 00756538
Part of subcall function 00756517: DialogBoxIndirectParamA.USER32(00750000,00000000,00000547,007519E0,00000000), ref: 00756557
Part of subcall function 00756517: FreeResource.KERNEL32(00000000,?,?,00752EE8,00000000,007519E0,00000547,0000083E,?,?,?,?,?,?,?,00000002), ref: 00756560

LocalFree.KERNEL32(00000000,00753100,00000000,00000000), ref: 00753AF4

Strings

<None>, xrefs: 00753AC5
LICENSE, xrefs: 00753A46

Memory Dump Source

Source File: 00000000.00000002.2647217088.0000000000751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00750000, based on PE: true

Associated: 00000000.00000002.2647191730.0000000000750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647237467.0000000000758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_750000_14OWDrfahJ.jbxd

Similarity

API ID: Resource$Free$Local$FindLoad$AllocDialogErrorIndirectLastLockMessageParamSizeofStringlstrcmpmemcpy_s
String ID: <None>$LICENSE
API String ID: 2414642746-383193767
Opcode ID: 3281d3e5ec97e250960e6178a6c30baf83e168173cc9a4663465681a97255dd8
Instruction ID: 72836149def8d1df104e72664d4acd3d662e438d515da2684a3de8371078b22d
Opcode Fuzzy Hash: 3281d3e5ec97e250960e6178a6c30baf83e168173cc9a4663465681a97255dd8
Instruction Fuzzy Hash: 6B118170700305EBD7609B329C09ED779F9EBD9743B10C12EBA45E61B1EAFE88048669

Uniqueness

Uniqueness Score: -1.00%

Function 007524E0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104,00000000,00000000), ref: 00752506
WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,?), ref: 0075252C
_lopen.KERNEL32(?,00000040), ref: 0075253B
_llseek.KERNEL32(00000000,00000000,00000002), ref: 0075254C
_lclose.KERNEL32(00000000), ref: 00752555

Strings

wininit.ini, xrefs: 00752510

Memory Dump Source

Source File: 00000000.00000002.2647217088.0000000000751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00750000, based on PE: true

Associated: 00000000.00000002.2647191730.0000000000750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647237467.0000000000758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_750000_14OWDrfahJ.jbxd

Similarity

API ID: DirectoryPrivateProfileStringWindowsWrite_lclose_llseek_lopen
String ID: wininit.ini
API String ID: 3273605193-4206010578
Opcode ID: c255a5524ab0df547835a4e4a464727a332a08775a03849beedd305e31024895
Instruction ID: 0b12526f1e937076a8391cfaffe1f889d27f2d5682ec4e3659fe8e6a6c318c13
Opcode Fuzzy Hash: c255a5524ab0df547835a4e4a464727a332a08775a03849beedd305e31024895
Instruction Fuzzy Hash: 0E01B932700218B7D7209B659C0CEDF7B7CDB46752F404265FA49D31D0EEB84E45CA95

Uniqueness

Uniqueness Score: -1.00%

Function 007536EE Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 243windowCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,00000000,?,?), ref: 00753723
MessageBeep.USER32(00000000), ref: 007539C3
MessageBoxA.USER32(00000000,00000000,smo,00000030), ref: 007539F1

Strings

smo, xrefs: 007539E9, 00753A19
3, xrefs: 00753785

Memory Dump Source

Source File: 00000000.00000002.2647217088.0000000000751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00750000, based on PE: true

Associated: 00000000.00000002.2647191730.0000000000750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647237467.0000000000758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_750000_14OWDrfahJ.jbxd

Similarity

API ID: Message$BeepVersion
String ID: 3$smo
API String ID: 2519184315-1411035656
Opcode ID: f614394507cc88a7bf58cec704fee30415b97c59fca0d38c5787de62353d7118
Instruction ID: 4c5417912c33003a9da7aaee68beae60944ecfadfa411231dee6f00d1897e135
Opcode Fuzzy Hash: f614394507cc88a7bf58cec704fee30415b97c59fca0d38c5787de62353d7118
Instruction Fuzzy Hash: E191F8B1E012149FEB758B24CC817E973A0AB45386F1481A9EC49E7261DBFC9F89CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00756517 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(00750000,000007D6,00000005), ref: 0075652A
LoadResource.KERNEL32(00750000,00000000,?,?,00752EE8,00000000,007519E0,00000547,0000083E,?,?,?,?,?,?,?), ref: 00756538
DialogBoxIndirectParamA.USER32(00750000,00000000,00000547,007519E0,00000000), ref: 00756557
FreeResource.KERNEL32(00000000,?,?,00752EE8,00000000,007519E0,00000547,0000083E,?,?,?,?,?,?,?,00000002), ref: 00756560

Strings

.u, xrefs: 0075657C

Memory Dump Source

Source File: 00000000.00000002.2647217088.0000000000751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00750000, based on PE: true

Associated: 00000000.00000002.2647191730.0000000000750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647237467.0000000000758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_750000_14OWDrfahJ.jbxd

Similarity

API ID: Resource$DialogFindFreeIndirectLoadParam
String ID: .u
API String ID: 1214682469-3478722563
Opcode ID: 9d4dd18c0fc86a1483b54a6245779d39b4dd24e2cd251f1cda2b355d19114e7a
Instruction ID: 189726b4ac42cc221e94822eee66720ae9d17846ebe65bb6900138289b34bbab
Opcode Fuzzy Hash: 9d4dd18c0fc86a1483b54a6245779d39b4dd24e2cd251f1cda2b355d19114e7a
Instruction Fuzzy Hash: 05012672540709BBDB105FA99C48DFB7A6CEB85363F404229FE0493190EBF98D20C6A5

Uniqueness

Uniqueness Score: -1.00%

Function 00756495 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 41libraryCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,advpack.dll,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,00000000), ref: 007564DF
LoadLibraryExA.KERNEL32(?,00000000,00000008,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,00000000), ref: 007564F9
LoadLibraryA.KERNEL32(advpack.dll,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,00000000), ref: 00756502

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 007564AC
advpack.dll, xrefs: 007564C2, 007564CD, 00756501

Memory Dump Source

Source File: 00000000.00000002.2647217088.0000000000751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00750000, based on PE: true

Associated: 00000000.00000002.2647191730.0000000000750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647237467.0000000000758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_750000_14OWDrfahJ.jbxd

Similarity

API ID: LibraryLoad$AttributesFile
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\$advpack.dll
API String ID: 438848745-3680919256
Opcode ID: ef017f23394c671a49b934a115dc7b38d60f40c5cc7afe19b800c07dd8c1c287
Instruction ID: 2b83ad9e21824ee5aed4e33bd53034ac7f82f80314250f2bbba7455fa3158bf4
Opcode Fuzzy Hash: ef017f23394c671a49b934a115dc7b38d60f40c5cc7afe19b800c07dd8c1c287
Instruction Fuzzy Hash: 9301D670540208ABD750EB64DC49BEE7778DB54313F9002A9F989931C0EFF8AE8D8A51

Uniqueness

Uniqueness Score: -1.00%

Function 00754169 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0075468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 007546A0
Part of subcall function 0075468F: SizeofResource.KERNEL32(00000000,00000000,?,00752D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 007546A9
Part of subcall function 0075468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 007546C3
Part of subcall function 0075468F: LoadResource.KERNEL32(00000000,00000000,?,00752D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 007546CC
Part of subcall function 0075468F: LockResource.KERNEL32(00000000,?,00752D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 007546D3
Part of subcall function 0075468F: memcpy_s.MSVCRT ref: 007546E5
Part of subcall function 0075468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 007546EF

LocalAlloc.KERNEL32(00000040,?,00000000,00000000,00000105,00000000,007530B4), ref: 00754189
LocalFree.KERNEL32(00000000,?,00000000,00000000,00000105,00000000,007530B4), ref: 007541E7

Part of subcall function 007544B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00754518
Part of subcall function 007544B9: MessageBoxA.USER32(?,?,smo,00010010), ref: 00754554

Strings

FINISHMSG, xrefs: 00754173, 007541AB
<None>, xrefs: 007541C5

Memory Dump Source

Source File: 00000000.00000002.2647217088.0000000000751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00750000, based on PE: true

Associated: 00000000.00000002.2647191730.0000000000750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647237467.0000000000758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_750000_14OWDrfahJ.jbxd

Similarity

API ID: Resource$FindFreeLoadLocal$AllocLockMessageSizeofStringmemcpy_s
String ID: <None>$FINISHMSG
API String ID: 3507850446-3091758298
Opcode ID: 0a8e2c8dd397603749ed04d9923c2845ce05f6d2f44bec72552462d97ac68b3d
Instruction ID: 57aa4c8b4e9edef825470e948fc5fbaf9b874a5fff159c251038c840ce610251
Opcode Fuzzy Hash: 0a8e2c8dd397603749ed04d9923c2845ce05f6d2f44bec72552462d97ac68b3d
Instruction Fuzzy Hash: 7F01ADA1340618BBF72417654C9AFFB258EDB9479BF004139BF05E21849EECCC8941B9

Uniqueness

Uniqueness Score: -1.00%

Function 007519E0 Relevance: 7.6, APIs: 5, Instructions: 51windowCOMMON

Download Yara Rule

APIs

EndDialog.USER32(?,?), ref: 00751A18
GetDesktopWindow.USER32 ref: 00751A24
LoadStringA.USER32(?,?,00000200), ref: 00751A4F
SetDlgItemTextA.USER32(?,0000083F,00000000), ref: 00751A62
MessageBeep.USER32(000000FF), ref: 00751A6A

Memory Dump Source

Source File: 00000000.00000002.2647217088.0000000000751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00750000, based on PE: true

Associated: 00000000.00000002.2647191730.0000000000750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647237467.0000000000758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_750000_14OWDrfahJ.jbxd

Similarity

API ID: BeepDesktopDialogItemLoadMessageStringTextWindow
String ID:
API String ID: 1273765764-0
Opcode ID: a8b1925ab6fc812215bd696b4ea95177f12717a4708f291a478262c02d223992
Instruction ID: cfd8463579a50bfc0b2a586f6186acc0a7679312687a1cd56086755f1a96f33a
Opcode Fuzzy Hash: a8b1925ab6fc812215bd696b4ea95177f12717a4708f291a478262c02d223992
Instruction Fuzzy Hash: CF11C63150020DABDB01DF64DD08BED77B4EB05303F50C264E92292190CAB89E04CB95

Uniqueness

Uniqueness Score: -1.00%

Function 007563C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 69fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\), ref: 0075642D
WriteFile.KERNEL32(00000000,?,?,00000000,00000000,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\), ref: 0075645B
CloseHandle.KERNEL32(00000000,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\), ref: 0075647A

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 007563EB

Memory Dump Source

Source File: 00000000.00000002.2647217088.0000000000751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00750000, based on PE: true

Associated: 00000000.00000002.2647191730.0000000000750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647237467.0000000000758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_750000_14OWDrfahJ.jbxd

Similarity

API ID: File$CloseCreateHandleWrite
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\
API String ID: 1065093856-305352358
Opcode ID: fd7342cf4ae4679d4c88be7786fa6f65faadd57ac0e7f97d5d8ff06c311a8db3
Instruction ID: 1469074168f9210cbcdba83828367d0b0197c046a5bcba36f2ada1cf993e97c2
Opcode Fuzzy Hash: fd7342cf4ae4679d4c88be7786fa6f65faadd57ac0e7f97d5d8ff06c311a8db3
Instruction Fuzzy Hash: FF21A571A0021CEBDB10DF25DC85FEB7778EB45316F104269F995A3180DAF85E898F64

Uniqueness

Uniqueness Score: -1.00%

Function 007547E0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000008,?,00000000,00754E6F), ref: 007547EA
LocalAlloc.KERNEL32(00000040,?), ref: 00754823
LocalFree.KERNEL32(00000000,00000000,00000000,00000010,00000000), ref: 00754847

Part of subcall function 007544B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00754518
Part of subcall function 007544B9: MessageBoxA.USER32(?,?,smo,00010010), ref: 00754554

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00754851

Memory Dump Source

Source File: 00000000.00000002.2647217088.0000000000751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00750000, based on PE: true

Associated: 00000000.00000002.2647191730.0000000000750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647237467.0000000000758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_750000_14OWDrfahJ.jbxd

Similarity

API ID: Local$Alloc$FreeLoadMessageString
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\
API String ID: 359063898-305352358
Opcode ID: 5d3ef7dcfaa194421c00ba908989b5342c32b9f3031acf7f64364a54067207f3
Instruction ID: cbdcb5fa3425df1fd1099b234c38c99211c206294a5d05c781288a43d2a07c71
Opcode Fuzzy Hash: 5d3ef7dcfaa194421c00ba908989b5342c32b9f3031acf7f64364a54067207f3
Instruction Fuzzy Hash: 77115974200B41AFEB148F349C0CFF63BAAEB85306F04C518FE4297340DABD9C4A8660

Uniqueness

Uniqueness Score: -1.00%

Function 00753680 Relevance: 6.1, APIs: 4, Instructions: 51windowCOMMON

Download Yara Rule

APIs

MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000004FF), ref: 0075369F
PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 007536B2
DispatchMessageA.USER32(?), ref: 007536CB
PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 007536DA

Memory Dump Source

Source File: 00000000.00000002.2647217088.0000000000751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00750000, based on PE: true

Associated: 00000000.00000002.2647191730.0000000000750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647237467.0000000000758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_750000_14OWDrfahJ.jbxd

Similarity

API ID: Message$Peek$DispatchMultipleObjectsWait
String ID:
API String ID: 2776232527-0
Opcode ID: b2df640544deeb56c5cc13902751273a05dc45dca588a529395b386614a3977d
Instruction ID: 240ce243c3b27d6685b96ed84c66f7da9adf2a13167f223c793c7e7432dd3e6b
Opcode Fuzzy Hash: b2df640544deeb56c5cc13902751273a05dc45dca588a529395b386614a3977d
Instruction Fuzzy Hash: D501A77290021977DB304BA65C48EEB7B7CEBC5B52F00022DFE05E2190D5E9CA44C675

Uniqueness

Uniqueness Score: -1.00%

Function 007565E8 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

CharPrevA.USER32(?,00000000,00000000,00000001,00000000,00752B33), ref: 00756602
CharPrevA.USER32(?,00000000), ref: 00756612
CharPrevA.USER32(?,00000000), ref: 00756629
CharNextA.USER32(00000000), ref: 00756635

Memory Dump Source

Source File: 00000000.00000002.2647217088.0000000000751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00750000, based on PE: true

Associated: 00000000.00000002.2647191730.0000000000750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647237467.0000000000758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_750000_14OWDrfahJ.jbxd

Similarity

API ID: Char$Prev$Next
String ID:
API String ID: 3260447230-0
Opcode ID: fda73ce311a36b9cc3ce0cf4ca1b5c7c39f875a5aed6848e61e5f4986ba61a26
Instruction ID: 268461f42e8ce839cc905e75d44b1304301af7d833e7573ed9615a7c2d477d5b
Opcode Fuzzy Hash: fda73ce311a36b9cc3ce0cf4ca1b5c7c39f875a5aed6848e61e5f4986ba61a26
Instruction Fuzzy Hash: 10F0F9715045507FD7321B284C888FBAFACCB97357B59427FE99183001D6DD0D0A8661

Uniqueness

Uniqueness Score: -1.00%

Function 007569B0 Relevance: 6.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

Part of subcall function 00756FBE: GetModuleHandleW.KERNEL32(00000000), ref: 00756FC5

__set_app_type.MSVCRT ref: 007569C2
__p__fmode.MSVCRT ref: 007569D8
__p__commode.MSVCRT ref: 007569E6
__setusermatherr.MSVCRT ref: 00756A07

Memory Dump Source

Source File: 00000000.00000002.2647217088.0000000000751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00750000, based on PE: true

Associated: 00000000.00000002.2647191730.0000000000750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647237467.0000000000758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_750000_14OWDrfahJ.jbxd

Similarity

API ID: HandleModule__p__commode__p__fmode__set_app_type__setusermatherr
String ID:
API String ID: 1632413811-0
Opcode ID: 6b0a2e0a2542cf5a22ce75b6acd72d4dee50c6e643adbc4fc3ceaa4b5095059e
Instruction ID: 7a9aa4820bdf556f6d9106944e29c76238efe70967bd9d662f73ffdbb27e8a94
Opcode Fuzzy Hash: 6b0a2e0a2542cf5a22ce75b6acd72d4dee50c6e643adbc4fc3ceaa4b5095059e
Instruction Fuzzy Hash: 69F0DA70508301DFC7986B30AD0F6893BA1F744333B508619E862962E1DFFE9559CA1A

Uniqueness

Uniqueness Score: -1.00%

Function 00756952 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

GetDiskFreeSpaceA.KERNEL32(0000005A,?,?,`Wu,?,00000000,00755760,?,A:\), ref: 0075697F
MulDiv.KERNEL32(?,?,00000400), ref: 00756999

Strings

`Wu, xrefs: 00756972, 00756975

Memory Dump Source

Source File: 00000000.00000002.2647217088.0000000000751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00750000, based on PE: true

Associated: 00000000.00000002.2647191730.0000000000750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647237467.0000000000758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2647256102.000000000075C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_750000_14OWDrfahJ.jbxd

Similarity

API ID: DiskFreeSpace
String ID: `Wu
API String ID: 1705453755-1644387346
Opcode ID: e0e046413bb4f3e78984a4ec4ff504bd3e388ea5c553aaf6ecacc1da5309d19d
Instruction ID: 024942673336aad30793636c80f078c87edd45a01dd794bdb6cd4a52c358271d
Opcode Fuzzy Hash: e0e046413bb4f3e78984a4ec4ff504bd3e388ea5c553aaf6ecacc1da5309d19d
Instruction Fuzzy Hash: D8F0FF76D0022CBBCB11DFD8CC44ADEBBBCEB48701F504296E910E3240DB759A048BD1

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: Ey3OF47.exePID: 7312, Parent PID: 7296COMMON

Execution Graph

Execution Coverage:	29.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	961
Total number of Limit Nodes:	26

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00013BA2 Relevance: 40.6, APIs: 11, Strings: 12, Instructions: 308
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00013C11
CompareStringA.KERNEL32(0000007F,00000001,?,000000FF,<None>,000000FF,00000104,00000004), ref: 00013CDC

Part of subcall function 0001468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 000146A0
Part of subcall function 0001468F: SizeofResource.KERNEL32(00000000,00000000,?,00012D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 000146A9
Part of subcall function 0001468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 000146C3
Part of subcall function 0001468F: LoadResource.KERNEL32(00000000,00000000,?,00012D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 000146CC
Part of subcall function 0001468F: LockResource.KERNEL32(00000000,?,00012D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 000146D3
Part of subcall function 0001468F: memcpy_s.MSVCRT ref: 000146E5
Part of subcall function 0001468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 000146EF

CompareStringA.KERNEL32(0000007F,00000001,?,000000FF,<None>,000000FF,00000104,?,00018C42), ref: 00013D8F
GetProcAddress.KERNEL32(00000000,DoInfInstall), ref: 00013E26
FreeLibrary.KERNEL32(00000000,?,00018C42), ref: 00013EFF
LocalFree.KERNEL32(?,?,?,?,00018C42), ref: 00013F1F
FreeLibrary.KERNEL32(00000000,?,00018C42), ref: 00013F40
LocalFree.KERNEL32(?,?,?,?,00018C42), ref: 00013F47
FreeLibrary.KERNEL32(00000000,DoInfInstall,00000000,00000010,00000000,?,00018C42), ref: 00013F76
LocalFree.KERNEL32(?,advpack.dll,00000000,00000010,00000000,?,?,?,00018C42), ref: 00013F80
LocalFree.KERNEL32(?,00000000,00000000,00000010,00000000,?,?,?,00018C42), ref: 00013FC2

Strings

POSTRUNPROGRAM, xrefs: 00013D60
C:\Users\user\AppData\Local\Temp\IXP001.TMP\, xrefs: 00013E74
DoInfInstall, xrefs: 00013E1F, 00013E24, 00013F68
REBOOT, xrefs: 00013BE2
USRQCMD, xrefs: 00013CAD
<None>, xrefs: 00013CC9, 00013D7D
D, xrefs: 00013C19
advpack.dll, xrefs: 00013F9D
RUNPROGRAM, xrefs: 00013D05
SHOWWINDOW, xrefs: 00013C34
ADMQCMD, xrefs: 00013C9E
smo, xrefs: 00013E68

Memory Dump Source

Source File: 00000001.00000002.2614761400.0000000000011000.00000020.00000001.01000000.00000004.sdmp, Offset: 00010000, based on PE: true

Associated: 00000001.00000002.2614739685.0000000000010000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614782170.0000000000018000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000_Ey3OF47.jbxd

Similarity

API ID: Free$Resource$Local$Library$CompareFindString$AddressLoadLockProcSizeofmemcpy_smemset
String ID: <None>$ADMQCMD$C:\Users\user\AppData\Local\Temp\IXP001.TMP\$D$DoInfInstall$POSTRUNPROGRAM$REBOOT$RUNPROGRAM$SHOWWINDOW$USRQCMD$advpack.dll$smo
API String ID: 1032054927-3762544297
Opcode ID: 13d4ae2ffe3d07a20ce5f469ba6df89c4798205b77d10b92885e17dba4c734b8
Instruction ID: bc2a735f0d3779d55ab170ab4ff5a7f132aee5263945acfe46b0c83b151614a8
Opcode Fuzzy Hash: 13d4ae2ffe3d07a20ce5f469ba6df89c4798205b77d10b92885e17dba4c734b8
Instruction Fuzzy Hash: A4B1E070A083019BE764DF24E845BEB76E5EB85700F10892DFA85D71E1DB78CAC5CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00011AE8 Relevance: 38.8, APIs: 10, Strings: 12, Instructions: 291
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CompareStringA.KERNEL32(0000007F,00000001,00000000,000000FF,.INF,000000FF,?,?,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,?,?,00000000,00000001,00000000), ref: 00011BE7
GetFileAttributesA.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,?,?,00000000,00000001,00000000), ref: 00011BFE
LocalAlloc.KERNEL32(00000040,00000200,?,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,?,?,00000000,00000001,00000000), ref: 00011C57
GetPrivateProfileIntA.KERNEL32(?,Reboot,00000000,?), ref: 00011C88
GetPrivateProfileStringA.KERNEL32(Version,AdvancedINF,00011140,00000000,00000008,?), ref: 00011CB8
GetShortPathNameA.KERNEL32(?,?,00000104), ref: 00011D1B

Part of subcall function 000144B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00014518
Part of subcall function 000144B9: MessageBoxA.USER32(?,?,smo,00010010), ref: 00014554

Strings

Command.com /c %s, xrefs: 00011D9B, 00011DE8
C:\Users\user\AppData\Local\Temp\IXP001.TMP\, xrefs: 00011BA0
setupapi.dll, xrefs: 00011D23, 00011D3A
.BAT, xrefs: 00011D83
rundll32.exe %s,InstallHinfSection %s 128 %s, xrefs: 00011D3B
DefaultInstall, xrefs: 00011C74, 00011C87, 00011CCE, 00011CD3, 00011D2D, 00011D39
Version, xrefs: 00011CB3
Reboot, xrefs: 00011C82
.INF, xrefs: 00011BDB
AdvancedINF, xrefs: 00011CAE
setupx.dll, xrefs: 00011D14
", xrefs: 00011B25

Memory Dump Source

Source File: 00000001.00000002.2614761400.0000000000011000.00000020.00000001.01000000.00000004.sdmp, Offset: 00010000, based on PE: true

Associated: 00000001.00000002.2614739685.0000000000010000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614782170.0000000000018000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000_Ey3OF47.jbxd

Similarity

API ID: String$PrivateProfile$AllocAttributesCompareFileLoadLocalMessageNamePathShort
String ID: "$.BAT$.INF$AdvancedINF$C:\Users\user\AppData\Local\Temp\IXP001.TMP\$Command.com /c %s$DefaultInstall$Reboot$Version$rundll32.exe %s,InstallHinfSection %s 128 %s$setupapi.dll$setupx.dll
API String ID: 383838535-819679500
Opcode ID: d9efc81146bbef27f4bb913e41b778efc32eca552772db64e4c46c48676ad1e3
Instruction ID: f478fb531c7f694540cccaa9978ea6b251f191eb889674a7ada136108e960326
Opcode Fuzzy Hash: d9efc81146bbef27f4bb913e41b778efc32eca552772db64e4c46c48676ad1e3
Instruction Fuzzy Hash: A7A17AB0A042186BEB689B24DC45FEA77A9EF45310F144294F795A32C1DBB49EC6CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00012F1D Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 120
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryA.KERNEL32(?,00000105), ref: 00012F93
LoadLibraryA.KERNEL32(?,advapi32.dll), ref: 00012FB2
GetProcAddress.KERNEL32(00000000,DecryptFileA), ref: 00012FC6
DecryptFileA.ADVAPI32 ref: 00012FE6
FreeLibrary.KERNEL32(00000000), ref: 00012FF8
SetCurrentDirectoryA.KERNELBASE(C:\Users\user\AppData\Local\Temp\IXP001.TMP\), ref: 0001301C

Part of subcall function 000151E5: LocalAlloc.KERNEL32(00000040,00000001,00000000,?,00000002,00000000,00012F4D,?,00000002,00000000), ref: 00015201

Strings

C:\Users\user\AppData\Local\Temp\IXP001.TMP\, xrefs: 00012FDB, 00013017
advapi32.dll, xrefs: 00012F99
DecryptFileA, xrefs: 00012FC0

Memory Dump Source

Source File: 00000001.00000002.2614761400.0000000000011000.00000020.00000001.01000000.00000004.sdmp, Offset: 00010000, based on PE: true

Associated: 00000001.00000002.2614739685.0000000000010000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614782170.0000000000018000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000_Ey3OF47.jbxd

Similarity

API ID: DirectoryLibrary$AddressAllocCurrentDecryptFileFreeLoadLocalProcSystem
String ID: C:\Users\user\AppData\Local\Temp\IXP001.TMP\$DecryptFileA$advapi32.dll
API String ID: 2126469477-3023407756
Opcode ID: 3b15c55620060d9c058f2f4722169fd00f3553706eb978ffe59ba36eb6347378
Instruction ID: de2cfa715fcf1a5119a27c96ffa6518ffdd355b7fca865f2081c3df58d695955
Opcode Fuzzy Hash: 3b15c55620060d9c058f2f4722169fd00f3553706eb978ffe59ba36eb6347378
Instruction Fuzzy Hash: 5241A531A002059BFB72AB71AC556E673F9AF48750F408179EA41C2192EB78CFC4CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00012390 Relevance: 12.1, APIs: 8, Instructions: 93
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileA.KERNELBASE(?,00018A3A,000111F4,00018A3A,00000000,?,?), ref: 000123F6
lstrcmpA.KERNEL32(?,000111F8), ref: 00012427
lstrcmpA.KERNEL32(?,000111FC), ref: 0001243B
SetFileAttributesA.KERNEL32(?,00000080,?), ref: 00012495
DeleteFileA.KERNEL32(?), ref: 000124A3
FindNextFileA.KERNELBASE(00000000,00000010), ref: 000124AF
FindClose.KERNELBASE(00000000), ref: 000124BE
RemoveDirectoryA.KERNELBASE(00018A3A), ref: 000124C5

Memory Dump Source

Source File: 00000001.00000002.2614761400.0000000000011000.00000020.00000001.01000000.00000004.sdmp, Offset: 00010000, based on PE: true

Associated: 00000001.00000002.2614739685.0000000000010000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614782170.0000000000018000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000_Ey3OF47.jbxd

Similarity

API ID: File$Find$lstrcmp$AttributesCloseDeleteDirectoryFirstNextRemove
String ID:
API String ID: 836429354-0
Opcode ID: 5fadaf4abfc274cafbb755e78abaa4275a9419866f77df4dce5efc686f18587e
Instruction ID: 598d08efb04413fbfe67284edfbdebb3394ebfbfb760013a0fcca27e032a0a29
Opcode Fuzzy Hash: 5fadaf4abfc274cafbb755e78abaa4275a9419866f77df4dce5efc686f18587e
Instruction Fuzzy Hash: 4A31C731305740ABD325DBA4CC89AEBB3ECAFC9305F04492DB655C7191EB38998DC752

Uniqueness

Uniqueness Score: -1.00%

Function 00012BFB Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 63libraryloaderCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(?,00000002,00000000,?,00016BB0,00010000,00000000,00000002,0000000A), ref: 00012C03
GetModuleHandleW.KERNEL32(Kernel32.dll,?,00016BB0,00010000,00000000,00000002,0000000A), ref: 00012C18
GetProcAddress.KERNEL32(00000000,HeapSetInformation), ref: 00012C28
CloseHandle.KERNEL32(00000000,?,?,00016BB0,00010000,00000000,00000002,0000000A), ref: 00012C98

Strings

Kernel32.dll, xrefs: 00012C13
HeapSetInformation, xrefs: 00012C22

Memory Dump Source

Source File: 00000001.00000002.2614761400.0000000000011000.00000020.00000001.01000000.00000004.sdmp, Offset: 00010000, based on PE: true

Associated: 00000001.00000002.2614739685.0000000000010000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614782170.0000000000018000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000_Ey3OF47.jbxd

Similarity

API ID: Handle$AddressCloseModuleProcVersion
String ID: HeapSetInformation$Kernel32.dll
API String ID: 62482547-3460614246
Opcode ID: 97852e7719cfaec14df5ee150d48d7e489aed108ab41d5d01db92665d7f8eff1
Instruction ID: 2cac823cbaaa6a76787c4c2c07d35984bc8ec9d3813471a46231611d1dda10df
Opcode Fuzzy Hash: 97852e7719cfaec14df5ee150d48d7e489aed108ab41d5d01db92665d7f8eff1
Instruction Fuzzy Hash: 55110C317013056BE7217BB5AC58AEF37E99B89794B048025FB04D7251DA39DCD1CAE1

Uniqueness

Uniqueness Score: -1.00%

Function 0001202A Relevance: 42.2, APIs: 16, Strings: 8, Instructions: 185
registrylibrarymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00012050
memset.MSVCRT ref: 0001205F
RegCreateKeyExA.KERNELBASE(80000002,Software\Microsoft\Windows\CurrentVersion\RunOnce,00000000,00000000,00000000,0002001F,00000000,?,?,?,?,?,?,00000000,00000000), ref: 0001208C

Part of subcall function 0001171E: _vsnprintf.MSVCRT ref: 00011750

RegQueryValueExA.KERNELBASE(?,wextract_cleanup1,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 000120C9
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 000120EA
GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00012103
LoadLibraryA.KERNELBASE(?,advpack.dll,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00012122
GetProcAddress.KERNEL32(00000000,DelNodeRunDLL32), ref: 00012134
FreeLibrary.KERNELBASE(00000000,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00012144
GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0001215B
GetModuleFileNameA.KERNEL32(?,00000104,?,?,?,?,?,?,?,?,00000000,00000000), ref: 0001218C
LocalAlloc.KERNEL32(00000040,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 000121C1
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 000121E4
RegSetValueExA.KERNELBASE(?,wextract_cleanup1,00000000,00000001,00000000,00000002,?,?,?,?,?,?,?,?,?), ref: 0001223D
RegCloseKey.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00012249
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00012250

Strings

C:\Users\user\AppData\Local\Temp\IXP001.TMP\, xrefs: 000121A8, 00012204
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 00012082
%s /D:%s, xrefs: 000121FF, 00012210
DelNodeRunDLL32, xrefs: 0001212E
advpack.dll, xrefs: 00012109
rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s", xrefs: 000121F6
wextract_cleanup%d, xrefs: 0001209E
wextract_cleanup1, xrefs: 000120A5, 000120BE, 000120F0, 00012232

Memory Dump Source

Source File: 00000001.00000002.2614761400.0000000000011000.00000020.00000001.01000000.00000004.sdmp, Offset: 00010000, based on PE: true

Associated: 00000001.00000002.2614739685.0000000000010000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614782170.0000000000018000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000_Ey3OF47.jbxd

Similarity

API ID: Close$DirectoryFreeLibraryLocalSystemValuememset$AddressAllocCreateFileLoadModuleNameProcQuery_vsnprintf
String ID: %s /D:%s$C:\Users\user\AppData\Local\Temp\IXP001.TMP\$DelNodeRunDLL32$Software\Microsoft\Windows\CurrentVersion\RunOnce$advpack.dll$rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s"$wextract_cleanup%d$wextract_cleanup1
API String ID: 178549006-217856272
Opcode ID: f609d328378ea1cbf63f7bd42d6acafb0d45f75c2fe8d36423531960f52209a8
Instruction ID: fd6b60bf8fb759e12680741886a6e74acb6856e49a3cab13c685cbd76fbda9f9
Opcode Fuzzy Hash: f609d328378ea1cbf63f7bd42d6acafb0d45f75c2fe8d36423531960f52209a8
Instruction Fuzzy Hash: 2F513471A00218BBEB229B60DC49FFA777CEF59700F0081A4FA49E7151DA759EC98B60

Uniqueness

Uniqueness Score: -1.00%

Function 000155A0 Relevance: 31.7, APIs: 12, Strings: 6, Instructions: 248
memorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0001468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 000146A0
Part of subcall function 0001468F: SizeofResource.KERNEL32(00000000,00000000,?,00012D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 000146A9
Part of subcall function 0001468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 000146C3
Part of subcall function 0001468F: LoadResource.KERNEL32(00000000,00000000,?,00012D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 000146CC
Part of subcall function 0001468F: LockResource.KERNEL32(00000000,?,00012D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 000146D3
Part of subcall function 0001468F: memcpy_s.MSVCRT ref: 000146E5
Part of subcall function 0001468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 000146EF

LocalAlloc.KERNEL32(00000040,00000001,00000000,?,00000002,00000000), ref: 000155CF
lstrcmpA.KERNEL32(00000000,<None>,00000000), ref: 00015638
LocalFree.KERNEL32(00000000), ref: 0001564C
LocalFree.KERNEL32(00000000,00000000,00000000,00000010,00000000,00000000), ref: 00015620

Part of subcall function 000144B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00014518
Part of subcall function 000144B9: MessageBoxA.USER32(?,?,smo,00010010), ref: 00014554

Part of subcall function 00016285: GetLastError.KERNEL32(00015BBC), ref: 00016285

GetTempPathA.KERNEL32(00000104,C:\Users\user\AppData\Local\Temp\IXP001.TMP\), ref: 000156B9
GetDriveTypeA.KERNEL32(0000005A,?,A:\), ref: 0001571E
GetFileAttributesA.KERNEL32(0000005A,?,A:\), ref: 00015737
GetWindowsDirectoryA.KERNEL32(0000005A,00000104,00000000,?,A:\), ref: 000157CD
GetFileAttributesA.KERNEL32(0000005A,msdownld.tmp,00000000,?,A:\), ref: 000157EF
CreateDirectoryA.KERNEL32(0000005A,00000000,?,A:\), ref: 00015802

Part of subcall function 00012630: GetWindowsDirectoryA.KERNEL32(?,00000104,00000000), ref: 00012654

SetFileAttributesA.KERNEL32(0000005A,00000002,?,A:\), ref: 00015830

Part of subcall function 00016517: FindResourceA.KERNEL32(00010000,000007D6,00000005), ref: 0001652A
Part of subcall function 00016517: LoadResource.KERNEL32(00010000,00000000,?,?,00012EE8,00000000,000119E0,00000547,0000083E,?,?,?,?,?,?,?), ref: 00016538
Part of subcall function 00016517: DialogBoxIndirectParamA.USER32(00010000,00000000,00000547,000119E0,00000000), ref: 00016557
Part of subcall function 00016517: FreeResource.KERNEL32(00000000,?,?,00012EE8,00000000,000119E0,00000547,0000083E,?,?,?,?,?,?,?,00000002), ref: 00016560

GetWindowsDirectoryA.KERNEL32(0000005A,00000104,?,A:\), ref: 00015878

Part of subcall function 0001597D: GetCurrentDirectoryA.KERNEL32(00000104,?,00000000,00000000), ref: 000159A8
Part of subcall function 0001597D: SetCurrentDirectoryA.KERNELBASE(?), ref: 000159AF

Strings

C:\Users\user\AppData\Local\Temp\IXP001.TMP\, xrefs: 000156AE, 000156B3, 0001583D
A:\, xrefs: 000156F4
Z, xrefs: 0001570A
<None>, xrefs: 00015632
RUNPROGRAM, xrefs: 000155BD, 00015600
msdownld.tmp, xrefs: 000157D3

Memory Dump Source

Source File: 00000001.00000002.2614761400.0000000000011000.00000020.00000001.01000000.00000004.sdmp, Offset: 00010000, based on PE: true

Associated: 00000001.00000002.2614739685.0000000000010000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614782170.0000000000018000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000_Ey3OF47.jbxd

Similarity

API ID: Resource$Directory$Free$AttributesFileFindLoadLocalWindows$Current$AllocCreateDialogDriveErrorIndirectLastLockMessageParamPathSizeofStringTempTypelstrcmpmemcpy_s
String ID: <None>$A:\$C:\Users\user\AppData\Local\Temp\IXP001.TMP\$RUNPROGRAM$Z$msdownld.tmp
API String ID: 2436801531-1384155332
Opcode ID: 770e267256f15c28cf3c8d6e8e58b03ebf3969db229aeae56a3e9224a9cc5085
Instruction ID: 82a244638db8aed820118cb2d6a41c3c201b624401b54a9b45ce2bc6c02d10c9
Opcode Fuzzy Hash: 770e267256f15c28cf3c8d6e8e58b03ebf3969db229aeae56a3e9224a9cc5085
Instruction Fuzzy Hash: DF817B70B04A04DBEB61AB709C95BFE72ADAFD5305F004065F586EB1D2EF788EC18A51

Uniqueness

Uniqueness Score: -1.00%

Function 00012CAA Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 183
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00012CD9
memset.MSVCRT ref: 00012CE9
memset.MSVCRT ref: 00012CF9

Part of subcall function 0001468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 000146A0
Part of subcall function 0001468F: SizeofResource.KERNEL32(00000000,00000000,?,00012D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 000146A9
Part of subcall function 0001468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 000146C3
Part of subcall function 0001468F: LoadResource.KERNEL32(00000000,00000000,?,00012D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 000146CC
Part of subcall function 0001468F: LockResource.KERNEL32(00000000,?,00012D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 000146D3
Part of subcall function 0001468F: memcpy_s.MSVCRT ref: 000146E5
Part of subcall function 0001468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 000146EF

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00012D34
SetEvent.KERNEL32(00000000,?,?,?,?,?,?,?,00000002,00000000), ref: 00012D40
CreateMutexA.KERNEL32(00000000,00000001,?,00000104,00000004,?,?,?,?,?,?,?,00000002,00000000), ref: 00012DAE
GetLastError.KERNEL32(?,?,?,?,?,?,?,00000002,00000000), ref: 00012DBD
CloseHandle.KERNEL32(smo,00000000,00000020,00000004,?,?,?,?,?,?,?,00000002,00000000), ref: 00012E0A

Part of subcall function 000144B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00014518
Part of subcall function 000144B9: MessageBoxA.USER32(?,?,smo,00010010), ref: 00014554

Strings

VERCHECK, xrefs: 00012E54
INSTANCECHECK, xrefs: 00012D95
TITLE, xrefs: 00012D09
smo, xrefs: 00012D04, 00012DD9, 00012DF0
EXTRACTOPT, xrefs: 00012D4D

Memory Dump Source

Source File: 00000001.00000002.2614761400.0000000000011000.00000020.00000001.01000000.00000004.sdmp, Offset: 00010000, based on PE: true

Associated: 00000001.00000002.2614739685.0000000000010000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614782170.0000000000018000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000_Ey3OF47.jbxd

Similarity

API ID: Resource$memset$CreateEventFindLoad$CloseErrorFreeHandleLastLockMessageMutexSizeofStringmemcpy_s
String ID: EXTRACTOPT$INSTANCECHECK$TITLE$VERCHECK$smo
API String ID: 1002816675-4137116347
Opcode ID: 3974a2e8c4b7966d827b40908e848c43c270ea2e2d9f1506d063e114789a23b2
Instruction ID: 378ba0ef396c4ceb52fbece2ce5b7fc9e5210fcb399dd5afcd7d6e460d863406
Opcode Fuzzy Hash: 3974a2e8c4b7966d827b40908e848c43c270ea2e2d9f1506d063e114789a23b2
Instruction Fuzzy Hash: 4751D5707403016BF764A7209C5ABFA36D9EB46704F508039FA45D61E2DBBC89E2C766

Uniqueness

Uniqueness Score: -1.00%

Function 0001597D Relevance: 19.7, APIs: 13, Instructions: 212
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryA.KERNEL32(00000104,?,00000000,00000000), ref: 000159A8
SetCurrentDirectoryA.KERNELBASE(?), ref: 000159AF
GetDiskFreeSpaceA.KERNELBASE(00000000,?,?,?,?,00000001), ref: 00015A13
MulDiv.KERNEL32(?,?,00000400), ref: 00015A40
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 00015A64
memset.MSVCRT ref: 00015A7C
GetLastError.KERNEL32(00000000,?,00000200,00000000), ref: 00015A98
FormatMessageA.KERNEL32(00001000,00000000,00000000), ref: 00015AA5
SetCurrentDirectoryA.KERNEL32(?,?,?,00000010,00000000), ref: 00015BFC

Part of subcall function 000144B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00014518
Part of subcall function 000144B9: MessageBoxA.USER32(?,?,smo,00010010), ref: 00014554

Part of subcall function 00016285: GetLastError.KERNEL32(00015BBC), ref: 00016285

Memory Dump Source

Source File: 00000001.00000002.2614761400.0000000000011000.00000020.00000001.01000000.00000004.sdmp, Offset: 00010000, based on PE: true

Associated: 00000001.00000002.2614739685.0000000000010000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614782170.0000000000018000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000_Ey3OF47.jbxd

Similarity

API ID: CurrentDirectory$ErrorLastMessage$DiskFormatFreeInformationLoadSpaceStringVolumememset
String ID:
API String ID: 4237285672-0
Opcode ID: 541736618a84f3e86ca8866dafd020c4522ad734c7013ae105a5e7359b70505e
Instruction ID: 4f33157d501fc4d4479387d7c629403137ead844119f5f39c27cea577bef65c9
Opcode Fuzzy Hash: 541736618a84f3e86ca8866dafd020c4522ad734c7013ae105a5e7359b70505e
Instruction Fuzzy Hash: E07182B1A0160CAFEB669F60CCC5BFA77BCEB88341F5481A9F40596181DB349EC58B61

Uniqueness

Uniqueness Score: -1.00%

Function 00014FE0 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 121
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0001468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 000146A0
Part of subcall function 0001468F: SizeofResource.KERNEL32(00000000,00000000,?,00012D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 000146A9
Part of subcall function 0001468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 000146C3
Part of subcall function 0001468F: LoadResource.KERNEL32(00000000,00000000,?,00012D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 000146CC
Part of subcall function 0001468F: LockResource.KERNEL32(00000000,?,00012D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 000146D3
Part of subcall function 0001468F: memcpy_s.MSVCRT ref: 000146E5
Part of subcall function 0001468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 000146EF

FindResourceA.KERNEL32(00000000,CABINET,0000000A), ref: 00014FFE
LoadResource.KERNEL32(00000000,00000000), ref: 00015006
LockResource.KERNEL32(00000000), ref: 0001500D
GetDlgItem.USER32(00000000,00000842), ref: 00015030
ShowWindow.USER32(00000000), ref: 00015037
GetDlgItem.USER32(00000841,00000005), ref: 0001504A
ShowWindow.USER32(00000000), ref: 00015051
FreeResource.KERNEL32(00000000,00000000,00000010,00000000), ref: 00015111
SendMessageA.USER32(00000FA1,00000000,00000000,00000000), ref: 00015159

Strings

*MEMCAB, xrefs: 000150C7
CABINET, xrefs: 00014FE6, 00014FF7

Memory Dump Source

Source File: 00000001.00000002.2614761400.0000000000011000.00000020.00000001.01000000.00000004.sdmp, Offset: 00010000, based on PE: true

Associated: 00000001.00000002.2614739685.0000000000010000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614782170.0000000000018000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000_Ey3OF47.jbxd

Similarity

API ID: Resource$Find$FreeItemLoadLockShowWindow$MessageSendSizeofmemcpy_s
String ID: *MEMCAB$CABINET
API String ID: 1305606123-2642027498
Opcode ID: eb251b7f0cea8598dad2a09de0f412877f74ecbe8fae53838baff9c739cb5e56
Instruction ID: 583f6cb9ed06ea5485322380383c0d96a75c66a75965c3b2bf3b9a4dc9a34905
Opcode Fuzzy Hash: eb251b7f0cea8598dad2a09de0f412877f74ecbe8fae53838baff9c739cb5e56
Instruction Fuzzy Hash: 8A31D8B1741701BBF7615B61ADC9FE73A9CFB49755F048014FA01AA1A1DBBC8CC08661

Uniqueness

Uniqueness Score: -1.00%

Function 000144B9 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 160
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00014518
MessageBoxA.USER32(?,?,smo,00010010), ref: 00014554
LocalAlloc.KERNEL32(00000040,00000065), ref: 000145A3
LocalAlloc.KERNEL32(00000040,00000065), ref: 000145E3
LocalAlloc.KERNEL32(00000040,00000002), ref: 0001460D
MessageBeep.USER32(00000000), ref: 00014630
MessageBoxA.USER32(?,00000000,smo,00000000), ref: 00014666
LocalFree.KERNEL32(00000000), ref: 0001466F

Part of subcall function 0001681F: GetVersionExA.KERNEL32(?,00000000,00000002), ref: 0001686E
Part of subcall function 0001681F: GetSystemMetrics.USER32(0000004A), ref: 000168A7
Part of subcall function 0001681F: RegOpenKeyExA.ADVAPI32(80000001,Control Panel\Desktop\ResourceLocale,00000000,00020019,?), ref: 000168CC
Part of subcall function 0001681F: RegQueryValueExA.ADVAPI32(?,00011140,00000000,?,?,0000000C), ref: 000168F4
Part of subcall function 0001681F: RegCloseKey.ADVAPI32(?), ref: 00016902

Strings

smo, xrefs: 00014545, 0001465A
LoadString() Error. Could not load string resource., xrefs: 000144E4

Memory Dump Source

Source File: 00000001.00000002.2614761400.0000000000011000.00000020.00000001.01000000.00000004.sdmp, Offset: 00010000, based on PE: true

Associated: 00000001.00000002.2614739685.0000000000010000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614782170.0000000000018000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000_Ey3OF47.jbxd

Similarity

API ID: Local$AllocMessage$BeepCloseFreeLoadMetricsOpenQueryStringSystemValueVersion
String ID: LoadString() Error. Could not load string resource.$smo
API String ID: 3244514340-2161240188
Opcode ID: c9235bf193e683e091daf339e3d26711bfae60c6c43374999ee6b253845e2342
Instruction ID: ef705ded984e68045199871a704b4b4a889428ce9a5d539bec70ec3a439ea750
Opcode Fuzzy Hash: c9235bf193e683e091daf339e3d26711bfae60c6c43374999ee6b253845e2342
Instruction Fuzzy Hash: 1C511972A00215AFDB219F28CC48BFA7BB9EF46304F144194FD09A7252DB36DE85CB91

Uniqueness

Uniqueness Score: -1.00%

Function 000153A1 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 71
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0001171E: _vsnprintf.MSVCRT ref: 00011750

RemoveDirectoryA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,?,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 000153FB
GetFileAttributesA.KERNELBASE(?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 00015402
GetTempFileNameA.KERNEL32(C:\Users\user\AppData\Local\Temp\IXP001.TMP\,IXP,00000000,?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 0001541F
DeleteFileA.KERNEL32(?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 0001542B
CreateDirectoryA.KERNEL32(?,00000000,?,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 00015434
CreateDirectoryA.KERNELBASE(?,00000000,?,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 00015452

Strings

C:\Users\user\AppData\Local\Temp\IXP001.TMP\, xrefs: 000153B7, 000153E1, 0001541E
IXP%03d.TMP, xrefs: 000153C0
IXP, xrefs: 00015419

Memory Dump Source

Source File: 00000001.00000002.2614761400.0000000000011000.00000020.00000001.01000000.00000004.sdmp, Offset: 00010000, based on PE: true

Associated: 00000001.00000002.2614739685.0000000000010000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614782170.0000000000018000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000_Ey3OF47.jbxd

Similarity

API ID: DirectoryFile$Create$AttributesDeleteNameRemoveTemp_vsnprintf
String ID: C:\Users\user\AppData\Local\Temp\IXP001.TMP\$IXP$IXP%03d.TMP
API String ID: 1082909758-957705000
Opcode ID: bee82df384ffdd318ee012b123ec882458ca6f7a8a69f6ef80a72e2e2c40a1fa
Instruction ID: 108760ccdd8d633ea8c310931c90e5615df1d61abcfe88555e89570260c018ee
Opcode Fuzzy Hash: bee82df384ffdd318ee012b123ec882458ca6f7a8a69f6ef80a72e2e2c40a1fa
Instruction Fuzzy Hash: DD112771701614B7E3259B369C49FEF366DEFC6322F004125F656D7191CE788AC286A2

Uniqueness

Uniqueness Score: -1.00%

Function 00015467 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?,?,?,?,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 000154C9
CreateDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 0001553D
RemoveDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 0001556F

Part of subcall function 000153A1: RemoveDirectoryA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,?,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 000153FB
Part of subcall function 000153A1: GetFileAttributesA.KERNELBASE(?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 00015402
Part of subcall function 000153A1: GetTempFileNameA.KERNEL32(C:\Users\user\AppData\Local\Temp\IXP001.TMP\,IXP,00000000,?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 0001541F
Part of subcall function 000153A1: DeleteFileA.KERNEL32(?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 0001542B
Part of subcall function 000153A1: CreateDirectoryA.KERNEL32(?,00000000,?,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 00015434

Strings

C:\Users\user\AppData\Local\Temp\IXP001.TMP\, xrefs: 0001547D, 00015481, 000154AB, 0001551C, 0001553C, 00015568
mips, xrefs: 000154F7
ppc, xrefs: 000154E9
alpha, xrefs: 000154F0
i386, xrefs: 000154FE

Memory Dump Source

Source File: 00000001.00000002.2614761400.0000000000011000.00000020.00000001.01000000.00000004.sdmp, Offset: 00010000, based on PE: true

Associated: 00000001.00000002.2614739685.0000000000010000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614782170.0000000000018000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000_Ey3OF47.jbxd

Similarity

API ID: Directory$File$CreateRemove$AttributesDeleteInfoNameSystemTemp
String ID: C:\Users\user\AppData\Local\Temp\IXP001.TMP\$alpha$i386$mips$ppc
API String ID: 1979080616-772166365
Opcode ID: 93cb2ac90aa389b50c860ec23532f5156fb7734e1679a60fa40fc09d94284fc2
Instruction ID: 4309e8fdc5188a67c50bdcb1b981b961e11b8ba3c00a51afd923391c7b719795
Opcode Fuzzy Hash: 93cb2ac90aa389b50c860ec23532f5156fb7734e1679a60fa40fc09d94284fc2
Instruction Fuzzy Hash: 3A313870B00E04EBDB249B2A9C645FE77EBABC5746B04412AB901CB185DB748FC18791

Uniqueness

Uniqueness Score: -1.00%

Function 0001256D Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 75
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,System\CurrentControlSet\Control\Session Manager,00000000,00020019,?,00000000,00014096,00014096,?,00011ED3,00000001,00000000,?,?,00014137,?), ref: 000125B2
RegQueryValueExA.KERNELBASE(?,PendingFileRenameOperations,00000000,00000000,00000000,00014096,?,00011ED3,00000001,00000000,?,?,00014137,?,00014096), ref: 000125CB
RegCloseKey.KERNELBASE(?,?,00011ED3,00000001,00000000,?,?,00014137,?,00014096), ref: 000125DD
RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Session Manager\FileRenameOperations,00000000,00020019,?,00000000,00014096,00014096,?,00011ED3,00000001,00000000,?,?,00014137,?), ref: 000125FF
RegQueryInfoKeyA.ADVAPI32(?,00000000,00000000,00000000,00000000,00000000,00000000,00014096,00000000,00000000,00000000,00000000,?,00011ED3,00000001,00000000), ref: 0001261A

Strings

System\CurrentControlSet\Control\Session Manager, xrefs: 000125A8
System\CurrentControlSet\Control\Session Manager\FileRenameOperations, xrefs: 000125F5
PendingFileRenameOperations, xrefs: 000125C3

Memory Dump Source

Source File: 00000001.00000002.2614761400.0000000000011000.00000020.00000001.01000000.00000004.sdmp, Offset: 00010000, based on PE: true

Associated: 00000001.00000002.2614739685.0000000000010000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614782170.0000000000018000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000_Ey3OF47.jbxd

Similarity

API ID: OpenQuery$CloseInfoValue
String ID: PendingFileRenameOperations$System\CurrentControlSet\Control\Session Manager$System\CurrentControlSet\Control\Session Manager\FileRenameOperations
API String ID: 2209512893-559176071
Opcode ID: 4a966d674c514498911ac9dd139882f92321b88e48a8e356636d99595f92bcc6
Instruction ID: f8c27fff8efd152456202893a213256c39a13a1c20b51c1e9674b4b967b1e6a5
Opcode Fuzzy Hash: 4a966d674c514498911ac9dd139882f92321b88e48a8e356636d99595f92bcc6
Instruction Fuzzy Hash: 85114F35A42228FBAB219B919C49DFFBEBCEF067A1F108055B908A2051D6345F94D6A1

Uniqueness

Uniqueness Score: -1.00%

Function 00016A60 Relevance: 13.6, APIs: 9, Instructions: 138
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00017155: GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 00017182
Part of subcall function 00017155: GetCurrentProcessId.KERNEL32 ref: 00017191
Part of subcall function 00017155: GetCurrentThreadId.KERNEL32 ref: 0001719A
Part of subcall function 00017155: GetTickCount.KERNEL32 ref: 000171A3
Part of subcall function 00017155: QueryPerformanceCounter.KERNEL32(?), ref: 000171B8

GetStartupInfoW.KERNEL32(?,000172B8,00000058), ref: 00016A7F
Sleep.KERNEL32(000003E8), ref: 00016AB4
_amsg_exit.MSVCRT ref: 00016AC9
_initterm.MSVCRT ref: 00016B1D
__IsNonwritableInCurrentImage.LIBCMT ref: 00016B49
exit.KERNELBASE ref: 00016BBF
_ismbblead.MSVCRT ref: 00016BDA

Memory Dump Source

Source File: 00000001.00000002.2614761400.0000000000011000.00000020.00000001.01000000.00000004.sdmp, Offset: 00010000, based on PE: true

Associated: 00000001.00000002.2614739685.0000000000010000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614782170.0000000000018000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000_Ey3OF47.jbxd

Similarity

API ID: Current$Time$CountCounterFileImageInfoNonwritablePerformanceProcessQuerySleepStartupSystemThreadTick_amsg_exit_initterm_ismbbleadexit
String ID:
API String ID: 836923961-0
Opcode ID: d9e7cd3fb62ba6fe14085e37f8e7af5a502d53ed4ec6637ccfd34975bd705969
Instruction ID: 8165287ccf398e4dab085cbda7416b6737ce4a06c6c3ba319425bf8fd26bb322
Opcode Fuzzy Hash: d9e7cd3fb62ba6fe14085e37f8e7af5a502d53ed4ec6637ccfd34975bd705969
Instruction Fuzzy Hash: 4141E331A493249BEB619B68DC847EA77F4BB49720F54801AE941E7291CF7A49C1CB81

Uniqueness

Uniqueness Score: -1.00%

Function 000158C8 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 74
memoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LocalAlloc.KERNEL32(00000040,?,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,?,00015534,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 000158E7
CreateFileA.KERNELBASE(00000000,40000000,00000000,00000000,00000001,04000080,00000000,TMP4351$.TMP,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,?,00015534,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 00015943
LocalFree.KERNEL32(00000000,?,00015534,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 0001594D
CloseHandle.KERNEL32(00000000,?,00015534,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 0001595C
GetFileAttributesA.KERNELBASE(C:\Users\user\AppData\Local\Temp\IXP001.TMP\,?,00015534,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 00015963

Strings

C:\Users\user\AppData\Local\Temp\IXP001.TMP\, xrefs: 000158CD, 000158CF, 00015919, 00015962
TMP4351$.TMP, xrefs: 00015923

Memory Dump Source

Source File: 00000001.00000002.2614761400.0000000000011000.00000020.00000001.01000000.00000004.sdmp, Offset: 00010000, based on PE: true

Associated: 00000001.00000002.2614739685.0000000000010000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614782170.0000000000018000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000_Ey3OF47.jbxd

Similarity

API ID: FileLocal$AllocAttributesCloseCreateFreeHandle
String ID: C:\Users\user\AppData\Local\Temp\IXP001.TMP\$TMP4351$.TMP
API String ID: 747627703-3033780695
Opcode ID: 02dc8a764f58483e27e788daf47496fde0da3cfbd885ace65fb58b8fcfad4ed6
Instruction ID: d308940ecfee19104f4938b78bc5c949edd8e6e60da4591ac66c9a3be0aaea51
Opcode Fuzzy Hash: 02dc8a764f58483e27e788daf47496fde0da3cfbd885ace65fb58b8fcfad4ed6
Instruction Fuzzy Hash: 62117831701210BBD7241F796C4CBDB7E9DDF86370F104615F509D71C1CA74888182A0

Uniqueness

Uniqueness Score: -1.00%

Function 00013FEF Relevance: 10.6, APIs: 7, Instructions: 97processsynchronizationwindowCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?,?,?,00000000), ref: 00014033
WaitForSingleObject.KERNEL32(?,000000FF), ref: 00014049
GetExitCodeProcess.KERNELBASE(?,?), ref: 0001405C
CloseHandle.KERNEL32(?), ref: 0001409C
CloseHandle.KERNEL32(?), ref: 000140A8
GetLastError.KERNEL32(00000000,?,00000200,00000000), ref: 000140DC
FormatMessageA.KERNELBASE(00001000,00000000,00000000), ref: 000140E9

Memory Dump Source

Source File: 00000001.00000002.2614761400.0000000000011000.00000020.00000001.01000000.00000004.sdmp, Offset: 00010000, based on PE: true

Associated: 00000001.00000002.2614739685.0000000000010000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614782170.0000000000018000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000_Ey3OF47.jbxd

Similarity

API ID: CloseHandleProcess$CodeCreateErrorExitFormatLastMessageObjectSingleWait
String ID:
API String ID: 3183975587-0
Opcode ID: f5589b5363562c1a95212045e21dd6dcc2b781bb62f9d8d9202c2020027ad256
Instruction ID: e00d16904957bc101ec542d24f88d476288bea275036314ae46a8c55ae8c250c
Opcode Fuzzy Hash: f5589b5363562c1a95212045e21dd6dcc2b781bb62f9d8d9202c2020027ad256
Instruction Fuzzy Hash: 9A31C231641208BBFB619B65DC48FEB77BCEB99714F1081A9FA09D2171C6344DC5CB51

Uniqueness

Uniqueness Score: -1.00%

Function 000151E5 Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0001468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 000146A0
Part of subcall function 0001468F: SizeofResource.KERNEL32(00000000,00000000,?,00012D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 000146A9
Part of subcall function 0001468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 000146C3
Part of subcall function 0001468F: LoadResource.KERNEL32(00000000,00000000,?,00012D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 000146CC
Part of subcall function 0001468F: LockResource.KERNEL32(00000000,?,00012D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 000146D3
Part of subcall function 0001468F: memcpy_s.MSVCRT ref: 000146E5
Part of subcall function 0001468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 000146EF

LocalAlloc.KERNEL32(00000040,00000001,00000000,?,00000002,00000000,00012F4D,?,00000002,00000000), ref: 00015201
LocalFree.KERNEL32(00000000,00000000,00000000,00000010,00000000,00000000), ref: 00015250

Part of subcall function 000144B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00014518
Part of subcall function 000144B9: MessageBoxA.USER32(?,?,smo,00010010), ref: 00014554

Part of subcall function 00016285: GetLastError.KERNEL32(00015BBC), ref: 00016285

Strings

<None>, xrefs: 00015262
UPROMPT, xrefs: 000151EF, 00015230

Memory Dump Source

Source File: 00000001.00000002.2614761400.0000000000011000.00000020.00000001.01000000.00000004.sdmp, Offset: 00010000, based on PE: true

Associated: 00000001.00000002.2614739685.0000000000010000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614782170.0000000000018000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000_Ey3OF47.jbxd

Similarity

API ID: Resource$FindFreeLoadLocal$AllocErrorLastLockMessageSizeofStringmemcpy_s
String ID: <None>$UPROMPT
API String ID: 957408736-2980973527
Opcode ID: 5003bdb7c0257e1dca1c58745c2575240842d13fc1c956447e62a8a1418867f6
Instruction ID: 827b76470dc5370f428e68f2854fa218895283a472318bc5e084fa5c3d074a46
Opcode Fuzzy Hash: 5003bdb7c0257e1dca1c58745c2575240842d13fc1c956447e62a8a1418867f6
Instruction Fuzzy Hash: 7911E2B6341601BBE3256BB15C59BFB71EDDBCB781B108029F702DA191DA7D8C804125

Uniqueness

Uniqueness Score: -1.00%

Function 000152B6 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 65fileCOMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNELBASE(031B46A8,00000080,?,00000000), ref: 000152F2
DeleteFileA.KERNELBASE(031B46A8), ref: 000152FA
LocalFree.KERNEL32(031B46A8,?,00000000), ref: 00015305
LocalFree.KERNEL32(031B46A8), ref: 0001530C
SetCurrentDirectoryA.KERNELBASE(000111FC,?,C:\Users\user\AppData\Local\Temp\IXP001.TMP\), ref: 00015363

Strings

C:\Users\user\AppData\Local\Temp\IXP001.TMP\, xrefs: 00015334

Memory Dump Source

Source File: 00000001.00000002.2614761400.0000000000011000.00000020.00000001.01000000.00000004.sdmp, Offset: 00010000, based on PE: true

Associated: 00000001.00000002.2614739685.0000000000010000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614782170.0000000000018000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000_Ey3OF47.jbxd

Similarity

API ID: FileFreeLocal$AttributesCurrentDeleteDirectory
String ID: C:\Users\user\AppData\Local\Temp\IXP001.TMP\
API String ID: 2833751637-3647970563
Opcode ID: 06088c0bbe653cd7c336331a9c6214762f17a2c956ae28baf4b8cb888d863457
Instruction ID: 8e4a26da8f076bf64c89fd0f536578122f8c441a241396dbfa03a2d9866606c4
Opcode Fuzzy Hash: 06088c0bbe653cd7c336331a9c6214762f17a2c956ae28baf4b8cb888d863457
Instruction Fuzzy Hash: 7221CF31501604DBFB629B10EC19BE977F1BF48741F448119E9525B1A1CBB95EC8CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00011FE1 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 23registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE(80000002,Software\Microsoft\Windows\CurrentVersion\RunOnce,00000000,00020006,0001538C,?,?,0001538C), ref: 00012005
RegDeleteValueA.KERNELBASE(0001538C,wextract_cleanup1,?,?,0001538C), ref: 00012017
RegCloseKey.ADVAPI32(0001538C,?,?,0001538C), ref: 00012020

Strings

Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 00011FFB
wextract_cleanup1, xrefs: 00011FE7, 0001200F

Memory Dump Source

Source File: 00000001.00000002.2614761400.0000000000011000.00000020.00000001.01000000.00000004.sdmp, Offset: 00010000, based on PE: true

Associated: 00000001.00000002.2614739685.0000000000010000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614782170.0000000000018000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000_Ey3OF47.jbxd

Similarity

API ID: CloseDeleteOpenValue
String ID: Software\Microsoft\Windows\CurrentVersion\RunOnce$wextract_cleanup1
API String ID: 849931509-1592051331
Opcode ID: d1561be01e3ad79b864bc9d7d708ed97bd1117ac63128eba5834cff07efc8e5a
Instruction ID: eb38d3a501df9c01f966700ec36ff1faa95700e11d0f360a97fb62ccc998447c
Opcode Fuzzy Hash: d1561be01e3ad79b864bc9d7d708ed97bd1117ac63128eba5834cff07efc8e5a
Instruction Fuzzy Hash: F7E04F30651318FFEB238B90ED0EFD97B6AFB09780F104294BA04A0061EB655B94D705

Uniqueness

Uniqueness Score: -1.00%

Function 00014CD0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNELBASE(?,?,?,?), ref: 00014DB5
SetDlgItemTextA.USER32(00000000,00000837,?), ref: 00014DDD

Strings

C:\Users\user\AppData\Local\Temp\IXP001.TMP\, xrefs: 00014D36, 00014DE3

Memory Dump Source

Source File: 00000001.00000002.2614761400.0000000000011000.00000020.00000001.01000000.00000004.sdmp, Offset: 00010000, based on PE: true

Associated: 00000001.00000002.2614739685.0000000000010000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614782170.0000000000018000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000_Ey3OF47.jbxd

Similarity

API ID: AttributesFileItemText
String ID: C:\Users\user\AppData\Local\Temp\IXP001.TMP\
API String ID: 3625706803-3647970563
Opcode ID: 728dc179ce776ecb56691ddad1c060caaa71b0641a0bdd82626972817e792187
Instruction ID: 89eaf10ce3cea328a45571cbbf02891510d132cbe7d7c11dc9032d0131171fe3
Opcode Fuzzy Hash: 728dc179ce776ecb56691ddad1c060caaa71b0641a0bdd82626972817e792187
Instruction Fuzzy Hash: 654122362041029BCF619F38ED546FA73E5EB46300F148668E886972B6DF32DECAC750

Uniqueness

Uniqueness Score: -1.00%

Function 00014C37 Relevance: 4.5, APIs: 3, Instructions: 39timeCOMMON

Download Yara Rule

APIs

DosDateTimeToFileTime.KERNEL32(?,?,?), ref: 00014C54
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00014C66
SetFileTime.KERNELBASE(?,?,?,?), ref: 00014C7E

Memory Dump Source

Source File: 00000001.00000002.2614761400.0000000000011000.00000020.00000001.01000000.00000004.sdmp, Offset: 00010000, based on PE: true

Associated: 00000001.00000002.2614739685.0000000000010000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614782170.0000000000018000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000_Ey3OF47.jbxd

Similarity

API ID: Time$File$DateLocal
String ID:
API String ID: 2071732420-0
Opcode ID: 441ed525d6692fb928ffaf9ac68978064fcf92c8399c798f15daa614b0ec54b9
Instruction ID: 248f36c73c0d881b31ba4ced96d8dd8a66f15f4335e26b661d1a363fd0eca90a
Opcode Fuzzy Hash: 441ed525d6692fb928ffaf9ac68978064fcf92c8399c798f15daa614b0ec54b9
Instruction Fuzzy Hash: C8F0907260220EBFABA5DFB4DC48DFB77ECEB09340B44852AA915C1060EA34DA54C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 0001487A Relevance: 3.1, APIs: 2, Instructions: 59fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(00008000,-80000000,00000000,00000000,?,00000080,00000000,00000000,00000000,00000000,00014A23,?,00014F67,*MEMCAB,00008000,00000180), ref: 000148DE
CreateFileA.KERNEL32(00008000,-80000000,00000000,00000000,?,00000080,00000000,?,00014F67,*MEMCAB,00008000,00000180), ref: 00014902

Memory Dump Source

Source File: 00000001.00000002.2614761400.0000000000011000.00000020.00000001.01000000.00000004.sdmp, Offset: 00010000, based on PE: true

Associated: 00000001.00000002.2614739685.0000000000010000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614782170.0000000000018000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000_Ey3OF47.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 84340913bc7c57d2349b981d06811926b4b47971a5d9ccced87b1234569e3170
Instruction ID: ceb00fc85732a46c8b3692fb679c29cdc4ea2f4d8a8206ebbd775ec8917d869d
Opcode Fuzzy Hash: 84340913bc7c57d2349b981d06811926b4b47971a5d9ccced87b1234569e3170
Instruction Fuzzy Hash: EF016DA3E1257026F36440294C88FFB555CCBD6734F1B0335BDEAEB1E2D5644C8481E0

Uniqueness

Uniqueness Score: -1.00%

Function 00014AD0 Relevance: 3.0, APIs: 2, Instructions: 47fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00013680: MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000004FF), ref: 0001369F
Part of subcall function 00013680: PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 000136B2
Part of subcall function 00013680: PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 000136DA

WriteFile.KERNELBASE(?,?,?,?,00000000), ref: 00014B05

Memory Dump Source

Source File: 00000001.00000002.2614761400.0000000000011000.00000020.00000001.01000000.00000004.sdmp, Offset: 00010000, based on PE: true

Associated: 00000001.00000002.2614739685.0000000000010000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614782170.0000000000018000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000_Ey3OF47.jbxd

Similarity

API ID: MessagePeek$FileMultipleObjectsWaitWrite
String ID:
API String ID: 1084409-0
Opcode ID: 4fa1f9e6e5468fee362d010e396edc10e38bfa2ed62f2d8122a64fa8bdc4c1fe
Instruction ID: 0b55bf3e539b068d125da6a6ca5e3a710efd1e87f42c7717d0e37599f0438d4c
Opcode Fuzzy Hash: 4fa1f9e6e5468fee362d010e396edc10e38bfa2ed62f2d8122a64fa8bdc4c1fe
Instruction Fuzzy Hash: CF019E31200301ABEB148F69EC95BE67799FB44725F08C229FA399B1F0CB74D991CB81

Uniqueness

Uniqueness Score: -1.00%

Function 0001658A Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

CharPrevA.USER32(00018B3E,00018B3F,00000001,00018B3E,-00000003,?,000160EC,00011140,?), ref: 000165BA

Memory Dump Source

Source File: 00000001.00000002.2614761400.0000000000011000.00000020.00000001.01000000.00000004.sdmp, Offset: 00010000, based on PE: true

Associated: 00000001.00000002.2614739685.0000000000010000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614782170.0000000000018000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000_Ey3OF47.jbxd

Similarity

API ID: CharPrev
String ID:
API String ID: 122130370-0
Opcode ID: 08e85c8499f3533c7efd88565b067d47db7a736b8a4fe6c83a8ea412075e3b64
Instruction ID: 6b6427319ab5560c4db75a08001ccb417ec025e8ea75f3ad327008e569e35661
Opcode Fuzzy Hash: 08e85c8499f3533c7efd88565b067d47db7a736b8a4fe6c83a8ea412075e3b64
Instruction Fuzzy Hash: F2F04C322086509BD332091D9C84BEABFDF9B86350F28416EE8DAC3205CA678CC583A4

Uniqueness

Uniqueness Score: -1.00%

Function 0001621E Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 0001623F

Part of subcall function 000144B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00014518
Part of subcall function 000144B9: MessageBoxA.USER32(?,?,smo,00010010), ref: 00014554

Part of subcall function 00016285: GetLastError.KERNEL32(00015BBC), ref: 00016285

Memory Dump Source

Source File: 00000001.00000002.2614761400.0000000000011000.00000020.00000001.01000000.00000004.sdmp, Offset: 00010000, based on PE: true

Associated: 00000001.00000002.2614739685.0000000000010000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614782170.0000000000018000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000_Ey3OF47.jbxd

Similarity

API ID: DirectoryErrorLastLoadMessageStringWindows
String ID:
API String ID: 381621628-0
Opcode ID: e97f6ff4f75564a7bcdd9d319785c40b6fb7ff9565e8021db1f7c414731e3fd9
Instruction ID: 63597a20bcd05984f1fc8590e6f284a78cd1e60603c8d0b4ba5a068917bd779e
Opcode Fuzzy Hash: e97f6ff4f75564a7bcdd9d319785c40b6fb7ff9565e8021db1f7c414731e3fd9
Instruction Fuzzy Hash: 6CF0B4B0700208ABE750EB748D02BFE36ACDB58700F404069B985D6092DD7599C48650

Uniqueness

Uniqueness Score: -1.00%

Function 00014B60 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(9ED71965,00000000,00000000,?,00014FA1,00000000), ref: 00014B98

Memory Dump Source

Source File: 00000001.00000002.2614761400.0000000000011000.00000020.00000001.01000000.00000004.sdmp, Offset: 00010000, based on PE: true

Associated: 00000001.00000002.2614739685.0000000000010000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614782170.0000000000018000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000_Ey3OF47.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 7a654157df530afa6a55d5437343bc6fa18231fbfb8efab2f4fc0f3db57ed4ce
Instruction ID: 3a0ac85703c1bb57f6fd5115a6b40cc1d7921d2c37e087d1d10c4418094e786c
Opcode Fuzzy Hash: 7a654157df530afa6a55d5437343bc6fa18231fbfb8efab2f4fc0f3db57ed4ce
Instruction Fuzzy Hash: 93F01271904B089E47718F39EC416D2BBE5AB95360330892E946ED21E0EB30A541CB90

Uniqueness

Uniqueness Score: -1.00%

Function 000166AE Relevance: 1.5, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(?,00014777,?,00014E38,?), ref: 000166B1

Memory Dump Source

Source File: 00000001.00000002.2614761400.0000000000011000.00000020.00000001.01000000.00000004.sdmp, Offset: 00010000, based on PE: true

Associated: 00000001.00000002.2614739685.0000000000010000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614782170.0000000000018000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000_Ey3OF47.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 480bebe9f6e61223939d2f469bdf820e40c8f0f88d59e1a5fe2001b4a828ca2d
Instruction ID: df77a20faa83ed61f8558026a608247e13aa536d6c3ec9deac34f6f11163feff
Opcode Fuzzy Hash: 480bebe9f6e61223939d2f469bdf820e40c8f0f88d59e1a5fe2001b4a828ca2d
Instruction Fuzzy Hash: 8BB0927A322440426A6146756C295963881A7C233A7E45B90F032C01E0CA3FD886D004

Uniqueness

Uniqueness Score: -1.00%

Function 00014CA0 Relevance: 1.3, APIs: 1, Instructions: 8memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNELBASE(00000000,?), ref: 00014CAA

Memory Dump Source

Source File: 00000001.00000002.2614761400.0000000000011000.00000020.00000001.01000000.00000004.sdmp, Offset: 00010000, based on PE: true

Associated: 00000001.00000002.2614739685.0000000000010000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614782170.0000000000018000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000_Ey3OF47.jbxd

Similarity

API ID: AllocGlobal
String ID:
API String ID: 3761449716-0
Opcode ID: e2bb94a66ef4ca4b61b3a901a977222664dd94995e5eedfb63f9f20751343d54
Instruction ID: 76404eeea42d10b2e0227b3a1a6b9cd48d37cd8c646624cfac3fa57fa9484505
Opcode Fuzzy Hash: e2bb94a66ef4ca4b61b3a901a977222664dd94995e5eedfb63f9f20751343d54
Instruction Fuzzy Hash: BCB0123214420CB7DF011FC2EC09FC53F1DE7C9771F144000F60C45050CA7694108696

Uniqueness

Uniqueness Score: -1.00%

Function 00014CC0 Relevance: 1.3, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

GlobalFree.KERNELBASE(?), ref: 00014CC8

Memory Dump Source

Source File: 00000001.00000002.2614761400.0000000000011000.00000020.00000001.01000000.00000004.sdmp, Offset: 00010000, based on PE: true

Associated: 00000001.00000002.2614739685.0000000000010000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614782170.0000000000018000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000_Ey3OF47.jbxd

Similarity

API ID: FreeGlobal
String ID:
API String ID: 2979337801-0
Opcode ID: d7ec2222dd030d2c4db66f0d21173fe845790534aed597e43a1a0fe57ea19e72
Instruction ID: f4ee5e9a7c459ae18270315611c77e3d3bf68f8746d0aad33c41577edd3b6084
Opcode Fuzzy Hash: d7ec2222dd030d2c4db66f0d21173fe845790534aed597e43a1a0fe57ea19e72
Instruction Fuzzy Hash: 15B0123100010CB78F011B42EC088853F1DD7C53607014010F50C41022CB3B98118585

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00015C9E Relevance: 24.9, APIs: 10, Strings: 4, Instructions: 422COMMON

Download Yara Rule

APIs

CharNextA.USER32(?,00000000,?,?), ref: 00015CEE
GetModuleFileNameA.KERNEL32(00018B3E,00000104,00000000,?,?), ref: 00015DFC
CharUpperA.USER32(?), ref: 00015E3E
CharUpperA.USER32(-00000052), ref: 00015EE1
CompareStringA.KERNEL32(0000007F,00000001,RegServer,000000FF,?,000000FF), ref: 00015F6F
CharUpperA.USER32(?), ref: 00015FA7
CharUpperA.USER32(-0000004E), ref: 00016008
CharUpperA.USER32(?), ref: 000160AA
CloseHandle.KERNEL32(00000000,00011140,00000000,00000040,00000000), ref: 000161F1
ExitProcess.KERNEL32 ref: 000161F8

Strings

RegServer, xrefs: 00015F66
", xrefs: 00015D78
:, xrefs: 00016118
", xrefs: 0001612D

Memory Dump Source

Source File: 00000001.00000002.2614761400.0000000000011000.00000020.00000001.01000000.00000004.sdmp, Offset: 00010000, based on PE: true

Associated: 00000001.00000002.2614739685.0000000000010000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614782170.0000000000018000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000_Ey3OF47.jbxd

Similarity

API ID: Char$Upper$CloseCompareExitFileHandleModuleNameNextProcessString
String ID: "$"$:$RegServer
API String ID: 1203814774-25366791
Opcode ID: 8639c349c082c8a9f68e3cac475a595aef50b7549921c46c82734bff8b85b655
Instruction ID: 8fcd440db3161ca76850930948ab5f1c29553c8366079f29d6e56d28fdd0eb00
Opcode Fuzzy Hash: 8639c349c082c8a9f68e3cac475a595aef50b7549921c46c82734bff8b85b655
Instruction Fuzzy Hash: EAD16E71E04A44DFEF758B389C487FA3BE1AB96306F1480A9D486CE191DB758EC6CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00011F90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94shutdownCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028,?,?), ref: 00011EFB
OpenProcessToken.ADVAPI32(00000000), ref: 00011F02
ExitWindowsEx.USER32(00000002,00000000), ref: 00011FD3

Strings

SeShutdownPrivilege, xrefs: 00011F28

Memory Dump Source

Source File: 00000001.00000002.2614761400.0000000000011000.00000020.00000001.01000000.00000004.sdmp, Offset: 00010000, based on PE: true

Associated: 00000001.00000002.2614739685.0000000000010000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614782170.0000000000018000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000_Ey3OF47.jbxd

Similarity

API ID: Process$CurrentExitOpenTokenWindows
String ID: SeShutdownPrivilege
API String ID: 2795981589-3733053543
Opcode ID: 8cdf72723e6782aec81ce0a3ca95ddb4a202e63817b00ad048a843f18b64093e
Instruction ID: dc5707c1536350e765d08ca3acaeda3feacfb69c5d737eb5470abae297d45f7d
Opcode Fuzzy Hash: 8cdf72723e6782aec81ce0a3ca95ddb4a202e63817b00ad048a843f18b64093e
Instruction Fuzzy Hash: B421B771B412057BEB345BE19C4AFFF76F8EB85B10F10402DFB06D6181D77988829661

Uniqueness

Uniqueness Score: -1.00%

Function 00016CF0 Relevance: 6.0, APIs: 4, Instructions: 13COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,00016E26,00011000), ref: 00016CF7
UnhandledExceptionFilter.KERNEL32(00016E26,?,00016E26,00011000), ref: 00016D00
GetCurrentProcess.KERNEL32(C0000409,?,00016E26,00011000), ref: 00016D0B
TerminateProcess.KERNEL32(00000000,?,00016E26,00011000), ref: 00016D12

Memory Dump Source

Source File: 00000001.00000002.2614761400.0000000000011000.00000020.00000001.01000000.00000004.sdmp, Offset: 00010000, based on PE: true

Associated: 00000001.00000002.2614739685.0000000000010000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614782170.0000000000018000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000_Ey3OF47.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminate
String ID:
API String ID: 3231755760-0
Opcode ID: c2baa4172adf60f19ef56e2864cfaf41547824103cadae11efe6d24d5578c001
Instruction ID: 8311c80f14b37f995de4bdccf8dc1c6cbe6958a7a40546238f4c246d9e171b33
Opcode Fuzzy Hash: c2baa4172adf60f19ef56e2864cfaf41547824103cadae11efe6d24d5578c001
Instruction Fuzzy Hash: 28D0C932201108BBFB012BE1EC0CA993F28EB4A226F448000F71982020CA3A44518B52

Uniqueness

Uniqueness Score: -1.00%

Function 00013210 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 188windowCOMMON

Download Yara Rule

APIs

LoadStringA.USER32(000003E8,00018598,00000200), ref: 00013271
GetDesktopWindow.USER32 ref: 000133E2
SetWindowTextA.USER32(?,smo), ref: 000133F7
SendDlgItemMessageA.USER32(?,00000835,000000C5,00000103,00000000), ref: 00013410
GetDlgItem.USER32(?,00000836), ref: 00013426
EnableWindow.USER32(00000000), ref: 0001342D
EndDialog.USER32(?,00000000), ref: 0001343F

Strings

C:\Users\user\AppData\Local\Temp\IXP001.TMP\, xrefs: 000132E2, 000132E7, 00013331, 00013344, 0001335B, 0001336A
smo, xrefs: 000133F1

Memory Dump Source

Source File: 00000001.00000002.2614761400.0000000000011000.00000020.00000001.01000000.00000004.sdmp, Offset: 00010000, based on PE: true

Associated: 00000001.00000002.2614739685.0000000000010000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614782170.0000000000018000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000_Ey3OF47.jbxd

Similarity

API ID: Window$Item$DesktopDialogEnableLoadMessageSendStringText
String ID: C:\Users\user\AppData\Local\Temp\IXP001.TMP\$smo
API String ID: 2418873061-2951332106
Opcode ID: 8dde3b0b32e0a511bbb9f0b0b5899a7259c07953c45cd70916422feaa3ea12e7
Instruction ID: d3f4b2e741696e84f49550371b18c6d6852ecdf06b63fb6267b82cf0f118990a
Opcode Fuzzy Hash: 8dde3b0b32e0a511bbb9f0b0b5899a7259c07953c45cd70916422feaa3ea12e7
Instruction Fuzzy Hash: 39514930381250BBFB725B355C4CFFF3D99EB86B54F508028F645A61D1CAB89BC19265

Uniqueness

Uniqueness Score: -1.00%

Function 000134F0 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 119threadwindowCOMMON

Download Yara Rule

APIs

TerminateThread.KERNEL32(00000000), ref: 00013535
EndDialog.USER32(?,?), ref: 00013541
ResetEvent.KERNEL32 ref: 0001355F
SetEvent.KERNEL32(00011140,00000000,00000020,00000004), ref: 00013590
GetDesktopWindow.USER32 ref: 000135C7
GetDlgItem.USER32(?,0000083B), ref: 000135F1
SendMessageA.USER32(00000000), ref: 000135F8
GetDlgItem.USER32(?,0000083B), ref: 00013610
SendMessageA.USER32(00000000), ref: 00013617
SetWindowTextA.USER32(?,smo), ref: 00013623
CreateThread.KERNEL32(00000000,00000000,Function_00004FE0,00000000,00000000,00018798), ref: 00013637
EndDialog.USER32(?,00000000), ref: 00013671

Strings

smo, xrefs: 0001361D

Memory Dump Source

Source File: 00000001.00000002.2614761400.0000000000011000.00000020.00000001.01000000.00000004.sdmp, Offset: 00010000, based on PE: true

Associated: 00000001.00000002.2614739685.0000000000010000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614782170.0000000000018000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000_Ey3OF47.jbxd

Similarity

API ID: DialogEventItemMessageSendThreadWindow$CreateDesktopResetTerminateText
String ID: smo
API String ID: 2406144884-2762499640
Opcode ID: 10aa53ef5b1ee62ecb49404d7cde5c0ff8cf5c605d14c39611679fbf70da7528
Instruction ID: 79e0a6ad8b189ecefaad7e86f95da2d6fdcc78954231998728b41a82064eeeb8
Opcode Fuzzy Hash: 10aa53ef5b1ee62ecb49404d7cde5c0ff8cf5c605d14c39611679fbf70da7528
Instruction Fuzzy Hash: 6931B071340300BBE7601F25AC4DEEA3AAAE786B55F50C529F602952B1CA798A80CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00014224 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 132libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(SHELL32.DLL,?,?,00000001), ref: 00014236
GetProcAddress.KERNEL32(00000000,SHBrowseForFolder), ref: 0001424C
GetProcAddress.KERNEL32(00000000,000000C3), ref: 00014263
GetProcAddress.KERNEL32(00000000,SHGetPathFromIDList), ref: 0001427A
GetTempPathA.KERNEL32(00000104,000188C0,?,00000001), ref: 0001429F
CharPrevA.USER32(000188C0,00031181,?,00000001), ref: 000142C2
CharPrevA.USER32(000188C0,00000000,?,00000001), ref: 000142D6
FreeLibrary.KERNEL32(00000000,?,00000001), ref: 00014391
FreeLibrary.KERNEL32(00000000,?,00000001), ref: 000143A5

Strings

SHBrowseForFolder, xrefs: 00014246
SHELL32.DLL, xrefs: 0001422F
SHGetPathFromIDList, xrefs: 00014274

Memory Dump Source

Source File: 00000001.00000002.2614761400.0000000000011000.00000020.00000001.01000000.00000004.sdmp, Offset: 00010000, based on PE: true

Associated: 00000001.00000002.2614739685.0000000000010000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614782170.0000000000018000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000_Ey3OF47.jbxd

Similarity

API ID: AddressLibraryProc$CharFreePrev$LoadPathTemp
String ID: SHBrowseForFolder$SHELL32.DLL$SHGetPathFromIDList
API String ID: 1865808269-1731843650
Opcode ID: 5a4ca3765966a0bf4c400db95841bb2211ac56164124f256587ea6bfbe7236c2
Instruction ID: a5ba9629f5e809a887049cca920d9af7a2fcbee9aae33a97b8e9c7cb8aefaffd
Opcode Fuzzy Hash: 5a4ca3765966a0bf4c400db95841bb2211ac56164124f256587ea6bfbe7236c2
Instruction Fuzzy Hash: 34410974A01204AFE7129F74DC84AFE7BF4EB4A344F548169E951A7261CF788EC1C761

Uniqueness

Uniqueness Score: -1.00%

Function 00012773 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 114registryCOMMON

Download Yara Rule

APIs

CharUpperA.USER32(199D070E,00000000,00000000,00000000), ref: 000127A8
CharNextA.USER32(0000054D), ref: 000127B5
CharNextA.USER32(00000000), ref: 000127BC
RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00020019,?,?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 00012829
RegQueryValueExA.ADVAPI32(?,00011140,00000000,?,-00000005,?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 00012852
ExpandEnvironmentStringsA.KERNEL32(-00000005,?,00000104,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 00012870
RegCloseKey.ADVAPI32(?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 000128A0
GetWindowsDirectoryA.KERNEL32(-00000005,00000104), ref: 000128AA
GetSystemDirectoryA.KERNEL32(-00000005,00000104), ref: 000128B9

Strings

Software\Microsoft\Windows\CurrentVersion\App Paths, xrefs: 000127E4

Memory Dump Source

Source File: 00000001.00000002.2614761400.0000000000011000.00000020.00000001.01000000.00000004.sdmp, Offset: 00010000, based on PE: true

Associated: 00000001.00000002.2614739685.0000000000010000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614782170.0000000000018000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000_Ey3OF47.jbxd

Similarity

API ID: Char$DirectoryNext$CloseEnvironmentExpandOpenQueryStringsSystemUpperValueWindows
String ID: Software\Microsoft\Windows\CurrentVersion\App Paths
API String ID: 2659952014-2428544900
Opcode ID: 1ce709faff5e7adf5fbf040b8377974814900e44e9c42c653cbdc37a428133a7
Instruction ID: b6adaa1e9066b8b6c0fbeabe7e7806ec65cd6c6a408be2a976ce616f36940192
Opcode Fuzzy Hash: 1ce709faff5e7adf5fbf040b8377974814900e44e9c42c653cbdc37a428133a7
Instruction Fuzzy Hash: CD41C671A0112CAFEB259B64DC85AFE77BDEF59700F0040A9F649D2101DB748ED58FA1

Uniqueness

Uniqueness Score: -1.00%

Function 00012267 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 88registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\RunOnce,00000000,0002001F,?,00000001), ref: 000122A3
RegQueryValueExA.ADVAPI32(?,wextract_cleanup1,00000000,00000000,?,?,00000001), ref: 000122D8
memset.MSVCRT ref: 000122F5
GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00012305
RegSetValueExA.ADVAPI32(?,wextract_cleanup1,00000000,00000001,?,?,?,?,?,?,?,?,?), ref: 0001236E
RegCloseKey.ADVAPI32(?), ref: 0001237A

Strings

C:\Users\user\AppData\Local\Temp\IXP001.TMP\, xrefs: 00012321
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 00012299
rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s", xrefs: 0001232D
wextract_cleanup1, xrefs: 0001227C, 000122CD, 00012363

Memory Dump Source

Source File: 00000001.00000002.2614761400.0000000000011000.00000020.00000001.01000000.00000004.sdmp, Offset: 00010000, based on PE: true

Associated: 00000001.00000002.2614739685.0000000000010000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614782170.0000000000018000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000_Ey3OF47.jbxd

Similarity

API ID: Value$CloseDirectoryOpenQuerySystemmemset
String ID: C:\Users\user\AppData\Local\Temp\IXP001.TMP\$Software\Microsoft\Windows\CurrentVersion\RunOnce$rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s"$wextract_cleanup1
API String ID: 3027380567-2601155950
Opcode ID: a698cfb72ff3f051d102caef6be3ae40ab6accdbe677547ec511999fb1602e02
Instruction ID: 6af20fce3a99c9f5889b85beebc35e72253d5284003ca64b987703507caefe59
Opcode Fuzzy Hash: a698cfb72ff3f051d102caef6be3ae40ab6accdbe677547ec511999fb1602e02
Instruction Fuzzy Hash: 3831D971A002186BDB62DB51DC49FEA7B7CEF19740F0041E5F94DAA051DA75AFC8CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00013100 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 70windowCOMMON

Download Yara Rule

APIs

EndDialog.USER32(?,00000000), ref: 0001313B
GetDesktopWindow.USER32 ref: 0001314B
SetDlgItemTextA.USER32(?,00000834), ref: 0001316A
SetWindowTextA.USER32(?,smo), ref: 00013176
SetForegroundWindow.USER32(?), ref: 0001317D
GetDlgItem.USER32(?,00000834), ref: 00013185
GetWindowLongA.USER32(00000000,000000FC), ref: 00013190
SetWindowLongA.USER32(00000000,000000FC,000130C0), ref: 000131A3
SendDlgItemMessageA.USER32(?,00000834,000000B1,000000FF,00000000), ref: 000131CA

Strings

smo, xrefs: 00013170

Memory Dump Source

Source File: 00000001.00000002.2614761400.0000000000011000.00000020.00000001.01000000.00000004.sdmp, Offset: 00010000, based on PE: true

Associated: 00000001.00000002.2614739685.0000000000010000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614782170.0000000000018000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000_Ey3OF47.jbxd

Similarity

API ID: Window$Item$LongText$DesktopDialogForegroundMessageSend
String ID: smo
API String ID: 3785188418-2762499640
Opcode ID: a843ad2e8f62d4807e77b950a07e3b76e870e738d0c1dce630cb9798750548da
Instruction ID: 0e6745a3f3b044ef1b86414ece8f8a6775e1c4468cd6554003ecabab48b97d3a
Opcode Fuzzy Hash: a843ad2e8f62d4807e77b950a07e3b76e870e738d0c1dce630cb9798750548da
Instruction Fuzzy Hash: EF119331745211BFFB215F68AC0CBDA3AA4FB4B731F108610F915951E0DBB99781C752

Uniqueness

Uniqueness Score: -1.00%

Function 000118A3 Relevance: 16.6, APIs: 11, Instructions: 112memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 000117EE: LoadLibraryA.KERNEL32(advapi32.dll,00000002,?,00000000,?,?,?,000118DD), ref: 0001181A
Part of subcall function 000117EE: GetProcAddress.KERNEL32(00000000,CheckTokenMembership), ref: 0001182C
Part of subcall function 000117EE: AllocateAndInitializeSid.ADVAPI32(000118DD,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,000118DD), ref: 00011855
Part of subcall function 000117EE: FreeSid.ADVAPI32(?,?,?,?,000118DD), ref: 00011883
Part of subcall function 000117EE: FreeLibrary.KERNEL32(00000000,?,?,?,000118DD), ref: 0001188A

GetCurrentProcess.KERNEL32(00000008,?,00000000,00000001), ref: 000118EB
OpenProcessToken.ADVAPI32(00000000), ref: 000118F2
GetTokenInformation.ADVAPI32(?,00000002,00000000,00000000,?), ref: 0001190A
GetLastError.KERNEL32 ref: 00011918
LocalAlloc.KERNEL32(00000000,?,?), ref: 0001192C
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?), ref: 00011944
AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00011964
EqualSid.ADVAPI32(00000004,?), ref: 0001197A
FreeSid.ADVAPI32(?), ref: 0001199C
LocalFree.KERNEL32(00000000), ref: 000119A3
CloseHandle.KERNEL32(?), ref: 000119AD

Memory Dump Source

Source File: 00000001.00000002.2614761400.0000000000011000.00000020.00000001.01000000.00000004.sdmp, Offset: 00010000, based on PE: true

Associated: 00000001.00000002.2614739685.0000000000010000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614782170.0000000000018000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000_Ey3OF47.jbxd

Similarity

API ID: Free$Token$AllocateInformationInitializeLibraryLocalProcess$AddressAllocCloseCurrentEqualErrorHandleLastLoadOpenProc
String ID:
API String ID: 2168512254-0
Opcode ID: 08c9a06bc448cbd9e7d779e7f964b1df1cf38be9300976ca549b867a65a27f92
Instruction ID: 5deeba9e1d57de4d9c4edef6d2b49d3b772e2fe3fe430ac56539ab166b44a548
Opcode Fuzzy Hash: 08c9a06bc448cbd9e7d779e7f964b1df1cf38be9300976ca549b867a65a27f92
Instruction Fuzzy Hash: 67314B71A01209AFEB219FA5EC48AFFBBBCFF09310B108429E655D2150E7349945CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0001468F Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 000146A0
SizeofResource.KERNEL32(00000000,00000000,?,00012D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 000146A9
FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 000146C3
LoadResource.KERNEL32(00000000,00000000,?,00012D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 000146CC
LockResource.KERNEL32(00000000,?,00012D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 000146D3
memcpy_s.MSVCRT ref: 000146E5
FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 000146EF

Strings

TITLE, xrefs: 0001469D, 000146C0
smo, xrefs: 000146E4

Memory Dump Source

Source File: 00000001.00000002.2614761400.0000000000011000.00000020.00000001.01000000.00000004.sdmp, Offset: 00010000, based on PE: true

Associated: 00000001.00000002.2614739685.0000000000010000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614782170.0000000000018000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000_Ey3OF47.jbxd

Similarity

API ID: Resource$Find$FreeLoadLockSizeofmemcpy_s
String ID: TITLE$smo
API String ID: 3370778649-3033500379
Opcode ID: 112ce5483c37da93d07ab3bc17bf9e6fa33d7e75532cf88a30f657f7b02d2c76
Instruction ID: dbede054a15ce49cacb6b147080f1e4375b5e94fff8fbaf5d0693c2903a16b9b
Opcode Fuzzy Hash: 112ce5483c37da93d07ab3bc17bf9e6fa33d7e75532cf88a30f657f7b02d2c76
Instruction Fuzzy Hash: CD01D1323412007BF3221BA56C0CFEB3E6CDBCBB62F048014FA49861A0C9B58C8482A3

Uniqueness

Uniqueness Score: -1.00%

Function 000117EE Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 71librarymemoryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(advapi32.dll,00000002,?,00000000,?,?,?,000118DD), ref: 0001181A
GetProcAddress.KERNEL32(00000000,CheckTokenMembership), ref: 0001182C
AllocateAndInitializeSid.ADVAPI32(000118DD,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,000118DD), ref: 00011855
FreeSid.ADVAPI32(?,?,?,?,000118DD), ref: 00011883
FreeLibrary.KERNEL32(00000000,?,?,?,000118DD), ref: 0001188A

Strings

advapi32.dll, xrefs: 00011810
CheckTokenMembership, xrefs: 00011826

Memory Dump Source

Source File: 00000001.00000002.2614761400.0000000000011000.00000020.00000001.01000000.00000004.sdmp, Offset: 00010000, based on PE: true

Associated: 00000001.00000002.2614739685.0000000000010000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614782170.0000000000018000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000_Ey3OF47.jbxd

Similarity

API ID: FreeLibrary$AddressAllocateInitializeLoadProc
String ID: CheckTokenMembership$advapi32.dll
API String ID: 4204503880-1888249752
Opcode ID: c5737588e0721b0101b17b0551964026e87ae3e3e728c549d2039306b6e8d4bd
Instruction ID: dbd6f347968c96415e488bec198467d0b774ffb9b86425cb8e8fe2a1ae73e5f4
Opcode Fuzzy Hash: c5737588e0721b0101b17b0551964026e87ae3e3e728c549d2039306b6e8d4bd
Instruction Fuzzy Hash: DB119331F01209ABEB159FA4DC49AFEBBB8EF49700F104169FA05E3290DB759D418B91

Uniqueness

Uniqueness Score: -1.00%

Function 00013450 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

EndDialog.USER32(?,?), ref: 00013490
GetDesktopWindow.USER32 ref: 0001349A
SetWindowTextA.USER32(?,smo), ref: 000134B2
SetDlgItemTextA.USER32(?,00000838), ref: 000134C4
SetForegroundWindow.USER32(?), ref: 000134CB
EndDialog.USER32(?,00000002), ref: 000134D8

Strings

smo, xrefs: 000134AC

Memory Dump Source

Source File: 00000001.00000002.2614761400.0000000000011000.00000020.00000001.01000000.00000004.sdmp, Offset: 00010000, based on PE: true

Associated: 00000001.00000002.2614739685.0000000000010000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614782170.0000000000018000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000_Ey3OF47.jbxd

Similarity

API ID: Window$DialogText$DesktopForegroundItem
String ID: smo
API String ID: 852535152-2762499640
Opcode ID: 15ca3a1665242aa75c890bd71ea8eeb0aeef5c1bc15ef92afde53717b9138fc6
Instruction ID: c17e49d3622568c9008d814815b0ef1da21a0e95681698ef27f62dd58cc587e7
Opcode Fuzzy Hash: 15ca3a1665242aa75c890bd71ea8eeb0aeef5c1bc15ef92afde53717b9138fc6
Instruction Fuzzy Hash: F7018831741114BBE7675FA5DC0C9ED3B95EB46711F108010F946865A0C779AFC1D785

Uniqueness

Uniqueness Score: -1.00%

Function 00012AAC Relevance: 12.1, APIs: 8, Instructions: 118COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(?,00000104,00000000,00000000,?), ref: 00012AE6
IsDBCSLeadByte.KERNEL32(00000000), ref: 00012AF2
CharNextA.USER32(?), ref: 00012B12
CharUpperA.USER32 ref: 00012B1E
CharPrevA.USER32(?,?), ref: 00012B55
CharNextA.USER32(?), ref: 00012BD4

Memory Dump Source

Source File: 00000001.00000002.2614761400.0000000000011000.00000020.00000001.01000000.00000004.sdmp, Offset: 00010000, based on PE: true

Associated: 00000001.00000002.2614739685.0000000000010000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614782170.0000000000018000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000_Ey3OF47.jbxd

Similarity

API ID: Char$Next$ByteFileLeadModuleNamePrevUpper
String ID:
API String ID: 571164536-0
Opcode ID: 3e4655b4027f93fcef395f8d5550e820c75c4e4c137320f93d9e76241f87ca94
Instruction ID: 5c9a2337b9687c51b691658fd514f255357608580e1aae420bb0ffdf8d5d8db0
Opcode Fuzzy Hash: 3e4655b4027f93fcef395f8d5550e820c75c4e4c137320f93d9e76241f87ca94
Instruction Fuzzy Hash: EB4128346082456FEB569F349C94AFE7BB99F57310F14409AE8C283202DB394ED6CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 000143D0 Relevance: 10.6, APIs: 7, Instructions: 97COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 000143F1
GetWindowRect.USER32(00000000,?), ref: 0001440B
GetDC.USER32(?), ref: 00014423
GetDeviceCaps.GDI32(00000000,00000008), ref: 0001442E
GetDeviceCaps.GDI32(00000000,0000000A), ref: 0001443A
ReleaseDC.USER32(?,00000000), ref: 00014447
SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,00000005,?,?), ref: 000144A2

Memory Dump Source

Source File: 00000001.00000002.2614761400.0000000000011000.00000020.00000001.01000000.00000004.sdmp, Offset: 00010000, based on PE: true

Associated: 00000001.00000002.2614739685.0000000000010000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614782170.0000000000018000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000_Ey3OF47.jbxd

Similarity

API ID: Window$CapsDeviceRect$Release
String ID:
API String ID: 2212493051-0
Opcode ID: c768ec627c60d92e2a0cacd12f4f8f38290868ab55e86dead3b145257aa0b370
Instruction ID: a8efde53df0ef129c73dbb80162b31f160088a2ea9ec527d78544c18d47f866d
Opcode Fuzzy Hash: c768ec627c60d92e2a0cacd12f4f8f38290868ab55e86dead3b145257aa0b370
Instruction Fuzzy Hash: C8313A32F01119AFDB15CFB8DD899EEBBB5EB89310F154169F805F3250EA34AD458BA0

Uniqueness

Uniqueness Score: -1.00%

Function 00016298 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 90COMMON

Download Yara Rule

APIs

Part of subcall function 0001171E: _vsnprintf.MSVCRT ref: 00011750

LoadResource.KERNEL32(00000000,00000000,?,?,00000002,00000000,?,000151CA,00000004,00000024,00012F71,?,00000002,00000000), ref: 000162CD
LockResource.KERNEL32(00000000,?,?,00000002,00000000,?,000151CA,00000004,00000024,00012F71,?,00000002,00000000), ref: 000162D4
FreeResource.KERNEL32(00000000,?,?,00000002,00000000,?,000151CA,00000004,00000024,00012F71,?,00000002,00000000), ref: 0001631B
FindResourceA.KERNEL32(00000000,00000004,0000000A), ref: 00016345
FreeResource.KERNEL32(00000000,?,?,00000002,00000000,?,000151CA,00000004,00000024,00012F71,?,00000002,00000000), ref: 00016357

Strings

UPDFILE%lu, xrefs: 000162B3, 00016329

Memory Dump Source

Source File: 00000001.00000002.2614761400.0000000000011000.00000020.00000001.01000000.00000004.sdmp, Offset: 00010000, based on PE: true

Associated: 00000001.00000002.2614739685.0000000000010000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614782170.0000000000018000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000_Ey3OF47.jbxd

Similarity

API ID: Resource$Free$FindLoadLock_vsnprintf
String ID: UPDFILE%lu
API String ID: 2922116661-2329316264
Opcode ID: 4176a143ea890e2c28a726cd9508c980e048c352fc073692936e55ba4ab93d16
Instruction ID: 1167ce5f8dae18cedc85e4d86da3d31420f2fe9b2377cf28c34d2bb82ffcc70a
Opcode Fuzzy Hash: 4176a143ea890e2c28a726cd9508c980e048c352fc073692936e55ba4ab93d16
Instruction Fuzzy Hash: 59210571A00219AFEB159FA4DC459FFBB78FF49710B104119FA12A3241DB7A9E42CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 0001681F Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 81registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,00000000,00000002), ref: 0001686E
GetSystemMetrics.USER32(0000004A), ref: 000168A7
RegOpenKeyExA.ADVAPI32(80000001,Control Panel\Desktop\ResourceLocale,00000000,00020019,?), ref: 000168CC
RegQueryValueExA.ADVAPI32(?,00011140,00000000,?,?,0000000C), ref: 000168F4
RegCloseKey.ADVAPI32(?), ref: 00016902

Part of subcall function 000166F9: CharNextA.USER32(?,00000001,00000000,00000000,?,?,?,0001691A), ref: 00016741

Strings

Control Panel\Desktop\ResourceLocale, xrefs: 000168C2

Memory Dump Source

Source File: 00000001.00000002.2614761400.0000000000011000.00000020.00000001.01000000.00000004.sdmp, Offset: 00010000, based on PE: true

Associated: 00000001.00000002.2614739685.0000000000010000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614782170.0000000000018000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000_Ey3OF47.jbxd

Similarity

API ID: CharCloseMetricsNextOpenQuerySystemValueVersion
String ID: Control Panel\Desktop\ResourceLocale
API String ID: 3346862599-1109908249
Opcode ID: 74f7a6c158a60116269ce10c3edd925d0e3804dc126ebb6a27d84c9e046aa4a5
Instruction ID: 856bb375470a19e8177755a5ea1277ae967c69cbe4d97b729c79be842eb2e8f2
Opcode Fuzzy Hash: 74f7a6c158a60116269ce10c3edd925d0e3804dc126ebb6a27d84c9e046aa4a5
Instruction Fuzzy Hash: 71314F31A01218AFEB218B61DC45BEAB7BCFB45764F0081A5E94DA6240DB399AC5CB52

Uniqueness

Uniqueness Score: -1.00%

Function 00013A3F Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 73memorystringCOMMON

Download Yara Rule

APIs

Part of subcall function 0001468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 000146A0
Part of subcall function 0001468F: SizeofResource.KERNEL32(00000000,00000000,?,00012D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 000146A9
Part of subcall function 0001468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 000146C3
Part of subcall function 0001468F: LoadResource.KERNEL32(00000000,00000000,?,00012D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 000146CC
Part of subcall function 0001468F: LockResource.KERNEL32(00000000,?,00012D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 000146D3
Part of subcall function 0001468F: memcpy_s.MSVCRT ref: 000146E5
Part of subcall function 0001468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 000146EF

LocalAlloc.KERNEL32(00000040,00000001,00000000,?,00000002,00000000,00012F64,?,00000002,00000000), ref: 00013A5D
LocalFree.KERNEL32(00000000,00000000,00000010,00000000,00000000), ref: 00013AB3

Part of subcall function 000144B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00014518
Part of subcall function 000144B9: MessageBoxA.USER32(?,?,smo,00010010), ref: 00014554

Part of subcall function 00016285: GetLastError.KERNEL32(00015BBC), ref: 00016285

lstrcmpA.KERNEL32(<None>,00000000), ref: 00013AD0
LocalFree.KERNEL32 ref: 00013B13

Part of subcall function 00016517: FindResourceA.KERNEL32(00010000,000007D6,00000005), ref: 0001652A
Part of subcall function 00016517: LoadResource.KERNEL32(00010000,00000000,?,?,00012EE8,00000000,000119E0,00000547,0000083E,?,?,?,?,?,?,?), ref: 00016538
Part of subcall function 00016517: DialogBoxIndirectParamA.USER32(00010000,00000000,00000547,000119E0,00000000), ref: 00016557
Part of subcall function 00016517: FreeResource.KERNEL32(00000000,?,?,00012EE8,00000000,000119E0,00000547,0000083E,?,?,?,?,?,?,?,00000002), ref: 00016560

LocalFree.KERNEL32(00000000,00013100,00000000,00000000), ref: 00013AF4

Strings

<None>, xrefs: 00013AC5
LICENSE, xrefs: 00013A46

Memory Dump Source

Source File: 00000001.00000002.2614761400.0000000000011000.00000020.00000001.01000000.00000004.sdmp, Offset: 00010000, based on PE: true

Associated: 00000001.00000002.2614739685.0000000000010000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614782170.0000000000018000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000_Ey3OF47.jbxd

Similarity

API ID: Resource$Free$Local$FindLoad$AllocDialogErrorIndirectLastLockMessageParamSizeofStringlstrcmpmemcpy_s
String ID: <None>$LICENSE
API String ID: 2414642746-383193767
Opcode ID: 22c0ac70f7d3963e87cb589525e58717c9e4b8762963b04f02a2b038862e80fc
Instruction ID: 5baf9654e038635a950245d23f30bfee65bab8753d0324f8b49016424ead2229
Opcode Fuzzy Hash: 22c0ac70f7d3963e87cb589525e58717c9e4b8762963b04f02a2b038862e80fc
Instruction Fuzzy Hash: 3D11DA30301301BBE7245F32AC19EDB3AF9DFDA700B10C02EB645D65B2DA7D89808665

Uniqueness

Uniqueness Score: -1.00%

Function 000124E0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104,00000000,00000000), ref: 00012506
WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,?), ref: 0001252C
_lopen.KERNEL32(?,00000040), ref: 0001253B
_llseek.KERNEL32(00000000,00000000,00000002), ref: 0001254C
_lclose.KERNEL32(00000000), ref: 00012555

Strings

wininit.ini, xrefs: 00012510

Memory Dump Source

Source File: 00000001.00000002.2614761400.0000000000011000.00000020.00000001.01000000.00000004.sdmp, Offset: 00010000, based on PE: true

Associated: 00000001.00000002.2614739685.0000000000010000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614782170.0000000000018000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000_Ey3OF47.jbxd

Similarity

API ID: DirectoryPrivateProfileStringWindowsWrite_lclose_llseek_lopen
String ID: wininit.ini
API String ID: 3273605193-4206010578
Opcode ID: f4f64ba178ed351f8bc731da354c5d11adc6bf84dc703e35886abe68083f5304
Instruction ID: 365592f3dc9533659f487f589ce9360a1d34c0efc15ff87252292f47043a47f9
Opcode Fuzzy Hash: f4f64ba178ed351f8bc731da354c5d11adc6bf84dc703e35886abe68083f5304
Instruction Fuzzy Hash: CE01F132B011186BD720DB659C4CEEFBBBDEB8A760F004154FA48D3190DE788E81CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 000136EE Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 243windowCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,00000000,?,?), ref: 00013723
MessageBeep.USER32(00000000), ref: 000139C3
MessageBoxA.USER32(00000000,00000000,smo,00000030), ref: 000139F1

Strings

smo, xrefs: 000139E9, 00013A19
3, xrefs: 00013785

Memory Dump Source

Source File: 00000001.00000002.2614761400.0000000000011000.00000020.00000001.01000000.00000004.sdmp, Offset: 00010000, based on PE: true

Associated: 00000001.00000002.2614739685.0000000000010000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614782170.0000000000018000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000_Ey3OF47.jbxd

Similarity

API ID: Message$BeepVersion
String ID: 3$smo
API String ID: 2519184315-1411035656
Opcode ID: 1e87f7dfc8be74e784689e81ccac182d2d6982a4a9d4e69b9faba72f9cfe00ba
Instruction ID: 851f8b07d733bd5d2bf38e71b530bda419eccd350cd2ea4bfc0d7b977d36a49b
Opcode Fuzzy Hash: 1e87f7dfc8be74e784689e81ccac182d2d6982a4a9d4e69b9faba72f9cfe00ba
Instruction Fuzzy Hash: 8791E2B1A012249FEBB58B24CC817EAB7E4AF45304F5540A9D8899B291DB758FC1CB42

Uniqueness

Uniqueness Score: -1.00%

Function 00016495 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 41libraryCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,advpack.dll,?,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,?,00000000), ref: 000164DF
LoadLibraryExA.KERNEL32(?,00000000,00000008,?,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,?,00000000), ref: 000164F9
LoadLibraryA.KERNEL32(advpack.dll,?,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,?,00000000), ref: 00016502

Strings

C:\Users\user\AppData\Local\Temp\IXP001.TMP\, xrefs: 000164AC
advpack.dll, xrefs: 000164C2, 000164CD, 00016501

Memory Dump Source

Source File: 00000001.00000002.2614761400.0000000000011000.00000020.00000001.01000000.00000004.sdmp, Offset: 00010000, based on PE: true

Associated: 00000001.00000002.2614739685.0000000000010000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614782170.0000000000018000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000_Ey3OF47.jbxd

Similarity

API ID: LibraryLoad$AttributesFile
String ID: C:\Users\user\AppData\Local\Temp\IXP001.TMP\$advpack.dll
API String ID: 438848745-875882553
Opcode ID: 1c9aa34d278539c24c3834b6a77a80a25188abc167159287c46bd7d26a34bcbf
Instruction ID: e65e5c5ae81ff6182c3be54250cf0caa8e5e87afff0d6c65bccc41c37104ae88
Opcode Fuzzy Hash: 1c9aa34d278539c24c3834b6a77a80a25188abc167159287c46bd7d26a34bcbf
Instruction Fuzzy Hash: 24014430A00108ABEB60DBA0DC49FEE7379EB55310F400194F985931C0CF75AECACB41

Uniqueness

Uniqueness Score: -1.00%

Function 000128E8 Relevance: 7.6, APIs: 5, Instructions: 140memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(00000000), ref: 00012A6F

Part of subcall function 00012773: CharUpperA.USER32(199D070E,00000000,00000000,00000000), ref: 000127A8
Part of subcall function 00012773: CharNextA.USER32(0000054D), ref: 000127B5
Part of subcall function 00012773: CharNextA.USER32(00000000), ref: 000127BC
Part of subcall function 00012773: RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00020019,?,?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 00012829
Part of subcall function 00012773: RegQueryValueExA.ADVAPI32(?,00011140,00000000,?,-00000005,?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 00012852
Part of subcall function 00012773: ExpandEnvironmentStringsA.KERNEL32(-00000005,?,00000104,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 00012870
Part of subcall function 00012773: RegCloseKey.ADVAPI32(?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 000128A0

GlobalAlloc.KERNEL32(00000042,00000000,?,?,?,?,?,?,?,?,00013938,?,?,?,?,-00000005), ref: 00012958
GlobalLock.KERNEL32(00000000,?,?,?,?,?,?,?,?,00013938,?,?,?,?,-00000005,?), ref: 00012969
GlobalUnlock.KERNEL32(00000000,?,?,?,?,?,?,?,?,00013938,?,?,?,?,-00000005,?), ref: 00012A21
GlobalUnlock.KERNEL32(00000000,?,?,?,?), ref: 00012A81

Memory Dump Source

Source File: 00000001.00000002.2614761400.0000000000011000.00000020.00000001.01000000.00000004.sdmp, Offset: 00010000, based on PE: true

Associated: 00000001.00000002.2614739685.0000000000010000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614782170.0000000000018000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000_Ey3OF47.jbxd

Similarity

API ID: Global$Char$NextUnlock$AllocCloseEnvironmentExpandFreeLockOpenQueryStringsUpperValue
String ID:
API String ID: 3949799724-0
Opcode ID: b2af4b5ce00967381a67a2f5d9349e6525eea3eea4371116825b1cea10d45a29
Instruction ID: d4b5b7329e6c5bc75252bef5c394d839bbb1a6a3050e53ae3db35c0f33cc0944
Opcode Fuzzy Hash: b2af4b5ce00967381a67a2f5d9349e6525eea3eea4371116825b1cea10d45a29
Instruction Fuzzy Hash: 5A513831E00219DFDB21CF98D884AEEBBB5FF48710F54816AE901E3211DB359991DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00014169 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0001468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 000146A0
Part of subcall function 0001468F: SizeofResource.KERNEL32(00000000,00000000,?,00012D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 000146A9
Part of subcall function 0001468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 000146C3
Part of subcall function 0001468F: LoadResource.KERNEL32(00000000,00000000,?,00012D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 000146CC
Part of subcall function 0001468F: LockResource.KERNEL32(00000000,?,00012D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 000146D3
Part of subcall function 0001468F: memcpy_s.MSVCRT ref: 000146E5
Part of subcall function 0001468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 000146EF

LocalAlloc.KERNEL32(00000040,?,00000000,00000000,00000105,00000000,000130B4), ref: 00014189
LocalFree.KERNEL32(00000000,?,00000000,00000000,00000105,00000000,000130B4), ref: 000141E7

Part of subcall function 000144B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00014518
Part of subcall function 000144B9: MessageBoxA.USER32(?,?,smo,00010010), ref: 00014554

Strings

<None>, xrefs: 000141C5
FINISHMSG, xrefs: 00014173, 000141AB

Memory Dump Source

Source File: 00000001.00000002.2614761400.0000000000011000.00000020.00000001.01000000.00000004.sdmp, Offset: 00010000, based on PE: true

Associated: 00000001.00000002.2614739685.0000000000010000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614782170.0000000000018000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000_Ey3OF47.jbxd

Similarity

API ID: Resource$FindFreeLoadLocal$AllocLockMessageSizeofStringmemcpy_s
String ID: <None>$FINISHMSG
API String ID: 3507850446-3091758298
Opcode ID: 0eed46b8fb5436bee358af11d17a692707b179739ec73977b783796d92c7335d
Instruction ID: 4df4fa83cd84486b37571e435c35553879a48f61c278b75661818353118fdc45
Opcode Fuzzy Hash: 0eed46b8fb5436bee358af11d17a692707b179739ec73977b783796d92c7335d
Instruction Fuzzy Hash: 2401F4B57013143BF32916658C96FFB218EDBDA795F114025BB05E21A1DA6CCCC141B5

Uniqueness

Uniqueness Score: -1.00%

Function 00017155 Relevance: 7.6, APIs: 5, Instructions: 51timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 00017182
GetCurrentProcessId.KERNEL32 ref: 00017191
GetCurrentThreadId.KERNEL32 ref: 0001719A
GetTickCount.KERNEL32 ref: 000171A3
QueryPerformanceCounter.KERNEL32(?), ref: 000171B8

Memory Dump Source

Source File: 00000001.00000002.2614761400.0000000000011000.00000020.00000001.01000000.00000004.sdmp, Offset: 00010000, based on PE: true

Associated: 00000001.00000002.2614739685.0000000000010000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614782170.0000000000018000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000_Ey3OF47.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: ebf9e2f2173f71e01f85a2cb1e09941b6bb2483af1a93045743d414f9f3661ed
Instruction ID: aa2eb2f07cfc3b167d88436c718998a73551f36a74cdbc8392ee45992f2f6ccb
Opcode Fuzzy Hash: ebf9e2f2173f71e01f85a2cb1e09941b6bb2483af1a93045743d414f9f3661ed
Instruction Fuzzy Hash: 2F114C71E05208EFDB50DFF8DA48ADEB7F4EF08310F618855E805E7210EA389B048B41

Uniqueness

Uniqueness Score: -1.00%

Function 000119E0 Relevance: 7.6, APIs: 5, Instructions: 51windowCOMMON

Download Yara Rule

APIs

EndDialog.USER32(?,?), ref: 00011A18
GetDesktopWindow.USER32 ref: 00011A24
LoadStringA.USER32(?,?,00000200), ref: 00011A4F
SetDlgItemTextA.USER32(?,0000083F,00000000), ref: 00011A62
MessageBeep.USER32(000000FF), ref: 00011A6A

Memory Dump Source

Source File: 00000001.00000002.2614761400.0000000000011000.00000020.00000001.01000000.00000004.sdmp, Offset: 00010000, based on PE: true

Associated: 00000001.00000002.2614739685.0000000000010000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614782170.0000000000018000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000_Ey3OF47.jbxd

Similarity

API ID: BeepDesktopDialogItemLoadMessageStringTextWindow
String ID:
API String ID: 1273765764-0
Opcode ID: 39e84f61f29795b4368fe772a80a92cc868b760fb875ef263a882859697f437c
Instruction ID: 5d5a2e6a8d06464e268fa166d81a1829422319236c92b926deb010f15c96a36d
Opcode Fuzzy Hash: 39e84f61f29795b4368fe772a80a92cc868b760fb875ef263a882859697f437c
Instruction Fuzzy Hash: 4211A131601109AFEB15EF64DD08AEE7BB8EF4A310F508154FA1292191DA359E41CB96

Uniqueness

Uniqueness Score: -1.00%

Function 000163C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 69fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,?,C:\Users\user\AppData\Local\Temp\IXP001.TMP\), ref: 0001642D
WriteFile.KERNEL32(00000000,?,?,00000000,00000000,?,C:\Users\user\AppData\Local\Temp\IXP001.TMP\), ref: 0001645B
CloseHandle.KERNEL32(00000000,?,C:\Users\user\AppData\Local\Temp\IXP001.TMP\), ref: 0001647A

Strings

C:\Users\user\AppData\Local\Temp\IXP001.TMP\, xrefs: 000163EB

Memory Dump Source

Source File: 00000001.00000002.2614761400.0000000000011000.00000020.00000001.01000000.00000004.sdmp, Offset: 00010000, based on PE: true

Associated: 00000001.00000002.2614739685.0000000000010000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614782170.0000000000018000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000_Ey3OF47.jbxd

Similarity

API ID: File$CloseCreateHandleWrite
String ID: C:\Users\user\AppData\Local\Temp\IXP001.TMP\
API String ID: 1065093856-3647970563
Opcode ID: fdc22740418aa86d34994e9ac2a2751c044ef944705df22abcd8ae44f73bcfc9
Instruction ID: 8bc7e55e3da186b987a9e308aeb55cd9da390f85e61caf124b3f46c5b9823db7
Opcode Fuzzy Hash: fdc22740418aa86d34994e9ac2a2751c044ef944705df22abcd8ae44f73bcfc9
Instruction Fuzzy Hash: A721D571A0021CABD711DF25DC85FEB77BCEB49314F1041A9F585A3280DAB55DC48FA4

Uniqueness

Uniqueness Score: -1.00%

Function 000147E0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000008,?,00000000,00014E6F), ref: 000147EA
LocalAlloc.KERNEL32(00000040,?), ref: 00014823
LocalFree.KERNEL32(00000000,00000000,00000000,00000010,00000000), ref: 00014847

Part of subcall function 000144B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00014518
Part of subcall function 000144B9: MessageBoxA.USER32(?,?,smo,00010010), ref: 00014554

Strings

C:\Users\user\AppData\Local\Temp\IXP001.TMP\, xrefs: 00014851

Memory Dump Source

Source File: 00000001.00000002.2614761400.0000000000011000.00000020.00000001.01000000.00000004.sdmp, Offset: 00010000, based on PE: true

Associated: 00000001.00000002.2614739685.0000000000010000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614782170.0000000000018000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000_Ey3OF47.jbxd

Similarity

API ID: Local$Alloc$FreeLoadMessageString
String ID: C:\Users\user\AppData\Local\Temp\IXP001.TMP\
API String ID: 359063898-3647970563
Opcode ID: 85f5e95461371c46243d888c8848c22309452afe7350ead36e35aa84774555a5
Instruction ID: 74948eb131712c39df4d9f40cd42f8ac53fd1156990907c2bd106db09824c643
Opcode Fuzzy Hash: 85f5e95461371c46243d888c8848c22309452afe7350ead36e35aa84774555a5
Instruction Fuzzy Hash: D11125796046416FE7659F249C58FFA3B9AEBC6310B04C519FE82CB351DE39CC468760

Uniqueness

Uniqueness Score: -1.00%

Function 00016517 Relevance: 6.1, APIs: 4, Instructions: 51COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(00010000,000007D6,00000005), ref: 0001652A
LoadResource.KERNEL32(00010000,00000000,?,?,00012EE8,00000000,000119E0,00000547,0000083E,?,?,?,?,?,?,?), ref: 00016538
DialogBoxIndirectParamA.USER32(00010000,00000000,00000547,000119E0,00000000), ref: 00016557
FreeResource.KERNEL32(00000000,?,?,00012EE8,00000000,000119E0,00000547,0000083E,?,?,?,?,?,?,?,00000002), ref: 00016560

Memory Dump Source

Source File: 00000001.00000002.2614761400.0000000000011000.00000020.00000001.01000000.00000004.sdmp, Offset: 00010000, based on PE: true

Associated: 00000001.00000002.2614739685.0000000000010000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614782170.0000000000018000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000_Ey3OF47.jbxd

Similarity

API ID: Resource$DialogFindFreeIndirectLoadParam
String ID:
API String ID: 1214682469-0
Opcode ID: 10db9d4931ac8f7fc9f2655e53874226c3a2afdfa6a85aca37c6a67615aba979
Instruction ID: 1b0b029d5df046b30732f676a1984c447b696254eb50e7a6babc4535886cd64f
Opcode Fuzzy Hash: 10db9d4931ac8f7fc9f2655e53874226c3a2afdfa6a85aca37c6a67615aba979
Instruction Fuzzy Hash: 12012672200A05BBEB215F699C08DFB7AADEB8A360F004125FE0093150DB76CD9086A1

Uniqueness

Uniqueness Score: -1.00%

Function 00013680 Relevance: 6.1, APIs: 4, Instructions: 51windowCOMMON

Download Yara Rule

APIs

MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000004FF), ref: 0001369F
PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 000136B2
DispatchMessageA.USER32(?), ref: 000136CB
PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 000136DA

Memory Dump Source

Source File: 00000001.00000002.2614761400.0000000000011000.00000020.00000001.01000000.00000004.sdmp, Offset: 00010000, based on PE: true

Associated: 00000001.00000002.2614739685.0000000000010000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614782170.0000000000018000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000_Ey3OF47.jbxd

Similarity

API ID: Message$Peek$DispatchMultipleObjectsWait
String ID:
API String ID: 2776232527-0
Opcode ID: 7bdd6005debeb3bc886d9db62613e4f6fa495786ef6c0edd674099d069ae3acf
Instruction ID: 5b9cbbad3a53da24ed08495ab02475281159e0a00f20235bf4d09eb4370d5962
Opcode Fuzzy Hash: 7bdd6005debeb3bc886d9db62613e4f6fa495786ef6c0edd674099d069ae3acf
Instruction Fuzzy Hash: 12018472A01214BBDB304AA65C48EEB7ABCEB86B10F004129F905E2184D5648684C660

Uniqueness

Uniqueness Score: -1.00%

Function 000165E8 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

CharPrevA.USER32(?,00000000,00000000,00000001,00000000,00012B33), ref: 00016602
CharPrevA.USER32(?,00000000), ref: 00016612
CharPrevA.USER32(?,00000000), ref: 00016629
CharNextA.USER32(00000000), ref: 00016635

Memory Dump Source

Source File: 00000001.00000002.2614761400.0000000000011000.00000020.00000001.01000000.00000004.sdmp, Offset: 00010000, based on PE: true

Associated: 00000001.00000002.2614739685.0000000000010000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614782170.0000000000018000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000_Ey3OF47.jbxd

Similarity

API ID: Char$Prev$Next
String ID:
API String ID: 3260447230-0
Opcode ID: d71a82c647f4fb91618df8be2a061bda14bcc0806414d597f4fd392f01776f48
Instruction ID: 2e8ad497a9fca298d3b0a87713f07d46aa806e3e79dc8b17fa0279058f5bb7d4
Opcode Fuzzy Hash: d71a82c647f4fb91618df8be2a061bda14bcc0806414d597f4fd392f01776f48
Instruction Fuzzy Hash: 2FF028321065507EE7331F288C888FBBFDCDF87355B2941AFE89582101D61B0D868661

Uniqueness

Uniqueness Score: -1.00%

Function 000169B0 Relevance: 6.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

Part of subcall function 00016FBE: GetModuleHandleW.KERNEL32(00000000), ref: 00016FC5

__set_app_type.MSVCRT ref: 000169C2
__p__fmode.MSVCRT ref: 000169D8
__p__commode.MSVCRT ref: 000169E6
__setusermatherr.MSVCRT ref: 00016A07

Memory Dump Source

Source File: 00000001.00000002.2614761400.0000000000011000.00000020.00000001.01000000.00000004.sdmp, Offset: 00010000, based on PE: true

Associated: 00000001.00000002.2614739685.0000000000010000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614782170.0000000000018000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2614801946.000000000001C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000_Ey3OF47.jbxd

Similarity

API ID: HandleModule__p__commode__p__fmode__set_app_type__setusermatherr
String ID:
API String ID: 1632413811-0
Opcode ID: 59f18e8595e521986476af39db1d1c513337b81864eb5e790c13028ff08c036c
Instruction ID: 4dc73675414fbccb590a863c9233d6a3b780e452b76166d55a35944e37ff84b0
Opcode Fuzzy Hash: 59f18e8595e521986476af39db1d1c513337b81864eb5e790c13028ff08c036c
Instruction Fuzzy Hash: 1BF09874609301DFE759AB78ED4A6D43BA2FB09331B10C619F865862E2CF3E8685CB11

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: BC5tT98.exePID: 7328, Parent PID: 7312COMMON

Execution Graph

Execution Coverage:	27.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	971
Total number of Limit Nodes:	46

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00BA3BA2 Relevance: 40.6, APIs: 11, Strings: 12, Instructions: 308
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00BA3C11
CompareStringA.KERNEL32(0000007F,00000001,?,000000FF,<None>,000000FF,00000104,00000004), ref: 00BA3CDC

Part of subcall function 00BA468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00BA46A0
Part of subcall function 00BA468F: SizeofResource.KERNEL32(00000000,00000000,?,00BA2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00BA46A9
Part of subcall function 00BA468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00BA46C3
Part of subcall function 00BA468F: LoadResource.KERNEL32(00000000,00000000,?,00BA2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00BA46CC
Part of subcall function 00BA468F: LockResource.KERNEL32(00000000,?,00BA2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00BA46D3
Part of subcall function 00BA468F: memcpy_s.MSVCRT ref: 00BA46E5
Part of subcall function 00BA468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 00BA46EF

CompareStringA.KERNEL32(0000007F,00000001,?,000000FF,<None>,000000FF,00000104,?,00BA8C42), ref: 00BA3D8F
GetProcAddress.KERNEL32(00000000,DoInfInstall), ref: 00BA3E26
FreeLibrary.KERNEL32(00000000,?,00BA8C42), ref: 00BA3EFF
LocalFree.KERNEL32(?,?,?,?,00BA8C42), ref: 00BA3F1F
FreeLibrary.KERNEL32(00000000,?,00BA8C42), ref: 00BA3F40
LocalFree.KERNEL32(?,?,?,?,00BA8C42), ref: 00BA3F47
FreeLibrary.KERNEL32(00000000,DoInfInstall,00000000,00000010,00000000,?,00BA8C42), ref: 00BA3F76
LocalFree.KERNEL32(?,advpack.dll,00000000,00000010,00000000,?,?,?,00BA8C42), ref: 00BA3F80
LocalFree.KERNEL32(?,00000000,00000000,00000010,00000000,?,?,?,00BA8C42), ref: 00BA3FC2

Strings

RUNPROGRAM, xrefs: 00BA3D05
D, xrefs: 00BA3C19
REBOOT, xrefs: 00BA3BE2
USRQCMD, xrefs: 00BA3CAD
advpack.dll, xrefs: 00BA3F9D
SHOWWINDOW, xrefs: 00BA3C34
DoInfInstall, xrefs: 00BA3E1F, 00BA3E24, 00BA3F68
smo, xrefs: 00BA3E68
<None>, xrefs: 00BA3CC9, 00BA3D7D
C:\Users\user\AppData\Local\Temp\IXP002.TMP\, xrefs: 00BA3E74
ADMQCMD, xrefs: 00BA3C9E
POSTRUNPROGRAM, xrefs: 00BA3D60

Memory Dump Source

Source File: 00000002.00000002.2584327656.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000002.00000002.2584302635.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584354562.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ba0000_BC5tT98.jbxd

Similarity

API ID: Free$Resource$Local$Library$CompareFindString$AddressLoadLockProcSizeofmemcpy_smemset
String ID: <None>$ADMQCMD$C:\Users\user\AppData\Local\Temp\IXP002.TMP\$D$DoInfInstall$POSTRUNPROGRAM$REBOOT$RUNPROGRAM$SHOWWINDOW$USRQCMD$advpack.dll$smo
API String ID: 1032054927-1275553841
Opcode ID: 6d7f8c93278e57fb5108200c0aca89cb9ef802e42d14e39f6b0a5a4b86e18f32
Instruction ID: b31059fddd091eacca4c81be4b177f2b89fe8971dd656d20e78390bf3bf92409
Opcode Fuzzy Hash: 6d7f8c93278e57fb5108200c0aca89cb9ef802e42d14e39f6b0a5a4b86e18f32
Instruction Fuzzy Hash: AAB1C370A1C3019FD760DF28D846B6B76E4EB87B50F1009AEFA95D7190EB71C944CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00BA1AE8 Relevance: 38.8, APIs: 10, Strings: 12, Instructions: 291
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CompareStringA.KERNEL32(0000007F,00000001,00000000,000000FF,.INF,000000FF,?,?,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,?,?,00000000,00000001,00000000), ref: 00BA1BE7
GetFileAttributesA.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,?,?,00000000,00000001,00000000), ref: 00BA1BFE
LocalAlloc.KERNEL32(00000040,00000200,?,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,?,?,00000000,00000001,00000000), ref: 00BA1C57
GetPrivateProfileIntA.KERNEL32(?,Reboot,00000000,?), ref: 00BA1C88
GetPrivateProfileStringA.KERNEL32(Version,AdvancedINF,00BA1140,00000000,00000008,?), ref: 00BA1CB8
GetShortPathNameA.KERNEL32(?,?,00000104), ref: 00BA1D1B

Part of subcall function 00BA44B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00BA4518
Part of subcall function 00BA44B9: MessageBoxA.USER32(?,?,smo,00010010), ref: 00BA4554

Strings

setupapi.dll, xrefs: 00BA1D23, 00BA1D3A
Reboot, xrefs: 00BA1C82
", xrefs: 00BA1B25
Version, xrefs: 00BA1CB3
.BAT, xrefs: 00BA1D83
setupx.dll, xrefs: 00BA1D14
C:\Users\user\AppData\Local\Temp\IXP002.TMP\, xrefs: 00BA1BA0
Command.com /c %s, xrefs: 00BA1D9B, 00BA1DE8
DefaultInstall, xrefs: 00BA1C74, 00BA1C87, 00BA1CCE, 00BA1CD3, 00BA1D2D, 00BA1D39
.INF, xrefs: 00BA1BDB
AdvancedINF, xrefs: 00BA1CAE
rundll32.exe %s,InstallHinfSection %s 128 %s, xrefs: 00BA1D3B

Memory Dump Source

Source File: 00000002.00000002.2584327656.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000002.00000002.2584302635.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584354562.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ba0000_BC5tT98.jbxd

Similarity

API ID: String$PrivateProfile$AllocAttributesCompareFileLoadLocalMessageNamePathShort
String ID: "$.BAT$.INF$AdvancedINF$C:\Users\user\AppData\Local\Temp\IXP002.TMP\$Command.com /c %s$DefaultInstall$Reboot$Version$rundll32.exe %s,InstallHinfSection %s 128 %s$setupapi.dll$setupx.dll
API String ID: 383838535-852641736
Opcode ID: 4191ef1f633e46bade6a9b472433ebf3bcf51e4ffebe6f6acedee0514635207e
Instruction ID: 3e3dac493396d24bc0728301d79bdd13d7cc363e7ea57ab53f4051a68dd4594b
Opcode Fuzzy Hash: 4191ef1f633e46bade6a9b472433ebf3bcf51e4ffebe6f6acedee0514635207e
Instruction Fuzzy Hash: FEA15B71A0C2146BEBA09B2CCC45BEA77E9DB47310F144AE5E595B32D0DFB09D85CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00BA2F1D Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 120
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryA.KERNEL32(?,00000105), ref: 00BA2F93
LoadLibraryA.KERNEL32(?,advapi32.dll), ref: 00BA2FB2
GetProcAddress.KERNEL32(00000000,DecryptFileA), ref: 00BA2FC6
DecryptFileA.ADVAPI32 ref: 00BA2FE6
FreeLibrary.KERNEL32(00000000), ref: 00BA2FF8
SetCurrentDirectoryA.KERNELBASE(C:\Users\user\AppData\Local\Temp\IXP002.TMP\), ref: 00BA301C

Part of subcall function 00BA51E5: LocalAlloc.KERNEL32(00000040,00000001,00000000,?,00000002,00000000,00BA2F4D,?,00000002,00000000), ref: 00BA5201

Strings

advapi32.dll, xrefs: 00BA2F99
C:\Users\user\AppData\Local\Temp\IXP002.TMP\, xrefs: 00BA2FDB, 00BA3017
DecryptFileA, xrefs: 00BA2FC0

Memory Dump Source

Source File: 00000002.00000002.2584327656.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000002.00000002.2584302635.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584354562.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ba0000_BC5tT98.jbxd

Similarity

API ID: DirectoryLibrary$AddressAllocCurrentDecryptFileFreeLoadLocalProcSystem
String ID: C:\Users\user\AppData\Local\Temp\IXP002.TMP\$DecryptFileA$advapi32.dll
API String ID: 2126469477-2099937843
Opcode ID: 468a057a8a617e48fbea96ddbf13c6e60030f9c32358afdd18b1c18354a1c41b
Instruction ID: 866598fb1b092e28485ed4392f3aabdea76429d2ba69a01d2e1ff6f13caef64e
Opcode Fuzzy Hash: 468a057a8a617e48fbea96ddbf13c6e60030f9c32358afdd18b1c18354a1c41b
Instruction Fuzzy Hash: 2D41D330A082059EDB30AB75EC4B76A37E9EB67B50F0000E6F941D35A1EF74CE80CA61

Uniqueness

Uniqueness Score: -1.00%

Function 00BA2390 Relevance: 12.1, APIs: 8, Instructions: 93
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileA.KERNELBASE(?,00BA8A3A,00BA11F4,00BA8A3A,00000000,?,?), ref: 00BA23F6
lstrcmpA.KERNEL32(?,00BA11F8), ref: 00BA2427
lstrcmpA.KERNEL32(?,00BA11FC), ref: 00BA243B
SetFileAttributesA.KERNEL32(?,00000080,?), ref: 00BA2495
DeleteFileA.KERNEL32(?), ref: 00BA24A3
FindNextFileA.KERNELBASE(00000000,00000010), ref: 00BA24AF
FindClose.KERNELBASE(00000000), ref: 00BA24BE
RemoveDirectoryA.KERNELBASE(00BA8A3A), ref: 00BA24C5

Memory Dump Source

Source File: 00000002.00000002.2584327656.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000002.00000002.2584302635.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584354562.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ba0000_BC5tT98.jbxd

Similarity

API ID: File$Find$lstrcmp$AttributesCloseDeleteDirectoryFirstNextRemove
String ID:
API String ID: 836429354-0
Opcode ID: 0988155890a2c14ae7759e9e1eb42bd57c19dc3cc1cb14193363b90fa8279f8e
Instruction ID: 74bfb4521942b3eb6543323b021e92cdb68006991cce963f621c78f1c22668d8
Opcode Fuzzy Hash: 0988155890a2c14ae7759e9e1eb42bd57c19dc3cc1cb14193363b90fa8279f8e
Instruction Fuzzy Hash: 90316031608640ABD321DBA8CD8AAEB73ECEB8B305F04496DA55587290EF349909C762

Uniqueness

Uniqueness Score: -1.00%

Function 00BA2BFB Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 63libraryloaderCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(?,00000002,00000000,?,00BA6BB0,00BA0000,00000000,00000002,0000000A), ref: 00BA2C03
GetModuleHandleW.KERNEL32(Kernel32.dll,?,00BA6BB0,00BA0000,00000000,00000002,0000000A), ref: 00BA2C18
GetProcAddress.KERNEL32(00000000,HeapSetInformation), ref: 00BA2C28
CloseHandle.KERNEL32(00000000,?,?,00BA6BB0,00BA0000,00000000,00000002,0000000A), ref: 00BA2C98

Strings

HeapSetInformation, xrefs: 00BA2C22
Kernel32.dll, xrefs: 00BA2C13

Memory Dump Source

Source File: 00000002.00000002.2584327656.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000002.00000002.2584302635.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584354562.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ba0000_BC5tT98.jbxd

Similarity

API ID: Handle$AddressCloseModuleProcVersion
String ID: HeapSetInformation$Kernel32.dll
API String ID: 62482547-3460614246
Opcode ID: 06789c4e427d5b9b3a6a87fce34b91c4a0ba852fb5a1895389541c9a7fe0e088
Instruction ID: f9f942886cbf09ec17e6142165a42ac14b9f4a394a092dfc3fc950eeaa82728b
Opcode Fuzzy Hash: 06789c4e427d5b9b3a6a87fce34b91c4a0ba852fb5a1895389541c9a7fe0e088
Instruction Fuzzy Hash: CF11CE312083057BD7206BBCAC8AB6F37E9DB8B7A0B0500A5F900E3260EF31DC01C661

Uniqueness

Uniqueness Score: -1.00%

Function 00BA202A Relevance: 42.2, APIs: 16, Strings: 8, Instructions: 185
registrylibrarymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00BA2050
memset.MSVCRT ref: 00BA205F
RegCreateKeyExA.KERNELBASE(80000002,Software\Microsoft\Windows\CurrentVersion\RunOnce,00000000,00000000,00000000,0002001F,00000000,?,?,?,?,?,?,00000000,00000000), ref: 00BA208C

Part of subcall function 00BA171E: _vsnprintf.MSVCRT ref: 00BA1750

RegQueryValueExA.KERNELBASE(?,wextract_cleanup2,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00BA20C9
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00BA20EA
GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00BA2103
LoadLibraryA.KERNELBASE(?,advpack.dll,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00BA2122
GetProcAddress.KERNEL32(00000000,DelNodeRunDLL32), ref: 00BA2134
FreeLibrary.KERNELBASE(00000000,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00BA2144
GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00BA215B
GetModuleFileNameA.KERNEL32(?,00000104,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00BA218C
LocalAlloc.KERNEL32(00000040,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00BA21C1
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00BA21E4
RegSetValueExA.KERNELBASE(?,wextract_cleanup2,00000000,00000001,00000000,00000002,?,?,?,?,?,?,?,?,?), ref: 00BA223D
RegCloseKey.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00BA2249
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00BA2250

Strings

%s /D:%s, xrefs: 00BA21FF, 00BA2210
wextract_cleanup2, xrefs: 00BA20A5, 00BA20BE, 00BA20F0, 00BA2232
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 00BA2082
rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s", xrefs: 00BA21F6
advpack.dll, xrefs: 00BA2109
C:\Users\user\AppData\Local\Temp\IXP002.TMP\, xrefs: 00BA21A8, 00BA2204
wextract_cleanup%d, xrefs: 00BA209E
DelNodeRunDLL32, xrefs: 00BA212E

Memory Dump Source

Source File: 00000002.00000002.2584327656.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000002.00000002.2584302635.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584354562.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ba0000_BC5tT98.jbxd

Similarity

API ID: Close$DirectoryFreeLibraryLocalSystemValuememset$AddressAllocCreateFileLoadModuleNameProcQuery_vsnprintf
String ID: %s /D:%s$C:\Users\user\AppData\Local\Temp\IXP002.TMP\$DelNodeRunDLL32$Software\Microsoft\Windows\CurrentVersion\RunOnce$advpack.dll$rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s"$wextract_cleanup%d$wextract_cleanup2
API String ID: 178549006-2699677747
Opcode ID: 7809f149a93be661bfaa018d360a1014ec350f591af9bc7d3ef24ff55781831a
Instruction ID: f3c6dc013c4446a2d5b8b21ab73efa9606b9ce9b41b1b950aa38f31000fd7fe7
Opcode Fuzzy Hash: 7809f149a93be661bfaa018d360a1014ec350f591af9bc7d3ef24ff55781831a
Instruction Fuzzy Hash: C051B271A08214ABDB309B68DC4AFFA77A8EB57700F0041E5FA49A7151EF719D49CA60

Uniqueness

Uniqueness Score: -1.00%

Function 00BA55A0 Relevance: 31.7, APIs: 12, Strings: 6, Instructions: 248
memorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00BA468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00BA46A0
Part of subcall function 00BA468F: SizeofResource.KERNEL32(00000000,00000000,?,00BA2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00BA46A9
Part of subcall function 00BA468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00BA46C3
Part of subcall function 00BA468F: LoadResource.KERNEL32(00000000,00000000,?,00BA2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00BA46CC
Part of subcall function 00BA468F: LockResource.KERNEL32(00000000,?,00BA2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00BA46D3
Part of subcall function 00BA468F: memcpy_s.MSVCRT ref: 00BA46E5
Part of subcall function 00BA468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 00BA46EF

LocalAlloc.KERNEL32(00000040,00000001,00000000,?,00000002,00000000), ref: 00BA55CF
lstrcmpA.KERNEL32(00000000,<None>,00000000), ref: 00BA5638
LocalFree.KERNEL32(00000000), ref: 00BA564C
LocalFree.KERNEL32(00000000,00000000,00000000,00000010,00000000,00000000), ref: 00BA5620

Part of subcall function 00BA44B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00BA4518
Part of subcall function 00BA44B9: MessageBoxA.USER32(?,?,smo,00010010), ref: 00BA4554

Part of subcall function 00BA6285: GetLastError.KERNEL32(00BA5BBC), ref: 00BA6285

GetTempPathA.KERNEL32(00000104,C:\Users\user\AppData\Local\Temp\IXP002.TMP\), ref: 00BA56B9
GetDriveTypeA.KERNEL32(0000005A,?,A:\), ref: 00BA571E
GetFileAttributesA.KERNEL32(0000005A,?,A:\), ref: 00BA5737
GetWindowsDirectoryA.KERNEL32(0000005A,00000104,00000000,?,A:\), ref: 00BA57CD
GetFileAttributesA.KERNEL32(0000005A,msdownld.tmp,00000000,?,A:\), ref: 00BA57EF
CreateDirectoryA.KERNEL32(0000005A,00000000,?,A:\), ref: 00BA5802

Part of subcall function 00BA2630: GetWindowsDirectoryA.KERNEL32(?,00000104,00000000), ref: 00BA2654

SetFileAttributesA.KERNEL32(0000005A,00000002,?,A:\), ref: 00BA5830

Part of subcall function 00BA6517: FindResourceA.KERNEL32(00BA0000,000007D6,00000005), ref: 00BA652A
Part of subcall function 00BA6517: LoadResource.KERNEL32(00BA0000,00000000,?,?,00BA2EE8,00000000,00BA19E0,00000547,0000083E,?,?,?,?,?,?,?), ref: 00BA6538
Part of subcall function 00BA6517: DialogBoxIndirectParamA.USER32(00BA0000,00000000,00000547,00BA19E0,00000000), ref: 00BA6557
Part of subcall function 00BA6517: FreeResource.KERNEL32(00000000,?,?,00BA2EE8,00000000,00BA19E0,00000547,0000083E,?,?,?,?,?,?,?,00000002), ref: 00BA6560

GetWindowsDirectoryA.KERNEL32(0000005A,00000104,?,A:\), ref: 00BA5878

Part of subcall function 00BA597D: GetCurrentDirectoryA.KERNEL32(00000104,?,00000000,00000000), ref: 00BA59A8
Part of subcall function 00BA597D: SetCurrentDirectoryA.KERNELBASE(?), ref: 00BA59AF

Strings

RUNPROGRAM, xrefs: 00BA55BD, 00BA5600
Z, xrefs: 00BA570A
<None>, xrefs: 00BA5632
A:\, xrefs: 00BA56F4
C:\Users\user\AppData\Local\Temp\IXP002.TMP\, xrefs: 00BA56AE, 00BA56B3, 00BA583D
msdownld.tmp, xrefs: 00BA57D3

Memory Dump Source

Source File: 00000002.00000002.2584327656.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000002.00000002.2584302635.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584354562.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ba0000_BC5tT98.jbxd

Similarity

API ID: Resource$Directory$Free$AttributesFileFindLoadLocalWindows$Current$AllocCreateDialogDriveErrorIndirectLastLockMessageParamPathSizeofStringTempTypelstrcmpmemcpy_s
String ID: <None>$A:\$C:\Users\user\AppData\Local\Temp\IXP002.TMP\$RUNPROGRAM$Z$msdownld.tmp
API String ID: 2436801531-2610921595
Opcode ID: be5f6668aecf06d539d671f000dab2feff3677d86aa14c1c10ff5a65e3056107
Instruction ID: b8620dfcc02c371cae945c28f8d402dbf6452e49c17e0cac1f44f86c69591fb1
Opcode Fuzzy Hash: be5f6668aecf06d539d671f000dab2feff3677d86aa14c1c10ff5a65e3056107
Instruction Fuzzy Hash: EE81F871A0CA04AADB34AB249C85BEE76EDDB67300F4404E5F586E3591EF748FC5CA60

Uniqueness

Uniqueness Score: -1.00%

Function 00BA2CAA Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 183
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00BA2CD9
memset.MSVCRT ref: 00BA2CE9
memset.MSVCRT ref: 00BA2CF9

Part of subcall function 00BA468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00BA46A0
Part of subcall function 00BA468F: SizeofResource.KERNEL32(00000000,00000000,?,00BA2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00BA46A9
Part of subcall function 00BA468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00BA46C3
Part of subcall function 00BA468F: LoadResource.KERNEL32(00000000,00000000,?,00BA2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00BA46CC
Part of subcall function 00BA468F: LockResource.KERNEL32(00000000,?,00BA2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00BA46D3
Part of subcall function 00BA468F: memcpy_s.MSVCRT ref: 00BA46E5
Part of subcall function 00BA468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 00BA46EF

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00BA2D34
SetEvent.KERNEL32(00000000,?,?,?,?,?,?,?,00000002,00000000), ref: 00BA2D40
CreateMutexA.KERNEL32(00000000,00000001,?,00000104,00000004,?,?,?,?,?,?,?,00000002,00000000), ref: 00BA2DAE
GetLastError.KERNEL32(?,?,?,?,?,?,?,00000002,00000000), ref: 00BA2DBD
CloseHandle.KERNEL32(smo,00000000,00000020,00000004,?,?,?,?,?,?,?,00000002,00000000), ref: 00BA2E0A

Part of subcall function 00BA44B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00BA4518
Part of subcall function 00BA44B9: MessageBoxA.USER32(?,?,smo,00010010), ref: 00BA4554

Strings

INSTANCECHECK, xrefs: 00BA2D95
TITLE, xrefs: 00BA2D09
VERCHECK, xrefs: 00BA2E54
smo, xrefs: 00BA2D04, 00BA2DD9, 00BA2DF0
EXTRACTOPT, xrefs: 00BA2D4D

Memory Dump Source

Source File: 00000002.00000002.2584327656.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000002.00000002.2584302635.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584354562.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ba0000_BC5tT98.jbxd

Similarity

API ID: Resource$memset$CreateEventFindLoad$CloseErrorFreeHandleLastLockMessageMutexSizeofStringmemcpy_s
String ID: EXTRACTOPT$INSTANCECHECK$TITLE$VERCHECK$smo
API String ID: 1002816675-4137116347
Opcode ID: f74abed43869d5a6abbef551e13eed9e33d8b2391081af7c60e4ddd02c5e08c5
Instruction ID: 72abfd12d0dcbc7f417ae7e0e07f8584c22a3f18890faca4add13fc4222c3d60
Opcode Fuzzy Hash: f74abed43869d5a6abbef551e13eed9e33d8b2391081af7c60e4ddd02c5e08c5
Instruction Fuzzy Hash: 4451AE7074C301BAE764AB2C9C4BB7B36D9EB97700F0440BAF941D65E1EFB48882D625

Uniqueness

Uniqueness Score: -1.00%

Function 00BA597D Relevance: 19.7, APIs: 13, Instructions: 212
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryA.KERNEL32(00000104,?,00000000,00000000), ref: 00BA59A8
SetCurrentDirectoryA.KERNELBASE(?), ref: 00BA59AF
GetDiskFreeSpaceA.KERNELBASE(00000000,?,?,?,?,00000001), ref: 00BA5A13
MulDiv.KERNEL32(?,?,00000400), ref: 00BA5A40
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 00BA5A64
memset.MSVCRT ref: 00BA5A7C
GetLastError.KERNEL32(00000000,?,00000200,00000000), ref: 00BA5A98
FormatMessageA.KERNEL32(00001000,00000000,00000000), ref: 00BA5AA5
SetCurrentDirectoryA.KERNEL32(?,?,?,00000010,00000000), ref: 00BA5BFC

Part of subcall function 00BA44B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00BA4518
Part of subcall function 00BA44B9: MessageBoxA.USER32(?,?,smo,00010010), ref: 00BA4554

Part of subcall function 00BA6285: GetLastError.KERNEL32(00BA5BBC), ref: 00BA6285

Memory Dump Source

Source File: 00000002.00000002.2584327656.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000002.00000002.2584302635.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584354562.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ba0000_BC5tT98.jbxd

Similarity

API ID: CurrentDirectory$ErrorLastMessage$DiskFormatFreeInformationLoadSpaceStringVolumememset
String ID:
API String ID: 4237285672-0
Opcode ID: b5e7cdfb53dba937283fa80726ad480184406556b65d17c3acf86903dd0cb231
Instruction ID: 2e4851f64fcc2eff0bd72980e4d6179c718db065fa766c306ae1396fe01ea583
Opcode Fuzzy Hash: b5e7cdfb53dba937283fa80726ad480184406556b65d17c3acf86903dd0cb231
Instruction Fuzzy Hash: 727170B1A04618ABEB259F64CC86BFB77ECEB4A340F5441E9F50697140EA709F85CB70

Uniqueness

Uniqueness Score: -1.00%

Function 00BA4FE0 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 121
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00BA468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00BA46A0
Part of subcall function 00BA468F: SizeofResource.KERNEL32(00000000,00000000,?,00BA2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00BA46A9
Part of subcall function 00BA468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00BA46C3
Part of subcall function 00BA468F: LoadResource.KERNEL32(00000000,00000000,?,00BA2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00BA46CC
Part of subcall function 00BA468F: LockResource.KERNEL32(00000000,?,00BA2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00BA46D3
Part of subcall function 00BA468F: memcpy_s.MSVCRT ref: 00BA46E5
Part of subcall function 00BA468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 00BA46EF

FindResourceA.KERNEL32(00000000,CABINET,0000000A), ref: 00BA4FFE
LoadResource.KERNEL32(00000000,00000000), ref: 00BA5006
LockResource.KERNEL32(00000000), ref: 00BA500D
GetDlgItem.USER32(00000000,00000842), ref: 00BA5030
ShowWindow.USER32(00000000), ref: 00BA5037
GetDlgItem.USER32(00000841,00000005), ref: 00BA504A
ShowWindow.USER32(00000000), ref: 00BA5051
FreeResource.KERNEL32(00000000,00000000,00000010,00000000), ref: 00BA5111
SendMessageA.USER32(00000FA1,00000000,00000000,00000000), ref: 00BA5159

Strings

CABINET, xrefs: 00BA4FE6, 00BA4FF7
*MEMCAB, xrefs: 00BA50C7

Memory Dump Source

Source File: 00000002.00000002.2584327656.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000002.00000002.2584302635.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584354562.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ba0000_BC5tT98.jbxd

Similarity

API ID: Resource$Find$FreeItemLoadLockShowWindow$MessageSendSizeofmemcpy_s
String ID: *MEMCAB$CABINET
API String ID: 1305606123-2642027498
Opcode ID: 9752d273999b701be96468336622e6e1f9dd8ee2ee20f8c81520b550fb99c71b
Instruction ID: 726f879813a9e44266b9d152907d80a8dc6928f7b5a90df19b38f5ce404c50c9
Opcode Fuzzy Hash: 9752d273999b701be96468336622e6e1f9dd8ee2ee20f8c81520b550fb99c71b
Instruction Fuzzy Hash: 61318CB06487027BE7305B65AD8BF673ADCEB8BB55F0400A5F906B32A1DFB48C40D661

Uniqueness

Uniqueness Score: -1.00%

Function 00BA53A1 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 71
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00BA171E: _vsnprintf.MSVCRT ref: 00BA1750

RemoveDirectoryA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,?,00000001,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,00000000), ref: 00BA53FB
GetFileAttributesA.KERNELBASE(?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,00000000), ref: 00BA5402
GetTempFileNameA.KERNEL32(C:\Users\user\AppData\Local\Temp\IXP002.TMP\,IXP,00000000,?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,00000000), ref: 00BA541F
DeleteFileA.KERNEL32(?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,00000000), ref: 00BA542B
CreateDirectoryA.KERNEL32(?,00000000,?,00000001,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,00000000), ref: 00BA5434
CreateDirectoryA.KERNELBASE(?,00000000,?,00000001,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,00000000), ref: 00BA5452

Strings

IXP, xrefs: 00BA5419
C:\Users\user\AppData\Local\Temp\IXP002.TMP\, xrefs: 00BA53B7, 00BA53E1, 00BA541E
IXP%03d.TMP, xrefs: 00BA53C0

Memory Dump Source

Source File: 00000002.00000002.2584327656.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000002.00000002.2584302635.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584354562.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ba0000_BC5tT98.jbxd

Similarity

API ID: DirectoryFile$Create$AttributesDeleteNameRemoveTemp_vsnprintf
String ID: C:\Users\user\AppData\Local\Temp\IXP002.TMP\$IXP$IXP%03d.TMP
API String ID: 1082909758-7194216
Opcode ID: 6289a1a372a3fd0614143dd2ddf529d59e73ace130cc1d76508243850483ce34
Instruction ID: 497b1255581fee4c4ce45b810cf12b4778e8e156c008fd5623f36184e1b6bb6d
Opcode Fuzzy Hash: 6289a1a372a3fd0614143dd2ddf529d59e73ace130cc1d76508243850483ce34
Instruction Fuzzy Hash: DF11E27170860477D7309B269C4AFAF36ADEBC7321F0000A5B546D32A0DF748E42C6B5

Uniqueness

Uniqueness Score: -1.00%

Function 00BA5467 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?,?,?,?,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,00000000), ref: 00BA54C9
CreateDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\IXP002.TMP\,00000000,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,00000000), ref: 00BA553D
RemoveDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\IXP002.TMP\,00000000,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,00000000), ref: 00BA556F

Part of subcall function 00BA53A1: RemoveDirectoryA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,?,00000001,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,00000000), ref: 00BA53FB
Part of subcall function 00BA53A1: GetFileAttributesA.KERNELBASE(?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,00000000), ref: 00BA5402
Part of subcall function 00BA53A1: GetTempFileNameA.KERNEL32(C:\Users\user\AppData\Local\Temp\IXP002.TMP\,IXP,00000000,?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,00000000), ref: 00BA541F
Part of subcall function 00BA53A1: DeleteFileA.KERNEL32(?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,00000000), ref: 00BA542B
Part of subcall function 00BA53A1: CreateDirectoryA.KERNEL32(?,00000000,?,00000001,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,00000000), ref: 00BA5434

Strings

i386, xrefs: 00BA54FE
ppc, xrefs: 00BA54E9
C:\Users\user\AppData\Local\Temp\IXP002.TMP\, xrefs: 00BA547D, 00BA5481, 00BA54AB, 00BA551C, 00BA553C, 00BA5568
mips, xrefs: 00BA54F7
alpha, xrefs: 00BA54F0

Memory Dump Source

Source File: 00000002.00000002.2584327656.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000002.00000002.2584302635.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584354562.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ba0000_BC5tT98.jbxd

Similarity

API ID: Directory$File$CreateRemove$AttributesDeleteInfoNameSystemTemp
String ID: C:\Users\user\AppData\Local\Temp\IXP002.TMP\$alpha$i386$mips$ppc
API String ID: 1979080616-3696344869
Opcode ID: c640d1c0ec1377bac7a3efe2aa04f990a9cb9e40eef239f664ca3edf5fd8dfaa
Instruction ID: edf2c66d46d0d57b9d8c4823b07414510cf9deecff245a3c94e3b2142889b95b
Opcode Fuzzy Hash: c640d1c0ec1377bac7a3efe2aa04f990a9cb9e40eef239f664ca3edf5fd8dfaa
Instruction Fuzzy Hash: 1531D471F0CA146BCB309F2D9C46ABE77EAEBA7740B0401EAA40293650DF70CF459A95

Uniqueness

Uniqueness Score: -1.00%

Function 00BA256D Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 75
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,System\CurrentControlSet\Control\Session Manager,00000000,00020019,?,00000000,00BA4096,00BA4096,?,00BA1ED3,00000001,00000000,?,?,00BA4137,?), ref: 00BA25B2
RegQueryValueExA.KERNELBASE(?,PendingFileRenameOperations,00000000,00000000,00000000,00BA4096,?,00BA1ED3,00000001,00000000,?,?,00BA4137,?,00BA4096), ref: 00BA25CB
RegCloseKey.KERNELBASE(?,?,00BA1ED3,00000001,00000000,?,?,00BA4137,?,00BA4096), ref: 00BA25DD
RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Session Manager\FileRenameOperations,00000000,00020019,?,00000000,00BA4096,00BA4096,?,00BA1ED3,00000001,00000000,?,?,00BA4137,?), ref: 00BA25FF
RegQueryInfoKeyA.ADVAPI32(?,00000000,00000000,00000000,00000000,00000000,00000000,00BA4096,00000000,00000000,00000000,00000000,?,00BA1ED3,00000001,00000000), ref: 00BA261A

Strings

System\CurrentControlSet\Control\Session Manager\FileRenameOperations, xrefs: 00BA25F5
PendingFileRenameOperations, xrefs: 00BA25C3
System\CurrentControlSet\Control\Session Manager, xrefs: 00BA25A8

Memory Dump Source

Source File: 00000002.00000002.2584327656.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000002.00000002.2584302635.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584354562.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ba0000_BC5tT98.jbxd

Similarity

API ID: OpenQuery$CloseInfoValue
String ID: PendingFileRenameOperations$System\CurrentControlSet\Control\Session Manager$System\CurrentControlSet\Control\Session Manager\FileRenameOperations
API String ID: 2209512893-559176071
Opcode ID: 341249be3743d1fe730fde697dffe720831cd994f0ea09ecf0e0ce2e46529c28
Instruction ID: 79cf31c7c670ba113c9ca3eacaf2d8e257ffd86e27d460c360be97a9b6bc4869
Opcode Fuzzy Hash: 341249be3743d1fe730fde697dffe720831cd994f0ea09ecf0e0ce2e46529c28
Instruction Fuzzy Hash: 5D114F35D46228BB9B309B999C1ADFBBEBCEF177A1F104095F908A2010DB305E44D6B1

Uniqueness

Uniqueness Score: -1.00%

Function 00BA6A60 Relevance: 13.6, APIs: 9, Instructions: 138
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00BA7155: GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 00BA7182
Part of subcall function 00BA7155: GetCurrentProcessId.KERNEL32 ref: 00BA7191
Part of subcall function 00BA7155: GetCurrentThreadId.KERNEL32 ref: 00BA719A
Part of subcall function 00BA7155: GetTickCount.KERNEL32 ref: 00BA71A3
Part of subcall function 00BA7155: QueryPerformanceCounter.KERNEL32(?), ref: 00BA71B8

GetStartupInfoW.KERNEL32(?,00BA72B8,00000058), ref: 00BA6A7F
Sleep.KERNEL32(000003E8), ref: 00BA6AB4
_amsg_exit.MSVCRT ref: 00BA6AC9
_initterm.MSVCRT ref: 00BA6B1D
__IsNonwritableInCurrentImage.LIBCMT ref: 00BA6B49
exit.KERNELBASE ref: 00BA6BBF
_ismbblead.MSVCRT ref: 00BA6BDA

Memory Dump Source

Source File: 00000002.00000002.2584327656.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000002.00000002.2584302635.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584354562.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ba0000_BC5tT98.jbxd

Similarity

API ID: Current$Time$CountCounterFileImageInfoNonwritablePerformanceProcessQuerySleepStartupSystemThreadTick_amsg_exit_initterm_ismbbleadexit
String ID:
API String ID: 836923961-0
Opcode ID: 1b77ae933d5f85ba35932fb254d9268545fa1e46a61eb531e8e948f163152ad4
Instruction ID: ae4784c39ca047ee55757bea34a23faccc4a4ab26ab7c0c98340a6ce57092587
Opcode Fuzzy Hash: 1b77ae933d5f85ba35932fb254d9268545fa1e46a61eb531e8e948f163152ad4
Instruction Fuzzy Hash: BD41A0B194C3259FDB219B68DC4676E77E4EB4B720F98419AE841E36A0DF744C41CAA0

Uniqueness

Uniqueness Score: -1.00%

Function 00BA58C8 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 74
memoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LocalAlloc.KERNEL32(00000040,?,00000001,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,00000000,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,?,00BA5534,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,00000000), ref: 00BA58E7
CreateFileA.KERNELBASE(00000000,40000000,00000000,00000000,00000001,04000080,00000000,TMP4351$.TMP,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,?,00BA5534,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,00000000), ref: 00BA5943
LocalFree.KERNEL32(00000000,?,00BA5534,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,00000000), ref: 00BA594D
CloseHandle.KERNEL32(00000000,?,00BA5534,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,00000000), ref: 00BA595C
GetFileAttributesA.KERNELBASE(C:\Users\user\AppData\Local\Temp\IXP002.TMP\,?,00BA5534,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,00000000), ref: 00BA5963

Strings

TMP4351$.TMP, xrefs: 00BA5923
C:\Users\user\AppData\Local\Temp\IXP002.TMP\, xrefs: 00BA58CD, 00BA58CF, 00BA5919, 00BA5962

Memory Dump Source

Source File: 00000002.00000002.2584327656.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000002.00000002.2584302635.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584354562.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ba0000_BC5tT98.jbxd

Similarity

API ID: FileLocal$AllocAttributesCloseCreateFreeHandle
String ID: C:\Users\user\AppData\Local\Temp\IXP002.TMP\$TMP4351$.TMP
API String ID: 747627703-394614654
Opcode ID: 47d103746410c8a5f2bd9dc6a194591e167c11b56e1060d3f90510eb0737b6f2
Instruction ID: 77d182f37fe7e3a1bdcb740e2c0df31ed7e97da61f9a17398300d038ca8d8778
Opcode Fuzzy Hash: 47d103746410c8a5f2bd9dc6a194591e167c11b56e1060d3f90510eb0737b6f2
Instruction Fuzzy Hash: 8E11D37160821076C7345F799C4EA9B7AD9EB47360B1046A5F505E7191CF709905C6B0

Uniqueness

Uniqueness Score: -1.00%

Function 00BA3FEF Relevance: 10.6, APIs: 7, Instructions: 97
processsynchronizationwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?,?,?,00000000), ref: 00BA4033
WaitForSingleObject.KERNEL32(?,000000FF), ref: 00BA4049
GetExitCodeProcess.KERNELBASE(?,?), ref: 00BA405C
CloseHandle.KERNEL32(?), ref: 00BA409C
CloseHandle.KERNEL32(?), ref: 00BA40A8
GetLastError.KERNEL32(00000000,?,00000200,00000000), ref: 00BA40DC
FormatMessageA.KERNEL32(00001000,00000000,00000000), ref: 00BA40E9

Memory Dump Source

Source File: 00000002.00000002.2584327656.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000002.00000002.2584302635.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584354562.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ba0000_BC5tT98.jbxd

Similarity

API ID: CloseHandleProcess$CodeCreateErrorExitFormatLastMessageObjectSingleWait
String ID:
API String ID: 3183975587-0
Opcode ID: 891e6586bbc7bad55d49ec898d8cf6d6c436fe7691b43a6bce265b5dbd32a544
Instruction ID: 5b3719437d2aa3397f9f1b94640585e2fa73d6ac149e3ce627f2ab64ba380086
Opcode Fuzzy Hash: 891e6586bbc7bad55d49ec898d8cf6d6c436fe7691b43a6bce265b5dbd32a544
Instruction Fuzzy Hash: E6317F71644218BBEB309B65DC4AFABB7BCEBD7710F1001AAF605E21A1CB704D85DB61

Uniqueness

Uniqueness Score: -1.00%

Function 00BA51E5 Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00BA468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00BA46A0
Part of subcall function 00BA468F: SizeofResource.KERNEL32(00000000,00000000,?,00BA2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00BA46A9
Part of subcall function 00BA468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00BA46C3
Part of subcall function 00BA468F: LoadResource.KERNEL32(00000000,00000000,?,00BA2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00BA46CC
Part of subcall function 00BA468F: LockResource.KERNEL32(00000000,?,00BA2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00BA46D3
Part of subcall function 00BA468F: memcpy_s.MSVCRT ref: 00BA46E5
Part of subcall function 00BA468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 00BA46EF

LocalAlloc.KERNEL32(00000040,00000001,00000000,?,00000002,00000000,00BA2F4D,?,00000002,00000000), ref: 00BA5201
LocalFree.KERNEL32(00000000,00000000,00000000,00000010,00000000,00000000), ref: 00BA5250

Part of subcall function 00BA44B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00BA4518
Part of subcall function 00BA44B9: MessageBoxA.USER32(?,?,smo,00010010), ref: 00BA4554

Part of subcall function 00BA6285: GetLastError.KERNEL32(00BA5BBC), ref: 00BA6285

Strings

UPROMPT, xrefs: 00BA51EF, 00BA5230
<None>, xrefs: 00BA5262

Memory Dump Source

Source File: 00000002.00000002.2584327656.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000002.00000002.2584302635.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584354562.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ba0000_BC5tT98.jbxd

Similarity

API ID: Resource$FindFreeLoadLocal$AllocErrorLastLockMessageSizeofStringmemcpy_s
String ID: <None>$UPROMPT
API String ID: 957408736-2980973527
Opcode ID: b80505dde9c0cfec0116243687b7dc7010bdc2504045a550854a764e659df09e
Instruction ID: f8afdf562b056ede16b65a5f7d993e829e6d2bb6f459c99b4dfbd18729cbdf4a
Opcode Fuzzy Hash: b80505dde9c0cfec0116243687b7dc7010bdc2504045a550854a764e659df09e
Instruction Fuzzy Hash: 6E1190B5248701BBE7746B759C8AB3B61DDDBCB380F1044A9F642E6290DFB98C015234

Uniqueness

Uniqueness Score: -1.00%

Function 00BA52B6 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 65fileCOMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNELBASE(02CC4648,00000080,?,00000000), ref: 00BA52F2
DeleteFileA.KERNELBASE(02CC4648), ref: 00BA52FA
LocalFree.KERNEL32(02CC4648,?,00000000), ref: 00BA5305
LocalFree.KERNEL32(02CC4648), ref: 00BA530C
SetCurrentDirectoryA.KERNELBASE(00BA11FC,?,C:\Users\user\AppData\Local\Temp\IXP002.TMP\), ref: 00BA5363

Strings

C:\Users\user\AppData\Local\Temp\IXP002.TMP\, xrefs: 00BA5334

Memory Dump Source

Source File: 00000002.00000002.2584327656.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000002.00000002.2584302635.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584354562.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ba0000_BC5tT98.jbxd

Similarity

API ID: FileFreeLocal$AttributesCurrentDeleteDirectory
String ID: C:\Users\user\AppData\Local\Temp\IXP002.TMP\
API String ID: 2833751637-1610346413
Opcode ID: 0762b2e7d5f15f868cff656a8f376f88a599017e93ad36364cb8f9c5a8ddc05c
Instruction ID: ec9c9ed2a3442d159c4ff21cb3291cf76361aa9ee75ea5f542806e9b7400e0b6
Opcode Fuzzy Hash: 0762b2e7d5f15f868cff656a8f376f88a599017e93ad36364cb8f9c5a8ddc05c
Instruction Fuzzy Hash: CD218B31A08604EFDB319B24EC0AB6977F4FB43790F0401AAE843575A0DFB45E84DB94

Uniqueness

Uniqueness Score: -1.00%

Function 00BA1FE1 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 23registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE(80000002,Software\Microsoft\Windows\CurrentVersion\RunOnce,00000000,00020006,00BA538C,?,?,00BA538C), ref: 00BA2005
RegDeleteValueA.KERNELBASE(00BA538C,wextract_cleanup2,?,?,00BA538C), ref: 00BA2017
RegCloseKey.ADVAPI32(00BA538C,?,?,00BA538C), ref: 00BA2020

Strings

wextract_cleanup2, xrefs: 00BA1FE7, 00BA200F
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 00BA1FFB

Memory Dump Source

Source File: 00000002.00000002.2584327656.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000002.00000002.2584302635.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584354562.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ba0000_BC5tT98.jbxd

Similarity

API ID: CloseDeleteOpenValue
String ID: Software\Microsoft\Windows\CurrentVersion\RunOnce$wextract_cleanup2
API String ID: 849931509-3354236729
Opcode ID: d6fdb64fab37c6690a4a6e869022ecc373280ce082bbba9b5529dbfdd6ccfb1d
Instruction ID: ad28b74a5d3a2b97054037efc70edb8e9e66e1e033f40bb7f473c6f7d01f320f
Opcode Fuzzy Hash: d6fdb64fab37c6690a4a6e869022ecc373280ce082bbba9b5529dbfdd6ccfb1d
Instruction Fuzzy Hash: 7CE04F30D54318BBD7329B90EC0BF697BA9E712740F1001D4BA04A2460EF615A14D725

Uniqueness

Uniqueness Score: -1.00%

Function 00BA4CD0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNELBASE(?,?,?,?), ref: 00BA4DB5
SetDlgItemTextA.USER32(00000000,00000837,?), ref: 00BA4DDD

Strings

C:\Users\user\AppData\Local\Temp\IXP002.TMP\, xrefs: 00BA4D36, 00BA4DE3

Memory Dump Source

Source File: 00000002.00000002.2584327656.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000002.00000002.2584302635.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584354562.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ba0000_BC5tT98.jbxd

Similarity

API ID: AttributesFileItemText
String ID: C:\Users\user\AppData\Local\Temp\IXP002.TMP\
API String ID: 3625706803-1610346413
Opcode ID: 13bce37c930aef090a2d4c4a46d9a64d9b4038065d84e4813df55eebd70fc1df
Instruction ID: b1b4675ebb43775849ea6ef3e61eef4424b1e2039c3d398264e05d9a7de104ca
Opcode Fuzzy Hash: 13bce37c930aef090a2d4c4a46d9a64d9b4038065d84e4813df55eebd70fc1df
Instruction Fuzzy Hash: 8D41003620C105AACB259F38D9456BAB3E5EBC7300B0446F8E8C297295DFB1DE4AC750

Uniqueness

Uniqueness Score: -1.00%

Function 00BA4C37 Relevance: 4.5, APIs: 3, Instructions: 39timeCOMMON

Download Yara Rule

APIs

DosDateTimeToFileTime.KERNEL32(?,?,?), ref: 00BA4C54
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00BA4C66
SetFileTime.KERNELBASE(?,?,?,?), ref: 00BA4C7E

Memory Dump Source

Source File: 00000002.00000002.2584327656.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000002.00000002.2584302635.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584354562.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ba0000_BC5tT98.jbxd

Similarity

API ID: Time$File$DateLocal
String ID:
API String ID: 2071732420-0
Opcode ID: 593a3e6f5fb7a60fd242074acd607d5f5164ae4c5659be977cc29d32d66e667d
Instruction ID: 570fe9f3421a57df98c7611d8e7418e9426c463c8d739e0d419dbf28f09c6bb6
Opcode Fuzzy Hash: 593a3e6f5fb7a60fd242074acd607d5f5164ae4c5659be977cc29d32d66e667d
Instruction Fuzzy Hash: C8F06D72605208BB9B249FA4CC49ABB7BECEB46250B44057AA819D2050FB70D914C7B0

Uniqueness

Uniqueness Score: -1.00%

Function 00BA487A Relevance: 3.1, APIs: 2, Instructions: 59fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(00008000,-80000000,00000000,00000000,?,00000080,00000000,00000000,00000000,00000000,00BA4A23,?,00BA4F67,*MEMCAB,00008000,00000180), ref: 00BA48DE
CreateFileA.KERNEL32(00008000,-80000000,00000000,00000000,?,00000080,00000000,?,00BA4F67,*MEMCAB,00008000,00000180), ref: 00BA4902

Memory Dump Source

Source File: 00000002.00000002.2584327656.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000002.00000002.2584302635.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584354562.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ba0000_BC5tT98.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: c7bf479d35a4cba520a0e7428aaa97c8312a6971df6b981c2a8cbb0d2e4e66a0
Instruction ID: 83e06cb7f3b32b81202a31bf201abb558b29d1258964a2f3db9d41cabada92ef
Opcode Fuzzy Hash: c7bf479d35a4cba520a0e7428aaa97c8312a6971df6b981c2a8cbb0d2e4e66a0
Instruction Fuzzy Hash: 5A0146A3E1A5703AF32440299C89FB7559CCBD7734F1B0374BDAAE76D2D6A84C0481E0

Uniqueness

Uniqueness Score: -1.00%

Function 00BA4AD0 Relevance: 3.0, APIs: 2, Instructions: 47fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00BA3680: MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000004FF), ref: 00BA369F
Part of subcall function 00BA3680: PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 00BA36B2
Part of subcall function 00BA3680: PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 00BA36DA

WriteFile.KERNELBASE(?,?,?,?,00000000), ref: 00BA4B05

Memory Dump Source

Source File: 00000002.00000002.2584327656.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000002.00000002.2584302635.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584354562.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ba0000_BC5tT98.jbxd

Similarity

API ID: MessagePeek$FileMultipleObjectsWaitWrite
String ID:
API String ID: 1084409-0
Opcode ID: 912532af5de7bdc82d4cdaac581f738e681805ee580f0b66e1219d7a9e6ebcf1
Instruction ID: b0c9748d906559f71832bd1d79de594b7ccc9f552b22e055acef34b36844d80f
Opcode Fuzzy Hash: 912532af5de7bdc82d4cdaac581f738e681805ee580f0b66e1219d7a9e6ebcf1
Instruction Fuzzy Hash: 34019631204201ABD7148F68EC06BA27B99F786725F148265F93AAB1E0CFB0D811D751

Uniqueness

Uniqueness Score: -1.00%

Function 00BA658A Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

CharPrevA.USER32(00BA8B3E,00BA8B3F,00000001,00BA8B3E,-00000003,?,00BA60EC,00BA1140,?), ref: 00BA65BA

Memory Dump Source

Source File: 00000002.00000002.2584327656.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000002.00000002.2584302635.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584354562.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ba0000_BC5tT98.jbxd

Similarity

API ID: CharPrev
String ID:
API String ID: 122130370-0
Opcode ID: 2ec4ec30eddf286b1bd29e9c292bdc4300dfb326511f237c67f51fb5d0d2b1b8
Instruction ID: a04b4e7bae7c1452d807b9f924f65d816d3ee5c22d22b0fecf473c8e2cf2ac76
Opcode Fuzzy Hash: 2ec4ec30eddf286b1bd29e9c292bdc4300dfb326511f237c67f51fb5d0d2b1b8
Instruction Fuzzy Hash: B2F028B2A0C2549FD331491D9884B66BFDADBA7350F2C05EAE8DAC3205DA658C4583A4

Uniqueness

Uniqueness Score: -1.00%

Function 00BA621E Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00BA623F

Part of subcall function 00BA44B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00BA4518
Part of subcall function 00BA44B9: MessageBoxA.USER32(?,?,smo,00010010), ref: 00BA4554

Part of subcall function 00BA6285: GetLastError.KERNEL32(00BA5BBC), ref: 00BA6285

Memory Dump Source

Source File: 00000002.00000002.2584327656.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000002.00000002.2584302635.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584354562.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ba0000_BC5tT98.jbxd

Similarity

API ID: DirectoryErrorLastLoadMessageStringWindows
String ID:
API String ID: 381621628-0
Opcode ID: e8416eb07d11e1942bacddf69dd8f8117d811bed5a064ad320d99cda99f89aed
Instruction ID: a79f44e5ec798eb856c4e83c53f8f7183acd94befc52463408503fef7b480179
Opcode Fuzzy Hash: e8416eb07d11e1942bacddf69dd8f8117d811bed5a064ad320d99cda99f89aed
Instruction Fuzzy Hash: 3FF0B4B07082086BD760EB748D03BBE33ECDB55300F4000A9A985D7181EE7499448650

Uniqueness

Uniqueness Score: -1.00%

Function 00BA4B60 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?,00000000,00000000,?,00BA4FA1,00000000), ref: 00BA4B98

Memory Dump Source

Source File: 00000002.00000002.2584327656.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000002.00000002.2584302635.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584354562.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ba0000_BC5tT98.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 441ffdaebb5afb4a9712a5fa22b6c9004553bbae2dcf7a1c68362da6cb501b28
Instruction ID: bbcbf01239d2e774f1b73989c5de11ea69abed7c4e679776af6fa4ffa587f1da
Opcode Fuzzy Hash: 441ffdaebb5afb4a9712a5fa22b6c9004553bbae2dcf7a1c68362da6cb501b28
Instruction Fuzzy Hash: F4F0FE31914B089E87718E398C01652BFE4FAF7760351093E94AEE2590EB70A455CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00BA66AE Relevance: 1.5, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(?,00BA4777,?,00BA4E38,?), ref: 00BA66B1

Memory Dump Source

Source File: 00000002.00000002.2584327656.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000002.00000002.2584302635.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584354562.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ba0000_BC5tT98.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 9d4f607db151b5919c1c2caf756007f3a76ab8e3c4ca4c57dec5cd9f7c356f5f
Instruction ID: 1c60ac38475876ac8ae3e87425c17b7f6cefe043bf6b72f1e65f578070b3d455
Opcode Fuzzy Hash: 9d4f607db151b5919c1c2caf756007f3a76ab8e3c4ca4c57dec5cd9f7c356f5f
Instruction Fuzzy Hash: D4B092B6266840426A6006756C2A5962981E6C263A7E81B90F032C11E0CF3ED846D014

Uniqueness

Uniqueness Score: -1.00%

Function 00BA4CA0 Relevance: 1.3, APIs: 1, Instructions: 8memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNELBASE(00000000,?), ref: 00BA4CAA

Memory Dump Source

Source File: 00000002.00000002.2584327656.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000002.00000002.2584302635.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584354562.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ba0000_BC5tT98.jbxd

Similarity

API ID: AllocGlobal
String ID:
API String ID: 3761449716-0
Opcode ID: 5c43f3818cf952bf2687b0e29bbca5ca10916d1095a72dd0254f174ec2e061d5
Instruction ID: c0ac29ca78d68e6c3c1a7bca2e0dd517b18930ea57b7135159876be75c96de7e
Opcode Fuzzy Hash: 5c43f3818cf952bf2687b0e29bbca5ca10916d1095a72dd0254f174ec2e061d5
Instruction Fuzzy Hash: 28B0123204420CB7CF501FC2EC0AF857F1DE7C9761F140000F60C460508F729410C7A6

Uniqueness

Uniqueness Score: -1.00%

Function 00BA4CC0 Relevance: 1.3, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

GlobalFree.KERNELBASE(?), ref: 00BA4CC8

Memory Dump Source

Source File: 00000002.00000002.2584327656.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000002.00000002.2584302635.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584354562.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ba0000_BC5tT98.jbxd

Similarity

API ID: FreeGlobal
String ID:
API String ID: 2979337801-0
Opcode ID: 293325d5911e23b76e85574b6526404d7a233a666b24a64d425a69eff0b7ac83
Instruction ID: b385eec9b529a12c90d03d5a1f357237afa83043eec9e43c7c18ef7aba5b6f3a
Opcode Fuzzy Hash: 293325d5911e23b76e85574b6526404d7a233a666b24a64d425a69eff0b7ac83
Instruction Fuzzy Hash: 83B0123100010CB78F101B52EC098457F1DD6C52607000010F50C420218F339811C595

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00BA5C9E Relevance: 24.9, APIs: 10, Strings: 4, Instructions: 422COMMON

Download Yara Rule

APIs

CharNextA.USER32(?,00000000,?,?), ref: 00BA5CEE
GetModuleFileNameA.KERNEL32(00BA8B3E,00000104,00000000,?,?), ref: 00BA5DFC
CharUpperA.USER32(?), ref: 00BA5E3E
CharUpperA.USER32(-00000052), ref: 00BA5EE1
CompareStringA.KERNEL32(0000007F,00000001,RegServer,000000FF,?,000000FF), ref: 00BA5F6F
CharUpperA.USER32(?), ref: 00BA5FA7
CharUpperA.USER32(-0000004E), ref: 00BA6008
CharUpperA.USER32(?), ref: 00BA60AA
CloseHandle.KERNEL32(00000000,00BA1140,00000000,00000040,00000000), ref: 00BA61F1
ExitProcess.KERNEL32 ref: 00BA61F8

Strings

RegServer, xrefs: 00BA5F66
:, xrefs: 00BA6118
", xrefs: 00BA612D
", xrefs: 00BA5D78

Memory Dump Source

Source File: 00000002.00000002.2584327656.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000002.00000002.2584302635.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584354562.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ba0000_BC5tT98.jbxd

Similarity

API ID: Char$Upper$CloseCompareExitFileHandleModuleNameNextProcessString
String ID: "$"$:$RegServer
API String ID: 1203814774-25366791
Opcode ID: 628fdb9ed0a45beb9a48787a779444dc51d6119a8add70f4e3e8a46702c57092
Instruction ID: a75783ba5e9266d2725d5a6dab70d00b6a262478c3d220d37f626faee9cc108f
Opcode Fuzzy Hash: 628fdb9ed0a45beb9a48787a779444dc51d6119a8add70f4e3e8a46702c57092
Instruction Fuzzy Hash: 17D114B1A0CA545EDB358B389C897FA7BE1EB27300F1840EAD4D6D7591DA718FC68B10

Uniqueness

Uniqueness Score: -1.00%

Function 00BA1F90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94shutdownCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028,?,?), ref: 00BA1EFB
OpenProcessToken.ADVAPI32(00000000), ref: 00BA1F02
ExitWindowsEx.USER32(00000002,00000000), ref: 00BA1FD3

Strings

SeShutdownPrivilege, xrefs: 00BA1F28

Memory Dump Source

Source File: 00000002.00000002.2584327656.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000002.00000002.2584302635.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584354562.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ba0000_BC5tT98.jbxd

Similarity

API ID: Process$CurrentExitOpenTokenWindows
String ID: SeShutdownPrivilege
API String ID: 2795981589-3733053543
Opcode ID: 71a6a373884dacb181c566faf94e0866361d0ac5ed7e676703d0704ec6adc2c5
Instruction ID: e0fd4e093fd7baf98818b7983a42840d0e5b6608ebd92a131d201e0bdda8e06a
Opcode Fuzzy Hash: 71a6a373884dacb181c566faf94e0866361d0ac5ed7e676703d0704ec6adc2c5
Instruction Fuzzy Hash: 1F21D671B482457EDB705BA99C4AFBF76F8EB87B10F100859FA02E7180DB758801D271

Uniqueness

Uniqueness Score: -1.00%

Function 00BA6CF0 Relevance: 6.0, APIs: 4, Instructions: 13COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,00BA6E26,00BA1000), ref: 00BA6CF7
UnhandledExceptionFilter.KERNEL32(00BA6E26,?,00BA6E26,00BA1000), ref: 00BA6D00
GetCurrentProcess.KERNEL32(C0000409,?,00BA6E26,00BA1000), ref: 00BA6D0B
TerminateProcess.KERNEL32(00000000,?,00BA6E26,00BA1000), ref: 00BA6D12

Memory Dump Source

Source File: 00000002.00000002.2584327656.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000002.00000002.2584302635.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584354562.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ba0000_BC5tT98.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminate
String ID:
API String ID: 3231755760-0
Opcode ID: 7f3309b507172d003afc3c686a3963e1be081fc77cb7cf11eeccd43de427b89d
Instruction ID: a9a23e15515ab3b14a17d2d435778ad6c668e4d70bd342b62ba09f7b576a426e
Opcode Fuzzy Hash: 7f3309b507172d003afc3c686a3963e1be081fc77cb7cf11eeccd43de427b89d
Instruction Fuzzy Hash: D7D0C932000108BBDB412BE1EC0EA593F28EB4B212F444000F319A3020CF325451CB72

Uniqueness

Uniqueness Score: -1.00%

Function 00BA3210 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 188windowCOMMON

Download Yara Rule

APIs

LoadStringA.USER32(000003E8,00BA8598,00000200), ref: 00BA3271
GetDesktopWindow.USER32 ref: 00BA33E2
SetWindowTextA.USER32(?,smo), ref: 00BA33F7
SendDlgItemMessageA.USER32(?,00000835,000000C5,00000103,00000000), ref: 00BA3410
GetDlgItem.USER32(?,00000836), ref: 00BA3426
EnableWindow.USER32(00000000), ref: 00BA342D
EndDialog.USER32(?,00000000), ref: 00BA343F

Strings

smo, xrefs: 00BA33F1
C:\Users\user\AppData\Local\Temp\IXP002.TMP\, xrefs: 00BA32E2, 00BA32E7, 00BA3331, 00BA3344, 00BA335B, 00BA336A

Memory Dump Source

Source File: 00000002.00000002.2584327656.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000002.00000002.2584302635.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584354562.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ba0000_BC5tT98.jbxd

Similarity

API ID: Window$Item$DesktopDialogEnableLoadMessageSendStringText
String ID: C:\Users\user\AppData\Local\Temp\IXP002.TMP\$smo
API String ID: 2418873061-1155430921
Opcode ID: a94b0f2dcf16635bafe08ebcc6615ad64860cffe4a565a8c2c1e7ca7791a1870
Instruction ID: 3c07bc6ce8588ce5bd12936c2392a6e92361aceab5767c87559dc97171167655
Opcode Fuzzy Hash: a94b0f2dcf16635bafe08ebcc6615ad64860cffe4a565a8c2c1e7ca7791a1870
Instruction Fuzzy Hash: ED51F43038C2407BEB615B355C8EF7B6AD9DB8BF54F1040A8F645A72D1CFA48E02E265

Uniqueness

Uniqueness Score: -1.00%

Function 00BA34F0 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 119threadwindowCOMMON

Download Yara Rule

APIs

TerminateThread.KERNEL32(00000000), ref: 00BA3535
EndDialog.USER32(?,?), ref: 00BA3541
ResetEvent.KERNEL32 ref: 00BA355F
SetEvent.KERNEL32(00BA1140,00000000,00000020,00000004), ref: 00BA3590
GetDesktopWindow.USER32 ref: 00BA35C7
GetDlgItem.USER32(?,0000083B), ref: 00BA35F1
SendMessageA.USER32(00000000), ref: 00BA35F8
GetDlgItem.USER32(?,0000083B), ref: 00BA3610
SendMessageA.USER32(00000000), ref: 00BA3617
SetWindowTextA.USER32(?,smo), ref: 00BA3623
CreateThread.KERNEL32(00000000,00000000,Function_00004FE0,00000000,00000000,00BA8798), ref: 00BA3637
EndDialog.USER32(?,00000000), ref: 00BA3671

Strings

smo, xrefs: 00BA361D

Memory Dump Source

Source File: 00000002.00000002.2584327656.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000002.00000002.2584302635.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584354562.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ba0000_BC5tT98.jbxd

Similarity

API ID: DialogEventItemMessageSendThreadWindow$CreateDesktopResetTerminateText
String ID: smo
API String ID: 2406144884-2762499640
Opcode ID: 6bc97c2eddc67d8f12dd92b35ef11f243aca1d031d11bcc6cd558564333de502
Instruction ID: 9d1625836d42c95a6b192e7cab56853a6f3a0d797dfa28d3b9629873326ac4cd
Opcode Fuzzy Hash: 6bc97c2eddc67d8f12dd92b35ef11f243aca1d031d11bcc6cd558564333de502
Instruction Fuzzy Hash: D031AE3124C300BBD7601F29EC4FE6A3AE8E79BF01F104569F602A72A4CF718A00DA65

Uniqueness

Uniqueness Score: -1.00%

Function 00BA4224 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 132libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(SHELL32.DLL,?,?,00000001), ref: 00BA4236
GetProcAddress.KERNEL32(00000000,SHBrowseForFolder), ref: 00BA424C
GetProcAddress.KERNEL32(00000000,000000C3), ref: 00BA4263
GetProcAddress.KERNEL32(00000000,SHGetPathFromIDList), ref: 00BA427A
GetTempPathA.KERNEL32(00000104,00BA88C0,?,00000001), ref: 00BA429F
CharPrevA.USER32(00BA88C0,01751181,?,00000001), ref: 00BA42C2
CharPrevA.USER32(00BA88C0,00000000,?,00000001), ref: 00BA42D6
FreeLibrary.KERNEL32(00000000,?,00000001), ref: 00BA4391
FreeLibrary.KERNEL32(00000000,?,00000001), ref: 00BA43A5

Strings

SHGetPathFromIDList, xrefs: 00BA4274
SHELL32.DLL, xrefs: 00BA422F
SHBrowseForFolder, xrefs: 00BA4246

Memory Dump Source

Source File: 00000002.00000002.2584327656.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000002.00000002.2584302635.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584354562.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ba0000_BC5tT98.jbxd

Similarity

API ID: AddressLibraryProc$CharFreePrev$LoadPathTemp
String ID: SHBrowseForFolder$SHELL32.DLL$SHGetPathFromIDList
API String ID: 1865808269-1731843650
Opcode ID: 9a5a30f03aa9603343ada40fdc419a720d36b11226f8840b32422a2bd637c779
Instruction ID: 6aa623bf3cb48b5afdd16d4a94ffa8673280abe7b98c5097ed39e286e18a4f32
Opcode Fuzzy Hash: 9a5a30f03aa9603343ada40fdc419a720d36b11226f8840b32422a2bd637c779
Instruction Fuzzy Hash: 3B41C3B4E08204AFDB119B64DC96A7EBBF4EB8B344F1401E9E941A3291CFB98C05C765

Uniqueness

Uniqueness Score: -1.00%

Function 00BA44B9 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 160memorywindowCOMMON

Download Yara Rule

APIs

LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00BA4518
MessageBoxA.USER32(?,?,smo,00010010), ref: 00BA4554
LocalAlloc.KERNEL32(00000040,00000065), ref: 00BA45A3
LocalAlloc.KERNEL32(00000040,00000065), ref: 00BA45E3
LocalAlloc.KERNEL32(00000040,00000002), ref: 00BA460D
MessageBeep.USER32(00000000), ref: 00BA4630
MessageBoxA.USER32(?,00000000,smo,00000000), ref: 00BA4666
LocalFree.KERNEL32(00000000), ref: 00BA466F

Part of subcall function 00BA681F: GetVersionExA.KERNEL32(?,00000000,00000002), ref: 00BA686E
Part of subcall function 00BA681F: GetSystemMetrics.USER32(0000004A), ref: 00BA68A7
Part of subcall function 00BA681F: RegOpenKeyExA.ADVAPI32(80000001,Control Panel\Desktop\ResourceLocale,00000000,00020019,?), ref: 00BA68CC
Part of subcall function 00BA681F: RegQueryValueExA.ADVAPI32(?,00BA1140,00000000,?,?,0000000C), ref: 00BA68F4
Part of subcall function 00BA681F: RegCloseKey.ADVAPI32(?), ref: 00BA6902

Strings

LoadString() Error. Could not load string resource., xrefs: 00BA44E4
smo, xrefs: 00BA4545, 00BA465A

Memory Dump Source

Source File: 00000002.00000002.2584327656.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000002.00000002.2584302635.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584354562.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ba0000_BC5tT98.jbxd

Similarity

API ID: Local$AllocMessage$BeepCloseFreeLoadMetricsOpenQueryStringSystemValueVersion
String ID: LoadString() Error. Could not load string resource.$smo
API String ID: 3244514340-2161240188
Opcode ID: 911bd5efc572553918d46c859421d0f10a8fe2a5f786b5e5ea7b8256d34d2c98
Instruction ID: 29a17d0170bbc0384289a6e4f23fdde1bce807e30e1812edd4ce248b340280a5
Opcode Fuzzy Hash: 911bd5efc572553918d46c859421d0f10a8fe2a5f786b5e5ea7b8256d34d2c98
Instruction Fuzzy Hash: 5151E476908215ABDB219F28CC49BAA7BE9EF87300F1445D5FD09B7241DBB1DE05CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00BA2773 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 114registryCOMMON

Download Yara Rule

APIs

CharUpperA.USER32(88C731A0,00000000,00000000,00000000), ref: 00BA27A8
CharNextA.USER32(0000054D), ref: 00BA27B5
CharNextA.USER32(00000000), ref: 00BA27BC
RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00020019,?,?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 00BA2829
RegQueryValueExA.ADVAPI32(?,00BA1140,00000000,?,-00000005,?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 00BA2852
ExpandEnvironmentStringsA.KERNEL32(-00000005,?,00000104,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 00BA2870
RegCloseKey.ADVAPI32(?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 00BA28A0
GetWindowsDirectoryA.KERNEL32(-00000005,00000104), ref: 00BA28AA
GetSystemDirectoryA.KERNEL32(-00000005,00000104), ref: 00BA28B9

Strings

Software\Microsoft\Windows\CurrentVersion\App Paths, xrefs: 00BA27E4

Memory Dump Source

Source File: 00000002.00000002.2584327656.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000002.00000002.2584302635.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584354562.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ba0000_BC5tT98.jbxd

Similarity

API ID: Char$DirectoryNext$CloseEnvironmentExpandOpenQueryStringsSystemUpperValueWindows
String ID: Software\Microsoft\Windows\CurrentVersion\App Paths
API String ID: 2659952014-2428544900
Opcode ID: 58c1d9b3d1b1c15a8cd78f9a00dafefecc7e02734b9869a4f6de2bb31958721e
Instruction ID: 3c1e1c1738a5947076a99cd27914ea972747f2e1cfac00d842fda7502f9a73bb
Opcode Fuzzy Hash: 58c1d9b3d1b1c15a8cd78f9a00dafefecc7e02734b9869a4f6de2bb31958721e
Instruction Fuzzy Hash: C14191B1A08128ABDB259B689C86AFE77FDEF17700F0440E9F545E3110DB748E85CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00BA2267 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 88registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\RunOnce,00000000,0002001F,?,00000001), ref: 00BA22A3
RegQueryValueExA.ADVAPI32(?,wextract_cleanup2,00000000,00000000,?,?,00000001), ref: 00BA22D8
memset.MSVCRT ref: 00BA22F5
GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00BA2305
RegSetValueExA.ADVAPI32(?,wextract_cleanup2,00000000,00000001,?,?,?,?,?,?,?,?,?), ref: 00BA236E
RegCloseKey.ADVAPI32(?), ref: 00BA237A

Strings

wextract_cleanup2, xrefs: 00BA227C, 00BA22CD, 00BA2363
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 00BA2299
rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s", xrefs: 00BA232D
C:\Users\user\AppData\Local\Temp\IXP002.TMP\, xrefs: 00BA2321

Memory Dump Source

Source File: 00000002.00000002.2584327656.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000002.00000002.2584302635.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584354562.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ba0000_BC5tT98.jbxd

Similarity

API ID: Value$CloseDirectoryOpenQuerySystemmemset
String ID: C:\Users\user\AppData\Local\Temp\IXP002.TMP\$Software\Microsoft\Windows\CurrentVersion\RunOnce$rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s"$wextract_cleanup2
API String ID: 3027380567-1720115735
Opcode ID: aa9533152684645e2ae74d3441fe71334a0c3b0ad7fef212927baf669c72b975
Instruction ID: 74f6bb809ec6c5b0abc78656d1e441e8c4dcbb4052fc4d2c11ad1041f8b53317
Opcode Fuzzy Hash: aa9533152684645e2ae74d3441fe71334a0c3b0ad7fef212927baf669c72b975
Instruction Fuzzy Hash: 3C318471A042186BDB319B55DC49FEB7BFCEB57700F0401E9B90DA6051EE71AB88CA60

Uniqueness

Uniqueness Score: -1.00%

Function 00BA3100 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 70windowCOMMON

Download Yara Rule

APIs

EndDialog.USER32(?,00000000), ref: 00BA313B
GetDesktopWindow.USER32 ref: 00BA314B
SetDlgItemTextA.USER32(?,00000834), ref: 00BA316A
SetWindowTextA.USER32(?,smo), ref: 00BA3176
SetForegroundWindow.USER32(?), ref: 00BA317D
GetDlgItem.USER32(?,00000834), ref: 00BA3185
GetWindowLongA.USER32(00000000,000000FC), ref: 00BA3190
SetWindowLongA.USER32(00000000,000000FC,00BA30C0), ref: 00BA31A3
SendDlgItemMessageA.USER32(?,00000834,000000B1,000000FF,00000000), ref: 00BA31CA

Strings

smo, xrefs: 00BA3170

Memory Dump Source

Source File: 00000002.00000002.2584327656.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000002.00000002.2584302635.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584354562.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ba0000_BC5tT98.jbxd

Similarity

API ID: Window$Item$LongText$DesktopDialogForegroundMessageSend
String ID: smo
API String ID: 3785188418-2762499640
Opcode ID: 18ecb7343ab2459082d1421d4f3e140a81eb756d60944d98af33a5c833b43d3d
Instruction ID: 1321fa06c9e643cb4504faa3ea1dd0afb01eecff2f8db2c42e8935e5b1b1ca23
Opcode Fuzzy Hash: 18ecb7343ab2459082d1421d4f3e140a81eb756d60944d98af33a5c833b43d3d
Instruction Fuzzy Hash: FA11B13164C211BBDB215F64DC0EBAA3AE4EB4BB20F104661F815B25E0DFB48A51C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 00BA18A3 Relevance: 16.6, APIs: 11, Instructions: 112memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00BA17EE: LoadLibraryA.KERNEL32(advapi32.dll,00000002,?,00000000,?,?,?,00BA18DD), ref: 00BA181A
Part of subcall function 00BA17EE: GetProcAddress.KERNEL32(00000000,CheckTokenMembership), ref: 00BA182C
Part of subcall function 00BA17EE: AllocateAndInitializeSid.ADVAPI32(00BA18DD,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,00BA18DD), ref: 00BA1855
Part of subcall function 00BA17EE: FreeSid.ADVAPI32(?,?,?,?,00BA18DD), ref: 00BA1883
Part of subcall function 00BA17EE: FreeLibrary.KERNEL32(00000000,?,?,?,00BA18DD), ref: 00BA188A

GetCurrentProcess.KERNEL32(00000008,?,00000000,00000001), ref: 00BA18EB
OpenProcessToken.ADVAPI32(00000000), ref: 00BA18F2
GetTokenInformation.ADVAPI32(?,00000002,00000000,00000000,?), ref: 00BA190A
GetLastError.KERNEL32 ref: 00BA1918
LocalAlloc.KERNEL32(00000000,?,?), ref: 00BA192C
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?), ref: 00BA1944
AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00BA1964
EqualSid.ADVAPI32(00000004,?), ref: 00BA197A
FreeSid.ADVAPI32(?), ref: 00BA199C
LocalFree.KERNEL32(00000000), ref: 00BA19A3
CloseHandle.KERNEL32(?), ref: 00BA19AD

Memory Dump Source

Source File: 00000002.00000002.2584327656.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000002.00000002.2584302635.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584354562.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ba0000_BC5tT98.jbxd

Similarity

API ID: Free$Token$AllocateInformationInitializeLibraryLocalProcess$AddressAllocCloseCurrentEqualErrorHandleLastLoadOpenProc
String ID:
API String ID: 2168512254-0
Opcode ID: 739f43e13af01b18d39323f49d0aa4ed7ab2444d4785b8ab1e51eeabacc6e6f7
Instruction ID: f301f6b5fc7e758ac2b89348f9142703bef080915ed7781f76fd09a66a75a97b
Opcode Fuzzy Hash: 739f43e13af01b18d39323f49d0aa4ed7ab2444d4785b8ab1e51eeabacc6e6f7
Instruction Fuzzy Hash: 5C312D71A04209AFDB609FA9DC99ABFBBFDFF0A700F100865E545E2150DB309906CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00BA468F Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00BA46A0
SizeofResource.KERNEL32(00000000,00000000,?,00BA2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00BA46A9
FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00BA46C3
LoadResource.KERNEL32(00000000,00000000,?,00BA2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00BA46CC
LockResource.KERNEL32(00000000,?,00BA2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00BA46D3
memcpy_s.MSVCRT ref: 00BA46E5
FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 00BA46EF

Strings

TITLE, xrefs: 00BA469D, 00BA46C0
smo, xrefs: 00BA46E4

Memory Dump Source

Source File: 00000002.00000002.2584327656.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000002.00000002.2584302635.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584354562.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ba0000_BC5tT98.jbxd

Similarity

API ID: Resource$Find$FreeLoadLockSizeofmemcpy_s
String ID: TITLE$smo
API String ID: 3370778649-3033500379
Opcode ID: 1e219cf3cb46aeaf51373e34024900191b0f22472df65fec3c70f08c1505b967
Instruction ID: 2afffdf24b676237cc362bac5c3875ec3ce8ae96c99c42de12e82027de4fb72c
Opcode Fuzzy Hash: 1e219cf3cb46aeaf51373e34024900191b0f22472df65fec3c70f08c1505b967
Instruction Fuzzy Hash: A60186362442107BE3201BA95C4EF7B7E6CDBC7B52F044054FA4A97150CFA18845C6B6

Uniqueness

Uniqueness Score: -1.00%

Function 00BA17EE Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 71librarymemoryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(advapi32.dll,00000002,?,00000000,?,?,?,00BA18DD), ref: 00BA181A
GetProcAddress.KERNEL32(00000000,CheckTokenMembership), ref: 00BA182C
AllocateAndInitializeSid.ADVAPI32(00BA18DD,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,00BA18DD), ref: 00BA1855
FreeSid.ADVAPI32(?,?,?,?,00BA18DD), ref: 00BA1883
FreeLibrary.KERNEL32(00000000,?,?,?,00BA18DD), ref: 00BA188A

Strings

advapi32.dll, xrefs: 00BA1810
CheckTokenMembership, xrefs: 00BA1826

Memory Dump Source

Source File: 00000002.00000002.2584327656.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000002.00000002.2584302635.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584354562.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ba0000_BC5tT98.jbxd

Similarity

API ID: FreeLibrary$AddressAllocateInitializeLoadProc
String ID: CheckTokenMembership$advapi32.dll
API String ID: 4204503880-1888249752
Opcode ID: ecc74d5de9b367acbfb959f0d9308b30aa300414790738f9ec1cb649f61adc32
Instruction ID: daa609075922c8e4c8cda6abafa1f65f23e8dba425c96fefa8c764534507c4d0
Opcode Fuzzy Hash: ecc74d5de9b367acbfb959f0d9308b30aa300414790738f9ec1cb649f61adc32
Instruction Fuzzy Hash: 4411B975E00209AFDB109FA4DC4AABEBBB8EF46710F100569F901E3290DF309D04C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 00BA3450 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

EndDialog.USER32(?,?), ref: 00BA3490
GetDesktopWindow.USER32 ref: 00BA349A
SetWindowTextA.USER32(?,smo), ref: 00BA34B2
SetDlgItemTextA.USER32(?,00000838), ref: 00BA34C4
SetForegroundWindow.USER32(?), ref: 00BA34CB
EndDialog.USER32(?,00000002), ref: 00BA34D8

Strings

smo, xrefs: 00BA34AC

Memory Dump Source

Source File: 00000002.00000002.2584327656.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000002.00000002.2584302635.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584354562.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ba0000_BC5tT98.jbxd

Similarity

API ID: Window$DialogText$DesktopForegroundItem
String ID: smo
API String ID: 852535152-2762499640
Opcode ID: b516f76276cead0ecc8de019fd6789182bf12e28bfd389a59ef7e887a389b081
Instruction ID: 2dff8ae086a49fa931bbcf461588f1138587653a30a33dbfe24236818cc36550
Opcode Fuzzy Hash: b516f76276cead0ecc8de019fd6789182bf12e28bfd389a59ef7e887a389b081
Instruction Fuzzy Hash: 5F01B131248114BBD7265F69DC0D9AD3AE4EB0FB40F104050F946A76A0CF748F42DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00BA2AAC Relevance: 12.1, APIs: 8, Instructions: 118COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(?,00000104,00000000,00000000,?), ref: 00BA2AE6
IsDBCSLeadByte.KERNEL32(00000000), ref: 00BA2AF2
CharNextA.USER32(?), ref: 00BA2B12
CharUpperA.USER32 ref: 00BA2B1E
CharPrevA.USER32(?,?), ref: 00BA2B55
CharNextA.USER32(?), ref: 00BA2BD4

Memory Dump Source

Source File: 00000002.00000002.2584327656.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000002.00000002.2584302635.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584354562.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ba0000_BC5tT98.jbxd

Similarity

API ID: Char$Next$ByteFileLeadModuleNamePrevUpper
String ID:
API String ID: 571164536-0
Opcode ID: 33bb4cee6c823e764ccc1f0392dc63d2e9d460b7b82a07bf166556116b0a3e7a
Instruction ID: bd5973b0e1d83b057fb562dad6ca1dcf9b6414bee9b877b201aa89a0b17fa644
Opcode Fuzzy Hash: 33bb4cee6c823e764ccc1f0392dc63d2e9d460b7b82a07bf166556116b0a3e7a
Instruction Fuzzy Hash: A941BF346082456FDB269F289854AFD7BE9DF57310F5400DAE88297242DF358E86CB71

Uniqueness

Uniqueness Score: -1.00%

Function 00BA43D0 Relevance: 10.6, APIs: 7, Instructions: 97COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00BA43F1
GetWindowRect.USER32(00000000,?), ref: 00BA440B
GetDC.USER32(?), ref: 00BA4423
GetDeviceCaps.GDI32(00000000,00000008), ref: 00BA442E
GetDeviceCaps.GDI32(00000000,0000000A), ref: 00BA443A
ReleaseDC.USER32(?,00000000), ref: 00BA4447
SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,00000005,?,00000001,?), ref: 00BA44A2

Memory Dump Source

Source File: 00000002.00000002.2584327656.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000002.00000002.2584302635.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584354562.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ba0000_BC5tT98.jbxd

Similarity

API ID: Window$CapsDeviceRect$Release
String ID:
API String ID: 2212493051-0
Opcode ID: b63d0b54c19d5ca6307c551ed4fec3c8271542257091a65a54467872fa13ffce
Instruction ID: cb10aafdbbb663f4c6ac9a7301e63dfbfadcac7ad88170393ad414ebdfcde993
Opcode Fuzzy Hash: b63d0b54c19d5ca6307c551ed4fec3c8271542257091a65a54467872fa13ffce
Instruction Fuzzy Hash: AF31E872E00119AFCB14CFB8DD899EEBBB5EB8A310F154169E905B7250EF70AD05CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00BA6298 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 90COMMON

Download Yara Rule

APIs

Part of subcall function 00BA171E: _vsnprintf.MSVCRT ref: 00BA1750

LoadResource.KERNEL32(00000000,00000000,?,?,00000002,00000000,?,00BA51CA,00000004,00000024,00BA2F71,?,00000002,00000000), ref: 00BA62CD
LockResource.KERNEL32(00000000,?,?,00000002,00000000,?,00BA51CA,00000004,00000024,00BA2F71,?,00000002,00000000), ref: 00BA62D4
FreeResource.KERNEL32(00000000,?,?,00000002,00000000,?,00BA51CA,00000004,00000024,00BA2F71,?,00000002,00000000), ref: 00BA631B
FindResourceA.KERNEL32(00000000,00000004,0000000A), ref: 00BA6345
FreeResource.KERNEL32(00000000,?,?,00000002,00000000,?,00BA51CA,00000004,00000024,00BA2F71,?,00000002,00000000), ref: 00BA6357

Strings

UPDFILE%lu, xrefs: 00BA62B3, 00BA6329

Memory Dump Source

Source File: 00000002.00000002.2584327656.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000002.00000002.2584302635.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584354562.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ba0000_BC5tT98.jbxd

Similarity

API ID: Resource$Free$FindLoadLock_vsnprintf
String ID: UPDFILE%lu
API String ID: 2922116661-2329316264
Opcode ID: 580a6c8dba6f11a5c86d55c6e6c1ec670756dea9e42a0886a95463ea190cd635
Instruction ID: 9cba69a4691fd80dcff13b01423e023877c021706fd26dd9835015655f86dc23
Opcode Fuzzy Hash: 580a6c8dba6f11a5c86d55c6e6c1ec670756dea9e42a0886a95463ea190cd635
Instruction Fuzzy Hash: 5721F6B5A04219AFDF109F68CC469BFBBF8FB4A710B040169F902A3251DB359D06CBE4

Uniqueness

Uniqueness Score: -1.00%

Function 00BA681F Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 81registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,00000000,00000002), ref: 00BA686E
GetSystemMetrics.USER32(0000004A), ref: 00BA68A7
RegOpenKeyExA.ADVAPI32(80000001,Control Panel\Desktop\ResourceLocale,00000000,00020019,?), ref: 00BA68CC
RegQueryValueExA.ADVAPI32(?,00BA1140,00000000,?,?,0000000C), ref: 00BA68F4
RegCloseKey.ADVAPI32(?), ref: 00BA6902

Part of subcall function 00BA66F9: CharNextA.USER32(?,00000001,00000000,00000000,?,?,?,00BA691A), ref: 00BA6741

Strings

Control Panel\Desktop\ResourceLocale, xrefs: 00BA68C2

Memory Dump Source

Source File: 00000002.00000002.2584327656.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000002.00000002.2584302635.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584354562.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ba0000_BC5tT98.jbxd

Similarity

API ID: CharCloseMetricsNextOpenQuerySystemValueVersion
String ID: Control Panel\Desktop\ResourceLocale
API String ID: 3346862599-1109908249
Opcode ID: 13f8990784a9a7c360844c0bc1ef79a8f350b2fdde2edc5305712f30011a9d18
Instruction ID: 2c5791b2639cbc0448749ff28384bc01777d4b392f015ff0e4e07725db4abd05
Opcode Fuzzy Hash: 13f8990784a9a7c360844c0bc1ef79a8f350b2fdde2edc5305712f30011a9d18
Instruction Fuzzy Hash: CF314FB1A042189FDB318B15CC45BABB7F9EB8B764F0801E9E949A3150DB309985CB52

Uniqueness

Uniqueness Score: -1.00%

Function 00BA3A3F Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 73memorystringCOMMON

Download Yara Rule

APIs

Part of subcall function 00BA468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00BA46A0
Part of subcall function 00BA468F: SizeofResource.KERNEL32(00000000,00000000,?,00BA2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00BA46A9
Part of subcall function 00BA468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00BA46C3
Part of subcall function 00BA468F: LoadResource.KERNEL32(00000000,00000000,?,00BA2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00BA46CC
Part of subcall function 00BA468F: LockResource.KERNEL32(00000000,?,00BA2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00BA46D3
Part of subcall function 00BA468F: memcpy_s.MSVCRT ref: 00BA46E5
Part of subcall function 00BA468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 00BA46EF

LocalAlloc.KERNEL32(00000040,00000001,00000000,?,00000002,00000000,00BA2F64,?,00000002,00000000), ref: 00BA3A5D
LocalFree.KERNEL32(00000000,00000000,00000010,00000000,00000000), ref: 00BA3AB3

Part of subcall function 00BA44B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00BA4518
Part of subcall function 00BA44B9: MessageBoxA.USER32(?,?,smo,00010010), ref: 00BA4554

Part of subcall function 00BA6285: GetLastError.KERNEL32(00BA5BBC), ref: 00BA6285

lstrcmpA.KERNEL32(<None>,00000000), ref: 00BA3AD0
LocalFree.KERNEL32 ref: 00BA3B13

Part of subcall function 00BA6517: FindResourceA.KERNEL32(00BA0000,000007D6,00000005), ref: 00BA652A
Part of subcall function 00BA6517: LoadResource.KERNEL32(00BA0000,00000000,?,?,00BA2EE8,00000000,00BA19E0,00000547,0000083E,?,?,?,?,?,?,?), ref: 00BA6538
Part of subcall function 00BA6517: DialogBoxIndirectParamA.USER32(00BA0000,00000000,00000547,00BA19E0,00000000), ref: 00BA6557
Part of subcall function 00BA6517: FreeResource.KERNEL32(00000000,?,?,00BA2EE8,00000000,00BA19E0,00000547,0000083E,?,?,?,?,?,?,?,00000002), ref: 00BA6560

LocalFree.KERNEL32(00000000,00BA3100,00000000,00000000), ref: 00BA3AF4

Strings

LICENSE, xrefs: 00BA3A46
<None>, xrefs: 00BA3AC5

Memory Dump Source

Source File: 00000002.00000002.2584327656.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000002.00000002.2584302635.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584354562.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ba0000_BC5tT98.jbxd

Similarity

API ID: Resource$Free$Local$FindLoad$AllocDialogErrorIndirectLastLockMessageParamSizeofStringlstrcmpmemcpy_s
String ID: <None>$LICENSE
API String ID: 2414642746-383193767
Opcode ID: 95e25a10dcbcdb4a14e75acb746df80dac72254f0ecc9bba3be2dba57be578d2
Instruction ID: 1a21488c17b3371ccfc821f2ba6fd9f040e97122bc1927f26d4092f122652462
Opcode Fuzzy Hash: 95e25a10dcbcdb4a14e75acb746df80dac72254f0ecc9bba3be2dba57be578d2
Instruction Fuzzy Hash: CD1187713082117BD7206F76DC0AF1B7AE9DBDBB00B10447EB545E75A1DFB988009664

Uniqueness

Uniqueness Score: -1.00%

Function 00BA24E0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104,00000000,00000000), ref: 00BA2506
WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,?), ref: 00BA252C
_lopen.KERNEL32(?,00000040), ref: 00BA253B
_llseek.KERNEL32(00000000,00000000,00000002), ref: 00BA254C
_lclose.KERNEL32(00000000), ref: 00BA2555

Strings

wininit.ini, xrefs: 00BA2510

Memory Dump Source

Source File: 00000002.00000002.2584327656.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000002.00000002.2584302635.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584354562.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ba0000_BC5tT98.jbxd

Similarity

API ID: DirectoryPrivateProfileStringWindowsWrite_lclose_llseek_lopen
String ID: wininit.ini
API String ID: 3273605193-4206010578
Opcode ID: adf76f48b55363503095b321be08d1ded1b5d152310ecfe2b9242a9257cb5083
Instruction ID: b6130952a87db95a0b171adc3c3f2e9d166c663c25b30765ef65c8529a130003
Opcode Fuzzy Hash: adf76f48b55363503095b321be08d1ded1b5d152310ecfe2b9242a9257cb5083
Instruction Fuzzy Hash: 13015E32A041186BC7309B69DC4AEDFBBBDEB97760F000195FA49D3190DF748E45CAA1

Uniqueness

Uniqueness Score: -1.00%

Function 00BA36EE Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 243windowCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,00000000,?,?), ref: 00BA3723
MessageBeep.USER32(00000000), ref: 00BA39C3
MessageBoxA.USER32(00000000,00000000,smo,00000030), ref: 00BA39F1

Strings

3, xrefs: 00BA3785
smo, xrefs: 00BA39E9, 00BA3A19

Memory Dump Source

Source File: 00000002.00000002.2584327656.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000002.00000002.2584302635.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584354562.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ba0000_BC5tT98.jbxd

Similarity

API ID: Message$BeepVersion
String ID: 3$smo
API String ID: 2519184315-1411035656
Opcode ID: 090d0d2138081f59fd8c60537a159460d2d0d55facc083d0ef3ac4247587e8c1
Instruction ID: e70555d6f461c03b6ac2d1780adb3aadfb93fd476dfbf16c6cdcc6fe9210be06
Opcode Fuzzy Hash: 090d0d2138081f59fd8c60537a159460d2d0d55facc083d0ef3ac4247587e8c1
Instruction Fuzzy Hash: AF91C2B1F092249BEB758F14CD81BAA77E0EB47B04F1541EAF84AA7251DB748F81CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00BA6495 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 41libraryCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,advpack.dll,?,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,?,00000000), ref: 00BA64DF
LoadLibraryExA.KERNEL32(?,00000000,00000008,?,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,?,00000000), ref: 00BA64F9
LoadLibraryA.KERNEL32(advpack.dll,?,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,?,00000000), ref: 00BA6502

Strings

advpack.dll, xrefs: 00BA64C2, 00BA64CD, 00BA6501
C:\Users\user\AppData\Local\Temp\IXP002.TMP\, xrefs: 00BA64AC

Memory Dump Source

Source File: 00000002.00000002.2584327656.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000002.00000002.2584302635.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584354562.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ba0000_BC5tT98.jbxd

Similarity

API ID: LibraryLoad$AttributesFile
String ID: C:\Users\user\AppData\Local\Temp\IXP002.TMP\$advpack.dll
API String ID: 438848745-3736221019
Opcode ID: 7cbaaacc8f159c5121fba3d631515b0e71aef80236451e45f728c81bf7712f47
Instruction ID: bd53e2ebc7e892e27082c9f70d7de2c6b8056a84e3509d957f7d2741ee384339
Opcode Fuzzy Hash: 7cbaaacc8f159c5121fba3d631515b0e71aef80236451e45f728c81bf7712f47
Instruction Fuzzy Hash: 790181B1E08108BFDB64DB64DC4AAEA77B8EB67310F5001D5F585A31D0DF70AE8ACA51

Uniqueness

Uniqueness Score: -1.00%

Function 00BA28E8 Relevance: 7.6, APIs: 5, Instructions: 140memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(00000000), ref: 00BA2A6F

Part of subcall function 00BA2773: CharUpperA.USER32(88C731A0,00000000,00000000,00000000), ref: 00BA27A8
Part of subcall function 00BA2773: CharNextA.USER32(0000054D), ref: 00BA27B5
Part of subcall function 00BA2773: CharNextA.USER32(00000000), ref: 00BA27BC
Part of subcall function 00BA2773: RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00020019,?,?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 00BA2829
Part of subcall function 00BA2773: RegQueryValueExA.ADVAPI32(?,00BA1140,00000000,?,-00000005,?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 00BA2852
Part of subcall function 00BA2773: ExpandEnvironmentStringsA.KERNEL32(-00000005,?,00000104,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 00BA2870
Part of subcall function 00BA2773: RegCloseKey.ADVAPI32(?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 00BA28A0

GlobalAlloc.KERNEL32(00000042,00000000,?,?,?,?,?,?,?,?,00BA3938,?,?,?,?,-00000005), ref: 00BA2958
GlobalLock.KERNEL32(00000000,?,?,?,?,?,?,?,?,00BA3938,?,?,?,?,-00000005,?), ref: 00BA2969
GlobalUnlock.KERNEL32(00000000,?,?,?,?,?,?,?,?,00BA3938,?,?,?,?,-00000005,?), ref: 00BA2A21
GlobalUnlock.KERNEL32(00000000,?,?,?,?), ref: 00BA2A81

Memory Dump Source

Source File: 00000002.00000002.2584327656.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000002.00000002.2584302635.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584354562.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ba0000_BC5tT98.jbxd

Similarity

API ID: Global$Char$NextUnlock$AllocCloseEnvironmentExpandFreeLockOpenQueryStringsUpperValue
String ID:
API String ID: 3949799724-0
Opcode ID: e89aa65f11ee353bff024ece6456c03a899ea2e7aba7d344d3e4d48fcc63df7a
Instruction ID: 1c75436af4f6b4e93664067fa3a837246e8d51255b2a5dc7fb06986662496870
Opcode Fuzzy Hash: e89aa65f11ee353bff024ece6456c03a899ea2e7aba7d344d3e4d48fcc63df7a
Instruction Fuzzy Hash: 8B510831E04219DFCB21DF98D985AAEFBF5FF49700F1441AAE915E3221DB319A41DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00BA4169 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00BA468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00BA46A0
Part of subcall function 00BA468F: SizeofResource.KERNEL32(00000000,00000000,?,00BA2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00BA46A9
Part of subcall function 00BA468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00BA46C3
Part of subcall function 00BA468F: LoadResource.KERNEL32(00000000,00000000,?,00BA2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00BA46CC
Part of subcall function 00BA468F: LockResource.KERNEL32(00000000,?,00BA2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00BA46D3
Part of subcall function 00BA468F: memcpy_s.MSVCRT ref: 00BA46E5
Part of subcall function 00BA468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 00BA46EF

LocalAlloc.KERNEL32(00000040,?,00000000,00000000,00000105,00000000,00BA30B4), ref: 00BA4189
LocalFree.KERNEL32(00000000,?,00000000,00000000,00000105,00000000,00BA30B4), ref: 00BA41E7

Part of subcall function 00BA44B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00BA4518
Part of subcall function 00BA44B9: MessageBoxA.USER32(?,?,smo,00010010), ref: 00BA4554

Strings

<None>, xrefs: 00BA41C5
FINISHMSG, xrefs: 00BA4173, 00BA41AB

Memory Dump Source

Source File: 00000002.00000002.2584327656.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000002.00000002.2584302635.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584354562.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ba0000_BC5tT98.jbxd

Similarity

API ID: Resource$FindFreeLoadLocal$AllocLockMessageSizeofStringmemcpy_s
String ID: <None>$FINISHMSG
API String ID: 3507850446-3091758298
Opcode ID: 7108e6cbe932b9f03df45f8b6ab814a8c2eb95c8f3ac9ed9d1fef2e92e5dcc2c
Instruction ID: 362d1727b2fd62c37662170b82c66228000962ac4c2eadb770ac19cbef99b0b8
Opcode Fuzzy Hash: 7108e6cbe932b9f03df45f8b6ab814a8c2eb95c8f3ac9ed9d1fef2e92e5dcc2c
Instruction Fuzzy Hash: 4301A4B53082247BF7241A698C86F7B69CEDBDB795F1044A5B705F26809FE8CC0141B9

Uniqueness

Uniqueness Score: -1.00%

Function 00BA19E0 Relevance: 7.6, APIs: 5, Instructions: 51windowCOMMON

Download Yara Rule

APIs

EndDialog.USER32(?,?), ref: 00BA1A18
GetDesktopWindow.USER32 ref: 00BA1A24
LoadStringA.USER32(?,?,00000200), ref: 00BA1A4F
SetDlgItemTextA.USER32(?,0000083F,00000000), ref: 00BA1A62
MessageBeep.USER32(000000FF), ref: 00BA1A6A

Memory Dump Source

Source File: 00000002.00000002.2584327656.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000002.00000002.2584302635.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584354562.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ba0000_BC5tT98.jbxd

Similarity

API ID: BeepDesktopDialogItemLoadMessageStringTextWindow
String ID:
API String ID: 1273765764-0
Opcode ID: 1c46d44dbd5713e63e171fdd456aa3997463aae92b57d486b1dc9b0fbf5806e1
Instruction ID: 171c1466b2204d1fdd98c2624099feb6a8815ba9277b45c3713894b0a0aa7dde
Opcode Fuzzy Hash: 1c46d44dbd5713e63e171fdd456aa3997463aae92b57d486b1dc9b0fbf5806e1
Instruction Fuzzy Hash: 6C118E31605109ABDB50EF68DD09AAE77F8EB4B310F1085A5E922E3190DF309E01DBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00BA7155 Relevance: 7.6, APIs: 5, Instructions: 51timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 00BA7182
GetCurrentProcessId.KERNEL32 ref: 00BA7191
GetCurrentThreadId.KERNEL32 ref: 00BA719A
GetTickCount.KERNEL32 ref: 00BA71A3
QueryPerformanceCounter.KERNEL32(?), ref: 00BA71B8

Memory Dump Source

Source File: 00000002.00000002.2584327656.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000002.00000002.2584302635.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584354562.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ba0000_BC5tT98.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: f87a382e922a5b9dee71f860e704e6b4b73cee7540fb7d49ba282896b7161a59
Instruction ID: f40276233130a4f10e89596ee96103655b3553313bbd5453ab36cc2c9a5fba27
Opcode Fuzzy Hash: f87a382e922a5b9dee71f860e704e6b4b73cee7540fb7d49ba282896b7161a59
Instruction Fuzzy Hash: 02110671D09208EBCB10DFB8DA59A9EB7F4FF4A315F6148A6E905E7210EF349A04CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00BA63C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 69fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,?,C:\Users\user\AppData\Local\Temp\IXP002.TMP\), ref: 00BA642D
WriteFile.KERNEL32(00000000,?,?,00000000,00000000,?,C:\Users\user\AppData\Local\Temp\IXP002.TMP\), ref: 00BA645B
CloseHandle.KERNEL32(00000000,?,C:\Users\user\AppData\Local\Temp\IXP002.TMP\), ref: 00BA647A

Strings

C:\Users\user\AppData\Local\Temp\IXP002.TMP\, xrefs: 00BA63EB

Memory Dump Source

Source File: 00000002.00000002.2584327656.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000002.00000002.2584302635.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584354562.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ba0000_BC5tT98.jbxd

Similarity

API ID: File$CloseCreateHandleWrite
String ID: C:\Users\user\AppData\Local\Temp\IXP002.TMP\
API String ID: 1065093856-1610346413
Opcode ID: f3c4927edb51b33ddf5d56b4c23d701ab813a7d014b20b265846ee4be0067868
Instruction ID: 828189ddcd09ebf1bbef1ba7f7cb41587dea0f9d7882e74543a8296591d96c64
Opcode Fuzzy Hash: f3c4927edb51b33ddf5d56b4c23d701ab813a7d014b20b265846ee4be0067868
Instruction Fuzzy Hash: A221C3B1A04218AFD720DF25DC86FEB77A8EB4A314F0041A9A595A3280DFB05D848FA4

Uniqueness

Uniqueness Score: -1.00%

Function 00BA47E0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000008,?,00000000,00BA4E6F), ref: 00BA47EA
LocalAlloc.KERNEL32(00000040,?), ref: 00BA4823
LocalFree.KERNEL32(00000000,00000000,00000000,00000010,00000000), ref: 00BA4847

Part of subcall function 00BA44B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00BA4518
Part of subcall function 00BA44B9: MessageBoxA.USER32(?,?,smo,00010010), ref: 00BA4554

Strings

C:\Users\user\AppData\Local\Temp\IXP002.TMP\, xrefs: 00BA4851

Memory Dump Source

Source File: 00000002.00000002.2584327656.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000002.00000002.2584302635.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584354562.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ba0000_BC5tT98.jbxd

Similarity

API ID: Local$Alloc$FreeLoadMessageString
String ID: C:\Users\user\AppData\Local\Temp\IXP002.TMP\
API String ID: 359063898-1610346413
Opcode ID: 54f65150fe726489291395aaa83a31c3f3f43d12c601286c8d794b92da551f27
Instruction ID: fd6163579a374839c10f80ba5cf1f8aae7bd4ee8cabfb151d267635e8fb4db26
Opcode Fuzzy Hash: 54f65150fe726489291395aaa83a31c3f3f43d12c601286c8d794b92da551f27
Instruction Fuzzy Hash: 601102796086416FD7248F34AC59F723B9AEBC7300B048599EA829B341DFB98C06C760

Uniqueness

Uniqueness Score: -1.00%

Function 00BA3680 Relevance: 6.1, APIs: 4, Instructions: 51windowCOMMON

Download Yara Rule

APIs

MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000004FF), ref: 00BA369F
PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 00BA36B2
DispatchMessageA.USER32(?), ref: 00BA36CB
PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 00BA36DA

Memory Dump Source

Source File: 00000002.00000002.2584327656.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000002.00000002.2584302635.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584354562.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ba0000_BC5tT98.jbxd

Similarity

API ID: Message$Peek$DispatchMultipleObjectsWait
String ID:
API String ID: 2776232527-0
Opcode ID: b9e40fcb9e016d793c58b7a2a44af0c08de6e2d38db49c5f49651945bd9ddfdb
Instruction ID: 4f9c6c405e341da2d9b6607a96c70e79557aced52283211c2a2535b68b556cad
Opcode Fuzzy Hash: b9e40fcb9e016d793c58b7a2a44af0c08de6e2d38db49c5f49651945bd9ddfdb
Instruction Fuzzy Hash: 8B0184729082147BDB304BAA5C49EEF76FCEB87F10F140159F905E2180DA608A44C670

Uniqueness

Uniqueness Score: -1.00%

Function 00BA6517 Relevance: 6.1, APIs: 4, Instructions: 51COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(00BA0000,000007D6,00000005), ref: 00BA652A
LoadResource.KERNEL32(00BA0000,00000000,?,?,00BA2EE8,00000000,00BA19E0,00000547,0000083E,?,?,?,?,?,?,?), ref: 00BA6538
DialogBoxIndirectParamA.USER32(00BA0000,00000000,00000547,00BA19E0,00000000), ref: 00BA6557
FreeResource.KERNEL32(00000000,?,?,00BA2EE8,00000000,00BA19E0,00000547,0000083E,?,?,?,?,?,?,?,00000002), ref: 00BA6560

Memory Dump Source

Source File: 00000002.00000002.2584327656.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000002.00000002.2584302635.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584354562.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ba0000_BC5tT98.jbxd

Similarity

API ID: Resource$DialogFindFreeIndirectLoadParam
String ID:
API String ID: 1214682469-0
Opcode ID: 5353bfbaf41a428be659111141ed8c2b2f77c3e981dc5af8cf8a775a89fd81cb
Instruction ID: c57f24b760cb573bcc4b5b35ed8b791e61a89b31682562bc060542e292291bdc
Opcode Fuzzy Hash: 5353bfbaf41a428be659111141ed8c2b2f77c3e981dc5af8cf8a775a89fd81cb
Instruction Fuzzy Hash: 460149B2500209BBCB205FA99C49DBB7BADEB9B760F080165FE00A3190DF71CC10D6B1

Uniqueness

Uniqueness Score: -1.00%

Function 00BA65E8 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

CharPrevA.USER32(?,00000000,00000000,00000001,00000000,00BA2B33), ref: 00BA6602
CharPrevA.USER32(?,00000000), ref: 00BA6612
CharPrevA.USER32(?,00000000), ref: 00BA6629
CharNextA.USER32(00000000), ref: 00BA6635

Memory Dump Source

Source File: 00000002.00000002.2584327656.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000002.00000002.2584302635.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584354562.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ba0000_BC5tT98.jbxd

Similarity

API ID: Char$Prev$Next
String ID:
API String ID: 3260447230-0
Opcode ID: 2439bfae37ef98ee4c81c2e775db15a6dd5d5300b10f93861893b5d87320a227
Instruction ID: 8ebe74f98b56d4451a0edf428e6b5641786e72dd197d7235792fef8d69912f18
Opcode Fuzzy Hash: 2439bfae37ef98ee4c81c2e775db15a6dd5d5300b10f93861893b5d87320a227
Instruction Fuzzy Hash: E6F0F4B25081507EE7321B2C8C889FBBFDCCB87254B2D01EFE49193001DB250D06C671

Uniqueness

Uniqueness Score: -1.00%

Function 00BA69B0 Relevance: 6.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

Part of subcall function 00BA6FBE: GetModuleHandleW.KERNEL32(00000000), ref: 00BA6FC5

__set_app_type.MSVCRT ref: 00BA69C2
__p__fmode.MSVCRT ref: 00BA69D8
__p__commode.MSVCRT ref: 00BA69E6
__setusermatherr.MSVCRT ref: 00BA6A07

Memory Dump Source

Source File: 00000002.00000002.2584327656.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000002.00000002.2584302635.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584354562.0000000000BA8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2584382522.0000000000BAC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ba0000_BC5tT98.jbxd

Similarity

API ID: HandleModule__p__commode__p__fmode__set_app_type__setusermatherr
String ID:
API String ID: 1632413811-0
Opcode ID: 8ec1f06afad76a29c45170682a43eed9203651d63911bf7be7ae775f84d0c63c
Instruction ID: dc6d8c562dd48eb2425b58c5ff169e07fd16601c18be6f06964cb2bbd224ed58
Opcode Fuzzy Hash: 8ec1f06afad76a29c45170682a43eed9203651d63911bf7be7ae775f84d0c63c
Instruction Fuzzy Hash: FEF015B094C301AFC768AB30ED1B7083BE1FB07331B110689E862976F0DF3A8565CA21

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: 2Iu7231.exePID: 7344, Parent PID: 7328COMMON

Execution Graph

Execution Coverage:	7.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0.9%
Total number of Nodes:	1528
Total number of Limit Nodes:	21

Executed Functions

Function 00081000 Relevance: 34.7, APIs: 23, Instructions: 223
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 00081028
CryptDestroyKey.ADVAPI32 ref: 0008104A
CryptDestroyKey.ADVAPI32 ref: 0008106F
CryptDestroyKey.ADVAPI32 ref: 00081094
CryptDestroyKey.ADVAPI32 ref: 000810B6
CryptDestroyKey.ADVAPI32 ref: 000810D8
CryptDestroyKey.ADVAPI32 ref: 000810FD
CryptDestroyKey.ADVAPI32 ref: 00081122
CryptDestroyKey.ADVAPI32 ref: 00081147
CryptDestroyKey.ADVAPI32 ref: 0008116C
CryptDestroyKey.ADVAPI32 ref: 00081191
CryptDestroyKey.ADVAPI32 ref: 000811B6
CryptDestroyKey.ADVAPI32 ref: 000811D8
CryptDestroyKey.ADVAPI32 ref: 000811FA
CryptDestroyKey.ADVAPI32 ref: 0008121C
CryptDestroyKey.ADVAPI32 ref: 0008123E
CryptDestroyKey.ADVAPI32 ref: 00081263
CryptDestroyKey.ADVAPI32 ref: 00081288
CryptDestroyKey.ADVAPI32 ref: 000812AD
CryptDestroyKey.ADVAPI32 ref: 000812D2
CryptDestroyKey.ADVAPI32 ref: 000812F4
CryptDestroyKey.ADVAPI32 ref: 00081316
CryptDestroyKey.ADVAPI32 ref: 00081338

Memory Dump Source

Source File: 00000003.00000002.2216650928.0000000000081000.00000020.00000001.01000000.00000006.sdmp, Offset: 00080000, based on PE: true

Associated: 00000003.00000002.2216626326.0000000000080000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216686529.00000000000AF000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000BF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000F5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216767194.00000000000FA000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_80000_2Iu7231.jbxd

Yara matches

Similarity

API ID: CryptDestroy$DispatcherExceptionUser
String ID:
API String ID: 2357493748-0
Opcode ID: a5716e5b9f6fda1438ad56888fbb9c028fcc21ac7dd56e91b602d6ff53f01814
Instruction ID: 37cc26e15db87ac61535aa011d54f09fb27b33066295bacdc9097a6681d8673f
Opcode Fuzzy Hash: a5716e5b9f6fda1438ad56888fbb9c028fcc21ac7dd56e91b602d6ff53f01814
Instruction Fuzzy Hash: 12A118745091849FE741EFBCD544F6D7FF1AB4A201F0284ACECC68B3A6CA389A54DB52

Uniqueness

Uniqueness Score: -1.00%

Function 000816B0 Relevance: 26.5, APIs: 10, Strings: 5, Instructions: 283
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE ref: 000817E1

Strings

D, xrefs: 0008173D
ridding, xrefs: 00081987
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe, xrefs: 00081790
D, xrefs: 0008177F
'&e{, xrefs: 00081809

Memory Dump Source

Source File: 00000003.00000002.2216650928.0000000000081000.00000020.00000001.01000000.00000006.sdmp, Offset: 00080000, based on PE: true

Associated: 00000003.00000002.2216626326.0000000000080000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216686529.00000000000AF000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000BF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000F5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216767194.00000000000FA000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_80000_2Iu7231.jbxd

Yara matches

Similarity

API ID: CreateProcess
String ID: '&e{$C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe$D$D$ridding
API String ID: 963392458-4294493744
Opcode ID: 2dc7a492eabe6f2045ff69e9092e7830e7127917a58209c23f2ed46cb64beba5
Instruction ID: 1956284395f0af8bbf9ece51c0bf72a9e2213b2be26b4ee3ef3ff2db674540b7
Opcode Fuzzy Hash: 2dc7a492eabe6f2045ff69e9092e7830e7127917a58209c23f2ed46cb64beba5
Instruction Fuzzy Hash: F3E1E0B4904218CFDB14EF68C984B9DBBF0BF48318F1085A9E499A7341D7759986CF92

Uniqueness

Uniqueness Score: -1.00%

Function 000A1799 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2216650928.0000000000081000.00000020.00000001.01000000.00000006.sdmp, Offset: 00080000, based on PE: true

Associated: 00000003.00000002.2216626326.0000000000080000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216686529.00000000000AF000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000BF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000F5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216767194.00000000000FA000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_80000_2Iu7231.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b962fd2f26cbe9330b84746a34536717462ca516e50708ed7db7ba45343a6a2
Instruction ID: 4c9a44faa559cb1375aa249e51ba4fd7ca135957292ee89b07efb91b809ac3ed
Opcode Fuzzy Hash: 4b962fd2f26cbe9330b84746a34536717462ca516e50708ed7db7ba45343a6a2
Instruction Fuzzy Hash: 38E0B672A15228EBCB15DBD8894598AB2FCEB46B51B1544A6B501D3111D270DE00CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 0009B22E Relevance: .0, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2216650928.0000000000081000.00000020.00000001.01000000.00000006.sdmp, Offset: 00080000, based on PE: true

Associated: 00000003.00000002.2216626326.0000000000080000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216686529.00000000000AF000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000BF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000F5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216767194.00000000000FA000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_80000_2Iu7231.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0523fb0726a566bfb54c014a075df250484c1fd338f8f46bb51b090e01eeff2c
Instruction ID: 3160bc108ff468b712de6fa247ce79eeb35769dd46b68ee941ee29ba16d99ef2
Opcode Fuzzy Hash: 0523fb0726a566bfb54c014a075df250484c1fd338f8f46bb51b090e01eeff2c
Instruction Fuzzy Hash: 38C08C34400B0086CE698B5093713FC33AAE3A37D2F80288CC4120BA52C61E9C86E600

Uniqueness

Uniqueness Score: -1.00%

Function 000A3019 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,?,?,2792C724,?,000A3126,000835F2,?,?,00000000), ref: 000A30DA

Strings

api-ms-, xrefs: 000A3070
ext-ms-, xrefs: 000A3084

Memory Dump Source

Source File: 00000003.00000002.2216650928.0000000000081000.00000020.00000001.01000000.00000006.sdmp, Offset: 00080000, based on PE: true

Associated: 00000003.00000002.2216626326.0000000000080000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216686529.00000000000AF000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000BF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000F5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216767194.00000000000FA000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_80000_2Iu7231.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 81d42fa776aedd7f6e54e092c25a34539ed29ddb6a9ea567a6ae0b4cdaebf4cf
Instruction ID: 36d0ec8a1efbf000fe48e0af82399deaa37d5c15920e5e48bdadb7e6b3d41647
Opcode Fuzzy Hash: 81d42fa776aedd7f6e54e092c25a34539ed29ddb6a9ea567a6ae0b4cdaebf4cf
Instruction Fuzzy Hash: FE21D071A01211ABEB719BE5DC55EAA77A89F437A0F250120FE05E7291EB34EF00C7E0

Uniqueness

Uniqueness Score: -1.00%

Function 0009681A Relevance: 6.1, APIs: 4, Instructions: 70
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0009677B: GetModuleHandleExW.KERNEL32(00000002,00000000,?,?,?,000967CD,?,?,0009680E,?,?,?,?,?,?,?), ref: 00096787

__Mtx_unlock.LIBCPMT ref: 00096860
FreeLibraryWhenCallbackReturns.KERNEL32(?,00000000,2792C724,?,?,?,000AEE24,000000FF), ref: 00096888
__Mtx_unlock.LIBCPMT ref: 000968C3
__Cnd_broadcast.LIBCPMT ref: 000968D4

Memory Dump Source

Source File: 00000003.00000002.2216650928.0000000000081000.00000020.00000001.01000000.00000006.sdmp, Offset: 00080000, based on PE: true

Associated: 00000003.00000002.2216626326.0000000000080000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216686529.00000000000AF000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000BF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000F5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216767194.00000000000FA000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_80000_2Iu7231.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$CallbackCnd_broadcastFreeHandleLibraryModuleReturnsWhen
String ID:
API String ID: 420990631-0
Opcode ID: a0842af68ffe29cc17bf5a21d5f7b243784b0368ec02a3109cbf554da027d989
Instruction ID: 669a65f56f3a88da9748ef663692b5f30058a0d6fb290676cee01262fb37df55
Opcode Fuzzy Hash: a0842af68ffe29cc17bf5a21d5f7b243784b0368ec02a3109cbf554da027d989
Instruction Fuzzy Hash: CC110832604604ABCE117FA0DC01EAFB7E8EF45B60F10852AF90593692DF3BD801E7A1

Uniqueness

Uniqueness Score: -1.00%

Function 000A7DA9 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 191
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000A74F3: GetConsoleOutputCP.KERNEL32(2792C724,?,00000000,?), ref: 000A7556

WriteFile.KERNEL32(?,?,00000000,?,00000000,?,?,?,00000000,?,?,00000000,?,?,0009E34C,?), ref: 000A7F12
GetLastError.KERNEL32(?,?,0009E34C,?,{,00000000,?,00000000,0009E17B,?,?,?,000BDF78,0000002C,0009E24C,?), ref: 000A7F1C

Strings

L, xrefs: 000A7F9D

Memory Dump Source

Source File: 00000003.00000002.2216650928.0000000000081000.00000020.00000001.01000000.00000006.sdmp, Offset: 00080000, based on PE: true

Associated: 00000003.00000002.2216626326.0000000000080000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216686529.00000000000AF000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000BF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000F5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216767194.00000000000FA000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_80000_2Iu7231.jbxd

Yara matches

Similarity

API ID: ConsoleErrorFileLastOutputWrite
String ID: L
API String ID: 2915228174-864600647
Opcode ID: 49e67fb9ed954d50c37ef9809ac9759433465d72f626b44c4d485fa019fff0b2
Instruction ID: 90c1de8e82618034f72e4ea0b0bfb5deacae3e0cd448ba0ef7e2e209108cd246
Opcode Fuzzy Hash: 49e67fb9ed954d50c37ef9809ac9759433465d72f626b44c4d485fa019fff0b2
Instruction Fuzzy Hash: F2618171D08249AFDF11CFE8CC84AEE7BB9AF5A304F148095E808A7252D735DE01CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00083A50 Relevance: 4.6, APIs: 3, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00083A8D

Part of subcall function 000841F0: std::_Lockit::_Lockit.LIBCPMT ref: 00084214
Part of subcall function 000841F0: std::_Lockit::~_Lockit.LIBCPMT ref: 0008423F

std::_Facet_Register.LIBCPMT ref: 00083B46
std::_Lockit::~_Lockit.LIBCPMT ref: 00083B89

Memory Dump Source

Source File: 00000003.00000002.2216650928.0000000000081000.00000020.00000001.01000000.00000006.sdmp, Offset: 00080000, based on PE: true

Associated: 00000003.00000002.2216626326.0000000000080000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216686529.00000000000AF000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000BF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000F5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216767194.00000000000FA000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_80000_2Iu7231.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: a51db4b8433eae29836096fbca242fca162f858277f78cecd6ec78daacb157a9
Instruction ID: 2db0c810cd5f626be7636c6d2ec63a72f31d8d38256d15a8e41f5d223e0b3bb0
Opcode Fuzzy Hash: a51db4b8433eae29836096fbca242fca162f858277f78cecd6ec78daacb157a9
Instruction Fuzzy Hash: 4941A2B4E01209DFCB14EFA8D995AEDBBF0BB48710F104129E856A7351D734AA44CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0009B1BA Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,0009B1B4,00000000,0009AAEA,?,?,2792C724,0009AAEA,?), ref: 0009B1CB
TerminateProcess.KERNEL32(00000000,?,0009B1B4,00000000,0009AAEA,?,?,2792C724,0009AAEA,?), ref: 0009B1D2
ExitProcess.KERNEL32 ref: 0009B1E4

Memory Dump Source

Source File: 00000003.00000002.2216650928.0000000000081000.00000020.00000001.01000000.00000006.sdmp, Offset: 00080000, based on PE: true

Associated: 00000003.00000002.2216626326.0000000000080000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216686529.00000000000AF000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000BF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000F5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216767194.00000000000FA000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_80000_2Iu7231.jbxd

Yara matches

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 16a28e4a75ebdc88e1220823cc4e644e7a78b8569d1db4558cc1d6ef8e853b5b
Instruction ID: 8194daf3afd1b8dc5d293b87efd48b0c1c693a22b7f5d1abb8b2f86e8bbb1e45
Opcode Fuzzy Hash: 16a28e4a75ebdc88e1220823cc4e644e7a78b8569d1db4558cc1d6ef8e853b5b
Instruction Fuzzy Hash: CAD09E31000509ABDF513FA0ED0DCAE3F65EF417517504020B91999073DB759996EB40

Uniqueness

Uniqueness Score: -1.00%

Function 00081A06 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 35
threadinjectionprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE ref: 000817E1
WriteProcessMemory.KERNELBASE ref: 00081AD9
WriteProcessMemory.KERNELBASE ref: 00081B2D
Wow64SetThreadContext.KERNEL32 ref: 00081B5A
ResumeThread.KERNELBASE ref: 00081B86

Strings

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe, xrefs: 00081790

Memory Dump Source

Source File: 00000003.00000002.2216650928.0000000000081000.00000020.00000001.01000000.00000006.sdmp, Offset: 00080000, based on PE: true

Associated: 00000003.00000002.2216626326.0000000000080000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216686529.00000000000AF000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000BF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000F5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216767194.00000000000FA000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_80000_2Iu7231.jbxd

Yara matches

Similarity

API ID: Process$MemoryThreadWrite$ContextCreateResumeWow64
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
API String ID: 2015093061-448403072
Opcode ID: 4373cb918854bc66b695f4ffa2f0aaf0f691392deb89aebb2e901cdb2d52f624
Instruction ID: f7c048b7e87ce3ad8c3bd17e04b780afecc66e60182535f36d4063af2c0f1b08
Opcode Fuzzy Hash: 4373cb918854bc66b695f4ffa2f0aaf0f691392deb89aebb2e901cdb2d52f624
Instruction Fuzzy Hash: 2901E9B0809705CBDB24EF64D85839EBBF4FF48315F108A5DE09996280D7798689CF87

Uniqueness

Uniqueness Score: -1.00%

Function 000A79AB Relevance: 3.1, APIs: 2, Instructions: 80
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,?,?,?,00000000,?,00000000,?,?,000A7EF8,?,?,?,00000000,?,?), ref: 000A7A47
GetLastError.KERNEL32(?,000A7EF8,?,?,?,00000000,?,?,?,00000000,?,?,00000000,?,?,0009E34C), ref: 000A7A6D

Memory Dump Source

Source File: 00000003.00000002.2216650928.0000000000081000.00000020.00000001.01000000.00000006.sdmp, Offset: 00080000, based on PE: true

Associated: 00000003.00000002.2216626326.0000000000080000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216686529.00000000000AF000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000BF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000F5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216767194.00000000000FA000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_80000_2Iu7231.jbxd

Yara matches

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: 21920fe48b37bdabcb11a955ac284a0b967f4ddb02cc8c139e3643cb8f3ae7bd
Instruction ID: d772882e291e0d0759711277e50badbb9a60f15780edb9989249ba7aa88c3fca
Opcode Fuzzy Hash: 21920fe48b37bdabcb11a955ac284a0b967f4ddb02cc8c139e3643cb8f3ae7bd
Instruction Fuzzy Hash: 2C21A331A04219AFCF19CF69DD809EDB7F9EF99301F1480A9E90AD7211D630DE46CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00084560 Relevance: 3.1, APIs: 2, Instructions: 79
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000845A4
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0008461E

Part of subcall function 0009500C: _Yarn.LIBCPMT ref: 0009502B
Part of subcall function 0009500C: _Yarn.LIBCPMT ref: 0009504F

Memory Dump Source

Source File: 00000003.00000002.2216650928.0000000000081000.00000020.00000001.01000000.00000006.sdmp, Offset: 00080000, based on PE: true

Associated: 00000003.00000002.2216626326.0000000000080000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216686529.00000000000AF000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000BF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000F5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216767194.00000000000FA000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_80000_2Iu7231.jbxd

Yara matches

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID:
API String ID: 1908188788-0
Opcode ID: 38aee30ad1318b9ed154332057f1e1ddd01bb80b3b74eafd01b678583d438a21
Instruction ID: 68c475a68df132adf0a37e8db46e008b6e1e057e7a6f60b6ad2dda312b3f3518
Opcode Fuzzy Hash: 38aee30ad1318b9ed154332057f1e1ddd01bb80b3b74eafd01b678583d438a21
Instruction Fuzzy Hash: 573109B0D00249CFCB18EFA8D8416EEBBB1FF49314F04452DE5456B342DB399954CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 000A369E Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6), ref: 000A36EA
GetFileType.KERNELBASE(00000000), ref: 000A36FC

Memory Dump Source

Source File: 00000003.00000002.2216650928.0000000000081000.00000020.00000001.01000000.00000006.sdmp, Offset: 00080000, based on PE: true

Associated: 00000003.00000002.2216626326.0000000000080000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216686529.00000000000AF000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000BF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000F5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216767194.00000000000FA000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_80000_2Iu7231.jbxd

Yara matches

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: 3e9051131805181ec8d7bf01e49331a57af97dfda9476ede8e964c95ef1707c1
Instruction ID: 801f6ca730ebd25e85561c7335547e05acc18f1a40712f8cbae31eb0d4d76f4a
Opcode Fuzzy Hash: 3e9051131805181ec8d7bf01e49331a57af97dfda9476ede8e964c95ef1707c1
Instruction Fuzzy Hash: F011D6F150874156DB704ABE8C8863BBAD5A797330B38071AF0B6876F1C734DE86D240

Uniqueness

Uniqueness Score: -1.00%

Function 00081F40 Relevance: 1.8, APIs: 1, Instructions: 310
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_strlen.LIBCMT ref: 00081F8E

Memory Dump Source

Source File: 00000003.00000002.2216650928.0000000000081000.00000020.00000001.01000000.00000006.sdmp, Offset: 00080000, based on PE: true

Associated: 00000003.00000002.2216626326.0000000000080000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216686529.00000000000AF000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000BF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000F5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216767194.00000000000FA000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_80000_2Iu7231.jbxd

Yara matches

Similarity

API ID: _strlen
String ID:
API String ID: 4218353326-0
Opcode ID: 279271cf218d4a5e64b476760aae58a51e2197e098d52281b19bf2aae5863f79
Instruction ID: 9e22dfc142dfa54d4c2e384608328082cc89e619cd3ed10770da6cb8b1997f94
Opcode Fuzzy Hash: 279271cf218d4a5e64b476760aae58a51e2197e098d52281b19bf2aae5863f79
Instruction Fuzzy Hash: 2FD1F474604B40DFC724EF28C595A6ABBE0BF58714B108A1DE8D78BBA2D735FA44CB41

Uniqueness

Uniqueness Score: -1.00%

Function 000A1558 Relevance: 1.7, APIs: 1, Instructions: 188
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.2216650928.0000000000081000.00000020.00000001.01000000.00000006.sdmp, Offset: 00080000, based on PE: true

Associated: 00000003.00000002.2216626326.0000000000080000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216686529.00000000000AF000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000BF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000F5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216767194.00000000000FA000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_80000_2Iu7231.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06aeefd1b85e1e9d998eec310b6867be6776af32210210aead6edab63b6def3c
Instruction ID: 9a27eb2d1901f577f9cc673672ee7aa78d906be73c3189de5ab2e08bbc0fb954
Opcode Fuzzy Hash: 06aeefd1b85e1e9d998eec310b6867be6776af32210210aead6edab63b6def3c
Instruction Fuzzy Hash: 18510172D042158FEF64ABE8D8847FDB7F0AF5B364F190129E552AB292D7318C00CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00093065 Relevance: 1.6, APIs: 1, Instructions: 107
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_Fputc.LIBCPMT ref: 000930D2

Memory Dump Source

Source File: 00000003.00000002.2216650928.0000000000081000.00000020.00000001.01000000.00000006.sdmp, Offset: 00080000, based on PE: true

Associated: 00000003.00000002.2216626326.0000000000080000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216686529.00000000000AF000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000BF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000F5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216767194.00000000000FA000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_80000_2Iu7231.jbxd

Yara matches

Similarity

API ID: Fputc
String ID:
API String ID: 3078413507-0
Opcode ID: f1e1829e0d3466d9d7d40e5d3b2c50f64f4c543ed441ed123b08c2021ed8786b
Instruction ID: 1e550cd5974db8c5eb0dfa2945065dd7abe9d276e88d16f0e5ec0a7adf7a4c79
Opcode Fuzzy Hash: f1e1829e0d3466d9d7d40e5d3b2c50f64f4c543ed441ed123b08c2021ed8786b
Instruction Fuzzy Hash: E4317231A0011AABCF24DFA9C5609EEB7F8BF48354B144569E501E7650EB32EA54EF90

Uniqueness

Uniqueness Score: -1.00%

Function 000A30E4 Relevance: 1.6, APIs: 1, Instructions: 57
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.2216650928.0000000000081000.00000020.00000001.01000000.00000006.sdmp, Offset: 00080000, based on PE: true

Associated: 00000003.00000002.2216626326.0000000000080000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216686529.00000000000AF000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000BF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000F5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216767194.00000000000FA000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_80000_2Iu7231.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e872682ef3fa138a032292c98c7415d822824e3145f7f736b7a5667981b6890c
Instruction ID: 100fb64ad1625cda8410c69a1c218e6ccf81bece815727ed015243b4dfc288a9
Opcode Fuzzy Hash: e872682ef3fa138a032292c98c7415d822824e3145f7f736b7a5667981b6890c
Instruction Fuzzy Hash: EA01B5376102115FAB258FADFD419AB33D6ABC67607148124F905CB194DB359901A790

Uniqueness

Uniqueness Score: -1.00%

Function 000A17CA Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,00000000,?,?,000A12BE,00000001,00000364,?,00000006,000000FF,?,?,0009FE4E,000A178E,00000000), ref: 000A180B

Memory Dump Source

Source File: 00000003.00000002.2216650928.0000000000081000.00000020.00000001.01000000.00000006.sdmp, Offset: 00080000, based on PE: true

Associated: 00000003.00000002.2216626326.0000000000080000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216686529.00000000000AF000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000BF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000F5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216767194.00000000000FA000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_80000_2Iu7231.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 6d30262b13e0fef17c6c1923ff8c11aca91cbd5f4bffc7f924a58245d0013a2c
Instruction ID: faabc8f32f9f501a13a781e842b1de9adb70f08bc405b93ad5f000512f230f11
Opcode Fuzzy Hash: 6d30262b13e0fef17c6c1923ff8c11aca91cbd5f4bffc7f924a58245d0013a2c
Instruction Fuzzy Hash: DCF0E9326045256B9F715BE69C05BEE77DC9F43B60F14C126E954D6091CF38DC0196F1

Uniqueness

Uniqueness Score: -1.00%

Function 000926C2 Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 000926C9

Memory Dump Source

Source File: 00000003.00000002.2216650928.0000000000081000.00000020.00000001.01000000.00000006.sdmp, Offset: 00080000, based on PE: true

Associated: 00000003.00000002.2216626326.0000000000080000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216686529.00000000000AF000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000BF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000F5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216767194.00000000000FA000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_80000_2Iu7231.jbxd

Yara matches

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: 146db756798e617de0e8d2bb33a51d76a7e2cad35e84b0e3ec82c6401b242580
Instruction ID: 641eef12bb4bd94f9259816efda13a476d095edc33246ad93582a19916a4e6f7
Opcode Fuzzy Hash: 146db756798e617de0e8d2bb33a51d76a7e2cad35e84b0e3ec82c6401b242580
Instruction Fuzzy Hash: 8201E8B4A00745CFCB61DF68C580A9ABBF0BF08304B50891EE489DB741E7B1EA44CF80

Uniqueness

Uniqueness Score: -1.00%

Function 000A174B Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,00000000,?,0009169D,?,?,000835F2,00000000,?,0008352E), ref: 000A177D

Memory Dump Source

Source File: 00000003.00000002.2216650928.0000000000081000.00000020.00000001.01000000.00000006.sdmp, Offset: 00080000, based on PE: true

Associated: 00000003.00000002.2216626326.0000000000080000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216686529.00000000000AF000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000BF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000F5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216767194.00000000000FA000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_80000_2Iu7231.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: bb7762401147f4c70e0fddb61c4b5382c6f6b6987d12fac555b11c150caea0f8
Instruction ID: 4fb524617a5e5a02cc96ad7424ac80ea82b25e235139028348bcf282f7fcebeb
Opcode Fuzzy Hash: bb7762401147f4c70e0fddb61c4b5382c6f6b6987d12fac555b11c150caea0f8
Instruction Fuzzy Hash: 46E0ED352082229AEB7026E6AC04BEE76BC9F833A0F141221ED26920D1CA20CC4092E1

Uniqueness

Uniqueness Score: -1.00%

Function 0009301B Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

std::ios_base::_Init.LIBCPMT ref: 00093021

Part of subcall function 00092C3D: __EH_prolog3.LIBCMT ref: 00092C44
Part of subcall function 00092C3D: std::locale::_Init.LIBCPMT ref: 00092C8D

Memory Dump Source

Source File: 00000003.00000002.2216650928.0000000000081000.00000020.00000001.01000000.00000006.sdmp, Offset: 00080000, based on PE: true

Associated: 00000003.00000002.2216626326.0000000000080000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216686529.00000000000AF000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000BF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000F5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216767194.00000000000FA000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_80000_2Iu7231.jbxd

Yara matches

Similarity

API ID: Init$H_prolog3std::ios_base::_std::locale::_
String ID:
API String ID: 2854901245-0
Opcode ID: 4b93a0d8f4398604008c618370c4c9ea5dc19b312bab8578cab4cf62148471ca
Instruction ID: 5589b03a1794696c0860d6b45882c71af5b33c766bde893f51b374cd2793cd8b
Opcode Fuzzy Hash: 4b93a0d8f4398604008c618370c4c9ea5dc19b312bab8578cab4cf62148471ca
Instruction Fuzzy Hash: 63F0E5306007146BDB30B6758455B8B77D4AF00334F00881EF48247A82DAB6F4408F94

Uniqueness

Uniqueness Score: -1.00%

Function 0008F610 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0008F631

Memory Dump Source

Source File: 00000003.00000002.2216650928.0000000000081000.00000020.00000001.01000000.00000006.sdmp, Offset: 00080000, based on PE: true

Associated: 00000003.00000002.2216626326.0000000000080000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216686529.00000000000AF000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000BF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000F5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216767194.00000000000FA000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_80000_2Iu7231.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 3864e6731067c9ddf47fbad72b4bc3454b06bb88b51078060ad0fb35b00bb120
Instruction ID: 6e4e1508d40c355ed8099d37a2b3c7d3953883510921f98dfca5db691d81ce32
Opcode Fuzzy Hash: 3864e6731067c9ddf47fbad72b4bc3454b06bb88b51078060ad0fb35b00bb120
Instruction Fuzzy Hash: FDE04670C04208EFCB44FBB5D1458ACBBB4BF40310F2040B9E999A7367EA319E25DB42

Uniqueness

Uniqueness Score: -1.00%

Function 00088A60 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00088A81

Memory Dump Source

Source File: 00000003.00000002.2216650928.0000000000081000.00000020.00000001.01000000.00000006.sdmp, Offset: 00080000, based on PE: true

Associated: 00000003.00000002.2216626326.0000000000080000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216686529.00000000000AF000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000BF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000F5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216767194.00000000000FA000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_80000_2Iu7231.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 7b77bb9c90f107982e3fc63dfe5d9a1053ed0cb31bb63efbdf9f80ec20138404
Instruction ID: b62eedf076881a94d3a7cb83d08cb6c3654514b3ca3ccb06a701e72c6e9c8195
Opcode Fuzzy Hash: 7b77bb9c90f107982e3fc63dfe5d9a1053ed0cb31bb63efbdf9f80ec20138404
Instruction Fuzzy Hash: 79E04670C04208EBCB08FBA8D14589CBBB8BF40304F2080BAE99967357DA31AE00DB42

Uniqueness

Uniqueness Score: -1.00%

Function 00081680 Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

FreeConsole.KERNELBASE ref: 000816A6

Memory Dump Source

Source File: 00000003.00000002.2216650928.0000000000081000.00000020.00000001.01000000.00000006.sdmp, Offset: 00080000, based on PE: true

Associated: 00000003.00000002.2216626326.0000000000080000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216686529.00000000000AF000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000BF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000F5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216767194.00000000000FA000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_80000_2Iu7231.jbxd

Yara matches

Similarity

API ID: ConsoleFree
String ID:
API String ID: 771614528-0
Opcode ID: ddfd4820a71f847902e93309af009975f3eab553ab26d5fca177e264acbcfc6c
Instruction ID: edbfe3e7a2443777101255b77d72067a4350d412ec0adc31584a73fdac4bb459
Opcode Fuzzy Hash: ddfd4820a71f847902e93309af009975f3eab553ab26d5fca177e264acbcfc6c
Instruction Fuzzy Hash: 31D09E749042049BC700FFA8944149E77A86F44250F558175D49C87616E63495528B93

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 000A5D94 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,000A60B2,00000002,00000000,?,?,?,000A60B2,?,00000000), ref: 000A5E2D
GetLocaleInfoW.KERNEL32(?,20001004,000A60B2,00000002,00000000,?,?,?,000A60B2,?,00000000), ref: 000A5E56
GetACP.KERNEL32(?,?,000A60B2,?,00000000), ref: 000A5E6B

Strings

OCP, xrefs: 000A5DE8
ACP, xrefs: 000A5DB2

Memory Dump Source

Source File: 00000003.00000002.2216650928.0000000000081000.00000020.00000001.01000000.00000006.sdmp, Offset: 00080000, based on PE: true

Associated: 00000003.00000002.2216626326.0000000000080000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216686529.00000000000AF000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000BF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000F5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216767194.00000000000FA000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_80000_2Iu7231.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: baafce104a03e4700485a982110a309b1e368aa3cba2ec1e9ec5e7931d8180f9
Instruction ID: 6224661e4e9c669538a1761058ffc354fa03377846fe2243e6db97b2d9787c51
Opcode Fuzzy Hash: baafce104a03e4700485a982110a309b1e368aa3cba2ec1e9ec5e7931d8180f9
Instruction Fuzzy Hash: E921B632700901A6EB78CFD4CD05A9B73E6BF66B62B564025E90ADB111FB32DF40C350

Uniqueness

Uniqueness Score: -1.00%

Function 000A5F69 Relevance: 7.7, APIs: 5, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000A1120: GetLastError.KERNEL32(?,00000008,000A171F,00000000,0009AC68), ref: 000A1124
Part of subcall function 000A1120: SetLastError.KERNEL32(00000000,00000006,000000FF), ref: 000A11C6

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 000A6075
IsValidCodePage.KERNEL32(00000000), ref: 000A60BE
IsValidLocale.KERNEL32(?,00000001), ref: 000A60CD
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 000A6115
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 000A6134

Memory Dump Source

Source File: 00000003.00000002.2216650928.0000000000081000.00000020.00000001.01000000.00000006.sdmp, Offset: 00080000, based on PE: true

Associated: 00000003.00000002.2216626326.0000000000080000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216686529.00000000000AF000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000BF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000F5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216767194.00000000000FA000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_80000_2Iu7231.jbxd

Yara matches

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: 8c2dde566ef5b9f3b44971f9665b36096071e0bb618af2398b5209a7a9c977f1
Instruction ID: fb6f66e70835f4d4fce03262b549ef3a4c119cf78f47c08cbcb6cf97e9614e33
Opcode Fuzzy Hash: 8c2dde566ef5b9f3b44971f9665b36096071e0bb618af2398b5209a7a9c977f1
Instruction Fuzzy Hash: F6517F71A00605AEEB20DFE4CC41EFF77F8BF4A701F184529A911E7192EB729944CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 000A5605 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000A1120: GetLastError.KERNEL32(?,00000008,000A171F,00000000,0009AC68), ref: 000A1124
Part of subcall function 000A1120: SetLastError.KERNEL32(00000000,00000006,000000FF), ref: 000A11C6

GetACP.KERNEL32(?,?,?,?,?,?,0009C6B4,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 000A56C6
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,0009C6B4,?,?,?,00000055,?,-00000050,?,?), ref: 000A56F1
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 000A5854

Strings

utf8, xrefs: 000A57C3

Memory Dump Source

Source File: 00000003.00000002.2216650928.0000000000081000.00000020.00000001.01000000.00000006.sdmp, Offset: 00080000, based on PE: true

Associated: 00000003.00000002.2216626326.0000000000080000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216686529.00000000000AF000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000BF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000F5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216767194.00000000000FA000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_80000_2Iu7231.jbxd

Yara matches

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: utf8
API String ID: 607553120-905460609
Opcode ID: e5e4ff21856c359353fd6460f4549baded66113620b760f614b2aa7aaea89c66
Instruction ID: ccf0e856ab62b67f8b5ed332a7e7e90bfa5dffb28dd6063be4ec3f00d364dc52
Opcode Fuzzy Hash: e5e4ff21856c359353fd6460f4549baded66113620b760f614b2aa7aaea89c66
Instruction Fuzzy Hash: 2571D675604B02AADB24ABF5DC86BEE73ECFF46701F144469F905EB182EA74D9408660

Uniqueness

Uniqueness Score: -1.00%

Function 00091DAF Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00091DBB
IsDebuggerPresent.KERNEL32 ref: 00091E87
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00091EA7
UnhandledExceptionFilter.KERNEL32(?), ref: 00091EB1

Memory Dump Source

Source File: 00000003.00000002.2216650928.0000000000081000.00000020.00000001.01000000.00000006.sdmp, Offset: 00080000, based on PE: true

Associated: 00000003.00000002.2216626326.0000000000080000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216686529.00000000000AF000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000BF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000F5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216767194.00000000000FA000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_80000_2Iu7231.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 2015c5336ef038d161e0438a2f7a5e570bccdbde069348903b2636a1655be76e
Instruction ID: cc9b1f00d04992d1fd0386bf4621b7ff454aa38cc43371a310f38c31781ec47c
Opcode Fuzzy Hash: 2015c5336ef038d161e0438a2f7a5e570bccdbde069348903b2636a1655be76e
Instruction Fuzzy Hash: ED313675D0521DDBEF20DFA0D989BCCBBF8AF08300F1040AAE44CAB251EB749A859F44

Uniqueness

Uniqueness Score: -1.00%

Function 000A5A18 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 000A1120: GetLastError.KERNEL32(?,00000008,000A171F,00000000,0009AC68), ref: 000A1124
Part of subcall function 000A1120: SetLastError.KERNEL32(00000000,00000006,000000FF), ref: 000A11C6

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 000A5A6C
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 000A5AB6
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 000A5B7C

Memory Dump Source

Source File: 00000003.00000002.2216650928.0000000000081000.00000020.00000001.01000000.00000006.sdmp, Offset: 00080000, based on PE: true

Associated: 00000003.00000002.2216626326.0000000000080000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216686529.00000000000AF000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000BF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000F5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216767194.00000000000FA000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_80000_2Iu7231.jbxd

Yara matches

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: 3beb6eae9f9fe31164cc8e10be6803b01ae961fc178c479f496e5b4bc9e4b455
Instruction ID: 547493dee4041a4fd4a8d654e51975510432a4e882448522b3ce6afa9160bbbd
Opcode Fuzzy Hash: 3beb6eae9f9fe31164cc8e10be6803b01ae961fc178c479f496e5b4bc9e4b455
Instruction Fuzzy Hash: DB617E71510A179FDB689FA8CC86BAAB3E8FF16312F104179E905C6286F739D941CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0009AAEB Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 0009ABE3
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 0009ABED
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00000000), ref: 0009ABFA

Memory Dump Source

Source File: 00000003.00000002.2216650928.0000000000081000.00000020.00000001.01000000.00000006.sdmp, Offset: 00080000, based on PE: true

Associated: 00000003.00000002.2216626326.0000000000080000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216686529.00000000000AF000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000BF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000F5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216767194.00000000000FA000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_80000_2Iu7231.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 8e013d8b48611a5b4c5f54086b97b17af57f70cd0b947536bc4de188ced475d2
Instruction ID: 8b088839e640e14ddf7ae2c0d3c606c35355457ea5353fb6eb9499a07022defe
Opcode Fuzzy Hash: 8e013d8b48611a5b4c5f54086b97b17af57f70cd0b947536bc4de188ced475d2
Instruction Fuzzy Hash: B331D4759012199BCF21DF64D988BDCBBB8BF08310F5041EAE41CA7252E7749F819F45

Uniqueness

Uniqueness Score: -1.00%

Function 000A58F2 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000A1120: GetLastError.KERNEL32(?,00000008,000A171F,00000000,0009AC68), ref: 000A1124
Part of subcall function 000A1120: SetLastError.KERNEL32(00000000,00000006,000000FF), ref: 000A11C6

EnumSystemLocalesW.KERNEL32(000A5A18,00000001,00000000,?,-00000050,?,000A6049,00000000,?,?,?,00000055,?), ref: 000A5964

Strings

I`, xrefs: 000A5939

Memory Dump Source

Source File: 00000003.00000002.2216650928.0000000000081000.00000020.00000001.01000000.00000006.sdmp, Offset: 00080000, based on PE: true

Associated: 00000003.00000002.2216626326.0000000000080000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216686529.00000000000AF000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000BF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000F5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216767194.00000000000FA000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_80000_2Iu7231.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID: I`
API String ID: 2417226690-86175204
Opcode ID: 3ced99f42981f7abb26daaadb980ada351e3d3e9edad717ab06b5ff54f0b507d
Instruction ID: c7d60e163afd545b977bc53d14892b52f7033c90a6dd31228e24f21625059900
Opcode Fuzzy Hash: 3ced99f42981f7abb26daaadb980ada351e3d3e9edad717ab06b5ff54f0b507d
Instruction Fuzzy Hash: 8311E936200B059FDB189F79CC915BFB791FF8536AB14452CE9864B741D3716942C740

Uniqueness

Uniqueness Score: -1.00%

Function 000A3E97 Relevance: 1.9, APIs: 1, Instructions: 373COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2216650928.0000000000081000.00000020.00000001.01000000.00000006.sdmp, Offset: 00080000, based on PE: true

Associated: 00000003.00000002.2216626326.0000000000080000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216686529.00000000000AF000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000BF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000F5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216767194.00000000000FA000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_80000_2Iu7231.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 005c214c56806416f91c6be0a011adc87ba1c46b78715c3607e14634345c34c6
Instruction ID: 93f7a0f4b5c4844346be399dd35f4f8c779c3ef1366f3b5960946b33d7b6b972
Opcode Fuzzy Hash: 005c214c56806416f91c6be0a011adc87ba1c46b78715c3607e14634345c34c6
Instruction Fuzzy Hash: AFC13376E40205AFDB20DBE8CC82FEE77F8AF59700F144565FA05EB286D6709D418BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00091F81 Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00091F97

Memory Dump Source

Source File: 00000003.00000002.2216650928.0000000000081000.00000020.00000001.01000000.00000006.sdmp, Offset: 00080000, based on PE: true

Associated: 00000003.00000002.2216626326.0000000000080000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216686529.00000000000AF000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000BF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000F5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216767194.00000000000FA000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_80000_2Iu7231.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 7959cebb567a48f24f5cabff8f232c53f40680b46b1e61670b2b1a3386eeac62
Instruction ID: 5a2a27a275993d54493e629ee287b089e1bdfe12ee4d1423f865b5502f3618e9
Opcode Fuzzy Hash: 7959cebb567a48f24f5cabff8f232c53f40680b46b1e61670b2b1a3386eeac62
Instruction Fuzzy Hash: CD51AF71A012059FEF58CF64E981BAEBBF1FB48310F24802AD509EB361E7799954DB50

Uniqueness

Uniqueness Score: -1.00%

Function 000A5C6B Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 000A1120: GetLastError.KERNEL32(?,00000008,000A171F,00000000,0009AC68), ref: 000A1124
Part of subcall function 000A1120: SetLastError.KERNEL32(00000000,00000006,000000FF), ref: 000A11C6

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 000A5CBF

Memory Dump Source

Source File: 00000003.00000002.2216650928.0000000000081000.00000020.00000001.01000000.00000006.sdmp, Offset: 00080000, based on PE: true

Associated: 00000003.00000002.2216626326.0000000000080000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216686529.00000000000AF000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000BF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000F5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216767194.00000000000FA000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_80000_2Iu7231.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 99726474e1e47d79101a6006f9589c83adc91b6cad64dbbe48a97567ea1fbb83
Instruction ID: 8b475728b4f42bb1e8a9cb097907a1156bf0552f9bca5b378d1aad80ff877db8
Opcode Fuzzy Hash: 99726474e1e47d79101a6006f9589c83adc91b6cad64dbbe48a97567ea1fbb83
Instruction Fuzzy Hash: 27218072610606ABDB289BA5DC46EFE73E8FF56311F10007AFD06DA146EB75AD40CB50

Uniqueness

Uniqueness Score: -1.00%

Function 000A5E9A Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 000A1120: GetLastError.KERNEL32(?,00000008,000A171F,00000000,0009AC68), ref: 000A1124
Part of subcall function 000A1120: SetLastError.KERNEL32(00000000,00000006,000000FF), ref: 000A11C6

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,000A5C34,00000000,00000000,?), ref: 000A5EC6

Memory Dump Source

Source File: 00000003.00000002.2216650928.0000000000081000.00000020.00000001.01000000.00000006.sdmp, Offset: 00080000, based on PE: true

Associated: 00000003.00000002.2216626326.0000000000080000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216686529.00000000000AF000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000BF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000F5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216767194.00000000000FA000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_80000_2Iu7231.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 8342b659d008cdd1effec057f512caeffe4724f33e2b9eb7c5ba86c7409cc829
Instruction ID: 98a4af49be51d74b483c6d1ca6e3c068162439d865197ae3bdc1f51f72f7e730
Opcode Fuzzy Hash: 8342b659d008cdd1effec057f512caeffe4724f33e2b9eb7c5ba86c7409cc829
Instruction Fuzzy Hash: 6CF0A936600511BFDB2896A4CC0ABFB7798FB41755F194434ED06A3181FA74FE41C590

Uniqueness

Uniqueness Score: -1.00%

Function 000A598D Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000A1120: GetLastError.KERNEL32(?,00000008,000A171F,00000000,0009AC68), ref: 000A1124
Part of subcall function 000A1120: SetLastError.KERNEL32(00000000,00000006,000000FF), ref: 000A11C6

EnumSystemLocalesW.KERNEL32(000A5C6B,00000001,?,?,-00000050,?,000A600D,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 000A59D7

Memory Dump Source

Source File: 00000003.00000002.2216650928.0000000000081000.00000020.00000001.01000000.00000006.sdmp, Offset: 00080000, based on PE: true

Associated: 00000003.00000002.2216626326.0000000000080000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216686529.00000000000AF000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000BF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000F5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216767194.00000000000FA000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_80000_2Iu7231.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 76d47ad3ccb69710ea112c6d867a82deb4e5f787b942ade9c5a78360d9ed123e
Instruction ID: 6b4f4c75552b911ca0ee954021cc6ea2fdb23ad5c731e0f8232480f1049a06b5
Opcode Fuzzy Hash: 76d47ad3ccb69710ea112c6d867a82deb4e5f787b942ade9c5a78360d9ed123e
Instruction Fuzzy Hash: 91F0C236200B049FDB149FB5DC82ABB7B95FB82769F05442CFA464B691D6719C02CA50

Uniqueness

Uniqueness Score: -1.00%

Function 000A2E4D Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0009F438: EnterCriticalSection.KERNEL32(?,?,0009AE36,00000000,000BDDA8,0000000C,0009ADFD,00000000,?,000A17FD,00000000,?,000A12BE,00000001,00000364,?), ref: 0009F447

EnumSystemLocalesW.KERNEL32(000A2E40,00000001,000BE1B8,0000000C,000A3272,00000000), ref: 000A2E85

Memory Dump Source

Source File: 00000003.00000002.2216650928.0000000000081000.00000020.00000001.01000000.00000006.sdmp, Offset: 00080000, based on PE: true

Associated: 00000003.00000002.2216626326.0000000000080000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216686529.00000000000AF000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000BF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000F5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216767194.00000000000FA000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_80000_2Iu7231.jbxd

Yara matches

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: f8ad336dd846aad596ff18192ff4bb7fa8141d247311978e422cdebb2083faff
Instruction ID: 54f502b746e970c39cff04c46b9e969e040c3ff6a49ebb17438b5bf42e8b65cf
Opcode Fuzzy Hash: f8ad336dd846aad596ff18192ff4bb7fa8141d247311978e422cdebb2083faff
Instruction Fuzzy Hash: 88F0E772A40205EFEB04EF98E946BED77A0EB89721F10852AE510DB2A1CB795944DB50

Uniqueness

Uniqueness Score: -1.00%

Function 000A58A7 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000A1120: GetLastError.KERNEL32(?,00000008,000A171F,00000000,0009AC68), ref: 000A1124
Part of subcall function 000A1120: SetLastError.KERNEL32(00000000,00000006,000000FF), ref: 000A11C6

EnumSystemLocalesW.KERNEL32(000A5800,00000001,?,?,?,000A606B,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 000A58DE

Memory Dump Source

Source File: 00000003.00000002.2216650928.0000000000081000.00000020.00000001.01000000.00000006.sdmp, Offset: 00080000, based on PE: true

Associated: 00000003.00000002.2216626326.0000000000080000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216686529.00000000000AF000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000BF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000F5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216767194.00000000000FA000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_80000_2Iu7231.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 371e4c4017dd839dfa655c1c09b2b84d0bce4fd8040a3e492deb99d56bce17ac
Instruction ID: 35a2c273f0fe41e4768c8739930b969f98d94a38efcf3f121af736c48fe7546b
Opcode Fuzzy Hash: 371e4c4017dd839dfa655c1c09b2b84d0bce4fd8040a3e492deb99d56bce17ac
Instruction Fuzzy Hash: AAF0E53A70020597DB14AFB5DC456AA7F94FFC2751B464068EA058B291DA799842C790

Uniqueness

Uniqueness Score: -1.00%

Function 000A3376 Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,0009D21A,?,20001004,00000000,00000002,?,?,0009C81C), ref: 000A33AA

Memory Dump Source

Source File: 00000003.00000002.2216650928.0000000000081000.00000020.00000001.01000000.00000006.sdmp, Offset: 00080000, based on PE: true

Associated: 00000003.00000002.2216626326.0000000000080000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216686529.00000000000AF000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000BF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000F5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216767194.00000000000FA000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_80000_2Iu7231.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 2f3575c26b6f0212ffc22a62ec6942151b5334ff6b90d3bf5f0800e54d402c8c
Instruction ID: d9944a0c8274e6121d3df0a0c77c75b6e6dc63fd313eb86f45cac278462bdf77
Opcode Fuzzy Hash: 2f3575c26b6f0212ffc22a62ec6942151b5334ff6b90d3bf5f0800e54d402c8c
Instruction Fuzzy Hash: 27E04F32504618FBCF122FF0DC04BAE7E66EF46751F004021FD0566121CB769A20AAD4

Uniqueness

Uniqueness Score: -1.00%

Function 000A35CD Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000A35CD

Memory Dump Source

Source File: 00000003.00000002.2216650928.0000000000081000.00000020.00000001.01000000.00000006.sdmp, Offset: 00080000, based on PE: true

Associated: 00000003.00000002.2216626326.0000000000080000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216686529.00000000000AF000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000BF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000F5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216767194.00000000000FA000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_80000_2Iu7231.jbxd

Yara matches

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 1de8513f91103863b50a5d4d030c6815ee121c075b021c79f26ceef37152388b
Instruction ID: df67e648ce197e4a68028fad8abd0ed266e6df2000c27c63784f3df3633dbb45
Opcode Fuzzy Hash: 1de8513f91103863b50a5d4d030c6815ee121c075b021c79f26ceef37152388b
Instruction Fuzzy Hash: 48A00170741602CBA7648F76AA1926A3BA9AB966D1705806AE509C56A0EA3C8454EF01

Uniqueness

Uniqueness Score: -1.00%

Function 00081650 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2216650928.0000000000081000.00000020.00000001.01000000.00000006.sdmp, Offset: 00080000, based on PE: true

Associated: 00000003.00000002.2216626326.0000000000080000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216686529.00000000000AF000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000BF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000F5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216767194.00000000000FA000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_80000_2Iu7231.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 339d62d68fde077bdbd4d715d79dd56c6cb8eb722a501ec2f20e81a6e2c495c3
Instruction ID: c075871285986240cdc92d21f031e42fac6324cdef5a2326be1b9f9213ac35a1
Opcode Fuzzy Hash: 339d62d68fde077bdbd4d715d79dd56c6cb8eb722a501ec2f20e81a6e2c495c3
Instruction Fuzzy Hash: C4D0923A655A58AFC210DF49E440D41F7B8FB8D670B154066EA0893B20C335FC11CAE0

Uniqueness

Uniqueness Score: -1.00%

Function 000916DA Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(000F801C,00000FA0,?,?,000916B8), ref: 000916E6
GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,000916B8), ref: 000916F1
GetModuleHandleW.KERNEL32(kernel32.dll,?,?,000916B8), ref: 00091702
GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 00091714
GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 00091722
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,000916B8), ref: 00091745
DeleteCriticalSection.KERNEL32(000F801C,00000007,?,?,000916B8), ref: 00091761
CloseHandle.KERNEL32(00000000,?,?,000916B8), ref: 00091771

Strings

WakeAllConditionVariable, xrefs: 0009171A
kernel32.dll, xrefs: 000916FD
api-ms-win-core-synch-l1-2-0.dll, xrefs: 000916EC
SleepConditionVariableCS, xrefs: 0009170E

Memory Dump Source

Source File: 00000003.00000002.2216650928.0000000000081000.00000020.00000001.01000000.00000006.sdmp, Offset: 00080000, based on PE: true

Associated: 00000003.00000002.2216626326.0000000000080000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216686529.00000000000AF000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000BF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000F5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216767194.00000000000FA000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_80000_2Iu7231.jbxd

Yara matches

Similarity

API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2565136772-3242537097
Opcode ID: bbe0a1feaea61fda581f8997e9d5f0bc073a504feb3c56c3f9873ed8d0e08b92
Instruction ID: f5c5507587a903f844463be00e0a3788963a6bd45f90f36c0a728deed5ec971c
Opcode Fuzzy Hash: bbe0a1feaea61fda581f8997e9d5f0bc073a504feb3c56c3f9873ed8d0e08b92
Instruction Fuzzy Hash: F0014C35B45A13ABFA601BA4AD4DEFA66B8AB45B91B040120FA04DA551DE78C805BA60

Uniqueness

Uniqueness Score: -1.00%

Function 0009621D Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 153threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00096245
GetCurrentThreadId.KERNEL32 ref: 00096262
GetCurrentThreadId.KERNEL32 ref: 00096283
GetCurrentThreadId.KERNEL32 ref: 00096306
__Xtime_diff_to_millis2.LIBCPMT ref: 0009631E
GetCurrentThreadId.KERNEL32 ref: 0009634A
GetCurrentThreadId.KERNEL32 ref: 00096390

Strings

jd, xrefs: 000962CA, 00096317, 00096337, 000962CF, 0009631A, 0009633C

Memory Dump Source

Source File: 00000003.00000002.2216650928.0000000000081000.00000020.00000001.01000000.00000006.sdmp, Offset: 00080000, based on PE: true

Associated: 00000003.00000002.2216626326.0000000000080000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216686529.00000000000AF000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000BF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000F5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216767194.00000000000FA000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_80000_2Iu7231.jbxd

Yara matches

Similarity

API ID: CurrentThread$Xtime_diff_to_millis2
String ID: jd
API String ID: 1280559528-3259793891
Opcode ID: ecfc2168f0af675e863c397ec50ae0fbdb9167a85650fdf96f1f6fc2e6ad4db1
Instruction ID: fc7b575c301066a10aba213095d78219bc390d82063c7dc57bff8d63095ee21d
Opcode Fuzzy Hash: ecfc2168f0af675e863c397ec50ae0fbdb9167a85650fdf96f1f6fc2e6ad4db1
Instruction Fuzzy Hash: 7E517D71900A16CBCF20DF64C9859ADB7F1FF09710B258469E846AB292C772EE45EF90

Uniqueness

Uniqueness Score: -1.00%

Function 00096FB3 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00096FB9
GetProcAddress.KERNEL32(00000000,GetCurrentPackageId), ref: 00096FC7
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 00096FD8
GetProcAddress.KERNEL32(00000000,GetTempPath2W), ref: 00096FE9

Strings

GetSystemTimePreciseAsFileTime, xrefs: 00096FCD
kernel32.dll, xrefs: 00096FB4
GetCurrentPackageId, xrefs: 00096FC1
GetTempPath2W, xrefs: 00096FDE

Memory Dump Source

Source File: 00000003.00000002.2216650928.0000000000081000.00000020.00000001.01000000.00000006.sdmp, Offset: 00080000, based on PE: true

Associated: 00000003.00000002.2216626326.0000000000080000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216686529.00000000000AF000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000BF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000F5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216767194.00000000000FA000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_80000_2Iu7231.jbxd

Yara matches

Similarity

API ID: AddressProc$HandleModule
String ID: GetCurrentPackageId$GetSystemTimePreciseAsFileTime$GetTempPath2W$kernel32.dll
API String ID: 667068680-1247241052
Opcode ID: 73cf43edf0dfb3645e349628d9983d583bde3df5d70d1e85ae2940d6b4e425d4
Instruction ID: 35cbe34dabe1d678c4469f03514c0b9f51944a967de9bb6e51a9864e5aa31cd0
Opcode Fuzzy Hash: 73cf43edf0dfb3645e349628d9983d583bde3df5d70d1e85ae2940d6b4e425d4
Instruction Fuzzy Hash: A7E0EC7AA56611AFA7006FB0BC0DCE73FF8EB467D23444275F605EA661EB780442CB64

Uniqueness

Uniqueness Score: -1.00%

Function 000999B4 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 00099AD3
___TypeMatch.LIBVCRUNTIME ref: 00099BE1
_UnwindNestedFrames.LIBCMT ref: 00099D33
CallUnexpected.LIBVCRUNTIME ref: 00099D4E

Strings

csm, xrefs: 00099B0A
csm, xrefs: 00099A5E
csm, xrefs: 000999F1

Memory Dump Source

Source File: 00000003.00000002.2216650928.0000000000081000.00000020.00000001.01000000.00000006.sdmp, Offset: 00080000, based on PE: true

Associated: 00000003.00000002.2216626326.0000000000080000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216686529.00000000000AF000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000BF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000F5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216767194.00000000000FA000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_80000_2Iu7231.jbxd

Yara matches

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: 0fd4e33a25d2c83249b9de1f065d3a84f5a4d8564ea15c7188798345f0aff432
Instruction ID: 99de1e7e266f57fe12ce2b189b8e6483d789690998403bde570da3dcc94aac22
Opcode Fuzzy Hash: 0fd4e33a25d2c83249b9de1f065d3a84f5a4d8564ea15c7188798345f0aff432
Instruction Fuzzy Hash: ACB16571801209EFCF29DFA8C9819EEBBB5FF14310F15815EE8116B212D771DA51EBA2

Uniqueness

Uniqueness Score: -1.00%

Function 000A8E14 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 298COMMONLIBRARYCODE

Download Yara Rule

Strings

, xrefs: 000A908D

Memory Dump Source

Source File: 00000003.00000002.2216650928.0000000000081000.00000020.00000001.01000000.00000006.sdmp, Offset: 00080000, based on PE: true

Associated: 00000003.00000002.2216626326.0000000000080000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216686529.00000000000AF000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000BF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000F5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216767194.00000000000FA000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_80000_2Iu7231.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID: 0-3907804496
Opcode ID: 86b7b766704b56ac0d15ce2c424de49a55ea7c68a1f47936319251248c3d587a
Instruction ID: a0c6fb08a126cf72591deadac134db2f5925a547d8bb0ca30a47129b9b1e4d27
Opcode Fuzzy Hash: 86b7b766704b56ac0d15ce2c424de49a55ea7c68a1f47936319251248c3d587a
Instruction Fuzzy Hash: 9CB1D070B00206AFDF11DFE9C884BBE7BF1AF86340F148169E501AB292CB759D42CB61

Uniqueness

Uniqueness Score: -1.00%

Function 000AD637 Relevance: 12.2, APIs: 8, Instructions: 248COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?), ref: 000AD6DD
__alloca_probe_16.LIBCMT ref: 000AD798
__alloca_probe_16.LIBCMT ref: 000AD827
__freea.LIBCMT ref: 000AD872
__freea.LIBCMT ref: 000AD878
__freea.LIBCMT ref: 000AD8AE
__freea.LIBCMT ref: 000AD8B4
__freea.LIBCMT ref: 000AD8C4

Memory Dump Source

Source File: 00000003.00000002.2216650928.0000000000081000.00000020.00000001.01000000.00000006.sdmp, Offset: 00080000, based on PE: true

Associated: 00000003.00000002.2216626326.0000000000080000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216686529.00000000000AF000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000BF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000F5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216767194.00000000000FA000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_80000_2Iu7231.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: a804f7c592483ca293e81208851b069228c1c178fb077e4ac7bd70b2a66bda62
Instruction ID: b1cc12655c9e0ae95d810ade91e0097dc9c3abd5525d0151e312b303ad045143
Opcode Fuzzy Hash: a804f7c592483ca293e81208851b069228c1c178fb077e4ac7bd70b2a66bda62
Instruction Fuzzy Hash: 5B71D672904205ABDF259FE48C81BEE77F5AF47310F290157F906A7692EB39DC008760

Uniqueness

Uniqueness Score: -1.00%

Function 00096DC9 Relevance: 12.2, APIs: 8, Instructions: 175COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,?,?,?,00000001), ref: 00096E12
__alloca_probe_16.LIBCMT ref: 00096E3E
MultiByteToWideChar.KERNEL32(00000001,00000001,00000000,?,00000000,00000000), ref: 00096E7D
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00096E9A
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00096ED9
__alloca_probe_16.LIBCMT ref: 00096EF6
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00096F38
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 00096F5B

Memory Dump Source

Source File: 00000003.00000002.2216650928.0000000000081000.00000020.00000001.01000000.00000006.sdmp, Offset: 00080000, based on PE: true

Associated: 00000003.00000002.2216626326.0000000000080000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216686529.00000000000AF000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000BF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000F5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216767194.00000000000FA000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_80000_2Iu7231.jbxd

Yara matches

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: ba6e57f1d2706becfb37f264789a816dc5d082b646384a7a6b6e9c86e2f133f3
Instruction ID: 5cdf9c1487326ef589e6f995abb01d6614e10d0744577f3df0f2dd86574dc83b
Opcode Fuzzy Hash: ba6e57f1d2706becfb37f264789a816dc5d082b646384a7a6b6e9c86e2f133f3
Instruction Fuzzy Hash: 97519B7260020AABEF209FA0EC55FAB7BF9EB44740F154139F915E6151D736DC10EBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00097DF0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00097E27
___except_validate_context_record.LIBVCRUNTIME ref: 00097E2F
_ValidateLocalCookies.LIBCMT ref: 00097EB8
__IsNonwritableInCurrentImage.LIBCMT ref: 00097EE3
_ValidateLocalCookies.LIBCMT ref: 00097F38

Strings

csm, xrefs: 00097ECD

Memory Dump Source

Source File: 00000003.00000002.2216650928.0000000000081000.00000020.00000001.01000000.00000006.sdmp, Offset: 00080000, based on PE: true

Associated: 00000003.00000002.2216626326.0000000000080000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216686529.00000000000AF000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000BF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000F5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216767194.00000000000FA000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_80000_2Iu7231.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 386005fb9da15c519c0cde3123f98f489c80fccafab7f45cad1d36a317e0605b
Instruction ID: e6edbf1d6c8baa93f5a328f12dfc8d626d8f9572956526ee5f63cb12447361be
Opcode Fuzzy Hash: 386005fb9da15c519c0cde3123f98f489c80fccafab7f45cad1d36a317e0605b
Instruction Fuzzy Hash: B241C235A14209ABCF10DF68C885AEEBBF5AF49324F1480A5E9186B392D7319D05DBD1

Uniqueness

Uniqueness Score: -1.00%

Function 00099646 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0009963D,0009739B,00095F74,2792C724,?,?,?,?,000AEC4E,000000FF,?,00088E85), ref: 00099654
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00099662
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0009967B
SetLastError.KERNEL32(00000000,?,0009963D,0009739B,00095F74,2792C724,?,?,?,?,000AEC4E,000000FF,?,00088E85), ref: 000996CD

Memory Dump Source

Source File: 00000003.00000002.2216650928.0000000000081000.00000020.00000001.01000000.00000006.sdmp, Offset: 00080000, based on PE: true

Associated: 00000003.00000002.2216626326.0000000000080000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216686529.00000000000AF000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000BF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000F5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216767194.00000000000FA000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_80000_2Iu7231.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: a9238ec8e260899a0fb7001aa1fe3d9a7252086eafbf4ac18b7cd12adc3d3e98
Instruction ID: 5902bd88e348a8cceedf90df097933aeb33ee53784c8f502bf8c6c252a2edc77
Opcode Fuzzy Hash: a9238ec8e260899a0fb7001aa1fe3d9a7252086eafbf4ac18b7cd12adc3d3e98
Instruction Fuzzy Hash: 9501D43220E3179EBE6426B9AC85ABB2AD4DF063B4B21023DF154840F3FF594C01F186

Uniqueness

Uniqueness Score: -1.00%

Function 000A04D7 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79COMMON

Download Yara Rule

Strings

C:\Users\user\AppData\Local\Temp\IXP002.TMP\2Iu7231.exe, xrefs: 000A04F3

Memory Dump Source

Source File: 00000003.00000002.2216650928.0000000000081000.00000020.00000001.01000000.00000006.sdmp, Offset: 00080000, based on PE: true

Associated: 00000003.00000002.2216626326.0000000000080000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216686529.00000000000AF000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000BF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000F5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216767194.00000000000FA000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_80000_2Iu7231.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2Iu7231.exe
API String ID: 0-3710601626
Opcode ID: f9bc9febdb58ee9f766a5092c49e1fc98b6cb19611504f69a631f13622dd79e0
Instruction ID: e0007c09ae350a1ff7c7a9b9ced80dcfda5a3690411080f2e073f7edda055b50
Opcode Fuzzy Hash: f9bc9febdb58ee9f766a5092c49e1fc98b6cb19611504f69a631f13622dd79e0
Instruction Fuzzy Hash: DE21A171A00A0AAFDB20AFF1DC40DAB77E9AF463A47108525F919D7152E730ED509FA0

Uniqueness

Uniqueness Score: -1.00%

Function 0009B250 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,2792C724,?,?,00000000,000AEE24,000000FF,?,0009B1E0,?,?,0009B1B4,00000000), ref: 0009B285
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0009B297
FreeLibrary.KERNEL32(00000000,?,00000000,000AEE24,000000FF,?,0009B1E0,?,?,0009B1B4,00000000), ref: 0009B2B9

Strings

CorExitProcess, xrefs: 0009B28F
mscoree.dll, xrefs: 0009B27E

Memory Dump Source

Source File: 00000003.00000002.2216650928.0000000000081000.00000020.00000001.01000000.00000006.sdmp, Offset: 00080000, based on PE: true

Associated: 00000003.00000002.2216626326.0000000000080000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216686529.00000000000AF000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000BF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000F5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216767194.00000000000FA000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_80000_2Iu7231.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: af76ef31482a245c01b7903fe87593b477866fcdc69481f024cf524bc8896dfd
Instruction ID: cd3a761fa9801cfd78b0aaa4291b7c08d470a378dd423b1e14d8311d21c7d48a
Opcode Fuzzy Hash: af76ef31482a245c01b7903fe87593b477866fcdc69481f024cf524bc8896dfd
Instruction Fuzzy Hash: 2C01623290066AEBDB118F91DD05FBEBBF8FB05B21F040625E911A6690DB789900CB90

Uniqueness

Uniqueness Score: -1.00%

Function 000A9C7C Relevance: 7.7, APIs: 5, Instructions: 202COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 000A9D03
__alloca_probe_16.LIBCMT ref: 000A9DC4
__freea.LIBCMT ref: 000A9E2B

Part of subcall function 000A174B: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,0009169D,?,?,000835F2,00000000,?,0008352E), ref: 000A177D

__freea.LIBCMT ref: 000A9E40
__freea.LIBCMT ref: 000A9E50

Memory Dump Source

Source File: 00000003.00000002.2216650928.0000000000081000.00000020.00000001.01000000.00000006.sdmp, Offset: 00080000, based on PE: true

Associated: 00000003.00000002.2216626326.0000000000080000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216686529.00000000000AF000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000BF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000F5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216767194.00000000000FA000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_80000_2Iu7231.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: d7528982bdaad09d20eed5ed35a366bffef48d9f3b01aafb06ffbe7ebfcc0b36
Instruction ID: 5abe16cafb10eb1547a6e0c60f3a08e9047e7f7652c8787a0ed4ca679baa07b6
Opcode Fuzzy Hash: d7528982bdaad09d20eed5ed35a366bffef48d9f3b01aafb06ffbe7ebfcc0b36
Instruction Fuzzy Hash: 40518C7270021AAFEF219FE4DC81EEF7AE9EB46750F150528BD04DB252EA35DD5086A0

Uniqueness

Uniqueness Score: -1.00%

Function 0009262D Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00092634
std::_Lockit::_Lockit.LIBCPMT ref: 0009263E

Part of subcall function 000841F0: std::_Lockit::_Lockit.LIBCPMT ref: 00084214
Part of subcall function 000841F0: std::_Lockit::~_Lockit.LIBCPMT ref: 0008423F

codecvt.LIBCPMT ref: 00092678
std::_Facet_Register.LIBCPMT ref: 0009268F
std::_Lockit::~_Lockit.LIBCPMT ref: 000926AF

Memory Dump Source

Source File: 00000003.00000002.2216650928.0000000000081000.00000020.00000001.01000000.00000006.sdmp, Offset: 00080000, based on PE: true

Associated: 00000003.00000002.2216626326.0000000000080000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216686529.00000000000AF000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000BF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000F5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216767194.00000000000FA000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_80000_2Iu7231.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registercodecvt
String ID:
API String ID: 712880209-0
Opcode ID: 9ea8a9a6fd97ebb058ea15b4925398c28058caf8753958fff915c0cb5e041d29
Instruction ID: 18360f04c17ab5c511ab7ecfc71e058751c9028a261a6a336ae0dae8ed58366d
Opcode Fuzzy Hash: 9ea8a9a6fd97ebb058ea15b4925398c28058caf8753958fff915c0cb5e041d29
Instruction Fuzzy Hash: 0101C03590021A9BCF05BBA4D845AFEBBB5BF84710F240109E810AB293DF749E01A780

Uniqueness

Uniqueness Score: -1.00%

Function 00093905 Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0009390C
std::_Lockit::_Lockit.LIBCPMT ref: 00093916

Part of subcall function 000841F0: std::_Lockit::_Lockit.LIBCPMT ref: 00084214
Part of subcall function 000841F0: std::_Lockit::~_Lockit.LIBCPMT ref: 0008423F

codecvt.LIBCPMT ref: 00093950
std::_Facet_Register.LIBCPMT ref: 00093967
std::_Lockit::~_Lockit.LIBCPMT ref: 00093987

Memory Dump Source

Source File: 00000003.00000002.2216650928.0000000000081000.00000020.00000001.01000000.00000006.sdmp, Offset: 00080000, based on PE: true

Associated: 00000003.00000002.2216626326.0000000000080000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216686529.00000000000AF000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000BF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000F5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216767194.00000000000FA000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_80000_2Iu7231.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registercodecvt
String ID:
API String ID: 712880209-0
Opcode ID: 0cd42f834b145817b3d801762d2b0c19ad39ef64d3a3330a071491e847b78622
Instruction ID: 8b34872234bc611f3062d36b62f2e49026c7e8f0f135b5bdeb1a2bd993fdb285
Opcode Fuzzy Hash: 0cd42f834b145817b3d801762d2b0c19ad39ef64d3a3330a071491e847b78622
Instruction Fuzzy Hash: 77018035A005168BCF05EBA4D855BFEB7A5BF84720F254509E8146B292DF749E01AB90

Uniqueness

Uniqueness Score: -1.00%

Function 0009A747 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000800,?,0009A6F8,?,?,00000000,?,?,?,0009A822,00000002,FlsGetValue,000B2218,FlsGetValue), ref: 0009A754
GetLastError.KERNEL32(?,0009A6F8,?,?,00000000,?,?,?,0009A822,00000002,FlsGetValue,000B2218,FlsGetValue,?,?,00099667), ref: 0009A75E
LoadLibraryExW.KERNEL32(?,00000000,00000000,000000FF,?,00088E85,?,?,?,00088C96), ref: 0009A786

Strings

api-ms-, xrefs: 0009A76B

Memory Dump Source

Source File: 00000003.00000002.2216650928.0000000000081000.00000020.00000001.01000000.00000006.sdmp, Offset: 00080000, based on PE: true

Associated: 00000003.00000002.2216626326.0000000000080000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216686529.00000000000AF000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000BF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000F5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216767194.00000000000FA000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_80000_2Iu7231.jbxd

Yara matches

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: e8263164c2ff8912510957100774df9a2a7c685c3097975e78dc7d268d3fcb55
Instruction ID: 56a126e54566f353edd60e9206c579c7b68ca1e83319e94e5385f7ac9dd1959f
Opcode Fuzzy Hash: e8263164c2ff8912510957100774df9a2a7c685c3097975e78dc7d268d3fcb55
Instruction Fuzzy Hash: DFE01230784209B7EE711BD0DD46F693BA99B02B54F104030FE0CA80A1E765D9509685

Uniqueness

Uniqueness Score: -1.00%

Function 000A74F3 Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(2792C724,?,00000000,?), ref: 000A7556

Part of subcall function 000A28BD: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,000A9E21,?,00000000,-00000008), ref: 000A2969

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 000A77B1
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 000A77F9
GetLastError.KERNEL32 ref: 000A789C

Memory Dump Source

Source File: 00000003.00000002.2216650928.0000000000081000.00000020.00000001.01000000.00000006.sdmp, Offset: 00080000, based on PE: true

Associated: 00000003.00000002.2216626326.0000000000080000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216686529.00000000000AF000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000BF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000F5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216767194.00000000000FA000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_80000_2Iu7231.jbxd

Yara matches

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 46949e42a84097b27b4d64f69bc48f607c6dc0e1efd8a3e4f349f5e4b1993206
Instruction ID: 9c5ea76df2a027f45791a63fb74f4075d6bda1a2d6a07985f5486198d5969b6f
Opcode Fuzzy Hash: 46949e42a84097b27b4d64f69bc48f607c6dc0e1efd8a3e4f349f5e4b1993206
Instruction Fuzzy Hash: C7D14975D042489FDF15CFE8D884AEDBBB5FF4A300F18856AE819E7352DA34A941CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0009975D Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00099824
___AdjustPointer.LIBCMT ref: 00099847
___AdjustPointer.LIBCMT ref: 000998E3

Memory Dump Source

Source File: 00000003.00000002.2216650928.0000000000081000.00000020.00000001.01000000.00000006.sdmp, Offset: 00080000, based on PE: true

Associated: 00000003.00000002.2216626326.0000000000080000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216686529.00000000000AF000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000BF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000F5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216767194.00000000000FA000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_80000_2Iu7231.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: c36c2cb3b30cf6581bba5a79073801a550370d155c01e775e5dcb3f06c5ce8dc
Instruction ID: e591e4e2ae2c1adde9b0c304e0fabe2ed1a0098f42025bef3597e65fb29d33dd
Opcode Fuzzy Hash: c36c2cb3b30cf6581bba5a79073801a550370d155c01e775e5dcb3f06c5ce8dc
Instruction Fuzzy Hash: BC51C072A09202AFEF298F59D841BBAB3E5EF45710F14442DED094B292EB31ED40E790

Uniqueness

Uniqueness Score: -1.00%

Function 000A183F Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 000A28BD: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,000A9E21,?,00000000,-00000008), ref: 000A2969

GetLastError.KERNEL32 ref: 000A18A3
__dosmaperr.LIBCMT ref: 000A18AA
GetLastError.KERNEL32(?,?,?,?), ref: 000A18E4
__dosmaperr.LIBCMT ref: 000A18EB

Memory Dump Source

Source File: 00000003.00000002.2216650928.0000000000081000.00000020.00000001.01000000.00000006.sdmp, Offset: 00080000, based on PE: true

Associated: 00000003.00000002.2216626326.0000000000080000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216686529.00000000000AF000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000BF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000F5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216767194.00000000000FA000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_80000_2Iu7231.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 03037d144520d9c9d6ada6b3cb47b0aa2cbca0b0acdf56f8ad4ebf94efa6cb25
Instruction ID: 7d1be1938ff3dd3ea8738c77178f7bcf339c41ad08130b82c3c9f58518f72caa
Opcode Fuzzy Hash: 03037d144520d9c9d6ada6b3cb47b0aa2cbca0b0acdf56f8ad4ebf94efa6cb25
Instruction Fuzzy Hash: 8821957160460AAFDF20AFE6C8818EBB7EEEF063A4B144529F915D7152DB35EC409B50

Uniqueness

Uniqueness Score: -1.00%

Function 000A29AB Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 000A29B3

Part of subcall function 000A28BD: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,000A9E21,?,00000000,-00000008), ref: 000A2969

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 000A29EB
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 000A2A0B

Memory Dump Source

Source File: 00000003.00000002.2216650928.0000000000081000.00000020.00000001.01000000.00000006.sdmp, Offset: 00080000, based on PE: true

Associated: 00000003.00000002.2216626326.0000000000080000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216686529.00000000000AF000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000BF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000F5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216767194.00000000000FA000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_80000_2Iu7231.jbxd

Yara matches

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 03c3ecf25bd6f332c6d5e9c671176e5ed1dd0bed77833e59523d177f9ddaff19
Instruction ID: e051c4b1815635a824075a3a0003fab201fdf071445d7dd214be1dcda56446ff
Opcode Fuzzy Hash: 03c3ecf25bd6f332c6d5e9c671176e5ed1dd0bed77833e59523d177f9ddaff19
Instruction Fuzzy Hash: D611C4B6902916BF773167FA9D89CFF2DACDF6B794B100134F901D5102EA68CD028171

Uniqueness

Uniqueness Score: -1.00%

Function 0009399A Relevance: 6.0, APIs: 4, Instructions: 34COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 000939A1
std::_Lockit::_Lockit.LIBCPMT ref: 000939AB

Part of subcall function 000841F0: std::_Lockit::_Lockit.LIBCPMT ref: 00084214
Part of subcall function 000841F0: std::_Lockit::~_Lockit.LIBCPMT ref: 0008423F

ctype.LIBCPMT ref: 000939E5
std::_Lockit::~_Lockit.LIBCPMT ref: 00093A1C

Memory Dump Source

Source File: 00000003.00000002.2216650928.0000000000081000.00000020.00000001.01000000.00000006.sdmp, Offset: 00080000, based on PE: true

Associated: 00000003.00000002.2216626326.0000000000080000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216686529.00000000000AF000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000BF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000F5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216767194.00000000000FA000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_80000_2Iu7231.jbxd

Yara matches

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3ctype
String ID:
API String ID: 3358926169-0
Opcode ID: 1e1ab609f7efc5de1cee65739bf9f6a2561d33f3798079df1c909f32d3e15ca6
Instruction ID: 2aca1cfa3418d08d5df12b84cac61af35cffdecbce79f9f8f339f266b8de4352
Opcode Fuzzy Hash: 1e1ab609f7efc5de1cee65739bf9f6a2561d33f3798079df1c909f32d3e15ca6
Instruction Fuzzy Hash: FAF0B43590010A9BCF44FBE0C806BFE3765AF40B20F510518F8206B1C3EF348E059B81

Uniqueness

Uniqueness Score: -1.00%

Function 000ADB65 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,?,000ACDDC,?,00000001,?,?,?,000A78F0,?,?,00000000), ref: 000ADB7C
GetLastError.KERNEL32(?,000ACDDC,?,00000001,?,?,?,000A78F0,?,?,00000000,?,?,?,000A7E77,?), ref: 000ADB88

Part of subcall function 000ADB4E: CloseHandle.KERNEL32(FFFFFFFE,000ADB98,?,000ACDDC,?,00000001,?,?,?,000A78F0,?,?,00000000,?,?), ref: 000ADB5E

___initconout.LIBCMT ref: 000ADB98

Part of subcall function 000ADB10: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,000ADB3F,000ACDC9,?,?,000A78F0,?,?,00000000,?), ref: 000ADB23

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,000ACDDC,?,00000001,?,?,?,000A78F0,?,?,00000000,?), ref: 000ADBAD

Memory Dump Source

Source File: 00000003.00000002.2216650928.0000000000081000.00000020.00000001.01000000.00000006.sdmp, Offset: 00080000, based on PE: true

Associated: 00000003.00000002.2216626326.0000000000080000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216686529.00000000000AF000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000BF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000F5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216767194.00000000000FA000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_80000_2Iu7231.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 1d88c2c074720c87d403b568e2595cb17f83494bd2b0082f2610d33b46740d45
Instruction ID: 4e5737eb5b2e0da7940a4785dfda50f8217357ea85ad31ee3861f2772d31f0b4
Opcode Fuzzy Hash: 1d88c2c074720c87d403b568e2595cb17f83494bd2b0082f2610d33b46740d45
Instruction Fuzzy Hash: 60F01236110155BBDF125FD5EC04E9A3F65FB463A0F014011FA1D85521C7328920DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0009184A Relevance: 6.0, APIs: 4, Instructions: 25COMMONLIBRARYCODE

Download Yara Rule

APIs

SleepConditionVariableCS.KERNELBASE(?,000917E7,00000064), ref: 0009186D
LeaveCriticalSection.KERNEL32(000F801C,?,?,000917E7,00000064,?,000858A5,?,?,00085838,?,00085677), ref: 00091877
WaitForSingleObjectEx.KERNEL32(?,00000000,?,000917E7,00000064,?,000858A5,?,?,00085838,?,00085677), ref: 00091888
EnterCriticalSection.KERNEL32(000F801C,?,000917E7,00000064,?,000858A5,?,?,00085838,?,00085677), ref: 0009188F

Memory Dump Source

Source File: 00000003.00000002.2216650928.0000000000081000.00000020.00000001.01000000.00000006.sdmp, Offset: 00080000, based on PE: true

Associated: 00000003.00000002.2216626326.0000000000080000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216686529.00000000000AF000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000BF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000F5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216767194.00000000000FA000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_80000_2Iu7231.jbxd

Yara matches

Similarity

API ID: CriticalSection$ConditionEnterLeaveObjectSingleSleepVariableWait
String ID:
API String ID: 3269011525-0
Opcode ID: 8379aceed7c2bbee7b3febef9dfcd466c8a6b502407138fbb8d25c4b954190d7
Instruction ID: 720b955f50e2d3f3d715005ae0d2cae78f35edcba1821540ceea854ef4f1b688
Opcode Fuzzy Hash: 8379aceed7c2bbee7b3febef9dfcd466c8a6b502407138fbb8d25c4b954190d7
Instruction Fuzzy Hash: 14E09231601D29FBDB612B90EC0CDFE3F29AB0A770B408030F7096A571CE684904BBE4

Uniqueness

Uniqueness Score: -1.00%

Function 000A006D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 194COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 000A00FD

Strings

pow, xrefs: 000A00D5, 000A00F2

Memory Dump Source

Source File: 00000003.00000002.2216650928.0000000000081000.00000020.00000001.01000000.00000006.sdmp, Offset: 00080000, based on PE: true

Associated: 00000003.00000002.2216626326.0000000000080000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216686529.00000000000AF000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000BF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000F5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216767194.00000000000FA000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_80000_2Iu7231.jbxd

Yara matches

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: 9842af1ea6603b116bb57f23076448e3a4be45de733b549403884dc0187125d6
Instruction ID: 866edab5f1a437b5aa2e14a3799cb5964fd774c07dd49c3dbced346363b5d4fd
Opcode Fuzzy Hash: 9842af1ea6603b116bb57f23076448e3a4be45de733b549403884dc0187125d6
Instruction Fuzzy Hash: 12517C61A1820986DB617BD4CD417FE7BD4EB53701F208E68E0D5422EBEB398C94DB47

Uniqueness

Uniqueness Score: -1.00%

Function 00099D59 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 00099D7E

Strings

MOC, xrefs: 00099D90
RCC, xrefs: 00099D98

Memory Dump Source

Source File: 00000003.00000002.2216650928.0000000000081000.00000020.00000001.01000000.00000006.sdmp, Offset: 00080000, based on PE: true

Associated: 00000003.00000002.2216626326.0000000000080000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216686529.00000000000AF000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000BF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000F5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216767194.00000000000FA000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_80000_2Iu7231.jbxd

Yara matches

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 31709d0abd0a4490ecb4d5a334018daa9db5d06aaa48c8b1a944d194d103f796
Instruction ID: 69c4413959f20d0f25290e4ebe906de6fe376526fadec0eebe02b3b445b15d82
Opcode Fuzzy Hash: 31709d0abd0a4490ecb4d5a334018daa9db5d06aaa48c8b1a944d194d103f796
Instruction Fuzzy Hash: EC414A72900209EFDF15DF98CC81AEEBBB5FF48304F158159F904A7252D3359A51EB51

Uniqueness

Uniqueness Score: -1.00%

Function 00096035 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 000960BD
RaiseException.KERNEL32(?,?,?,?), ref: 000960E2

Part of subcall function 00097930: RaiseException.KERNEL32(E06D7363,00000001,00000003,00091DAE,?,?,?,?,00091DAE,00000000,000BBEDC,00000000), ref: 00097990

Part of subcall function 0009AD9F: IsProcessorFeaturePresent.KERNEL32(00000017,0009AAEA,?,0009AA59,?,00000000,0009AC68,?,?,?,?,?,00000000,?,?,0009AD06), ref: 0009ADBB

Strings

csm, xrefs: 00096071

Memory Dump Source

Source File: 00000003.00000002.2216650928.0000000000081000.00000020.00000001.01000000.00000006.sdmp, Offset: 00080000, based on PE: true

Associated: 00000003.00000002.2216626326.0000000000080000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216686529.00000000000AF000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000BF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216710591.00000000000F5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2216767194.00000000000FA000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_80000_2Iu7231.jbxd

Yara matches

Similarity

API ID: ExceptionRaise$FeaturePresentProcessor__alloca_probe_16
String ID: csm
API String ID: 1924019822-1018135373
Opcode ID: 12d57c7c928eadb02208de5f94047dbdb0223da41eaae79ebfad875af5f30f3c
Instruction ID: 1337045233a944eea18684a52006340aae9c03842bb479d92945c06b5a583bbe
Opcode Fuzzy Hash: 12d57c7c928eadb02208de5f94047dbdb0223da41eaae79ebfad875af5f30f3c
Instruction Fuzzy Hash: D621AC32D00218ABCF34DFE9E981AEFB7F9AF84710F540419E505AB252D772AD54EB81

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: AppLaunch.exePID: 7984, Parent PID: 7344COMMON

Execution Graph

Execution Coverage:	18.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	5.1%
Total number of Nodes:	117
Total number of Limit Nodes:	8

Executed Functions

Function 0D7F5F80 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 355
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 0D7F6121

Strings

., xrefs: 0D7F61DB
1, xrefs: 0D7F6260

Memory Dump Source

Source File: 0000000B.00000002.2394943372.000000000D7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0D7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d7f0000_AppLaunch.jbxd

Similarity

API ID: InitializeThunk
String ID: .$1
API String ID: 2994545307-1839485796
Opcode ID: b6f05f0b7d6bd1b109ea73258c31ba1b8f27914adc7d9fada2fa0694fc9d634f
Instruction ID: 5988c1f1d59da6a3dc57f1824b013f79c26a85b1bd6a6414948196112c308f0f
Opcode Fuzzy Hash: b6f05f0b7d6bd1b109ea73258c31ba1b8f27914adc7d9fada2fa0694fc9d634f
Instruction Fuzzy Hash: F2F1E374E01228CFDB69DF65D894B9DBBB2BF89305F1082A9D509A7394DB319E81CF10

Uniqueness

Uniqueness Score: -1.00%

Function 0D7F22E8 Relevance: 5.4, Strings: 4, Instructions: 442
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 0D7F2996
$^q, xrefs: 0D7F2646
$^q, xrefs: 0D7F25A2
$^q, xrefs: 0D7F2A3A

Memory Dump Source

Source File: 0000000B.00000002.2394943372.000000000D7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0D7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d7f0000_AppLaunch.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: 6af34065aa461c90a30e457b981400879e1435f95bb4d69b96f0ac0c54c21cc2
Instruction ID: 1718e6acf64beca78560b64bcb69546c41519636ddc7557ab95fc96f54063469
Opcode Fuzzy Hash: 6af34065aa461c90a30e457b981400879e1435f95bb4d69b96f0ac0c54c21cc2
Instruction Fuzzy Hash: B722BD70A01228CFDB65DF64C880BDEB7B2BF89304F1095A9D509AB355DB349E86CF54

Uniqueness

Uniqueness Score: -1.00%

Function 070E1848 Relevance: 5.3, Strings: 4, Instructions: 267
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 070E19AD
$^q, xrefs: 070E1A3D
$^q, xrefs: 070E199D
$^q, xrefs: 070E1A27

Memory Dump Source

Source File: 0000000B.00000002.2373644691.00000000070E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_70e0000_AppLaunch.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: a05c4666829c999f946221da04a03781e1d1808506af8e1a6217a1c1e916874e
Instruction ID: db089e567a349d78f631e05a3b0672157fd4b635527e920174a144f6b508b5e9
Opcode Fuzzy Hash: a05c4666829c999f946221da04a03781e1d1808506af8e1a6217a1c1e916874e
Instruction Fuzzy Hash: 5EC1E4B0E0021CCFDB64DFA5C880B9DBBF6BF89304F1092AAD419AB254DB349985CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0D7F3998 Relevance: 2.8, APIs: 1, Instructions: 1290
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000B.00000002.2394943372.000000000D7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0D7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d7f0000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5496fa4414bfb69ae2ac537ed901eff4924fe177c431a41b94f4fda01894c8c9
Instruction ID: f50bf97ee6620898a94a07b382694207a8515f66c114655729bf28e210330fd2
Opcode Fuzzy Hash: 5496fa4414bfb69ae2ac537ed901eff4924fe177c431a41b94f4fda01894c8c9
Instruction Fuzzy Hash: F0E28BB4A012298FCB65DF28D994B9DBBB9FB49304F1081EAD50DA7350DB30AE85CF45

Uniqueness

Uniqueness Score: -1.00%

Function 0D7F17F8 Relevance: 2.7, Strings: 2, Instructions: 223
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PH^q, xrefs: 0D7F1AF3
LR^q, xrefs: 0D7F18A2

Memory Dump Source

Source File: 0000000B.00000002.2394943372.000000000D7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0D7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d7f0000_AppLaunch.jbxd

Similarity

API ID:
String ID: LR^q$PH^q
API String ID: 0-4173805542
Opcode ID: 50093385e0a7f3812333fd2ba8e9a2592fd21e050eab58a8e04bca2bb86fc310
Instruction ID: caad664c3a56deb7cfe979e008685fe6f0ec96858dee485f0b61d39d8bf32ff0
Opcode Fuzzy Hash: 50093385e0a7f3812333fd2ba8e9a2592fd21e050eab58a8e04bca2bb86fc310
Instruction Fuzzy Hash: EDA1D474E00318CFDB24DFA5C894BADBBB6BF89300F5085A9D909AB354DB319A85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 070E196F Relevance: 2.6, Strings: 2, Instructions: 130COMMON

Download Yara Rule

Strings

$^q, xrefs: 070E199D
$^q, xrefs: 070E1A27

Memory Dump Source

Source File: 0000000B.00000002.2373644691.00000000070E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_70e0000_AppLaunch.jbxd

Similarity

API ID:
String ID: $^q$$^q
API String ID: 0-355816377
Opcode ID: 4945e8fe524085dcd9ee9ba95e33a201a14f988fe5fac0e0fabcf012f8aea024
Instruction ID: 77554b10270b7128c75c4a2d87c5b3a19aae9794592e3509593fd7ab68ffc0b9
Opcode Fuzzy Hash: 4945e8fe524085dcd9ee9ba95e33a201a14f988fe5fac0e0fabcf012f8aea024
Instruction Fuzzy Hash: 8151D0B0E0522DCFDB64DFA4C880BADBBB6BF49304F1042AAD409AB254DB745E85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0D7F0CA8 Relevance: .4, Instructions: 420COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2394943372.000000000D7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0D7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d7f0000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b409fe00ceb341e4b68997faa38dd66b6889d025501d14428cfb8ad5cefa1ae7
Instruction ID: 2847fd224794e1b04278b829c744b74dc1764d0dc8cb47cfc4af0d1ab28d9ba7
Opcode Fuzzy Hash: b409fe00ceb341e4b68997faa38dd66b6889d025501d14428cfb8ad5cefa1ae7
Instruction Fuzzy Hash: 02226874E01229CFDB65DF69C890BD9B7B1BF89310F5085EAD549AB350EB30AA85CF40

Uniqueness

Uniqueness Score: -1.00%

Function 072CDE98 Relevance: 1.7, APIs: 1, Instructions: 204COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 072CE0FE

Memory Dump Source

Source File: 0000000B.00000002.2373808711.00000000072C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_72c0000_AppLaunch.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 97a2561db1e649c3f74c0b4ea72e56070842f17b3e75a0d38c51c107f3d9c8ce
Instruction ID: 5781c1445c83837c20a9ca54759e065803fb077941f8bf49c4234f9fe2c3c214
Opcode Fuzzy Hash: 97a2561db1e649c3f74c0b4ea72e56070842f17b3e75a0d38c51c107f3d9c8ce
Instruction Fuzzy Hash: 608134B0A10B469FDB24DF29C45079ABBF5FF98300F008A2ED48ADBA50D775E845CB91

Uniqueness

Uniqueness Score: -1.00%

Function 072C899D Relevance: 1.6, APIs: 1, Instructions: 100COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 072C8A59

Memory Dump Source

Source File: 0000000B.00000002.2373808711.00000000072C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_72c0000_AppLaunch.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: fc57d5d783d055dfff6ecd13068f8aa2834f8f222bc1eed90801f8338b9816c4
Instruction ID: f50ea37128c898b6a50dd1ac62b5505924ffea420790db6525ef87b829c116e6
Opcode Fuzzy Hash: fc57d5d783d055dfff6ecd13068f8aa2834f8f222bc1eed90801f8338b9816c4
Instruction Fuzzy Hash: 2A41D1B0C00619DEDB24CFA9C984ADEBBF5BF49304F24816AD408AB255DB755946CF90

Uniqueness

Uniqueness Score: -1.00%

Function 072C6EA8 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 072C8A59

Memory Dump Source

Source File: 0000000B.00000002.2373808711.00000000072C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_72c0000_AppLaunch.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 1707ce8e67043ab220e3b8336e61b5e0e3a93185a918ba67b4c411c4f6637ccc
Instruction ID: 005f3b4216090dd203416b0dabf418f794b945bf4168cd2002c49258a1ad2576
Opcode Fuzzy Hash: 1707ce8e67043ab220e3b8336e61b5e0e3a93185a918ba67b4c411c4f6637ccc
Instruction Fuzzy Hash: 8E41FFB0C1071DCBDB24CFA9C944B9EBBF5BF48304F24816AD408AB251DB756986CF90

Uniqueness

Uniqueness Score: -1.00%

Function 072CDBB8 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,072CE179,00000800,00000000,00000000), ref: 072CE38A

Memory Dump Source

Source File: 0000000B.00000002.2373808711.00000000072C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_72c0000_AppLaunch.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: a60588570ca660a959b0c728caa21f0317ac908543a481d142edf4821b96646c
Instruction ID: 8a9ede4df23790d95d4f92dc75ca8fa62ef482fb4091b6332d609e58bc038ac1
Opcode Fuzzy Hash: a60588570ca660a959b0c728caa21f0317ac908543a481d142edf4821b96646c
Instruction Fuzzy Hash: 731126B6D003499FDB10CF9AC444AEEFBF4EB98710F11852EE919A7210C379A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 072CE318 Relevance: 1.6, APIs: 1, Instructions: 54libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,072CE179,00000800,00000000,00000000), ref: 072CE38A

Memory Dump Source

Source File: 0000000B.00000002.2373808711.00000000072C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_72c0000_AppLaunch.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 30154bb5ca9d517a1b544e83fc4678292fff2a932a8f20fe1ba961992b0dece7
Instruction ID: dc0d90fab7281fe1fca9a1e3a77b3c60f8b26e90ed89854f3e05674f58332882
Opcode Fuzzy Hash: 30154bb5ca9d517a1b544e83fc4678292fff2a932a8f20fe1ba961992b0dece7
Instruction Fuzzy Hash: E01114B6D003099FDB24CF9AC484ADEFBF4EB88710F14852ED519A7210C374A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0D7FB3B8 Relevance: 1.6, APIs: 1, Instructions: 53libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(00000000,?,?,?,?,00000000,00000E58,?,?,0D7FB8D6), ref: 0D7FB9DE

Memory Dump Source

Source File: 0000000B.00000002.2394943372.000000000D7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0D7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d7f0000_AppLaunch.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 18307186fd2283f43d0c4206fabafe6601c356130b69f4d2886826d4e05dfa76
Instruction ID: c48e8d2282aaf2e1420118284bf08336e3b0b957fc2a2aa8c93e0dc4e7f5bfad
Opcode Fuzzy Hash: 18307186fd2283f43d0c4206fabafe6601c356130b69f4d2886826d4e05dfa76
Instruction Fuzzy Hash: 311123B6D00249CBCB20CF9AC444A9EFBF4EF88324F14842AD559A7310D774A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0D7FB973 Relevance: 1.6, APIs: 1, Instructions: 51libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(00000000,?,?,?,?,00000000,00000E58,?,?,0D7FB8D6), ref: 0D7FB9DE

Memory Dump Source

Source File: 0000000B.00000002.2394943372.000000000D7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0D7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d7f0000_AppLaunch.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 62599ea2945ea043189f2c9a75a318a1fb5c668cf2159d1265911e1596a46194
Instruction ID: abf41008a8391168d6c38c46bb4a7c4877e370bf9c4eb9c6f43d8f221b9f76e8
Opcode Fuzzy Hash: 62599ea2945ea043189f2c9a75a318a1fb5c668cf2159d1265911e1596a46194
Instruction Fuzzy Hash: 8E11F0B6D002498BCB20CF9AC844A9EFBF4EF88224F14882AD569A7310D774A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 072CE098 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 072CE0FE

Memory Dump Source

Source File: 0000000B.00000002.2373808711.00000000072C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_72c0000_AppLaunch.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: b1fe6e2f500df81b4bf45b3f534666e49b199e16fd4d50387a670cb9e837b9d1
Instruction ID: a645c4adf100b568886567a8d3406c09defa9f9cedc095eb9397f9f41685e43a
Opcode Fuzzy Hash: b1fe6e2f500df81b4bf45b3f534666e49b199e16fd4d50387a670cb9e837b9d1
Instruction Fuzzy Hash: 6E1110B6C0024A8FCB10CF9AC844ADEFBF4EB88324F10896AD859B7210C375A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 070E2998 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 070E35DD

Memory Dump Source

Source File: 0000000B.00000002.2373644691.00000000070E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_70e0000_AppLaunch.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 5f553cb1ea96abe08a443dcea15be3f14e67ea28072744f42a67799fa2b1ffba
Instruction ID: 730427bf8de105980169a96034c293c8fd464047d675d145f537548a624211cf
Opcode Fuzzy Hash: 5f553cb1ea96abe08a443dcea15be3f14e67ea28072744f42a67799fa2b1ffba
Instruction Fuzzy Hash: F11102B69003499FDB10CF8AC884BDEBFF8EB48324F108459E554A7200C374A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 070E3578 Relevance: 1.5, APIs: 1, Instructions: 45windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 070E35DD

Memory Dump Source

Source File: 0000000B.00000002.2373644691.00000000070E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_70e0000_AppLaunch.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: f96c890048641dd4625362e627fa2fff424ce5bcc1615f7e4e6f238310e128fa
Instruction ID: 5692cc099f9d39bf9bd990369e8f5d5720f199f4444261b03b10f428be1fec78
Opcode Fuzzy Hash: f96c890048641dd4625362e627fa2fff424ce5bcc1615f7e4e6f238310e128fa
Instruction Fuzzy Hash: 851122B5800249CFDB10CF9AC984BDEBFF8EB48324F10841AD458A7300C374A984CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0703D4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2373385401.000000000703D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0703D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_703d000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d3e462a5b76bb54efe287fb23edbe134457deaa72101784a3eba1401a1b3f8c
Instruction ID: fe5c8a75989a113ac58e14a000b0aacddbaa6cfa14cc32fe6c829edee11036e5
Opcode Fuzzy Hash: 6d3e462a5b76bb54efe287fb23edbe134457deaa72101784a3eba1401a1b3f8c
Instruction Fuzzy Hash: CE2107B1604241DFDB05DF14D9C0B2BBFA9FB84318F24C66AE9094B256C336D456CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0703D3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2373385401.000000000703D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0703D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_703d000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 939366ec68ff6fb104f9791c2f5a3ab9ee2d9147bb4083a7d138619fc3550a3a
Instruction ID: dd737c50ba79fa2a968a5f56ed5d6f3db4245ad28c1f1d5227675bcd2600bc0b
Opcode Fuzzy Hash: 939366ec68ff6fb104f9791c2f5a3ab9ee2d9147bb4083a7d138619fc3550a3a
Instruction Fuzzy Hash: 622128B1604204DFEB05DF14D9C0B1ABFA9FB94324F24C6A9D9094B216C376E456C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 0704D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2373421660.000000000704D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0704D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_704d000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bf9f7a19aacb5cd74c695a1afd086173c99cb40b7f7ca7ee2c0329462ba0db4
Instruction ID: f51622672d37777db777ff7e919e075c28fecdaac90d957fcb0c4d0a1a3e2aa2
Opcode Fuzzy Hash: 2bf9f7a19aacb5cd74c695a1afd086173c99cb40b7f7ca7ee2c0329462ba0db4
Instruction Fuzzy Hash: 2521F2F1604240DFCB14DF14D988B2ABBA5EB84314F24C67DDA098B256C33AD447CA61

Uniqueness

Uniqueness Score: -1.00%

Function 0704D006 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2373421660.000000000704D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0704D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_704d000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05fd4610ce2b4bdf7269ac672094bacb94e7c34c5877addd1ce48ed7db09d1e8
Instruction ID: 54f66d3234122a6366fd6ce6b1e25d1a1d4c4a28965939d13fe4408089a4072c
Opcode Fuzzy Hash: 05fd4610ce2b4bdf7269ac672094bacb94e7c34c5877addd1ce48ed7db09d1e8
Instruction Fuzzy Hash: 102162B55083809FCB16CF14D994711BFB1EB46214F28C6EAD9498F267C33A985ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 0703D4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2373385401.000000000703D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0703D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_703d000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce69cba98bfff612cefda2c4877fe7df6cc59bd7a6ce96c012d28fad0f514114
Instruction ID: 22b42190d6b8686183372ab46afec06add52cfdbd04beb3a08da5115b4bb04ac
Opcode Fuzzy Hash: ce69cba98bfff612cefda2c4877fe7df6cc59bd7a6ce96c012d28fad0f514114
Instruction Fuzzy Hash: 8B11E6B6604280CFCB16CF14D9C4B16BFB1FB84318F24C6AADC494B616C336D45ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0703D3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2373385401.000000000703D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0703D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_703d000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce69cba98bfff612cefda2c4877fe7df6cc59bd7a6ce96c012d28fad0f514114
Instruction ID: 24ac9b21a595f09417554a6e28667cd9004daadd3669999945f563b661f2da3e
Opcode Fuzzy Hash: ce69cba98bfff612cefda2c4877fe7df6cc59bd7a6ce96c012d28fad0f514114
Instruction Fuzzy Hash: 881103B2504280CFDB02CF10D9C4B16BFB1FB94324F24C6A9D8090B616C33AE45ACBA1

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: 3rB05VU.exePID: 8008, Parent PID: 7328COMMON

Executed Functions

Function 00848DC0 Relevance: 135.4, APIs: 59, Strings: 16, Instructions: 4185threadsleeplibraryCOMMON

Download Yara Rule

APIs

SetPriorityClass.KERNEL32(?,00008000), ref: 00849004
SetUnhandledExceptionFilter.KERNEL32(00848DA0), ref: 0084900B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00849023
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00849086
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 008494D3
LoadLibraryA.KERNEL32(B7B1B6A8,B7B1B6A8,FFFFFFF9,FFFFFFFF,00000002,00000000,?,?,BAAAADAB,?,?,BAAAADAB,?,?,BAAAADAB), ref: 0084960B
LoadLibraryA.KERNEL32(96919688,96919688,?,?,BAAAADAB,?,?,BAAAADAB,?,?,BAAAADAB,?,?,BAAAADAB,00000002,00000000), ref: 00849672
CreateThread.KERNEL32(00000000,00000000,Function_0001CA80,00000000,00000000,00000000), ref: 00849693
CloseHandle.KERNEL32(00000000,?,?,BAAAADAB,?,?,BAAAADAB,?,?,BAAAADAB,?,?,BAAAADAB,00000002,00000000), ref: 0084969A
Sleep.KERNEL32(00000001,?,?,BAAAADAB,?,?,BAAAADAB,?,?,BAAAADAB,?,?,BAAAADAB,00000002,00000000), ref: 0084974E
GetTempPathA.KERNEL32(000000FA,00000002,?,?,BAAAADAB,?,?,BAAAADAB,?,?,BAAAADAB,?,?,BAAAADAB,00000002,00000000), ref: 00849787

Part of subcall function 007FB940: GetFileAttributesA.KERNEL32(?,?,?,00822420), ref: 007FB95D
Part of subcall function 007FB940: GetLastError.KERNEL32(?,00822420), ref: 007FB968

CreateDirectoryA.KERNEL32(00929B8C,00000000,AFB2BAAB,?,?,BAAAADAB,?,?,BAAAADAB,?,?,BAAAADAB,?,?,BAAAADAB,00000002), ref: 00849C02
CreateDirectoryA.KERNEL32(?,00000000,?,?,BAAAADAB,?,?,BAAAADAB,?,?,BAAAADAB,?,?,BAAAADAB,00000002,00000000), ref: 00849C31
SetCurrentDirectoryA.KERNEL32(?,?,?,BAAAADAB,?,?,BAAAADAB,?,?,BAAAADAB,?,?,BAAAADAB,00000002,00000000), ref: 00849D67
GetFileAttributesA.KERNEL32(C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus,?,?,?,?,BAAAADAB,?,?,BAAAADAB,?,?,BAAAADAB,?,?,BAAAADAB,00000002), ref: 00849D93
CreateMutexA.KERNEL32(00000000,00000001,00000000,?,ADBEAFAC,?,?,BAAAADAB,?,?,BAAAADAB,?,?,BAAAADAB), ref: 00849EFC
GetLastError.KERNEL32(?,ADBEAFAC,?,?,BAAAADAB,?,?,BAAAADAB,?,?,BAAAADAB,?,?,BAAAADAB,00000002,00000000), ref: 00849F11
Sleep.KERNEL32(00000064), ref: 00849FC3
shutdown.WS2_32(00000002), ref: 00849FF3
closesocket.WS2_32 ref: 00849FFF
WSACleanup.WS2_32 ref: 0084A005
Sleep.KERNEL32(000003E8), ref: 0084A015
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0084A02B
__aulldiv.LIBCMT ref: 0084A3E7
__aulldiv.LIBCMT ref: 0084A598
send.WS2_32(0000000F,00000000,00000000,00000000), ref: 0084A5FF
Sleep.KERNEL32(00000064,?,?,?,00006BC0,00000000,?,000000A3,FFFFFFF9,FFFFFFFF,00000002,00000000,?,?,BAAAADAB), ref: 0084A7B6
Sleep.KERNEL32(00000000,?,?,?,?,?,00006BC0,00000000,?,000000A3,FFFFFFF9,FFFFFFFF,00000002,00000000), ref: 0084A90D
GetModuleHandleA.KERNEL32(ntdll.dll,?,?,?,?,00008A8E,00008A8D,?,?,?,?,?,00006BC0,00000000,?,000000A3), ref: 0084B0C1
GetProcAddress.KERNEL32(00000000,?), ref: 0084B0CF
GetCurrentProcess.KERNEL32(00000000,?,00008A8E,00008A8D,?,?,?,?,?,00006BC0,00000000,?,000000A3,FFFFFFF9,FFFFFFFF,00000002), ref: 0084B0DD
CreateThread.KERNEL32(00000000,00000000,Function_0004A2F0,00000000,00000000,00000000), ref: 0084B545
CreateThread.KERNEL32(00000000,00000000,0083B6D0,00000000,00000000,00000000), ref: 0084B559
CreateThread.KERNEL32(00000000,00000000,Function_00052BE0,00000000,00000000,00000000), ref: 0084B56D
FreeLibrary.KERNEL32(6A410000,?,?,B3AABE89,B3AABE89,B6B8B0B3,B6B8B0B3,?,00008A8E,00008A8D,?,?,?,?,?,00006BC0), ref: 0084B6B3
WaitForSingleObject.KERNEL32(00000000,00000000,?,?,?,?,?,00008A8E,00008A8D,?,?,?,?,?,00006BC0,00000000), ref: 0084B891
CreateThread.KERNEL32(00000000,00000000,Function_00053170,00000000,00000000,00000000), ref: 0084BB0E
CreateThread.KERNEL32(00000000,00000000,Function_00054190,00000000,00000000,00000000), ref: 0084BB22
CreateThread.KERNEL32(00000000,00000000,Function_000559B0,00000000,00000000,00000000), ref: 0084BB36
CreateThread.KERNEL32(00000000,00000000,Function_000566C0,00000000,00000000,00000000), ref: 0084BB4A
CreateThread.KERNEL32(00000000,00000000,Function_00057D90,00000000,00000000,00000000), ref: 0084BB5E
CreateThread.KERNEL32(00000000,00000000,Function_00057EA0,00000000,00000000,00000000), ref: 0084BB72
CreateThread.KERNEL32(00000000,00000000,Function_00058BA0,00000000,00000000,00000000), ref: 0084BB86
WaitForSingleObject.KERNEL32(00000000,000493E0), ref: 0084BD36
WaitForSingleObject.KERNEL32(?,000493E0), ref: 0084BDE6
CloseHandle.KERNEL32(00000000), ref: 0084C064
DeleteFileA.KERNEL32(?), ref: 0084C69C
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00849C48

Part of subcall function 007FB990: FindFirstFileA.KERNEL32(00000000,00000004,008E8953,?,?,?,\*.*,00000004,?,74DF3100), ref: 007FBAA1

GetVersionExA.KERNEL32(0000009C), ref: 0084C811
MessageBoxA.USER32(00000000,The Windows Vista operating system is not an obstacle.,Error,00000010), ref: 0084C83B
Sleep.KERNEL32(00000BB8), ref: 0084C8D9
shutdown.WS2_32(00000002), ref: 0084C8E3
closesocket.WS2_32 ref: 0084C8EF
WSACleanup.WS2_32 ref: 0084C8F5
GetModuleHandleA.KERNEL32(ntdll.dll,?), ref: 0084C940
GetProcAddress.KERNEL32(00000000,?), ref: 0084C94E
GetCurrentProcess.KERNEL32(00000000), ref: 0084C95C
NtTerminateProcess.NTDLL(00000000), ref: 0084C963
GetCurrentProcessId.KERNEL32 ref: 0084C96A

Strings

:, xrefs: 0084A9B9
89.149.18.60, xrefs: 0084A7DB, 0084A82E, 0084A929, 0084A93A, 0084A9D3, 0084BB93, 0084C378, 0084C397
/*************/, xrefs: 008492AA
L, xrefs: 0084C7CC
</config>, xrefs: 00849E28
The Windows Vista operating system is not an obstacle., xrefs: 0084C834
2, xrefs: 0084A38B
., xrefs: 0084A97D
2, xrefs: 0084A524
, xrefs: 00849E1D
\config.xml, xrefs: 00849DE0
<config>, xrefs: 00849E12
ntdll.dll, xrefs: 0084B0BC, 0084C93B
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus, xrefs: 00849D8E, 00849DB3
131, xrefs: 00848DF5, 00848E03, 00848E29, 00848E2E, 00848E3C, 00848E60, 00848E78, 00849ED5, 0084A0E4
Error, xrefs: 0084C82F

Memory Dump Source

Source File: 0000000C.00000002.2581035824.00000000007F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007F0000, based on PE: true

Associated: 0000000C.00000002.2581017077.00000000007F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581115078.00000000008F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581146123.0000000000929000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581165656.000000000092D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7f0000_3rB05VU.jbxd

Similarity

API ID: Create$Thread$Sleep$Unothrow_t@std@@@__ehfuncinfo$??2@$CurrentFileHandleProcess$DirectoryLibraryObjectSingleWait$AddressAttributesCleanupCloseErrorLastLoadModuleProc__aulldivclosesocketshutdown$ClassDeleteExceptionFilterFindFirstFreeMessageMutexPathPriorityTempTerminateUnhandledVersionsend
String ID: $.$/*************/$131$89.149.18.60$:$</config>$<config>$C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus$Error$L$The Windows Vista operating system is not an obstacle.$\config.xml$ntdll.dll$2$2
API String ID: 3390398298-3592079131
Opcode ID: ba1ab67e021a2bdd03cef2f6e06a54ef0029a1d39244bb6dbbc3d20a95f6b87f
Instruction ID: 6e498d5bfd7c919180c5179558f5791731701f510321821ba9c429f00e6a868a
Opcode Fuzzy Hash: ba1ab67e021a2bdd03cef2f6e06a54ef0029a1d39244bb6dbbc3d20a95f6b87f
Instruction Fuzzy Hash: C083E070900268CFDB28CF68C854BAEBBB1FF55304F1441D9D849AB392DB75AA85CF91

Uniqueness

Uniqueness Score: -1.00%

Function 007FEA60 Relevance: 25.7, APIs: 12, Strings: 2, Instructions: 1192fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,F5F1F583,?,F5F1F583,008318FA,00000000,F5F1F583,F5F1F584,F5F1F583,00000000,7FFFFFFF), ref: 007FEBE5
CreateDirectoryA.KERNEL32(00000000,00000000,0000002E,0000002F,?,?,F5F1F583,?,0091164C,00000001,0000002E,0000002F,?,00000000,008318FA), ref: 007FEEAB
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 007FEF1B
FindNextFileA.KERNEL32(00000000,?), ref: 007FEF31
FindClose.KERNEL32(00000000), ref: 007FEF41
GetLastError.KERNEL32 ref: 007FEF47
GetLastError.KERNEL32 ref: 007FEF65
SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,?,00000000,7FFFFFFF), ref: 007FF0E6
CreateDirectoryA.KERNEL32(?,00000000,?,ABAA9E83,?,?,ABAA9E83,ABAA9E84,ABAA9E83,?,?,?,ABAA9E83,ABAA9E84,ABAA9E83), ref: 007FF2C4
CreateDirectoryA.KERNEL32(00000000,00000000,?,BBB19683,?,?,BBB19683,BBB19684,BBB19683,?,BBB19683,?,00000000,BBB19683,BBB19684,BBB19683), ref: 007FF424
CreateDirectoryA.KERNEL32(00000000,00000000,?,BCB09383,?,?,BCB09383,BCB09384,BCB09383,?,BCB09383,?,00000000,BCB09383,BCB09384,BCB09383), ref: 007FF687

Part of subcall function 007FB940: GetFileAttributesA.KERNEL32(?,?,?,00822420), ref: 007FB95D
Part of subcall function 007FB940: GetLastError.KERNEL32(?,00822420), ref: 007FB968

CreateDirectoryA.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,00000000,?,?,?), ref: 007FF902

Strings

&, xrefs: 00803EBF
., xrefs: 007FEC00

Memory Dump Source

Source File: 0000000C.00000002.2581035824.00000000007F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007F0000, based on PE: true

Associated: 0000000C.00000002.2581017077.00000000007F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581115078.00000000008F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581146123.0000000000929000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581165656.000000000092D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7f0000_3rB05VU.jbxd

Similarity

API ID: CreateDirectory$File$ErrorFindLast$AttributesCloseCopyFirstFolderNextPath
String ID: &$.
API String ID: 3850399370-4005498665
Opcode ID: 2836b7f60413fd17ed45745e2230d26c79af467ee0b1dfd22768961ea8147601
Instruction ID: 687d0f465713b93ffd64da074e048566d1943354e60b54159862a4d76bf02a7d
Opcode Fuzzy Hash: 2836b7f60413fd17ed45745e2230d26c79af467ee0b1dfd22768961ea8147601
Instruction Fuzzy Hash: 7EB2AE70C1028DDEDF04DFA8C8587FDBBB4AF15304F148298E555BB292EBB85A49CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0080CA80 Relevance: 23.3, APIs: 11, Strings: 2, Instructions: 573
networksleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 0080D376

Part of subcall function 0080BCD0: setsockopt.WS2_32(0000FFFF,00001006,?,00000008), ref: 0080BCFC

recv.WS2_32(?,00000004,00000002), ref: 0080CAF1
WSAGetLastError.WS2_32 ref: 0080CAF5
recv.WS2_32(00000000,0000000C,00000002,00000000), ref: 0080CB73
recv.WS2_32(00000000,0000000C,00000008), ref: 0080CB94
recv.WS2_32(00000000,?,00000008,?), ref: 0080CC26
recv.WS2_32(?,00000004,00000008), ref: 0080CD31
__aulldiv.LIBCMT ref: 0080D0DD
__aulldiv.LIBCMT ref: 0080D27D
send.WS2_32(?,00000000,00000000,00000000), ref: 0080D2E4
Sleep.KERNEL32(00000001), ref: 0080D368

Strings

2, xrefs: 0080D057
2, xrefs: 0080D1F7

Memory Dump Source

Source File: 0000000C.00000002.2581035824.00000000007F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007F0000, based on PE: true

Associated: 0000000C.00000002.2581017077.00000000007F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581115078.00000000008F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581146123.0000000000929000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581165656.000000000092D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7f0000_3rB05VU.jbxd

Similarity

API ID: recv$Sleep__aulldiv$ErrorLastsendsetsockopt
String ID: 2$2
API String ID: 4175949153-3919836843
Opcode ID: 41fc9198f39591af0d054f1698aaeac94bc8d74378fa7198637fa69853472d66
Instruction ID: 217e23bccab36562fe4454b4fcb85e4ba0bb277c797547a0fb2123ab07e9f7ce
Opcode Fuzzy Hash: 41fc9198f39591af0d054f1698aaeac94bc8d74378fa7198637fa69853472d66
Instruction Fuzzy Hash: 39424670E00258CBEB24CFA8CD54BEDBBB1FB59304F218299D419B7292D7751A85CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0082C060 Relevance: 20.4, APIs: 13, Instructions: 911
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?,0092C150,?,B6B8B0B3,B6B8B0B3), ref: 0082C1AC
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 0082C1E7
RegOpenKeyExA.ADVAPI32(?,?,00000000,00020019,000000FF), ref: 0082C215
RegQueryValueExA.ADVAPI32(000000FF,B6BEB29A,00000000,00000001,?,00000104,B6BEB29A), ref: 0082C313
RegQueryValueExA.ADVAPI32(000000FF,8F9E9296,00000000,00000001,?,00000104,8F9E9296,?,?,?,?,?,000000F2), ref: 0082C453
RegQueryValueExA.ADVAPI32(000000FF,8F8B928C,00000000,00000001,?,00000104,8F8B928C,?,?,?,?,?,000000F2), ref: 0082C4A3
RegQueryValueExA.ADVAPI32(000000FF,8F9E9296,00000000,00000003,?,00000200,8F9E9296,?,?,?,?,?,000000F2), ref: 0082C569
RegQueryValueExA.ADVAPI32(000000FF,EC8F908F,00000000,00000003,?,00000200,EC8F908F,?,?,?,?,?,000000F2), ref: 0082C5D9
RegQueryValueExA.ADVAPI32(000000FF,8F8B8B97,00000000,00000003,?,00000200,8F8B8B97,?,?,?,?,?,000000F2), ref: 0082C649
RegQueryValueExA.ADVAPI32(000000FF,8F8B928C,00000000,00000003,?,00000200,8F8B928C,?,?,?,?,?,000000F2), ref: 0082C6B9
RegCloseKey.ADVAPI32(000000FF), ref: 0082CDA1
RegEnumKeyA.ADVAPI32(?,00000001,?,00000104), ref: 0082CDD4
RegCloseKey.ADVAPI32(?), ref: 0082CDE8

Memory Dump Source

Source File: 0000000C.00000002.2581035824.00000000007F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007F0000, based on PE: true

Associated: 0000000C.00000002.2581017077.00000000007F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581115078.00000000008F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581146123.0000000000929000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581165656.000000000092D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7f0000_3rB05VU.jbxd

Similarity

API ID: QueryValue$CloseEnumOpen
String ID:
API String ID: 2041898428-0
Opcode ID: 71e89a40f6ffbdff683c53f40558a4e8fdaeecc70b34c112fcb119ad490d4838
Instruction ID: c39d88faadd1c7548b1a98ee160511a9078ef05813c105514b37e4c4cf2a687a
Opcode Fuzzy Hash: 71e89a40f6ffbdff683c53f40558a4e8fdaeecc70b34c112fcb119ad490d4838
Instruction Fuzzy Hash: B082A0708002A89EDF25DFA4DC54BEEBBB4FF15300F1481D9E549A7642EB705A89CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00820DB0 Relevance: 16.3, APIs: 6, Strings: 2, Instructions: 2315stringCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,00000000,?,?,?,?,?,?,?,?,00842C95), ref: 00820E84
GetPrivateProfileSectionNamesA.KERNEL32(?,00001000,00000000), ref: 00820EFA
GetPrivateProfileStringA.KERNEL32(?,B7ABBE8F,00000000,?,00000104), ref: 00820FC9
lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00842C95), ref: 0082310F

Part of subcall function 007FB4D0: __fread_nolock.LIBCMT ref: 007FB5CE

CreateDirectoryA.KERNEL32(?,00000000), ref: 00822441
CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?,?,?), ref: 008226F9

Strings

&, xrefs: 0082320C
cannot use operator[] with a string argument with , xrefs: 00823197, 008231C9, 008231FB, 00823259, 008232AE

Memory Dump Source

Source File: 0000000C.00000002.2581035824.00000000007F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007F0000, based on PE: true

Associated: 0000000C.00000002.2581017077.00000000007F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581115078.00000000008F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581146123.0000000000929000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581165656.000000000092D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7f0000_3rB05VU.jbxd

Similarity

API ID: CreateDirectoryPrivateProfile$FolderNamesPathSectionString__fread_nolocklstrlen
String ID: &$cannot use operator[] with a string argument with
API String ID: 2628882823-967631581
Opcode ID: 8b260b1b3be9e8dbab4ad15460d6646588df9aabf8040d54a58e3f9ed7d30ffb
Instruction ID: c3721fefa51b7417f0f9e3e48844fc90775a9b21649c33fc1e17f7a3c74fcb16
Opcode Fuzzy Hash: 8b260b1b3be9e8dbab4ad15460d6646588df9aabf8040d54a58e3f9ed7d30ffb
Instruction Fuzzy Hash: A133AF70C042A8DADF15DB68CC58BEEBBB5BF16300F1441D9E449A7242DB745B89CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 00826AB0 Relevance: 13.3, APIs: 5, Strings: 2, Instructions: 1028
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 00826BC5
GetPrivateProfileSectionNamesA.KERNEL32(?,00001000,?), ref: 00826C56
GetPrivateProfileStringA.KERNEL32(?,B7ABBE8F,00000000,?,00000104), ref: 00826D0B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00827644
lstrlenA.KERNEL32(?), ref: 0082794F

Strings

#, xrefs: 00827A09
cannot use operator[] with a string argument with , xrefs: 008279BF, 008279F8

Memory Dump Source

Source File: 0000000C.00000002.2581035824.00000000007F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007F0000, based on PE: true

Associated: 0000000C.00000002.2581017077.00000000007F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581115078.00000000008F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581146123.0000000000929000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581165656.000000000092D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7f0000_3rB05VU.jbxd

Similarity

API ID: PrivateProfile$FolderNamesPathSectionStringUnothrow_t@std@@@__ehfuncinfo$??2@lstrlen
String ID: #$cannot use operator[] with a string argument with
API String ID: 3203477177-740485285
Opcode ID: 394daf887a3cf2622c1c7deb9ae54b77c391e50210ebe14310f5ccac1a879f21
Instruction ID: c0ae4ea5267a74e100062ac21ada826681f3c19078c94dc9501a1dd3670d4370
Opcode Fuzzy Hash: 394daf887a3cf2622c1c7deb9ae54b77c391e50210ebe14310f5ccac1a879f21
Instruction Fuzzy Hash: 3BA2AD70D042A8CEDF25DB68D855BEDBBB4BF15300F1481D9E449A7282DB745B88CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 008241F0 Relevance: 11.7, APIs: 4, Strings: 2, Instructions: 1172stringCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 00824306
GetPrivateProfileSectionNamesA.KERNEL32(?,00001000,?), ref: 00824397
GetPrivateProfileStringA.KERNEL32(?,B7ABBE8F,00000000,?,00000104), ref: 0082444B

Part of subcall function 00804AC0: __Mtx_unlock.LIBCPMT ref: 00804B58

lstrlenA.KERNEL32(?), ref: 00825318

Part of subcall function 008C2A3B: RaiseException.KERNEL32(E06D7363,00000001,00000003,00000000,?,?,?,008A919F,00000000,00926D34,?,00000000), ref: 008C2A9B

Strings

', xrefs: 00825434
cannot use operator[] with a string argument with , xrefs: 0082538B, 008253C0, 00825423

Memory Dump Source

Source File: 0000000C.00000002.2581035824.00000000007F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007F0000, based on PE: true

Associated: 0000000C.00000002.2581017077.00000000007F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581115078.00000000008F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581146123.0000000000929000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581165656.000000000092D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7f0000_3rB05VU.jbxd

Similarity

API ID: PrivateProfile$ExceptionFolderMtx_unlockNamesPathRaiseSectionStringlstrlen
String ID: '$cannot use operator[] with a string argument with
API String ID: 3748818436-1348476624
Opcode ID: 9999f7f40e591aceccccdf07a9c1b657f9006e35fd070741e44fef400f0d0e4c
Instruction ID: 9718c66f2e6da8b9410729f629bda8989e6e87817b4774f89624a910291c9ed0
Opcode Fuzzy Hash: 9999f7f40e591aceccccdf07a9c1b657f9006e35fd070741e44fef400f0d0e4c
Instruction Fuzzy Hash: B7B2CF30D042A9CEDF15DB68D958BEDBBB5BF16300F1482D9D449A7282DB705B88CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 008182C0 Relevance: 11.0, APIs: 2, Strings: 3, Instructions: 2240COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,00000000,?,?), ref: 0081839B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 008199A5

Part of subcall function 008C2A3B: RaiseException.KERNEL32(E06D7363,00000001,00000003,00000000,?,?,?,008A919F,00000000,00926D34,?,00000000), ref: 008C2A9B

Strings

g, xrefs: 0081A369
@, xrefs: 00818CFE
cannot use operator[] with a string argument with , xrefs: 0081A23D, 0081A26F, 0081A2A1, 0081A2D3, 0081A324, 0081A358

Memory Dump Source

Source File: 0000000C.00000002.2581035824.00000000007F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007F0000, based on PE: true

Associated: 0000000C.00000002.2581017077.00000000007F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581115078.00000000008F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581146123.0000000000929000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581165656.000000000092D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7f0000_3rB05VU.jbxd

Similarity

API ID: ExceptionFolderPathRaiseUnothrow_t@std@@@__ehfuncinfo$??2@
String ID: @$cannot use operator[] with a string argument with $g
API String ID: 3139777191-1098361084
Opcode ID: 8824186084cc1f5ba49ceab70d86034e3e6dfdc08ee28ef30ae511f3280c46ad
Instruction ID: 1b1e355fdb5083fc60c23c20a58e1d99ef6c710c98bf247a6142ba40a7588567
Opcode Fuzzy Hash: 8824186084cc1f5ba49ceab70d86034e3e6dfdc08ee28ef30ae511f3280c46ad
Instruction Fuzzy Hash: 5A23DF70C0029CDADF15DB68C8597EEBBB9BF15304F1481D8E449A7282DB745F89CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0081E200 Relevance: 8.5, APIs: 1, Strings: 3, Instructions: 1486COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?), ref: 0081E2DA

Strings

@, xrefs: 0081F407
-, xrefs: 0081F78C
+, xrefs: 0081F7CD

Memory Dump Source

Source File: 0000000C.00000002.2581035824.00000000007F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007F0000, based on PE: true

Associated: 0000000C.00000002.2581017077.00000000007F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581115078.00000000008F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581146123.0000000000929000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581165656.000000000092D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7f0000_3rB05VU.jbxd

Similarity

API ID: FolderPath
String ID: +$-$@
API String ID: 1514166925-3905070308
Opcode ID: 04a8446379e66926836ae0b1293aff3ce797380ce4fb2ba9fe2558bfb69ed196
Instruction ID: 9bc7b1bcaf302547f2d56cc4cea96f463b0e2b940959239f8f897f1b55f4cce9
Opcode Fuzzy Hash: 04a8446379e66926836ae0b1293aff3ce797380ce4fb2ba9fe2558bfb69ed196
Instruction Fuzzy Hash: 26E2CD70D00258CBDF28DF68C8587EEBBB5FF55304F1442D9E449AB282DB745A89CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0081E250 Relevance: 8.2, APIs: 1, Strings: 3, Instructions: 1231COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?), ref: 0081E2DA

Part of subcall function 00811B60: FindFirstFileA.KERNEL32(?,0000F583,?,0000F583,?,?,0000F583,0000F584,0000F583,?), ref: 00811C65

Strings

@, xrefs: 0081F407
-, xrefs: 0081F78C
+, xrefs: 0081F7CD

Memory Dump Source

Source File: 0000000C.00000002.2581035824.00000000007F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007F0000, based on PE: true

Associated: 0000000C.00000002.2581017077.00000000007F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581115078.00000000008F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581146123.0000000000929000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581165656.000000000092D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7f0000_3rB05VU.jbxd

Similarity

API ID: FileFindFirstFolderPath
String ID: +$-$@
API String ID: 2195519125-3905070308
Opcode ID: 06bb83ce65bad577b0812da5f439cab329b20480116cabbb5e9c93ccca156449
Instruction ID: 04aaa41df1399f4c90ebbbdd472e85f2ed59ed9f6536b334a5a5aad4baaea1d2
Opcode Fuzzy Hash: 06bb83ce65bad577b0812da5f439cab329b20480116cabbb5e9c93ccca156449
Instruction Fuzzy Hash: 23C2AC70C00298CBEF25DB68C8587EEBBB5FF55304F1442E9D449AB282DB745B89CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0081A530 Relevance: 7.9, APIs: 2, Strings: 2, Instructions: 875COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,ABACB6B7,ABACB6B7), ref: 0081A63E
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0081AF32

Strings

, xrefs: 0081AFBF
cannot use operator[] with a string argument with , xrefs: 0081B16B

Memory Dump Source

Source File: 0000000C.00000002.2581035824.00000000007F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007F0000, based on PE: true

Associated: 0000000C.00000002.2581017077.00000000007F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581115078.00000000008F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581146123.0000000000929000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581165656.000000000092D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7f0000_3rB05VU.jbxd

Similarity

API ID: FolderPathUnothrow_t@std@@@__ehfuncinfo$??2@
String ID: $cannot use operator[] with a string argument with
API String ID: 2082173394-2524441778
Opcode ID: 31fcd968954ee1101e3a3d827ec14bc312c6a560f7454818abf626149bb0ed31
Instruction ID: 957b3dc46d7ecad525a670caee79145bfb4bcb007d1559361d9beb39bdaf28b0
Opcode Fuzzy Hash: 31fcd968954ee1101e3a3d827ec14bc312c6a560f7454818abf626149bb0ed31
Instruction Fuzzy Hash: 4782AD71D01258DFDF18DBA8C954BEDBBB5BF15304F148198E449BB282DB706E88CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00814BC0 Relevance: 6.1, APIs: 1, Strings: 2, Instructions: 887COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 00814CE5

Strings

, xrefs: 0081566F
cannot use operator[] with a string argument with , xrefs: 0081582D

Memory Dump Source

Source File: 0000000C.00000002.2581035824.00000000007F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007F0000, based on PE: true

Associated: 0000000C.00000002.2581017077.00000000007F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581115078.00000000008F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581146123.0000000000929000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581165656.000000000092D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7f0000_3rB05VU.jbxd

Similarity

API ID: FolderPath
String ID: $cannot use operator[] with a string argument with
API String ID: 1514166925-2524441778
Opcode ID: 8702bb355791b7429106964f8b80f47fbbd81404c16e9eeade1ce08ddcdf55ca
Instruction ID: b109f60e7cac4f649b282996f729388b894964283e099726e9ee5ce401ccaa40
Opcode Fuzzy Hash: 8702bb355791b7429106964f8b80f47fbbd81404c16e9eeade1ce08ddcdf55ca
Instruction Fuzzy Hash: FE82AD71D04298CFDF14DBA8C854BEDBBB5FF55304F188298E449B7282DB706A89CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00800520 Relevance: 6.1, APIs: 2, Strings: 1, Instructions: 863COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,?,00000003,00000001), ref: 00800575
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,?,?,?,00000003,00000001), ref: 00800598

Strings

q, xrefs: 00802872

Memory Dump Source

Source File: 0000000C.00000002.2581035824.00000000007F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007F0000, based on PE: true

Associated: 0000000C.00000002.2581017077.00000000007F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581115078.00000000008F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581146123.0000000000929000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581165656.000000000092D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7f0000_3rB05VU.jbxd

Similarity

API ID: FolderPath
String ID: q
API String ID: 1514166925-4110462503
Opcode ID: 962745b759a4f8e96f3bf021c9d8de00379e8c214c3e8d88a0de436f01b9d347
Instruction ID: c2b05c6958dfdf81b021b7a9869231f437c92c4c7956368b4c5cff9f3b0ffe0a
Opcode Fuzzy Hash: 962745b759a4f8e96f3bf021c9d8de00379e8c214c3e8d88a0de436f01b9d347
Instruction Fuzzy Hash: E682B070C1428CCADF15DFA4C9587EDBBB4BF1A304F14829DD44667292EB742B89CB61

Uniqueness

Uniqueness Score: -1.00%

Function 008DAC6A Relevance: 5.7, APIs: 1, Strings: 2, Instructions: 408timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,008DB0AF,00000000,00000000,00000000), ref: 008DAF6E

Strings

W. Europe Standard Time, xrefs: 008DB007
W. Europe Summer Time, xrefs: 008DB01B

Memory Dump Source

Source File: 0000000C.00000002.2581035824.00000000007F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007F0000, based on PE: true

Associated: 0000000C.00000002.2581017077.00000000007F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581115078.00000000008F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581146123.0000000000929000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581165656.000000000092D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7f0000_3rB05VU.jbxd

Similarity

API ID: InformationTimeZone
String ID: W. Europe Standard Time$W. Europe Summer Time
API String ID: 565725191-690618308
Opcode ID: b919150e496d7d33fd0ebdc7982a04401ab2a0cea48d6dc1e5c58c36036e3f0b
Instruction ID: e413d40c3727de3a845ed03f88631c2147635aab1ca871787630f6b8ffb1b63e
Opcode Fuzzy Hash: b919150e496d7d33fd0ebdc7982a04401ab2a0cea48d6dc1e5c58c36036e3f0b
Instruction Fuzzy Hash: C6C11672900115AFCB28AB69DC02ABE77B9FF04720F254257F911EB381EB708E41D792

Uniqueness

Uniqueness Score: -1.00%

Function 008466C0 Relevance: 4.3, APIs: 2, Instructions: 1343COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNEL32(?,00000000), ref: 0084679E

Part of subcall function 007FB990: FindFirstFileA.KERNEL32(00000000,00000004,008E8953,?,?,?,\*.*,00000004,?,74DF3100), ref: 007FBAA1

CreateDirectoryA.KERNEL32(?,00000000), ref: 00846DB6

Memory Dump Source

Source File: 0000000C.00000002.2581035824.00000000007F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007F0000, based on PE: true

Associated: 0000000C.00000002.2581017077.00000000007F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581115078.00000000008F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581146123.0000000000929000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581165656.000000000092D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7f0000_3rB05VU.jbxd

Similarity

API ID: CreateDirectory$FileFindFirst
String ID:
API String ID: 2788900106-0
Opcode ID: 5471feddfdea4af58a829ff587942b026bf4972ab8cf2352425cf528a6093af0
Instruction ID: 8a4bd73d43d70a153e8c213e6fb8bcc8e6a5de1eaac353bdbb2216b65bfaf215
Opcode Fuzzy Hash: 5471feddfdea4af58a829ff587942b026bf4972ab8cf2352425cf528a6093af0
Instruction Fuzzy Hash: A8D29E308086DD8ECF25D7788C497EDBB70AF26314F1442DDE599A72D2EB344A85CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00844190 Relevance: 2.9, APIs: 1, Instructions: 1419COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNEL32(?,00000000), ref: 0084425B

Memory Dump Source

Source File: 0000000C.00000002.2581035824.00000000007F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007F0000, based on PE: true

Associated: 0000000C.00000002.2581017077.00000000007F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581115078.00000000008F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581146123.0000000000929000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581165656.000000000092D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7f0000_3rB05VU.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 55e577050a66ec0a420089509475b17530a248d330d2215cd7ebd9329ffd6d5c
Instruction ID: ad22364bc0ee4e3c54cdc935aaa9afa4e003d94319fc7d5fd4cf49c93dd17f6b
Opcode Fuzzy Hash: 55e577050a66ec0a420089509475b17530a248d330d2215cd7ebd9329ffd6d5c
Instruction Fuzzy Hash: D7E260308087DE8ECF25D7788C487DDBB74AF26314F5442D9E1A9A72D2D7344A86CB62

Uniqueness

Uniqueness Score: -1.00%

Function 008D08B9 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 273
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 008D0572: CreateFileW.KERNEL32(?,?,?,?,?,?,00000000), ref: 008D058F

GetLastError.KERNEL32 ref: 008D09CD
__dosmaperr.LIBCMT ref: 008D09D4
GetFileType.KERNEL32(00000000), ref: 008D09E0
GetLastError.KERNEL32 ref: 008D09EA
__dosmaperr.LIBCMT ref: 008D09F3
CloseHandle.KERNEL32(00000000), ref: 008D0A13
CloseHandle.KERNEL32(?), ref: 008D0B60
GetLastError.KERNEL32 ref: 008D0B92
__dosmaperr.LIBCMT ref: 008D0B99

Strings

H, xrefs: 008D0B1E

Memory Dump Source

Source File: 0000000C.00000002.2581035824.00000000007F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007F0000, based on PE: true

Associated: 0000000C.00000002.2581017077.00000000007F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581115078.00000000008F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581146123.0000000000929000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581165656.000000000092D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7f0000_3rB05VU.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: 4a9c507240cc03ab5753dc227c13fa7fb1ee5e0839bd0ce40d082eed0cc2be38
Instruction ID: 75f2c3c6793683d638a20b00e0335a1e17407dc1df87a6a325c6e984a4793623
Opcode Fuzzy Hash: 4a9c507240cc03ab5753dc227c13fa7fb1ee5e0839bd0ce40d082eed0cc2be38
Instruction Fuzzy Hash: C2A136319142199FCF19AF68DC52BAD3BE1FB06324F14025EF811EB392DB359812DB52

Uniqueness

Uniqueness Score: -1.00%

Function 0080E020 Relevance: 12.7, APIs: 4, Strings: 3, Instructions: 421
sleepnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__aulldiv.LIBCMT ref: 0080E34C
__aulldiv.LIBCMT ref: 0080E48B
send.WS2_32(?,00000000,00000000,00000000), ref: 0080E4E9
Sleep.KERNEL32(00000064,?,?,0000000A,00000000,?), ref: 0080E5E2

Strings

2, xrefs: 0080E43B
2, xrefs: 0080E2FC
131, xrefs: 0080E071

Memory Dump Source

Source File: 0000000C.00000002.2581035824.00000000007F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007F0000, based on PE: true

Associated: 0000000C.00000002.2581017077.00000000007F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581115078.00000000008F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581146123.0000000000929000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581165656.000000000092D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7f0000_3rB05VU.jbxd

Similarity

API ID: __aulldiv$Sleepsend
String ID: 131$2$2
API String ID: 1279978859-383009711
Opcode ID: cab190684945e1cd1788ba8ce6c050557eeff60937379059075bbfce8ce44843
Instruction ID: 7a57b74368a76ce2c10ff33bf861ebfe587c9d5aeb9593ecc7d966e16bd7df17
Opcode Fuzzy Hash: cab190684945e1cd1788ba8ce6c050557eeff60937379059075bbfce8ce44843
Instruction Fuzzy Hash: AF126770E00258CFEF15CFA8C9647EEBBB1FB59314F208659D411BB282D7751986CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0080E610 Relevance: 12.7, APIs: 4, Strings: 3, Instructions: 421
sleepnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__aulldiv.LIBCMT ref: 0080E93C
__aulldiv.LIBCMT ref: 0080EA7B
send.WS2_32(?,00000000,00000000,00000000), ref: 0080EAD9
Sleep.KERNEL32(00000064,?,?,0000000A,00000000,?), ref: 0080EBD2

Strings

2, xrefs: 0080E8EC
131, xrefs: 0080E661
2, xrefs: 0080EA2B

Memory Dump Source

Source File: 0000000C.00000002.2581035824.00000000007F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007F0000, based on PE: true

Associated: 0000000C.00000002.2581017077.00000000007F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581115078.00000000008F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581146123.0000000000929000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581165656.000000000092D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7f0000_3rB05VU.jbxd

Similarity

API ID: __aulldiv$Sleepsend
String ID: 131$2$2
API String ID: 1279978859-383009711
Opcode ID: 9ed1f53992f88bc53ec071ce051d2fe1b57b7c38e789c23665ea2228f4816257
Instruction ID: b8cde653c0f1178b2b1bf4ae65957bcfbdc096119b6ac6a732e48083bf703ce2
Opcode Fuzzy Hash: 9ed1f53992f88bc53ec071ce051d2fe1b57b7c38e789c23665ea2228f4816257
Instruction Fuzzy Hash: F0125670E00258CFEF15CFA8C9A47AEBBB1FB59314F208659D411BB282D7751985CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0080EC00 Relevance: 12.7, APIs: 4, Strings: 3, Instructions: 421
sleepnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__aulldiv.LIBCMT ref: 0080EF2C
__aulldiv.LIBCMT ref: 0080F06B
send.WS2_32(?,00000000,00000000,00000000), ref: 0080F0C9
Sleep.KERNEL32(00000064,?,?,0000000A,00000000,?), ref: 0080F1C2

Strings

2, xrefs: 0080F01B
2, xrefs: 0080EEDC
131, xrefs: 0080EC51

Memory Dump Source

Source File: 0000000C.00000002.2581035824.00000000007F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007F0000, based on PE: true

Associated: 0000000C.00000002.2581017077.00000000007F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581115078.00000000008F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581146123.0000000000929000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581165656.000000000092D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7f0000_3rB05VU.jbxd

Similarity

API ID: __aulldiv$Sleepsend
String ID: 131$2$2
API String ID: 1279978859-383009711
Opcode ID: 83f0feac07bc77def9248e8e32790dabf725159f6f340d70c354e4a7c0709e34
Instruction ID: c27bc4ccaf7397e0fc09c614a5ac4d0ac8554e8a2af930a59f9db50e12654226
Opcode Fuzzy Hash: 83f0feac07bc77def9248e8e32790dabf725159f6f340d70c354e4a7c0709e34
Instruction Fuzzy Hash: 28126970E00258CFEF15CFA8C9647EEBBB1FB59304F208659D811BB682D7751985CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 007F8420 Relevance: 11.0, APIs: 1, Strings: 5, Instructions: 496COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?), ref: 007F874F

Strings

.zip, xrefs: 007F8544
*, xrefs: 007F8AB7
/, xrefs: 007F88C4
\, xrefs: 007F888B
recursive_directory_iterator::recursive_directory_iterator, xrefs: 007F8BC7

Memory Dump Source

Source File: 0000000C.00000002.2581035824.00000000007F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007F0000, based on PE: true

Associated: 0000000C.00000002.2581017077.00000000007F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581115078.00000000008F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581146123.0000000000929000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581165656.000000000092D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7f0000_3rB05VU.jbxd

Similarity

API ID: AttributesFile
String ID: *$.zip$/$\$recursive_directory_iterator::recursive_directory_iterator
API String ID: 3188754299-893826777
Opcode ID: 4992ca970fcd72a2d68b3500779211cad57caebb805549af28dfaf153d57fc8c
Instruction ID: 71ff4d92ada0105a8be54fbb3ae4a6e20e3771aff877ae09b7c6f833c6efdf1c
Opcode Fuzzy Hash: 4992ca970fcd72a2d68b3500779211cad57caebb805549af28dfaf153d57fc8c
Instruction Fuzzy Hash: E4324970C0129DCFDF11DBA8C958BEDBBB0BF15308F148198E50967292EB745B89CB92

Uniqueness

Uniqueness Score: -1.00%

Function 008D6373 Relevance: 9.3, APIs: 6, Instructions: 292COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2581035824.00000000007F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007F0000, based on PE: true

Associated: 0000000C.00000002.2581017077.00000000007F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581115078.00000000008F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581146123.0000000000929000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581165656.000000000092D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7f0000_3rB05VU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 429cab106c66c7b85b61f6e790a2de079be741a6dc8bf8974b1ecd7394cd2296
Instruction ID: 8cb75b64f34483d4479dc1a2e2528f97681137ac8eb846e814f73225b4d5802d
Opcode Fuzzy Hash: 429cab106c66c7b85b61f6e790a2de079be741a6dc8bf8974b1ecd7394cd2296
Instruction Fuzzy Hash: 0EB1DEB0A0424DABDB11DFACE841BAE7BB1FF55314F14429AE401D7392EB70D952CB61

Uniqueness

Uniqueness Score: -1.00%

Function 007FCB40 Relevance: 6.4, APIs: 4, Instructions: 388registryCOMMON

Download Yara Rule

APIs

Part of subcall function 007FB6A0: GetCurrentProcess.KERNEL32(?), ref: 007FB6AF
Part of subcall function 007FB6A0: IsWow64Process.KERNEL32(00000000), ref: 007FB6B6

RegOpenKeyExA.KERNEL32(80000002,?,00000000,00020019,00000000,?,B1B4B18A,B1B4B18B,B1B4B18A), ref: 007FCC3E
RegQueryValueExA.KERNEL32(00000000,B7BCBE92,00000000,00020019,B7BCBE92,00000400,B7BCBE92), ref: 007FCC9E
RegCloseKey.ADVAPI32(00000000), ref: 007FCCCD
GetCurrentHwProfileA.ADVAPI32(?), ref: 007FCD47

Memory Dump Source

Source File: 0000000C.00000002.2581035824.00000000007F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007F0000, based on PE: true

Associated: 0000000C.00000002.2581017077.00000000007F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581115078.00000000008F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581146123.0000000000929000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581165656.000000000092D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7f0000_3rB05VU.jbxd

Similarity

API ID: CurrentProcess$CloseOpenProfileQueryValueWow64
String ID:
API String ID: 165412945-0
Opcode ID: 24888778ed0c2b8ad98cea5e246e2fcae2dec08a88548392f5c3921c15f22a33
Instruction ID: df3d3ffec2369fbbfb90f6601145fe405cf4ae1d86b2d500b09a2d868d95ba75
Opcode Fuzzy Hash: 24888778ed0c2b8ad98cea5e246e2fcae2dec08a88548392f5c3921c15f22a33
Instruction Fuzzy Hash: 91F1E271C0024CDEDF15DBA4C948BFEBBB4AF15304F148299E545A7282EB745B89CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0087A540 Relevance: 6.1, APIs: 4, Instructions: 66fileCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,?,?,00000000), ref: 0087A55F
GetLastError.KERNEL32 ref: 0087A56A
ReadFile.KERNEL32(?,?,?,?,00000000), ref: 0087A592
GetLastError.KERNEL32 ref: 0087A59C

Memory Dump Source

Source File: 0000000C.00000002.2581035824.00000000007F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007F0000, based on PE: true

Associated: 0000000C.00000002.2581017077.00000000007F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581115078.00000000008F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581146123.0000000000929000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581165656.000000000092D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7f0000_3rB05VU.jbxd

Similarity

API ID: ErrorFileLast$PointerRead
String ID:
API String ID: 2170121939-0
Opcode ID: 84fe68c976e08542cd647d48b70fe8797a666a5fdc5e1dcbab7cc7ea48d55609
Instruction ID: d60d9094f9200b38b54501394fe1658a47c7cecd4f88571a0db3aaf1b55b6fde
Opcode Fuzzy Hash: 84fe68c976e08542cd647d48b70fe8797a666a5fdc5e1dcbab7cc7ea48d55609
Instruction Fuzzy Hash: 0D114F72600109ABCB108FA9EC05FAABBA8FF44371F108266FD2CD6250E771D9608BD1

Uniqueness

Uniqueness Score: -1.00%

Function 008067D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38processsynchronizationCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,08000000,00000000,00000000,00000044,?), ref: 00806817
WaitForSingleObject.KERNEL32(?,000000FF,00000000,00000000,00000000,08000000,00000000,00000000,00000044,?), ref: 00806827

Strings

D, xrefs: 008067E9

Memory Dump Source

Source File: 0000000C.00000002.2581035824.00000000007F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007F0000, based on PE: true

Associated: 0000000C.00000002.2581017077.00000000007F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581115078.00000000008F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581146123.0000000000929000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581165656.000000000092D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7f0000_3rB05VU.jbxd

Similarity

API ID: CreateObjectProcessSingleWait
String ID: D
API String ID: 623904672-2746444292
Opcode ID: 7b8d3cdb9d6ac72eee87ecbf20d348e91f5585239418de5ba6510d0eb9311b28
Instruction ID: a6880fb51cbd9da76aa2835fc21659f77cb5ad0b6f6fbd4b3cc47363b39536f3
Opcode Fuzzy Hash: 7b8d3cdb9d6ac72eee87ecbf20d348e91f5585239418de5ba6510d0eb9311b28
Instruction Fuzzy Hash: 46F09671E4031976EB10DBA08C06FEE7778FF05B10F204326FA14BA1D0FBB069548699

Uniqueness

Uniqueness Score: -1.00%

Function 008D031C Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 221fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,?,?,?,?,?,00000000), ref: 008D058F

Strings

@, xrefs: 008D03E3

Memory Dump Source

Source File: 0000000C.00000002.2581035824.00000000007F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007F0000, based on PE: true

Associated: 0000000C.00000002.2581017077.00000000007F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581115078.00000000008F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581146123.0000000000929000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581165656.000000000092D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7f0000_3rB05VU.jbxd

Similarity

API ID: CreateFile
String ID: @
API String ID: 823142352-2766056989
Opcode ID: 60cceb3e09acaea798488a2cf8c2f79e6bde609417a4c11fd7a140bc77c9a5cd
Instruction ID: 5abc2f3ce7476666d143405dc0b35626cbc62139183acf9a6ddd8ce1cd564503
Opcode Fuzzy Hash: 60cceb3e09acaea798488a2cf8c2f79e6bde609417a4c11fd7a140bc77c9a5cd
Instruction Fuzzy Hash: 6461F67190010DABDB299A68EC45FBE3B65FB10328F284367FA14E6391E274CD90DE55

Uniqueness

Uniqueness Score: -1.00%

Function 007FC5E0 Relevance: 3.3, APIs: 2, Instructions: 274COMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 007FC668
GetVolumeInformationA.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 007FC869

Memory Dump Source

Source File: 0000000C.00000002.2581035824.00000000007F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007F0000, based on PE: true

Associated: 0000000C.00000002.2581017077.00000000007F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581115078.00000000008F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581146123.0000000000929000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581165656.000000000092D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7f0000_3rB05VU.jbxd

Similarity

API ID: DirectoryInformationVolumeWindows
String ID:
API String ID: 3487004747-0
Opcode ID: adfb82174a891bf604bab1f724be4c1894d48d3dd79da5611a909027a3efdea5
Instruction ID: 033139d83e5e2e3de1fc9ffc1803d50dd95168c367c4dbb0be597b985bb3dbd3
Opcode Fuzzy Hash: adfb82174a891bf604bab1f724be4c1894d48d3dd79da5611a909027a3efdea5
Instruction Fuzzy Hash: 2FB1E070C0024DDADF05DFA8C9197FEBBB4AF05304F14829DE541A7282E7B96649CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00804770 Relevance: 3.3, APIs: 2, Instructions: 251fileCOMMON

Download Yara Rule

APIs

CopyFileA.KERNEL32(00820B4B,?,00000000), ref: 00804959
__Mtx_unlock.LIBCPMT ref: 00804A37

Part of subcall function 00804750: CopyFileA.KERNEL32(00820B4B,?,00000000), ref: 0080475F

Memory Dump Source

Source File: 0000000C.00000002.2581035824.00000000007F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007F0000, based on PE: true

Associated: 0000000C.00000002.2581017077.00000000007F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581115078.00000000008F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581146123.0000000000929000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581165656.000000000092D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7f0000_3rB05VU.jbxd

Similarity

API ID: CopyFile$Mtx_unlock
String ID:
API String ID: 741997458-0
Opcode ID: 81da3694fada472d18b7e22655cacefad3d9cb5e4c78387165462f805dd03308
Instruction ID: d91687af1cca20bb31b10d2bd67a98277b6dd3bf30866bb97adeccb10f678603
Opcode Fuzzy Hash: 81da3694fada472d18b7e22655cacefad3d9cb5e4c78387165462f805dd03308
Instruction Fuzzy Hash: D3A1CC70D04249DFDF04DFA8C9057EEBBB4FF55304F208298E845A7292EB756A49CB92

Uniqueness

Uniqueness Score: -1.00%

Function 0084E380 Relevance: 3.2, APIs: 2, Instructions: 185COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 0084E51B
__fread_nolock.LIBCMT ref: 0084E53D

Memory Dump Source

Source File: 0000000C.00000002.2581035824.00000000007F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007F0000, based on PE: true

Associated: 0000000C.00000002.2581017077.00000000007F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581115078.00000000008F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581146123.0000000000929000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581165656.000000000092D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7f0000_3rB05VU.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 6cda157f4a4b1a36b927ebdad4d4bdf8fdca06a8cc9179dec38855276fef4ba4
Instruction ID: 6158e6984b204e4251e37e20bdbae6ae578d3be5e217d9e843617f2d27ae1448
Opcode Fuzzy Hash: 6cda157f4a4b1a36b927ebdad4d4bdf8fdca06a8cc9179dec38855276fef4ba4
Instruction Fuzzy Hash: 8C6129326046198FCB15CF2CD88096AB7E1FF84724F0586A9FC58CB355EB31DC188B96

Uniqueness

Uniqueness Score: -1.00%

Function 00804AC0 Relevance: 3.1, APIs: 2, Instructions: 131COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00804B58
__Mtx_unlock.LIBCPMT ref: 00804C23

Memory Dump Source

Source File: 0000000C.00000002.2581035824.00000000007F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007F0000, based on PE: true

Associated: 0000000C.00000002.2581017077.00000000007F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581115078.00000000008F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581146123.0000000000929000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581165656.000000000092D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7f0000_3rB05VU.jbxd

Similarity

API ID: Mtx_unlock
String ID:
API String ID: 1418687624-0
Opcode ID: 54613f36ec0cff667442c4e40474c1eeb925c29ff83d5611d2ebc3eadbda4bd2
Instruction ID: 2b7740045e689b6f8b387332db77e733ab408fbab98fafc57a48e79e2517a4ae
Opcode Fuzzy Hash: 54613f36ec0cff667442c4e40474c1eeb925c29ff83d5611d2ebc3eadbda4bd2
Instruction Fuzzy Hash: B441E0B1E002158BDB28DFACDD1176EB7B1FB84710F04062DE905A7782DB71A901CBD2

Uniqueness

Uniqueness Score: -1.00%

Function 0087ADB0 Relevance: 3.1, APIs: 2, Instructions: 124fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,?,00000003,00000000,BFFFFFFD,00000000,00000000), ref: 0087AE6F
CreateFileA.KERNEL32(?,?,00000003,00000000,BFFFFFFD,00000000,00000000), ref: 0087AE77

Memory Dump Source

Source File: 0000000C.00000002.2581035824.00000000007F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007F0000, based on PE: true

Associated: 0000000C.00000002.2581017077.00000000007F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581115078.00000000008F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581146123.0000000000929000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581165656.000000000092D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7f0000_3rB05VU.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 58dc1b94d8a30d12049011df103cd8c2b80640885245f793b3ed6a9ba827cffa
Instruction ID: 5cccc2f99d54b31c448c5780120f6c6ea40a883b43bdb55c6fa0de6944937a09
Opcode Fuzzy Hash: 58dc1b94d8a30d12049011df103cd8c2b80640885245f793b3ed6a9ba827cffa
Instruction Fuzzy Hash: 2741AB726043058BDB149F29D842B6EBBE5FBC4364F048A2EF99DC7280E735D9548B92

Uniqueness

Uniqueness Score: -1.00%

Function 00806580 Relevance: 3.1, APIs: 2, Instructions: 119COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32 ref: 00806608
CreateDirectoryA.KERNEL32(?,00000000), ref: 008066F5

Memory Dump Source

Source File: 0000000C.00000002.2581035824.00000000007F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007F0000, based on PE: true

Associated: 0000000C.00000002.2581017077.00000000007F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581115078.00000000008F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581146123.0000000000929000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581165656.000000000092D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7f0000_3rB05VU.jbxd

Similarity

API ID: AttributesCreateDirectoryFile
String ID:
API String ID: 3401506121-0
Opcode ID: a8fff2c5abd8ff55ce97f4a8a32e66e993953e45b0907d2607781f647dac982d
Instruction ID: 978a61c5bc3f38202d4d2e3f1253559558c63ab0602f267c96fb89e8b86b2fa7
Opcode Fuzzy Hash: a8fff2c5abd8ff55ce97f4a8a32e66e993953e45b0907d2607781f647dac982d
Instruction Fuzzy Hash: 1941CE70A086549BDB24CF68DC04BACB7B0FF55720F24072AF461D76C0E775A9A2DB80

Uniqueness

Uniqueness Score: -1.00%

Function 008D0102 Relevance: 3.1, APIs: 2, Instructions: 52COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(00000000,00000000,00927188,008AA051,00000002,008AA051,00000000,?,?,?,008D020C,00000000,?,008AA051,00000002,00927188), ref: 008D013E
GetLastError.KERNEL32(008AA051,?,?,?,008D020C,00000000,?,008AA051,00000002,00927188,00000000,008AA051,00000000,00927188,0000000C,008CAE64), ref: 008D014B

Memory Dump Source

Source File: 0000000C.00000002.2581035824.00000000007F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007F0000, based on PE: true

Associated: 0000000C.00000002.2581017077.00000000007F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581115078.00000000008F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581146123.0000000000929000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581165656.000000000092D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7f0000_3rB05VU.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 000a90af13e1d826ad071055e9234e3dea9a553f540bde44c91570e0887fbf6a
Instruction ID: 9d097bb55e3603b2897908f772ea7000ceca11888cec47bf924f2afd0d9d1386
Opcode Fuzzy Hash: 000a90af13e1d826ad071055e9234e3dea9a553f540bde44c91570e0887fbf6a
Instruction Fuzzy Hash: 7C01C03261411AAFCF058F69DC56EAE3B69FB85320F240349F811DB291FA71E952DB90

Uniqueness

Uniqueness Score: -1.00%

Function 008D8B03 Relevance: 3.0, APIs: 2, Instructions: 22memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,008E09F9,?,00000000,?,?,008E0C9A,?,00000007,?,?,008E118E,?,?), ref: 008D8B19
GetLastError.KERNEL32(?,?,008E09F9,?,00000000,?,?,008E0C9A,?,00000007,?,?,008E118E,?,?), ref: 008D8B24

Memory Dump Source

Source File: 0000000C.00000002.2581035824.00000000007F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007F0000, based on PE: true

Associated: 0000000C.00000002.2581017077.00000000007F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581115078.00000000008F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581146123.0000000000929000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581165656.000000000092D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7f0000_3rB05VU.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: f975a906bcd4c5415a6b81cd493b38d9be864180cb219b8080a07f5f1dcc9113
Instruction ID: 64d567c4f9ab3d23d913f02d0daeba3989c02c95023e46ebbaa4cd6177491bab
Opcode Fuzzy Hash: f975a906bcd4c5415a6b81cd493b38d9be864180cb219b8080a07f5f1dcc9113
Instruction Fuzzy Hash: 6AE0C272100204ABCB212FB4EC08F9E3BA8FB503A1F25456AF608D6171DF30C990CBC1

Uniqueness

Uniqueness Score: -1.00%

Function 008C6642 Relevance: 1.7, APIs: 1, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2581035824.00000000007F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007F0000, based on PE: true

Associated: 0000000C.00000002.2581017077.00000000007F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581115078.00000000008F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581146123.0000000000929000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581165656.000000000092D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7f0000_3rB05VU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39dd24b4262e1646eddc6203047e57181426fc7dff8b781c1a687b0330e7a6cb
Instruction ID: 2589147ed8ceefe43826aa7da87e541d4bebe2a122c728ceaa3012952bb434e5
Opcode Fuzzy Hash: 39dd24b4262e1646eddc6203047e57181426fc7dff8b781c1a687b0330e7a6cb
Instruction Fuzzy Hash: 72519374A00108AFDB14DF58C885FA97BF1FF49328F24866CE8099B252E631DE61CB91

Uniqueness

Uniqueness Score: -1.00%

Function 008D8768 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 008D87A2

Memory Dump Source

Source File: 0000000C.00000002.2581035824.00000000007F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007F0000, based on PE: true

Associated: 0000000C.00000002.2581017077.00000000007F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581115078.00000000008F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581146123.0000000000929000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581165656.000000000092D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7f0000_3rB05VU.jbxd

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: 1d95478b8d949e74bb9d9d3721d3154f21b58da919f554f8dc334d8be07dec8a
Instruction ID: 87307ed616c20aba3039cc2760e35fe32fba23f0d340961f32de77e73ac81e37
Opcode Fuzzy Hash: 1d95478b8d949e74bb9d9d3721d3154f21b58da919f554f8dc334d8be07dec8a
Instruction Fuzzy Hash: 53111871A0410AAFCF05DF58E94199A7BF4FF48304F14406AF809EB351D670D911CB65

Uniqueness

Uniqueness Score: -1.00%

Function 007FC540 Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

SetupDiGetClassDevsA.SETUPAPI(008F6520,00000000,00000000), ref: 007FC573

Memory Dump Source

Source File: 0000000C.00000002.2581035824.00000000007F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007F0000, based on PE: true

Associated: 0000000C.00000002.2581017077.00000000007F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581115078.00000000008F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581146123.0000000000929000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581165656.000000000092D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7f0000_3rB05VU.jbxd

Similarity

API ID: ClassDevsSetup
String ID:
API String ID: 2330331845-0
Opcode ID: ed491d07d481f551cf7b0d876143e69235ce0ac629fc88ccca5e92b760ac59f4
Instruction ID: 1061c7fc0b99947b4f5bf2cb9aeed1a27a9c7a0a0c5c2c084d5d97534db7d16c
Opcode Fuzzy Hash: ed491d07d481f551cf7b0d876143e69235ce0ac629fc88ccca5e92b760ac59f4
Instruction Fuzzy Hash: F501DFB0A447589BE3208F24D90576BBBB0FB01B24F20071DE565977C0E3F96A4887D2

Uniqueness

Uniqueness Score: -1.00%

Function 008D8143 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000001,?,008D7AC9,00000001,00000364,00000001,00000006,000000FF,?,008C237D,00000002,00000000,?,?), ref: 008D8184

Memory Dump Source

Source File: 0000000C.00000002.2581035824.00000000007F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007F0000, based on PE: true

Associated: 0000000C.00000002.2581017077.00000000007F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581115078.00000000008F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581146123.0000000000929000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581165656.000000000092D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7f0000_3rB05VU.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: c500d0d2c2e3577aebe045340e002f78995c2079b1560f170e6b058d0b110088
Instruction ID: 4ef4054f6ee4e7af965332fd12f8af54bd90a73d3ad22d5d63b9e62f50dd1f66
Opcode Fuzzy Hash: c500d0d2c2e3577aebe045340e002f78995c2079b1560f170e6b058d0b110088
Instruction Fuzzy Hash: 7DF0BE39640629E6DF216A269C01B5B3758FF417A0B298757F918E6390CF20EC0A86E2

Uniqueness

Uniqueness Score: -1.00%

Function 008D8B7D Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00000001,00000000,?,008C237D,00000002,00000000,?,?,?,007F2F12,?,00000004), ref: 008D8BAF

Memory Dump Source

Source File: 0000000C.00000002.2581035824.00000000007F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007F0000, based on PE: true

Associated: 0000000C.00000002.2581017077.00000000007F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581115078.00000000008F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581146123.0000000000929000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581165656.000000000092D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7f0000_3rB05VU.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 28222b86441b19e0262cc54574fe7aa8621cae4da302339aa3c1fc7fb413a70a
Instruction ID: fa9e8f6e35402a84f078467dfa150489a620b594beb40dea5770b861496b2d15
Opcode Fuzzy Hash: 28222b86441b19e0262cc54574fe7aa8621cae4da302339aa3c1fc7fb413a70a
Instruction Fuzzy Hash: 3EE06DB1141A24EEDA213B6A9C04F5B3758FB827B0F2607A3EC15E6390DF60ED0085A2

Uniqueness

Uniqueness Score: -1.00%

Function 008AC090 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,008ABE3F,00849684,?,?,BAAAADAB,?,?,BAAAADAB), ref: 008AC09A

Memory Dump Source

Source File: 0000000C.00000002.2581035824.00000000007F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007F0000, based on PE: true

Associated: 0000000C.00000002.2581017077.00000000007F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581115078.00000000008F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581146123.0000000000929000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581165656.000000000092D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7f0000_3rB05VU.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: c06c55e9a7a76aae64d54b8a8465b0640e376fd05c0bda966c73e490737bdc4f
Instruction ID: c274d32fc56a4274cd7de019c086ca4d50b2699e1cd38ffedff5317ecedb0c54
Opcode Fuzzy Hash: c06c55e9a7a76aae64d54b8a8465b0640e376fd05c0bda966c73e490737bdc4f
Instruction Fuzzy Hash: 21E0C23094021C8BFB00FBF86C4AA9D37E8F70A300F500A21ED06E2643EB11E4A08B67

Uniqueness

Uniqueness Score: -1.00%

Function 008D0572 Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,?,?,?,?,?,00000000), ref: 008D058F

Memory Dump Source

Source File: 0000000C.00000002.2581035824.00000000007F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007F0000, based on PE: true

Associated: 0000000C.00000002.2581017077.00000000007F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581115078.00000000008F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581146123.0000000000929000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581165656.000000000092D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7f0000_3rB05VU.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 4036eeb9fe608e07721f7c1739a35c6b9634e0df21ec26eb9aee98cd40235b53
Instruction ID: bbfa887a70aed0746708903dbe8af62ba0dcf72394f6de907e4946ed95503147
Opcode Fuzzy Hash: 4036eeb9fe608e07721f7c1739a35c6b9634e0df21ec26eb9aee98cd40235b53
Instruction Fuzzy Hash: 61D06C3200010DBBDF029F84DC06EDA3BAAFB48714F014100BA1856020C732E871EB90

Uniqueness

Uniqueness Score: -1.00%

Function 00804750 Relevance: 1.5, APIs: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

Part of subcall function 007FAB00: CreateToolhelp32Snapshot.KERNEL32(00000002), ref: 007FAB63
Part of subcall function 007FAB00: Process32First.KERNEL32(00000000,00000128), ref: 007FAB73
Part of subcall function 007FAB00: Process32Next.KERNEL32(00000000,00000128), ref: 007FAB90

CopyFileA.KERNEL32(00820B4B,?,00000000), ref: 0080475F

Memory Dump Source

Source File: 0000000C.00000002.2581035824.00000000007F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007F0000, based on PE: true

Associated: 0000000C.00000002.2581017077.00000000007F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581115078.00000000008F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581146123.0000000000929000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581165656.000000000092D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7f0000_3rB05VU.jbxd

Similarity

API ID: Process32$CopyCreateFileFirstNextSnapshotToolhelp32
String ID:
API String ID: 646994977-0
Opcode ID: 41020fe2cfb3e7b38520510f6757f73bf30c9f4aa7b84cdce86634df858e4123
Instruction ID: 7372f8b413f8e055f39ed7781b2ad982004ae0d85ccdfd9a7ede2fa3490fb3a9
Opcode Fuzzy Hash: 41020fe2cfb3e7b38520510f6757f73bf30c9f4aa7b84cdce86634df858e4123
Instruction Fuzzy Hash: F0C08C3220012062D220623A3C0EFAB4A9D9FC2930F36812AB008EA198DD58C84280A4

Uniqueness

Uniqueness Score: -1.00%

Function 008AC1D0 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

SystemFunction036.ADVAPI32(?,?), ref: 008AC1DE

Memory Dump Source

Source File: 0000000C.00000002.2581035824.00000000007F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007F0000, based on PE: true

Associated: 0000000C.00000002.2581017077.00000000007F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581115078.00000000008F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581146123.0000000000929000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2581165656.000000000092D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7f0000_3rB05VU.jbxd

Similarity

API ID: Function036System
String ID:
API String ID: 2600738214-0
Opcode ID: 5458fade2543060700ed744d2892e4ad6e9c32adf8e56f00e4343fd13486d2ef
Instruction ID: 9b510eef8c455a9c5f00d857c6fdfab6e762324c8833fdccd53e869f7551d5e2
Opcode Fuzzy Hash: 5458fade2543060700ed744d2892e4ad6e9c32adf8e56f00e4343fd13486d2ef
Instruction Fuzzy Hash: F2C08C3100050C66AE403FC4A801AB83B09FA13794B404091F92CC9823AB2299719685

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 14OWDrfahJ.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: RedLine

Yara Signatures

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe

C:\Users\user\AppData\Local\MaxLoonaFest131\MaxLoonaFest131.exe

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.log

C:\Users\user\AppData\Local\Temp\9qAkkNWhLDEhe3SVi3MbZOkApbYumn_h.zip

C:\Users\user\AppData\Local\Temp\FANBooster131\FANBooster131.exe

C:\Users\user\AppData\Local\Temp\IXP000.TMP\5Rp2df8.exe

C:\Users\user\AppData\Local\Temp\IXP000.TMP\Ey3OF47.exe

C:\Users\user\AppData\Local\Temp\IXP001.TMP\4eD052Od.exe

C:\Users\user\AppData\Local\Temp\IXP001.TMP\BC5tT98.exe

Windows Analysis Report
14OWDrfahJ.exe

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.
Tactics:	Collection
Data Sources:	Logon Session: Logon Session Creation, Process: Process Access, Process: Process Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre